3148 lines
134 KiB
Erlang
3148 lines
134 KiB
Erlang
***************************************
|
||
* *
|
||
* KRAKOWICZ'S KRACKING KORNER *
|
||
* *
|
||
* THE BASICS OF KRACKING I: *
|
||
* *
|
||
* ROMS AND PROMS AND F8'S *
|
||
* *
|
||
***************************************
|
||
|
||
ALONG WITH A NUMBER OF REQUESTS FOR MATERIAL USEFUL TO THOSE WHO ARE NOT YET
|
||
IN THE RANKS OF PROFESSIONALS IN THIS FIELD, IT HAS BEEN POINTED OUT TO ME THAT
|
||
I AM ALL TOO WILLING TO SUGGEST BURNING THIS PROM, INSTALLING THAT ROM, AND
|
||
GENERALLY MAKING WHOLESALE HARDWARE CHANGES IN AN UNSUSPECTING APPLE, WITHOUT
|
||
PROVIDING BACKGROUND INFORMATION FOR THE UP-AND-COMING KRACKISTS OF THE FUTURE.
|
||
|
||
THIS SERIES, WHILE AIMED AT THE BEGINNING TO INTERMEDIATE KRACKIST, WILL STILL
|
||
ASSUME A REASONABLE KNOWLEDGE OF ASSEMBLY LANGUAGE. IF YOU FIND THESE
|
||
DISCUSSIONS ARE STILL TOO HEAVY INTO MACHINE CODE FOR YOU, THEN IT'S BEST TO BUY
|
||
A BOOK LIKE ROGER WAGNER'S "ASSEMBLY LINES" OR EQUIVALENT, AND STUDY IT
|
||
CAREFULLY (IF, ON THE OTHER HAND, YOU FIND THAT THIS IS ALL BENEATH YOU, JUST
|
||
KEEP A KNOWING SMIRK ON YOUR LIPS AS YOU SKIP LIGHTLY OVER THESE EPISODES -
|
||
THERE MIGHT BE SOMETHING YOU MISSED BECAUSE YOU HAD A BAD HANGOVER ONE DAY IN
|
||
KRACKING 101).
|
||
|
||
IN THIS AND FUTURE EPISODES IN THE 'BASICS OF KRACKING' SERIES, WE'LL DEAL
|
||
WITH THE FUNDAMENTALS OF THE KRACKIST'S ART, STARTING WITH THE HOW (AND WHY) OF
|
||
MAKING ALTERATIONS IN THE APPLE'S "PERMANENT" MEMORY. FIRST OF ALL, THE MOST
|
||
IMPORTANT SINGLE TOOL AVAILABLE TO THE ASPIRING KRACKIST IS REPLACING THE
|
||
AUTOSTART ROM ON THE MOTHER BOARD WITH AN "OLD MONITOR" ROM. WITH THIS ROM IN
|
||
PLACE, YOU CAN HIT 'RESET' WHENEVER YOU WANT, AND ALWAYS BE RETURNED TO THE
|
||
MONITOR FOR THE BEGINNING OF THE SNOOPING PROCESS. THIS CHANGE, INCIDENTALLY,
|
||
WILL MAKE AVAILABLE TO YOU A REASONABLE SET OF "STEP AND TRACE" UTILITIES (SEE
|
||
THE APPLE II REFERENCE MANUAL. PP 51-53).
|
||
|
||
TO UNDERSTAND WHAT THE DIFFERENCES ARE BETWEEN THE TWO ROMS, LET'S TAKE A
|
||
MINUTE TO EXAMINE WHAT PRESSING THE 'RESET' KEY DOES (OMIGOSH, MAUDE, THERE HE
|
||
GOES AGAIN ON THAT DETAILED TECHNICAL CRAP!). INSTEAD OF GOING THROUGH THE
|
||
KEYBOARD INPUT ROUTINE AT C000, THE RESET KEY IS CONNECTED DIRECTLY TO PIN 40 OF
|
||
THE 6502 MICROPROCESSOR CHIP. WHEN THIS PIN IS CONNECTED TO GROUND (0 VOLTS),
|
||
THE COMPUTER JUMPS UNCONDITIONALLY TO THE ADDRESS CONTAINED IN LOCATIONS FFFC
|
||
AND FFFD. THIS IS NOT A TRUE INTERRUPT, SINCE THE APPLE FORGETS WHAT IT WAS
|
||
DOING BEFORE THE LINE WAS "YANKED", BUT IT IS AN EXAMPLE OF 'VECTORING' OR
|
||
SENDING THE COMPUTER TO A SPECIFIC PLACE BY SETTING AN ADDRESS INTO THE PROGRAM
|
||
COUNTER. IN THE AUTOSTART ROM, THESE TWO LOCATIONS CONTAIN 62 FA, SO THE NEXT
|
||
INSTRUCTION TO BE EXECUTED IS AT FA62. THIS SERIES OF ROUTINES (SEE P. 143 AND
|
||
PP. 36-38 OF THE REFERENCE MANUAL) CHECKS TO SEE IF THE COMPUTER IS BEING
|
||
POWERED UP FOR THE FIRST TIME (COLDSTART) OR RESET WITH THE POWER ON
|
||
(WARMSTART). IF IT IS A WARMSTART, THE SYSTEM JUMPS TO THE INSTRUCTIONS AT
|
||
LOCATIONS 3F2 AND 3F3, AND BEGINS RUNNING THE PROGRAM FOUND THERE (USUALLY BASIC
|
||
AT E000).
|
||
|
||
THE "OLD MONITOR" ROM, HOWEVER, HAS 59 FF STORED IN FFFC-D. THIS CAUSES AN
|
||
APPLE II (OR A II+ WITH AN INTEGER CARD AND THE RED SWITCH "UP") TO GO TO
|
||
ROUTINES WHICH SET UP THE KEYBOARD FOR INPUT, THE TV FOR OUTPUT, AND WIND UP IN
|
||
THE MONITOR WITH THE '*' PROMPT DISPLAYED. IN CONTRAST TO THE AUTOSTART ROM,
|
||
WHERE ANYONE CAN TELL THE RESET BUTTON WHERE TO GO, THERE IS NO WAY TO PREVENT A
|
||
RESET FROM GOING TO FF59 AND WINDING UP IN THE MONITOR. THIS IS OBVIOUSLY
|
||
ESSENTIAL IF YOU WANT TO BREAK INTO A GAME AND START EXAMINING THE CODE, BUT IT
|
||
HAS ITS OWN SET OF PROBLEMS.
