345 lines
11 KiB
Plaintext
345 lines
11 KiB
Plaintext
|
***************************************
|
|||
|
|
* *
|
|||
|
|
* *
|
|||
|
|
* KRAKOWICZ'S KRACKING KORNER IV *
|
|||
|
|
* *
|
|||
|
|
* *
|
|||
|
|
* *
|
|||
|
|
* *
|
|||
|
|
* *
|
|||
|
|
* THE ARCADE MACHINE *
|
|||
|
|
* *
|
|||
|
|
* *
|
|||
|
|
* *
|
|||
|
|
* WITH NOTES ON NMI AND IDSI'S JUGGLER*
|
|||
|
|
* *
|
|||
|
|
* *
|
|||
|
|
* *
|
|||
|
|
***************************************
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
AFTER A NINE-MONTH DELAY,
|
|||
|
|
BR0DERBUND HAS FINALLY RELEASED THE
|
|||
|
|
ARCADE MACHINE (A.M.). THE PROTECTION
|
|||
|
|
SCHEME IS A NEW CHALLENGE FOR COPIERS,
|
|||
|
|
SINCE IT USES THE TECHNIQUE KNOWN AS
|
|||
|
|
SPIRALING OR QUARTER-TRACKING, AS WELL
|
|||
|
|
AS THE STANDARD BR0DERBUND SYSTEM OF A
|
|||
|
|
NEW ADDRESS MARKER FOR EACH TRACK. AN
|
|||
|
|
ATTEMPT TO COPY THE DISK WITH A
|
|||
|
|
CONVENTIONAL NIBBLE COPIER QUICKLY
|
|||
|
|
REVEALS THAT TRACKS 0 AND 3-11 ARE
|
|||
|
|
EASILY COPIED WITH AN ADDRESS MARKER OF
|
|||
|
|
D5 AA 96, WHILE THE REST OF THE TRACKS
|
|||
|
|
ARE A MYSTERY. PROBING INTO THE LOADER
|
|||
|
|
REVEALS THE FOLLOWING INFORMATION ABOUT
|
|||
|
|
TRACK USAGE:
|
|||
|
|
|
|||
|
|
TRACK CONTENTS
|
|||
|
|
----- --------
|
|||
|
|
|
|||
|
|
T0/S0 PRELOADER --> 800-8FF
|
|||
|
|
(AS ALWAYS)
|
|||
|
|
/S1-5 LOADER --> 300-7FF
|
|||
|
|
|
|||
|
|
T1-2 HIRES SPLIT "BR0DERBUND"
|
|||
|
|
LOGO AND PROGRAM
|
|||
|
|
|
|||
|
|
T12-20 MAIN PROGRAM WHICH LOADS
|
|||
|
|
INTO 800-BFFF
|
|||
|
|
|
|||
|
|
T12-13.5 FOUR HALFTRACKS USED FOR
|
|||
|
|
QUARTER-TRACKING
|
|||
|
|
|
|||
|
|
T3-4 #1 SHAPE CREATOR
|
|||
|
|
|
|||
|
|
T5-6 #2 PATH CREATOR
|
|||
|
|
|
|||
|
|
T7-8 #3 GAME OPTIONS
|
|||
|
|
|
|||
|
|
T9-A #4 LEVEL OPTIONS
|
|||
|
|
|
|||
|
|
TC-D #5 BKGD/TITLE CREATOR
|
|||
|
|
|
|||
|
|
TE-F #6 LOAD/SAVE GAME
|
|||
|
|
|
|||
|
|
T10-11 #7 CREATE GAME DISK
|
|||
|
|
|
|||
|
|
(OPTION #8 JUMPS TO 0800
|
|||
|
|
TO RUN THE GAME)
|
|||
|
|
|
|||
|
|
|
|||
|
|
THE APPROACH TO KRACKING THIS TYPE
|
|||
|
|
OF PROGRAM SEEMS STRAIGHTFORWARD:LOAD
|
|||
|
|
THE PROGRAM INTO MEMORY, RESET IT, AND
|
|||
|
|
SAVE IT OUT TO DISK AS A BINARY FILE,
|
|||
|
|
WITH THE APPROPRIATE MEMORY MOVES.