|
||
|
||
IN THE PROCESS OF SETTING UP THE I/O DESCRIBED ABOVE, ESPECIALLY IN SETTING UP
|
||
THE TEXT WINDOW ON THE SCREEN, A NUMBER OF LOCATIONS IN ZERO PAGE MUST BE
|
||
CHANGED. THE FOLLOWING LOCATIONS WILL PROBABLY BE ALTERED (ALL HEX):
|
||
20,21,22,23,24,25,28,29,32,33,35, 36,37,38,39, AND 48. WORSE THAN THAT, THE
|
||
ENTIRE SCREEN SCROLLS UP ONE LINE WHEN THE MONITOR PROMPT IS PRINTED, WHICH
|
||
LOSES THE ENTIRE TOP ROW OF THE TEXT SCREEN (LOCATIONS 400-427), AND ALTERS THE
|
||
CONTENTS OF ALL THE OTHER LOCATIONS FROM 400-7FF, WITH THE EXCEPTION OF THE
|
||
"SCRATCHPAD" REGIONS AT 478-47F, 4F8-4FF, ETC. (THE COMPUTER WIMP AT YOUR
|
||
SCHOOL SAYS THAT THE TOP LINE "FALLS INTO THE BIT BUCKET", BUT YOU KNOW HOW
|
||
EVERYONE FEELS ABOUT HIM.)
|
||
|
||
AS MOST SOFTWARE PROTECTORS KNOW, THIS WILL KEEP MOST OF THE AMATEURS OUT OF
|
||
THE PROGRAM, AND YOU'LL SEE EVIDENCE OF THIS TECHNIQUE IN THE FORM OF A LOT OF
|
||
"GARBAGE" ON THE TEXT SCREEN WHEN YOU RESET OUT OF A PROTECTED GAME. OUR JOB,
|
||
THEN, IS TO KEEP THESE ZERO PAGE AND SCREEN MEMORY LOCATIONS FROM BEING LOST,
|
||
SINCE MOST PROTECTION SCHEMES USE THESE AREAS IN SOME WAY OR OTHER (BR0DERBUND,
|
||
FOR EXAMPLE, HAS RECENTLY BEEN STORING THE ADDRESS MARKER FOR THE DISK TRACK IN
|
||
LOCATIONS 20, 21, AND 22).
|
||
|
||
THE SAFE WAY TO PREVENT INFORMATION FROM BEING LOST FROM THESE "VOLATILE"
|
||
LOCATIONS IS TO TRANSFER ALL OF THE CONTENTS TO A SAFE AREA -- LOCATIONS 2000 &
|
||
UP (OR 4000 & UP) WHERE A HI-RES PICTURE NORMALLY RESIDES. IN FACT, IT WOULD BE
|
||
BEST TO SAVE EVERYTHING FROM 0 TO 8FF, SINCE BOOTING A DISKETTE TO SAVE THE DATA
|
||
ALSO DESTROYS LOCATIONS 800-8FF. (REMEMBER THE FIRST LAW OF DISK KRACKING -
|
||
TRACK 0, SECTOR 0 ALWAYS STARTS WITH D5 AA 96 AND ALWAYS LOADS INTO 800-8FF).
|
||
BECAUSE THIS IS THE BEGINNING CLASS, LET'S LOOK AT TWO EXAMPLES OF SHORT BINARY
|
||
SUBROUTINES THAT WILL DO THE "SAVE" FOR US. BOTH START, AS WILL BE EXPLAINED
|
||
LATER, AT LOCATION FECD IN THE F8 ROM. THE FIRST IS THE MOST STRAIGHTFORWARD
|
||
AND EASIST TO FOLLOW:
|
||
|
||
|
||
LDY #$00 ;CLEAR Y-REGISTER
|
||
LDA $00,Y ;GET A BYTE FROM 0+Y
|
||
STA $2000,Y ;STORE AT 2000+Y
|
||
LDA $0100,Y ;THEN FROM 100+Y
|
||
STA $2100,Y ;TO 2100+Y
|
||
LDA $0200,Y ;AND SO ON UNTIL
|
||
STA $2200,Y ;WE HAVE COVERED
|
||
LDA $0300,Y ;ALL THE MEMORY
|
||
STA $2300,Y ;'PAGES' FROM 0 TO 8
|
||
LDA $0400,Y ;AND STORED INTO
|
||
STA $2400,Y ;PAGES 20 TO 28
|
||
LDA $0500,Y
|
||
STA $2500,Y
|
||
LDA $0600,Y
|
||
LDA $2600,Y
|
||
LDA $0700,Y
|
||
STA $2700,Y
|
||
LDA $0800,Y
|
||
STA $2800,Y
|
||
INY ;THEN ADD 1 TO Y-REG
|
||
BNE $FED0 ;AND REPEAT IF < 256
|
||
JMP $FF59 ;WHEN WE'RE ALL DONE
|
||
;JUMP TO MONITOR START
|
||
|
||
THIS 61-BYTE ROUTINE, IF IT COULD BE EXECUTED AUTOMATICALLY WHEN THE RESET KEY
|
||
IS PRESSED, WOULD SAFELY STASH ALL OF THE CHANGEABLE MEMORY AND EXIT GRACEFULLY
|
||
INTO THE MONITOR.
|
||
|
||
A MORE COMPACT AND GENERAL, BUT LESS OBVIOUS ROUTINE IS SHOWN BELOW. IT IS
|
||
INCLUDED BECAUSE IT IS TYPICAL OF THE "MEMORY MOVE PROGRAMS" THAT WE WILL
|
||
EVENTUALLY HAVE TO WRITE IN KRACKING ALMOST ANY PROGRAM.