|
|||
|
|
HOPEFULLY, YOU'LL LOCATE THE STARTING
|
|||
|
|
ADDRESS AND BE ABLE TO RUN THE BINARY
|
|||
|
|
FILE AT WILL. IF YOU WISH TO INCLUDE
|
|||
|
|
ALL OF THE ADVERTISING FOR BR0DERBUND
|
|||
|
|
AT THE BEGINNING, THIS WORKS. IF YOU
|
|||
|
|
TRY TO DELETE THE DUAL BANNER, IT
|
|||
|
|
CRASHES. THE REASON IS THAT MODULE
|
|||
|
|
SWITCHING IS VIA THE STACK--THEY PUSH
|
|||
|
|
THE CORRECT LOCATION ONTO THE STACK AND
|
|||
|
|
DO AN RTS. SO, UNLESS YOU HAPPEN TO
|
|||
|
|
KNOW THE VALUE OF THE PROGRAM COUNTER
|
|||
|
|
(THAT IS, EXACTLY WHAT THE ADDRESS WAS
|
|||
|
|
WHEN YOU STOPPED), THE STACK POINTER
|
|||
|
|
(S) AND THE PROCESSOR STATUS WORD (P),
|
|||
|
|
AND RESTORE THEM EXACTLY AS THEY WERE
|
|||
|
|
BEFORE THE RESET, THE PROGRAM PROBABLY
|
|||
|
|
WON'T RUN. ANYONE WHO TRIED TO BREAK
|
|||
|
|
JUGGLER FOUND THIS TO BE FRUSTRATING IN
|
|||
|
|
THE EXTREME, SINCE SOMETIMES THE GAME
|
|||
|
|
WOULD RUN ALL THE WAY THROUGH THE FIRST
|
|||
|
|
LEVEL BEFORE CRASHING - THE SAME
|
|||
|
|
TECHNIQUE WAS USED THERE, BUT WITH EVEN
|
|||
|
|
MORE PROTECTION.
|
|||
|
|
|
|||
|
|
THERE IS A HARD WAY AND AN EASY
|
|||
|
|
WAY TO DO EVERYTHING, AND IF YOU ARE
|
|||
|
|
COMPLETELY RESTRICTED TO SOFTWARE
|
|||
|
|
DEVICES, IT IS STILL POSSIBLE TO BREAK
|
|||
|
|
ARCADE MACHINE. REFERRING TO THE
|
|||
|
|
NIBBLE ALTERATION TECHNIQUES DESCRIBED
|
|||
|
|
IN THE PREVIOUS EPISODE, IT IS POSSIBLE
|
|||
|
|
TO LOCATE AND ALTER THE GAME LOADER SO
|
|||
|
|
THAT IT HALTS WITH CONDITIONS WELL
|
|||
|
|
DEFINED AFTER THE ENTIRE PROGRAM IS IN
|
|||
|
|
MEMORY. IF IT IS YOUR PURPOSE IN LIFE
|
|||
|
|
TO LEARN AS MUCH AS YOU POSSIBLY CAN
|
|||
|
|
ABOUT DISK PROTECTION SCHEMES AND THE
|
|||
|
|
CIRCUMVENTION THEREOF (ONLY A FEW
|
|||
|
|
REALLY CRAZY PEOPLE ARE SO INCLINED),
|
|||
|
|
THIS IS REWARDING. IF YOU ARE
|
|||
|
|
INTERESTED IN PREPARING AN UNPROTECTED
|
|||
|
|
VERSION OF THE GAME WITH MINUMUM
|
|||
|
|
ADVERTISING AND MINIMUM EFFORT,
|
|||
|
|
HOWEVER, THERE IS AN EASIER WAY.