|
||
|
||
LDY #$00 ;CLEAR Y-REGISTER
|
||
LDA $00,Y ;XFER THE ZERO PAGE TO
|
||
STA $2000,Y ;2000-20FF SO WE CAN USE
|
||
INY ;THE ZERO PAGE MEMORY
|
||
BNE $FED0 ;FOR THE OTHER MOVES
|
||
LDA #$00 ;SET UP LOCNS 0 & 1 AS A
|
||
STA $00 ;2-BYTE POINTER FOR THE
|
||
STA $02 ;SOURCE ADDRESS, USE 2&3
|
||
LDA #$01 ;AS 2-BYTE POINTER FOR
|
||
STA $01 ;THE DESTINATION ADDRESS
|
||
LDA #$21 ;STARTING AT $2100
|
||
STA $03
|
||
LDA ($00)<- ;GET A BYTE FROM 100-UP
|
||
STA ($02) ^ ;STORE AT 2100-UP
|
||
INC $02 ^ ;INCREMENT LO-ORDER BYTE
|
||
INC $00 ^ ;OF SOURCE & DESTINATION
|
||
BNE ->->->^ ;(BACK TO LDA ($00) IF
|
||
^ ;LO-ORDER IS <256
|
||
INC $03 ^ ;IF LO-ORDER=0, INC THE
|
||
INC $01 ^ ;HI BYTE OF EACH
|
||
LDA $01 ^ ;CHECK TO SEE IF HI-BYTE
|
||
CMP $#09 ^ ;IS 9 -WE'RE THRU AT 8FF
|
||
BNE ->->->^ ;IF NOT, LOOP BACK TO
|
||
;THE LOAD/STORE UNTIL
|
||
;WE'RE ALL DONE
|
||
JMP $FF59 ;EXIT THRU MONITOR
|
||
|
||
UNLIKE THE FIRST ROUTINE, THIS ONE (AT 47 BYTES) USES RAM LOCATIONS 0 THROUGH
|
||
3, SO THE ZERO PAGE MUST BE TRANSFERRED BEFORE IT IS ALTERED BY USING THOSE
|
||
ADDRESSES AS POINTERS. WHILE THE FIRST ROUTINE MUST GROW BY SIX BYTES FOR EACH
|
||
ADDITIONAL PAGE TRANSFERRED, THE SECOND NEEDS ONLY TO HAVE THE "9" IN THE
|
||
COMPARE STATEMENT CHANGED TO THE APPROPRIATE VALUE ONE HIGHER THAN THE LAST PAGE
|
||
NUMBER BEING TRANSFERRED.
|
||
|
||
TO RETURN TO THE BUSINESS OF ALTERING ROMS, IT IS EASY TO SEE THAT AN
|
||
AUTOSTART ROM COULD BE MADE TO BEHAVE LIKE AN OLD ROM JUST BY CHANGING LOCATIONS
|
||
FFFC-D TO 59 FF FROM 62 FA. (A NOTE TO THE FAINT-HEARTED--YOU CAN BUY AN OLD
|
||
MONITOR F8 ROM FOR ABOUT $10 AND PLUG IT DIRECTLY INTO YOU APPLE'S F8 SOCKET,
|
||
BUT YOU WON'T HAVE ALL THE BENEFITS WE'VE BEEN TALKING ABOUT). AS LONG AS WE'RE
|
||
GOING TO THE EFFORT OF MAKING A CHANGE, THOUGH, WE MIGHT AS WELL ADD ONE OF THE
|
||
ROUTINES ABOVE AND ALLOW THE NEW ROM TO SAVE THE VOLATILE MEMORY FOR US. TO DO
|
||
THIS, WE'LL HAVE TO GIVE UP SOMETHING IN THE ROM, AND THE MOST EASILY
|
||
SURRENDERED AREA FOR MOST OF US IS THE TAPE READ/SAVE ROUTINES AT $FECD. IF WE
|
||
THEN CHANGED FFFC-D TO CD FE, THE MEMORY FROM 0 TO 8FF WOULD BE SAVED TO
|
||
2000-28FF EVERY TIME THE 'RESET' KEY WAS PRESSED. SINCE IT'S SOMETIMES
|
||
INCONVENIENT TO HAVE THAT HAPPEN WHEN THE RESET KEY IS PRESSED, WE CAN REQUIRE
|
||
THAT A SPECIFIC KEY BE ALSO PRESSED TO MAKE IT OCCUR. THESE FEW INSTRUCTIONS
|
||
INSERTED BEFORE EITHER OF THE ROUTINES ABOVE WILL GIVE A "RESET AND SAVE" WHEN
|
||
THE "-" KEY IS HELD DOWN (OR WAS THE LAST KEY PRESSED), WHILE GIVING A REGULAR
|
||
"OLD RESET" THE REST OF THE TIME.
|
||
|
||
LDA $C000 ;LOOK AT THE KEYBOARD
|
||
ROL ;MASK OFF HIGH BIT
|
||
CMP #$5A ;WAS IT "-"?($2D X 2=$5A)
|
||
BNE ->->-> ;IF NOT, BRANCH TO THE
|
||
! ;LOCATION WITH THE
|
||
! ;"JUMP FF59" INSTRUCTION
|
||
! ;AT THE END OF THE SAVE
|
||
! ;SUBROUTINE.
|
||
|
||
|
||
OK, OK - WE ALL AGREE THAT THESE WOULD BE NEAT THINGS TO HAVE IN THE F8 ROM,
|
||
SO HOW DO WE GET IT THERE? FIRST, GET HOLD OF A PROMBURNER (PROMBLASTER, EPROM
|
||
PROGRAMMER, ETC.) THAT WILL PROGRAM 2716 EPROMS. EACH ONE IS DIFFERENT, SO I
|
||
WON'T TRY TO GIVE DETAILED INSTRUCTIONS ON THE ACTUAL PROGRAMMING. BUY OR
|
||
BORROW A FRIEND'S OLD F8 ROM (OR GET THE BINARY FILE) THEN TYPE IN OR LOAD IN
|
||
THE CHANGES YOU WANT TO MAKE AT FECD & UP AND AT FFFC-D, AND PROGRAM A 2716
|
||
EPROM WITH OUR MODIFIED VERSION OF APPLE'S F8 MONITOR ROM.
|
||
|
||
ALL THAT REMAINS TO TAKE FULL ADVANTAGE OF THE NEW F8 ROM IS TO MAKE A
|
||
SLIGHTLY MODIFIED SOCKET AND PLUG IT IN. BOTH THE 2716 AND THE ORIGINAL 9316
|
||
ROM USED BY APPLE ARE READ-ONLY-MEMORY DEVICES HOLDING 2K BY 8 BITS OF
|
||
INFORMATION ("16K" ROMS), BUT THE PINOUT, OR ASSIGNMENT OF CHIP FUNCTIONS TO PIN
|
||
NUMBERS IS SLIGHTLY DIFFERENT. TO USE THE 2716 IN A BOARD DESIGNED FOR A 9316,
|
||
YOU NEED TO TIE PIN 21 TO 5 VOLTS (PIN 24) AND TIE PIN 18 TO GROUND (PIN 12).
|
||
YOU COULD MODIFY THE PROM ITSELF, BUT YOU'RE LIABLE TO RUIN THE CHIP, AND IT
|
||
CREATES A REAL MAGILLA IF YOU NEED TO REPROGRAM IT. (A ROM CARD, SUCH AS AN
|
||
INTEGER CARD, CAN BE USED FOR 2716'S IF TWO JUMPERS ARE CONNECTED AT THE TOP OF
|
||
THE CARD, AND ->ONLY<- 2716'S ARE USED IN ALL OF ITS SOCKETS AFTER THAT).
|
||
|
||
GET A 24-PIN, PREFERABLY LOW-PROFILE IC SOCKET, AND ORIENT IT WITH THE PINS UP
|
||
AND THE NOTCH INDICATING THE 'PIN ONE' END TO THE RIGHT. IT SHOULD LOOK LIKE:
|
||
|
||
---------------------------------------
|
||
! 13 14 15 16 17 18 19 20 21 22 23 24!
|
||
! ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ !
|
||
! !
|
||
! !
|
||
! /
|
||
! (NOTCH)->!
|
||
! \
|
||
! !
|
||
! . . . . . . . . . . . . !
|
||
!/ / / / / / / / / / / / !
|
||
!12 11 10 9 8 7 6 5 4 3 2 1 !
|
||
---------------------------------------
|
||
|
||
USING A LOW-WATTAGE SOLDERING IRON, SOLDER A SHORT PIECE OF 26-30 GAUGE WIRE
|
||
BETWEEN PINS 21 AND 24, AND ANOTHER ONE BETWEEN PINS 12 AND 18. MAKE THE
|
||
CONNECTION AS CLOSE TO THE SOCKET AS POSSIBLE, AND TRY TO AVOID GETTING ANY
|
||
SOLDER ON THE ENDS OF PINS 12 AND 24. CUT OFF PINS 21 AND 18, AGAIN AS CLOSE AS
|
||
POSSIBLE TO THE SOCKET. (PLUGGING ANOTHER SOCKET INTO THE ONE BEING MODIFIED
|
||
WILL HELP TO PREVENT DISTORTION DURING THE SURGERY). THE SOCKET NOW LOOKS LIKE:
|
||
|
||
---------------------------------------
|
||
! 13 14 15 16 17 18 19 20 21 22 23 24!
|
||
! ./ ./ ./ ./ ./ / ./ ./ / ./ ./ ./ !
|
||
! X X / !
|
||
! / / / !
|
||
! / /-------/ /
|
||
! /---------/ !
|
||
! / \
|
||
! / !
|
||
! / . . . . . . . . . . . !
|
||
!/ / / / / / / / / / / / !
|
||
!12 11 10 9 8 7 6 5 4 3 2 1 !
|
||
---------------------------------------
|
||
|
||
X=NO PIN
|
||
|
||
DOUBLE CHECK THE CONNECTIONS ON THE BOTTOM OF THE SOCKET, AND PLUG THE 2716
|
||
INTO THE SOCKET, BEING CAREFUL TO MATCH THE NOTCHED END OF THE CHIP TO THE
|
||
SOCKET. MAKE SURE THAT THE POWER TO THE APPLE IS TURNED OFF, AND PLUG THE
|
||
ASSEMBLY INTO THE F8 SOCKET ON THE MOTHER BOARD WITH THE NOTCH TOWARD THE FRONT
|
||
(KEYBOARD) END OF THE APPLE. CROSS YOUR FINGERS AND TURN ON THE APPLE. IF
|
||
THERE IS NO FAMILIAR "BEEP", OR IF THE TV SCREEN STAYS WHITE, OR IF THE SYSTEM
|
||
DOESN'T RESPOND TO THE RESET KEY, TURN OFF THE POWER AND EXAMINE THE CHIP AND
|
||
SOCKET CAREFULLY TO FIND THE ERROR. IF BLACK CLOUDS OF SMOKE ROLL OUT FROM THE
|
||
APPLE, FORGET WHERE YOU READ THIS. ACTUALLY, THE MOST COMMON MISTAKE OF
|
||
INSERTING THE CHIP BACKWARDS IS SELDOM HARMFUL TO IT, BUT DOES LOCK UP THE
|
||
APPLE'S BUS. REMEMBER THAT BOTH THE 2716 AND THE 9316 THAT YOU REMOVED CAN BE
|
||
DAMAGED BY STATIC ELECTRICITY, SO HANDLE WITH CARE AND DON'T SCUFF YOUR FEET ON
|
||
THE CAT.