|
|||
|
|
|
|||
|
|
THIS SOLUTION IS ELEGANT, BUT
|
|||
|
|
REQUIRES A VISIT TO THAT GOD OF THE
|
|||
|
|
UNDERWORLD =>HARDWARE<=. BY NOW
|
|||
|
|
EVERYONE IS FAMILIAR WITH THE TERM NMI,
|
|||
|
|
THANKS TO AN OVERSOLD CARD WHICH USES
|
|||
|
|
THIS TECHNIQUE TO REPLAY SINGLE-LOAD
|
|||
|
|
GAMES FROM DISK. NMI STANDS FOR
|
|||
|
|
NON-MASKABLE INTERRUPT, ONE OF FOUR
|
|||
|
|
TYPES OF INTERRUPT AVAILABLE ON THE
|
|||
|
|
6502 (THE OTHERS ARE RESET, BREAK, AND
|
|||
|
|
THE IRQ OR INTERRUPT REQUEST). AS THE
|
|||
|
|
NAME OF THIS ONE IMPLIES, IT IS AN
|
|||
|
|
INTERRUPT WHICH MUST BE ATTENDED,
|
|||
|
|
REGARDLESS OF WHATEVER ELSE THE CPU HAD
|
|||
|
|
IN MIND TO DO NEXT. THIS LINE COMES
|
|||
|
|
DIRECTLY FROM PIN 6 OF THE CPU CHIP, IS
|
|||
|
|
HELD AT 5 VOLTS (LOGIC 1) BY A IK
|
|||
|
|
RESISTOR, AND RUN OUT TO PIN 29 OF THE
|
|||
|
|
PERIPHERAL CONNECTORS. CONNECTING THIS
|
|||
|
|
PIN MOMENTARILY TO GROUND (PIN 26)
|
|||
|
|
BEGINS A SMALL MICROPROGRAM WITHIN THE
|
|||
|
|
6502 WHICH STORES THE PROGRAM COUNTER
|
|||
|
|
('PC', TWO BYTES) AND THEN THE
|
|||
|
|
PROCESSOR STATUS WORD ('P', ONE BYTE)
|
|||
|
|
ON THE STACK, AND JUMPS TO THE ADDRESS
|
|||
|
|
STORED IN LOCATIONS FFFA AND FFFB IN
|
|||
|
|
THE F8 ROM. THIS BUSINESS OF PUSHING
|
|||
|
|
ONTO THE STACK IS A LITTLE OBSCURE, SO
|
|||
|
|
LET'S SPEND A FEW SECONDS DESCRIBING
|
|||
|
|
THE STACK STRUCTURE. WE ALL KNOW THAT
|
|||
|
|
THE STACK IS IN PAGE ONE OF MEMORY
|
|||
|
|
($100-$1FF), AND THAT THERE IS A THING
|
|||
|
|
CALLED A STACK POINTER (S) WHICH POINTS
|
|||
|
|
TO AN ADDRESS WITHIN THAT RANGE. IF THE
|
|||
|
|
FOLLOWING PROGRAM WERE RUN, THE STACK
|
|||
|
|
WOULD LOOK LIKE WHAT'S SHOWN BELOW:
|
|||
|
|
|
|||
|
|
|
|||
|
|
1000: TSX
|
|||
|
|
TXA
|
|||
|
|
JSR $1010
|
|||
|
|
|
|||
|
|
1010: JSR $1020
|
|||
|
|
|
|||
|
|
1020: JSR $1030
|
|||
|
|
|
|||
|
|
1030: TSX
|
|||
|
|
BRK
|
|||
|
|
|
|||
|
|
---------------------------------------
|
|||
|
|
|
|||
|
|
(STACK)
|
|||
|
|
|
|||
|
|
FINAL STACK POINTER LOCATION-> XX (ANY)
|
|||
|
|
22
|
|||
|
|
10
|
|||
|
|
12
|
|||
|
|
10
|
|||
|
|
04
|
|||
|
|