|
||
|
||
---------------------------------------
|
||
|
||
***************************************
|
||
* *
|
||
* KRAKOWICZ'S KRACKING KORNER *
|
||
* *
|
||
* THE BASICS OF KRACKING II *
|
||
* *
|
||
* SINGLE-LOAD GAMES, STARTING *
|
||
* LOCATIONS, AND OBFUSCATION. *
|
||
* *
|
||
***************************************
|
||
|
||
|
||
THE FIRST IN THIS SERIES WAS STRAIGHTFORWARD, SINCE THE HARDWARE RESET IS A
|
||
NECESSITY TO BEGIN KRACKING. AFTER THAT, THE PATH DIVIDES, AND THERE ARE MANY
|
||
MANY WAYS TO PRODUCING AN UNPROTECTED VERSION OF A PROGRAM. THE PATH YOU FOLLOW
|
||
IS GOVERNED BY THREE THINGS: THE KIND OF PROGRAM, THE TYPE OF PROTECTION
|
||
EMPLOYED, AND YOUR OWN PERSONAL STYLE (STYLE, BY THE WAY, IS PRIMARILY THE
|
||
RESULT OF LIMITATIONS. TRY TO KEEP AN OPEN MIND AND DEVELOP AS MUCH VERSATILITY
|
||
AS POSSIBLE). THE EASIEST KIND OF PROGRAM TO DEAL WITH IS THE ONE THAT IS SEEN
|
||
LESS FREQUENTLY EVERY MONTH: THE "SINGLE-LOAD" PROGRAM OR GAME. THESE ARE
|
||
PROGRAMS WHICH ARE LOADED IN FROM DISK ONLY ONCE, AND THEN ARE RUN STRICTLY FROM
|
||
MEMORY WITH NO DISK ACCESS. IN THE GOOD OLD DAYS, ALMOST EVERY GAME WAS LIKE
|
||
THIS, AND REMOVING PROTECTION WAS NOT THAT DIFFICULT. ON THE OTHER HAND, WHEN
|
||
YOU READ SOMETHING LIKE OLAF LUBECK'S CHALLENGE IN TRACK 17, SECTOR D OF
|
||
CANNONBALL BLITZ: "YOU'LL NEVER CRACK IT", THERE'S MORE SATISFACTION WHEN YOU
|
||
GET TO SAY "OH, YES I DID!".
|
||
|
||
IN ORDER TO BECOME PROFICIENT AT THIS AND THE TECHNIQUES TO BE DISCUSSED IN
|
||
FUTURE EPISODES, YOU WILL HAVE TO GET USED TO COMMITTING A VERY UNNATURAL ACT:
|
||
INTERPRETING ASSEMBLER CODE WITH NO COMMENTS OR INSTRUCTIONS TO GUIDE YOU. THE
|
||
DISASSEMBLER (MONITOR 'L' COMMAND) IS A GREAT HELP IN THIS WORK, SINCE IT
|
||
TRANSLATES MACHINE CODE INTO ASSEMBLER MNENONICS, BUT THE REAL BURDEN FALLS ON
|
||
THE INGENUITY OF THE KRACKIST. THERE IS NO SUBSTITUTE FOR EXPERIENCE, AND NO
|
||
ONE CAN TEACH YOU HOW TO DO IT BEYOND POINTING OUT SOME OF THE TECHNIQUES WE
|
||
USE, AND WARNING YOU ABOUT SOME OF THE TRICKS USED TO KEEP YOU FROM SUCCEEDING.
|
||
|
||
THE PHILOSOPHY OF ATTACK WITH THESE GAMES IS TO FIND THE STARTING
|
||
LOCATION--THE ADDRESS WHICH WILL ALWAYS RESTART THE GAME, AND THEN TO SAVE THE
|
||
GAME (PROGRAM) AS A NORMAL DOS 3.3 BINARY FILE. AS A SIMPLE EXAMPLE OF A
|
||
STARTING LOCATION, YOU PROBABLY ALREADY KNOW THAT WHEN YOU MESS UP WITH APPLE'S
|
||
"FID" PROGRAM, YOU CAN RESTART BY TYPING '803G' FROM THE MONITOR. AT ONE TIME,
|
||
BEFORE THE PUBLISHERS GOT SMART, A STARTING LOCATION WAS LIKELY TO BE A COMMON,
|
||
EVEN NUMBER LIKE $800, C00, 4000, OR 6000, AND IT'S STILL WORTH CHECKING THESE
|
||
'OLD FAVORITES' IN CASE YOU FIND A NAIVE OR LAZY AUTHOR. IF THESE FAIL, WE WILL
|
||
HAVE TO BEGIN THE PROCESS OF MEMORY SNOOPING. THIS IS THE INTRODUCTION TO THE
|
||
UNGLAMOROUS ACTIVITY THAT OCCUPIES MOST OF THE TIME OF THE DEDICATED KRACKIST.
|
||
AS ALWAYS, INSPECTOR AND WATSON IN ROM ARE HIGHLY RECOMMENDED, SINCE THEY MAKE
|
||
THE PROCESS INFINITELY EASIER. WHAT WE ARE TRYING TO DO IS DIRECTLY LOCATE THE
|
||
BEGINNING ADDRESS OF THE PROGRAM, OR TO SEARCH BACK TO IT FROM SOMETHING WE CAN
|
||
RECOGNIZE.
|
||
|
||
SINCE MANY GAMES BEGIN BY DISPLAYING A HI-RES "BANNER" OR GAME SCREEN, A GOOD
|
||
PLACE TO START LOOKING IS THE SERIES OF INSTRUCTIONS THAT SET UP THE HI-RES
|
||
SCREEN (THERE IS A DISCUSSION OF THIS IN THE DOC FOR MASTERKEY PLUS, BUT THEY
|
||
MAKE A FEW TOO MANY ASSUMPTIONS). APPLE'S SCREEN DISPLAY, AS YOU PROBABLY KNOW,
|
||
IS SET UP BY ACCESSING SOME "SOFT SWITCHES". IN HEX, THESE ARE LOCATIONS $C050
|
||
TO C057 (SORRY, BUT IF YOU'RE GOING TO LEARN THE GENTLE ART OF KRACKING, YOU'LL
|
||
HAVE TO BECOME FLUENT IN HEXADECIMAL--WE WON'T PULL ANY PUNCHES WHEN IT COMES TO
|
||
NUMBER SYSTEMS). IT DOESN'T MATTER WHAT YOU DO TO THESE LOCATIONS, AS LONG AS
|
||
YOU MAKE A REFERENCE, SO THE FOLLOWING INSTRUCTIONS ALL ESTABLISH GRAPHICS MODE:
|
||
|
||
|
||
LDA $C050, BIT $C050, ROL $C050
|
||
STA $C050, CMP $C050, EOR $C050
|
||
|
||
|
||
(ALSO, THIS ONE: LDY #$71; AND $BFAF,Y)
|
||
|
||
MANY AUTHORS HAVE ESTABLISHED THE HABIT, HOWEVER, OF WRITING THE SEQUENCE
|
||
|
||
LDA $C054 (SELECT PRIMARY PAGE)
|
||
LDA $C057 (SELECT HI-RES GRAPHICS)
|
||
LDA $C050 (SELECT GRAPHICS MODE)
|
||
|
||
AND SOMETIMES,
|
||
|
||
LDA $C052 (PURE GRAPHICS SCREEN).
|
||
|
||
TO FIND THESE INSTRUCTIONS, USE THE INSPECTOR'S 'FIND' FUNCTION, AND PROGRAM
|
||
IT TO SEARCH FOR THE TWO-BYTE SEQUENCES OF '50 C0' AND '57 C0'. GENERALLY, AS
|
||
LONG AS THE WRITERS AREN'T DELIBERATELY TRYING TO CONFUSE YOU, YOU WILL FIND ONE
|
||
TO SEVERAL LOCATIONS WHERE THESE SEQUENCES ARE CLOSE TO EACH OTHER. YOU WILL
|
||
ALSO FIND SOME ADDRESSES THAT DON'T REALLY CONTAIN A SCREEN REFERENCE, SINCE THE
|
||
SEARCH IS ONLY FOR TWO BYTES (FOR YOU TRIVIA/ STATISTICS BUFFS OUT THERE, A
|
||
GIVEN TWO-BYTE SEQUENCE WOULD OCCUR LESS THAT ONCE IN THE ENTIRE RAM MEMORY
|
||
SPACE FROM 0 TO $BFFF IF THE DISTRIBUTION WERE TRULY RANDOM. IT'S NOT.).
|
||
|
||
TO SEE IF EACH OCCURANCE OF THE PATTERN IS THE STARTING LOCATION, LOOK
|
||
BACKWARDS UNTIL YOU FIND AN ABSOLUTE END FOR THE PREVIOUS SUBROUTINE SUCH AS
|
||
'RTS' OR 'JMP'. YOUR SUBROUTINE SHOULD BEGIN IMMEDIATELY AFTER THAT, AND YOU
|
||
SHOULD ASSUME FOR THE MOMENT THAT IT'S THE STARTING LOCATION. IF, FOR EXAMPLE,
|
||
THE LOCATION YOU FOUND IS $4123, TEST IT BY RELOADING THE GAME, RESETTING IT,
|
||
AND TYPING '4123G'. IF IT RUNS, SIT BACK AND GLOAT, OTHERWISE READ ON (IT
|
||
SOUNDS UNNECESSARY TO RELOAD, BUT THE INSPECTOR USES A FEW LOCATIONS IN PAGES 0,
|
||
2, AND 3, SO IT'S BEST TO BE SAFE). IF MURPHY'S LAW OF DYNAMIC NEGATIVES IS
|
||
WITH YOU AND THE GAME DIDN'T START, IT'S USUALLY BECAUSE YOU HAVEN'T FOUND THE
|
||
TRUE STARTING LOCATION. YOU THEN NEED TO TRACE BACK FURTHER IN THE PROGRAM
|
||
SEQUENCE TO FIND THE REAL START.
|
||
|
||
THERE ARE THREE WAYS FOR ANOTHER ROUTINE TO GET TO THE ONE YOU'RE LOOKING AT:
|
||
JMP, JSR, AND THE FAMILY OF BRANCH INSTRUCTIONS. TO ELIMINATE THE THIRD
|
||
POSSIBILITY, KEEP IN MIND THAT BRANCHES CAN REACH UP TO $7F (127) LOCATIONS AWAY
|
||
FROM EITHER DIRECTION. THIS IS EQUAL TO ABOUT 60 INSTRUCTIONS, SO YOU SHOULD
|
||
REVIEW ABOUT ONE FULL PAGE OF DISASSEMBLY PRINTOUT (THREE SCREENSFUL) BEFORE AND
|
||
RARELY AFTER WHAT LOOKED LIKE A POSSIBLE START. IF YOU FIND A 'BNE 4123', OR
|
||
'BCC 4123', ETC., YOU WILL HAVE TO TRACK BACK TO THE BEGINNING OF THAT ROUTINE
|
||
AND TRY AGAIN. REPEAT THIS PROCESS UNTIL YOU FIND A LOCATION THAT CAN ONLY BE
|
||
REACHED BY A JMP OR JSR.
|
||
|
||
TO FIND OUT HOW THE PROGRAM GOT TO THIS LOCATION, DO A 3-BYTE SEARCH WITH THE
|
||
INSPECTOR FOR A JSR $4123: 20 23 41. IF NOTHING SHOWS UP, TRY THE JMP $4123:
|
||
4C 23 41. ONE OF THESE MUST PRODUCE A REFERENCE, OR YOU MESSED UP THE EARLIER
|
||
CHECK FOR BRANCHES. ONCE YOU FIND THE EARLIER REFERENCE, GO THROUGH THE SAME
|
||
PROCEDURE TO FIND THE START OF THIS ROUTINE, AND TRY IT OUT AS A STARTING
|
||
LOCATION FOR THE GAME. IF IT DOESN'T WORK, TRY ONE MORE STEP FURTHER BACK
|
||
(KRAKOWICZ'S FOURTH LAW OF KRACKING SAYS THAT IF YOU HAVE TO GO BACK MORE THAN
|
||
TWO STEPS, YOU'RE PROBABLY NOT ON THE RIGHT TRAIL).
|
||
|
||
A NUMBER OF GAMES STILL DO US THE FAVOR OF PUTTING UP A SCREEN, PERHAPS
|
||
PLAYING A LITTLE MUSIC, AND THEN WAITING FOR THE SPACE BAR OR OTHER KEY TO BE
|
||
PRESSED. IF IT'S NOT POSSIBLE TO FIND THE SCREEN SETUP, WE STILL HAVE A FAIRLY
|
||
OBVIOUS "HOOK" INTO FINDING THE STARTING ADDRESS, AND IN MANY CASES THE GAME CAN
|
||
BE SAVED 'AS IS' BY USING THE KEYBOARD ROUTINE AS THE STARTING ADDRESS. DON'T
|
||
WORRY FOR NOW ABOUT EXACTLY HOW WE WILL "SAVE THE GAME". WE'LL GO THROUGH THAT
|
||
CAREFULLY AND THOROUGHLY IN THE NEXT EPISODE.