FIRST STACK POINTER LOCATION-> 10
|
|||
|
|
|
|||
|
|
---------------------------------------
|
|||
|
|
|
|||
|
|
|
|||
|
|
THIS "PROGRAM" STORES THE FIRST VALUE
|
|||
|
|
OF THE STACK POINTER IN THE
|
|||
|
|
ACCUMULATOR, JSR'S TO THREE PLACES,
|
|||
|
|
STORES THE FINAL VALUE OF THE STACK
|
|||
|
|
POINTER IN THE X-REGISTER, AND THEN
|
|||
|
|
HALTS. (WE HAVE TO NEGLECT FOR THE
|
|||
|
|
MOMENT THAT APPLE'S MONITOR DOES SOME
|
|||
|
|
WEIRD THINGS TO THE STACK AFTER THE
|
|||
|
|
'BRK'). IF WE EXAMINE THE STACK MEMORY
|
|||
|
|
BETWEEN THE LOCATIONS IN THE ACC. AND
|
|||
|
|
X-REG, WE WILL FIND THE VALUES LISTED
|
|||
|
|
ABOVE. ALTHOUGH WE SPEAK OF THE STACK
|
|||
|
|
AS A "PUSH-DOWN" (ALSO "LIFO" FOR
|
|||
|
|
LAST-IN, FIRST-OUT) STACK, WHAT
|
|||
|
|
ACTUALLY HAPPENS IS THAT THE VALUE OF
|
|||
|
|
THE STACK POINTER IS DECREMENTED, SO
|
|||
|
|
THAT IT POINTS TO A LOCATION ONE LESS
|
|||
|
|
THAN IT WAS. THE SUBROUTINE ADDRESSES
|
|||
|
|
TO WHICH THE PROGRAM WHOULD RETURN (IF
|
|||
|
|
IT WERE GIVEN AN 'RTS') ARE STORED IN
|
|||
|
|
NORMAL FASHION OF LOW BYTE, HIGH BYTE,
|
|||
|
|
AT A LOCATION ONE HIGHER THAN THE
|
|||
|
|
VALUE OF THE STACK POINTER. THE RTS
|
|||
|
|
INSTRUCTION TRANSFERS THESE NUMBERS
|
|||
|
|
INTO THE PROGRAM COUNTER, INCREMENTS
|
|||
|
|
THE STACK POINTER BY TWO, INCREMENTS
|
|||
|
|
THE LOW BYTE BY ONE, AND STARTS THE
|
|||
|
|
PROGRAM EXECUTING AGAIN AT THE LOCATION
|
|||
|
|
OF THE PROGRAM COUNTER. THE STACK
|
|||
|
|
POINTER NOW POINTS TO (ONE BELOW) THE
|
|||
|
|
NEXT SUBROUTINE RETURN ADDRESS, AND THE
|
|||
|
|
NEXT 'RTS' INSTRUCTION ENCOUNTERED IN
|
|||
|
|
THE PROGRAM WILL RETURN TO THAT
|
|||
|
|
ADDRESS. NOTICE THAT THE FINAL LOCATION
|
|||
|
|
OF THE STACK POINTER CAN HAVE ANYTHING
|
|||
|
|
IN IT, SINCE IT POINTS TO THE LOCATION
|
|||
|
|
WHERE THE NEXT BYTE WILL BE STORED, NOT
|
|||
|
|
WHERE THE LAST ONE WAS STORED. THE
|
|||
|
|
DATA PAIRS '22,10', '12,10', AND '04,
|
|||
|
|
10' CORRESPOND TO THE SUBROUTINE RETURN
|
|||
|
|
ADDRESSES 1023, 1013, AND 1005 FOR THE
|
|||
|
|
PROGRAM, EACH ONE BEING ONE LESS
|
|||
|
|
THAN THE ACTUAL RETURN POINT.