|
||
|
||
SINCE THE KEYBOARD ADDRESS IS C000, WE CAN USUALLY LOCATE ALL THE INPUTS BY
|
||
SEARCHING FOR THE 3-BYTE SEQUENCE OF 'AD 00 C0' WITH THE INSPECTOR.
|
||
OCCASIONALLY, THE X OR Y REGISTER IS USED TO LOAD KEYBOARD DATA, SO THE
|
||
SEQUENCES AC 00 C0 AND AE 00 C0 SHOULD BE TRIED IF THE FIRST COMES UP BLANK
|
||
(ONLY THE REAL BASTARDS LIKE SIRIUS USE LDY #$67; LDA $BF99,Y FOR THE KEYBOARD
|
||
INPUT). ALSO, KEEP IN MIND THAT ALL THE ADDRESSES FROM C000 TO C00F WILL ACCESS
|
||
THE KEYBOARD, AND IF SOMEONE WAS REALLY DETERMINED TO CONFUSE YOU THEY COULD USE
|
||
C007 ONE TIME, C00D THE NEXT, AND SO ON. IF YOU KNOW THAT THE GAME USES THE
|
||
KEYBOARD AND THE PRELIMINARY SEARCHES DON'T SHOW HOW, KEEP ON LOOKING FOR THESE
|
||
ADDRESSES, OR THE SIRIUS-TYPE COMPUTED ADDRESSES. IT PROBABLY MEANS THEY HAVE
|
||
SOMETHING TO KIDE, AND LOCATING THE KEYBOARD READ WILL REVEAL ENOUGH TO MAKE THE
|
||
SEARCH WORTHWHILE.
|
||
|
||
IF THE PROGRAM IS WAITING FOR THE SPACE BAR, YOU WILL USUALLY FIND A SEQUENCE
|
||
LIKE:
|
||
|
||
|
||
|
||
78E0: LDA $C000 ;READ THE KEYBORARD
|
||
BPL $78E0 ;NO KEY PRESSED
|
||
STA $C010 ;RESET KBD STROBE
|
||
*CMP #$A0 ;WAS IT SPACE?
|
||
*BNE $78E0 ;NOPE, KEEP TRYING
|
||
JMP $6012 ;YES, GO TO START
|
||
|
||
*THESE TWO LINES ARE ELIMINATED IF PRESSING ANY KEY WILL START THE GAME.
|
||
|
||
TO CHECK OUT 6012 AS A STARTING ADDRESS, SET UP TO VIEW THE HI-RES SCREEN
|
||
(OTHERWISE THE GAME MIGHT BE RUNNING WHILE YOU WATCH A BLANK TEXT SCREEN) WITH:
|
||
C050 (CR) C057 (CR), THEN TYPE 6012G. AS BEFORE, YOU WILL KNOW AT ONCE IF YOU
|
||
WERE SUCCESSFUL.
|
||
|
||
ANOTHER WAY TO FIND A RESTART POINT IS TO SEARCH THROUGH THE KEYBOARD INPUT
|
||
ROUTINES FOR A RESTART KEY. IT HAS BECOME CONVENTIONAL TO USE CTRL-R AS THE
|
||
RESTART COMMAND (OCCASIONALLY CTRL-S OR CTRL-B), AND THIS IS EVEN EASIER TO
|
||
TRACE. IN ONE OF THE ROUTINES FOLLOWING A C000 REFERENCE, YOU WILL FIND A CMP
|
||
#$92 (SEE THE REFERENCE MANUAL, P. 7 FOR THE HEX VALUES OF THE KEYBOARD). THE
|
||
LOCATION BRANCHED TO OR JUMPED TO BY A SUCCESSFUL COMPARE WILL BE THE RESTART
|
||
FOR THE GAME. AGAIN, YOU CAN SAVE THE GAME AS IS AND USE YOUR NEW-FOUND
|
||
STARTING LOCATION.
|
||
|
||
|
||
IF THESE RELATIVELY SIMPLE APPROACHES FAIL, YOU'LL HAVE TO RESORT TO THE REAL
|
||
GRUNT TYPE OF DETECTIVE WORK--LOOKING FOR SOMETHING PROMISING (WE'LL DISCUSS
|
||
BOOT-TRACING AS AN ALTERNATIVE WAY OF GETTING TO THIS POINT IN ANOTHER EPISODE
|
||
DEVOTED ENTIRELY TO THAT TECHNIQUE). LIKELY THINGS TO LOOK FOR ARE "SETUPS",
|
||
WHERE A LOT OF ZERO PAGE LOCATIONS ARE INITIALIZED TO BEGIN THE GAME:
|
||
|
||
LDA #$00
|
||
STA $23
|
||
STA $57
|
||
LDA #$12
|
||
STA $30
|
||
LDA #$E9
|
||
STA $72
|
||
ETC.
|
||
ETC
|
||
|
||
OR, SOMETIMES, A GAME START IS INDICATED BY A SUBROUTINE SEQUENCE WHICH MAPS OUT
|
||
THE PATH FOR THE GAME (THIS IS AN INDICATION OF AN EXPERIENCED, WELL-DISCIPLIED
|
||
PROGRAMMER, AND THUS IS MORE COMMONLY SEEN IN BUSINESS OR PROFESSIONAL PROGRAMS;
|
||
RARELY IN GAME PROGRAMMING).
|
||
|
||
JSR $8CD
|
||
JSR $CE4
|
||
JSR $2020
|
||
JSR $203D
|
||
JSR $8FE
|
||
ETC.
|
||
|
||
AND, ALTHOUGH IT'S LESS OFTEN THE START OF A PROGRAM OR GAME, A "JUMP TABLE"
|
||
CAN BE A SIGNIFICANT CLUE TO THE ORGANIZATION OF THE PROGRAM:
|
||
|
||
JMP $204D
|
||
JMP $2433
|
||
JMP $EF2
|
||
JMP $2077
|
||
ETC.
|
||
|
||
UNFORTUNATELY, SNOOPING FOR THESE IS A TIME-CONSUMING, HIT-AND-MISS OPERATION
|
||
- THE REAL STARTING ADDRESS CAN BE ANYWHERE FROM 0000 TO BFFF (OR EVEN VIA A
|
||
BASIC SUBROUTINE IN D000-F7FF, BUT I DON'T WANT TO DISCOURAGE YOU YET).