|
|||
|
|
|
|||
|
|
THAT DIGRESSION WAS INTENDED TO
|
|||
|
|
CLARIFY THE STACK STRUCTURE THAT
|
|||
|
|
RESULTS FROM AN NMI SIGNAL:
|
|||
|
|
|
|||
|
|
STACK POINTER: (ANYTHING)
|
|||
|
|
S+1: STATUS WORD (P)
|
|||
|
|
S+2: PROGRAM CTR LOW (PCL)
|
|||
|
|
S+3: PROGRAM CTR HI (PCH)
|
|||
|
|
|
|||
|
|
THIS WAS SET UP TO ALLOW AN EXTERNAL
|
|||
|
|
DEVICE TO INTERRUPT THE APPLE, AND THEN
|
|||
|
|
TO RESUME THE INTERRUPTED PROGRAM
|
|||
|
|
EXACTLY WHERE IT WAS BEFORE THE
|
|||
|
|
INTERRUPT OCCURRED. THE INSTRUCTION
|
|||
|
|
THAT MAKES IT ALL HAPPEN IS 'RTI',
|
|||
|
|
WHICH OBLIGINGLY PUTS THE PROCESSOR
|
|||
|
|
STATUS WORD BACK, RESTORES THE ORIGINAL
|
|||
|
|
VALUE OF THE PC, AND CRANKS UP THE
|
|||
|
|
PROGRAM JUST AS IT WAS BEFORE THE NMI
|
|||
|
|
LINE WAS YANKED.
|
|||
|
|
|
|||
|
|
THE PRACTICAL IMPLEMENTATION OF
|
|||
|
|
THIS TRICK IN KRACKING REQUIRES A
|
|||
|
|
MINIMUM OF TWO THINGS: AN ALTERED F8
|
|||
|
|
ROM AND A SWITCH. A NORMAL F8 ROM HAS
|
|||
|
|
FB 03 AT FFFA-FFFB, WHICH MEANS THAT AN
|
|||
|
|
NMI SIGNAL WILL EXECUTE THE INSTRUCTION
|
|||
|
|
AT 03FB. PRUDENT SOFTWARE PUBLISHERS
|
|||
|
|
WILL PUT THERE EITHER A JUMP TO THE
|
|||
|
|
BEGINNING OF THE GAME OR TO A REBOOT:
|
|||
|
|
4C 00 C6. TO GET AROUND THE PROBLEM,
|
|||
|
|
THE F8 ROM MUST BE MODIFIED. SINCE MOST
|
|||
|
|
SERIOUS KRACKISTS ALREADY HAVE A
|
|||
|
|
KRAKROM OR LOCKBUSTER, ETC., WHICH
|
|||
|
|
RELOCATES THE 0-7FF MEMORY WHEN RESET
|
|||
|
|
IS PRESSED, THIS IS NOT A MAJOR
|
|||
|
|
PROBLEM. YOU SHOULD PUT THE STARTING
|
|||
|
|
ADDRESS OF THE MEMORY MOVE ROUTINE IN
|
|||
|
|
LOCATIONS FFFA-B, AND BURN A NEW 2716
|
|||
|
|
EPROM. AFTER THIS PROM IS INSTALLED IN
|
|||
|
|
THE F8 SOCKET, ACTIVATING THE NMI LINE
|
|||
|
|
WILL SAVE ALL OF THE VOLATILE MEMORY AS
|
|||
|
|
WELL AS THE PC AND P (A WORD OF CAUTION
|
|||
|
|
- IF YOU DON'T HAVE A SOLID-STATE
|
|||
|
|
SWITCH ON THE NMI LINE, YOU'LL STORE
|
|||
|
|
SOME ADDITIONAL GARBAGE ON THE STACK,
|
|||
|
|
BUT THE SYSTEM WILL STILL WORK).
|
|||
|
|
|
|||
|
|
EACH TIME YOU USE THE NMI ROM,
|
|||
|
|
YOU'LL HAVE TO EXAMINE THE MEMORY AREA
|
|||
|
|
WHERE THE STACK IS STORED. SINCE THE
|
|||
|
|
STACK POINTER IS ALWAYS ONE LESS THAN
|
|||
|
|
THE LAST LOCATION STORED INTO, YOU
|
|||
|
|
SHOULD HAVE NO TROUBLE IDENTIFYING THE
|
|||
|
|
CORRECT VALUE OF PC AND P. AFTER
|
|||
|
|
SAVING THE GAME, WITH MEMORY MOVES IF
|
|||
|
|
REQUIRED, SET THE STACK POINTER TO THE
|
|||
|
|
LOCATION OF THE STATUS WORD-1 (USE LDX
|
|||
|
|
#NN, TXS), AND DO AN RTI INSTRUCTION.
|
|||
|
|
THE PROGRAM WILL START RIGHT BACK UP AS
|
|||
|
|
IF IT HAD NEVER BEEN INTERRUPTED. BE
|
|||
|
|
SURE THAT YOUR MEMORY RELOCATE ROUTINE
|
|||
|
|
IN ROM SAVES THE VALUE OF THE A, X, AND
|
|||
|
|
Y REGISTERS, AND RESTORES THE CORRECT
|
|||
|
|
VALUES BEFORE THE RTI.
|
|||
|
|
|
|||
|
|
ONE FINAL CAUTION - SOME GAMES
|
|||
|
|
(LIKE JUGGLER) REQUIRE THAT YOU HAVE AN
|
|||
|
|
UNMODIFIED ROM IN THE F8 SOCKET - THIS
|
|||
|
|
REQUIRES A LITTLE MORE ASSISTANCE FROM
|
|||
|
|
THE GOD OF HARDWARE, AND WILL BE DEALT
|
|||
|
|
WITH IN A FUTURE EPISODE DESCRIBING
|
|||
|
|
OTHER APPLICATIONS OF THE NMI
|
|||
|
|
TECHNIQUE.
|
|||
|
|
|
|||
|
|
RETURNING TO THE A.M. KRACK, YOU
|
|||
|
|
NOW CAN BOOT THE DISK AND GET TO THE
|
|||
|
|
MAIN MENU. DO THE NMI TRICK BY CLOSING
|
|||
|
|
A SWITCH WIRED BETWEEN PINS 29 AND 26
|
|||
|
|
OF ANY PERIPHERAL CARD, AND MOVE THE
|
|||
|
|
EXCESS MEMORY TO 2000-3FFF (THE
|
|||
|
|
NORWEGIAN NURDS WERE NICE ENOUGH TO
|
|||
|
|
LEAVE US HI-RES PAGE ONE OPEN -- TAK!),
|
|||
|
|
INCLUDING 0-8FF AND B600-BFFF. ADD THE
|
|||
|
|
APPROPRIATE MEMORY MOVE ROUTINES AS
|
|||
|
|
WELL AS THE REGISTER RESTORE, STACK
|
|||
|
|
POINTER ADJUST, AND RTI, THEN BOOT A
|
|||
|
|
SLAVE DISK AND BSAVE THE MEMORY FROM
|
|||
|
|
900-9600.
|
|||
|
|
|
|||
|
|
COPY TRACKS 3-11 FROM THE ORIGINAL
|
|||
|
|
A.M. WITH YOUR FAVORITE COPIER, AND
|
|||
|
|
TELL THE VTOC THAT THOSE TRACKS ARE
|
|||
|
|
OCCUPIED. SAVE THE FILE ONTO ANY TRACKS
|
|||
|
|
ABOVE 11, AND, USING THE BOOT MODIFIER
|
|||
|
|
DESCRIBED IN THE KKK III ON WAY OUT,
|
|||
|
|
LOAD IN THE MAIN PROGRAM AS PART OF THE
|
|||
|
|
BOOT. YOU SHOULD NOW BE OFF AND RUNNING
|
|||
|
|
WITH YOUR OWN FRESHLY BROKEN COPY OF
|
|||
|
|
ARCADE MACHINE.
|
|||
|
|
|
|||
|
|
IT'S NOT REALLY AS HARD AS IT
|
|||
|
|
SOUNDS, AND IF YOU REALLY LIKE TO
|
|||
|
|
PROGRAM YOUR OWN LEFT-RIGHT
|
|||
|
|
SHOOT-EM-UPS WITHOUT LEARNING TO
|
|||
|
|
PROGRAM, THE RESULT IS WORTH THE
|
|||
|
|
EFFORT.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
=>KRAKOWICZ<=
|
|||
|
|
|
|||
|
|
|
|||
|
|
|