|
||
|
||
WHILE IT WILL BE DISCONCERTING TO THE BEGINNER, AS YOU GET MORE EXPERIENCE YOU
|
||
BEGIN TO ENJOY DEFEATING VARIOUS DELIBERATE ATTEMPTS TO THROW YOU OFF THE
|
||
TRAIL--THE GENERAL SUBJECT OF OBFUSCATION, OR INTENTIONAL LACK OF CLARITY.
|
||
BECAUSE THE MAJOR SOFTWARE COMPANIES KNOW WE'RE OUT HERE WAITING FOR THEIR
|
||
LATEST OUTPUT, THEY OFTEN TRY TO MISDIRECT US OR FIND INNOVATIVE WAYS OF HIDING
|
||
SENSITIVE PORTIONS OF THE PROGRAM WITH A VARIETY OF TECHNIQUES. TAKE A LOOK AT
|
||
THE FOLLOWING PIECE OF CODE FROM ON-LINE'S CANNONBALL BLITZ:
|
||
|
||
59E4- CE E7 59 DEC $59E7
|
||
59E7- CF ???
|
||
59E8- EA NOP
|
||
59E9- 59 EF EA EOR $EAEF,Y
|
||
59EC- 59 AD 51 EOR $51AD,Y
|
||
59EF- C0 AD CPY #$AD
|
||
59F1- 54 ???
|
||
59F2- C0 AD CPY #$AD
|
||
59F4- 57 ???
|
||
59F5- C0 AD CPY #$AD
|
||
59F7- 52 ???
|
||
59F8- C0 20 CPY #$20
|
||
59FA- 60 RTS
|
||
59FB- 5B ???
|
||
59FC- 20 C5 5B JSR $5BC5
|
||
59FF- 20 4E 5B JSR $5B4E
|
||
|
||
THIS IS AN EXAMPLE OF "SELF-MODIFYING CODE"-INSTRUCTIONS THAT CHANGE AS THE
|
||
PROGRAM IS RUN. IT'S DANGEROUS AND GENERALLY POOR PROGRAMMING PRACTICE, BUT IT
|
||
CAN BE USED TO THROW THE DOGS OFF THE SCENT. AT FIRST GLANCE, IT LOOKS LIKE
|
||
DATA OR GARBAGE STUCK IN BEFORE SOME REAL CODE. LET'S LOOK AT EXACTLY HOW IT
|
||
WORKS. EXECUTING THE FIRST INSTRUCTION CHANGES THE SECOND INSTRUCTION FROM JUNK
|
||
INTO A LEGAL INSTRUCTION:
|
||
|
||
|
||
59E4- CE E7 59 DEC $59E7
|
||
59E7- CE EA 59 DEC $59EA
|
||
59EA- EF ???
|
||
59EB- EA NOP
|
||
59EC- 59 AD 51 EOR $51AD,Y
|
||
59EF- C0 AD CPY #$AD
|
||
|
||
|
||
(IF YOU HAVE AN OLD MONITOR ROM, YOU CAN TYPE 59E4S TO EXECUTE THE FIRST
|
||
INSTRUCTION). IF WE EXECUTE THE SECOND INSTRUCTION, THE ENTIRE PICTURE CHANGES:
|
||
|
||
59E4- CE E7 59 DEC $59E7
|
||
59E7- CE EA 59 DEC $59EA
|
||
59EA- EE EA 59 INC $59EA
|
||
59ED- AD 51 C0 LDA $C051
|
||
59F0- AD 54 C0 LDA $C054
|
||
59F3- AD 57 C0 LDA $C057
|
||
59F6- AD 52 C0 LDA $C052
|
||
59F9- 20 60 5B JSR $5B60
|
||
59FC- 20 C5 5B JSR $5BC5
|
||
59FF- 20 4E 5B JSR $5B4E
|
||
5A02- A9 04 LDA #$04
|
||
5A04- 8D EC B7 STA $B7EC
|
||
5A07- A9 00 LDA #$00
|
||
5A09- 8D EB B7 STA $B7EB
|
||
5A0C- A9 00 LDA #$00
|
||
5A0E- 8D F0 B7 STA $B7F0
|
||
5A11- A9 60 LDA #$60
|
||
5A13- 8D F1 B7 STA $B7F1
|
||
5A16- A9 40 LDA #$40
|
||
5A18- 20 45 5A JSR $5A45
|
||
5A1B- 10 01 BPL $5A1E
|
||
5A1D- A9 20 LDA #$20
|
||
5A1F- 91 5A STA ($5A),Y
|
||
5A21- AD 50 C0 LDA $C050
|
||
5A24- A9 09 LDA #$09
|
||
|
||
SUDDENLY, THE SCREEN SETUP CODE THAT WAS ALWAYS THERE POPS INTO VIEW. THIS
|
||
POINTS OUT THE VALUE OF SEARCHING WITH THE INSPECTOR, SINCE EVEN THE CLOSEST
|
||
SCRUTINY WOULD PROBABLY NOT HAVE MADE YOU SUSPECT WHAT WAS ACTUALLY HERE.
|
||
NOTICE, TOO, THAT THE THIRD INSTRUCTION INCREMENTS 59EA, SO ONCE IT'S BEEN RUN,
|
||
IT'S OBSCURED AGAIN.
|
||
|
||
ANOTHER STANDARD TRICK, ALSO SHOWN IN THIS EXAMPLE, IS CALLED "FALSE
|
||
DISASSEMBLY", AND IS DEAR TO EDU-WARE, ON-LINE, IDSI, AND SCIENTIFIC RESEARCH
|
||
ASSOCIATES. HERE, EXTRA BYTES ARE ADDED FOR THE SOLE PURPOSE OF GIVING A FALSE
|
||
INDICATION OF PROGRAM FLOW; THE FAKE BYTES ARE THEN BRANCHED AROUND. LOOK
|
||
CLOSELY AT THE INSTRUCTION IN 5A1B-IT SAYS BPL 5A1E. THE NEXT INSTRUCTIONS IN
|
||
SEQUENCE APPEAR TO THE CASUAL EYE TO BE LDA $#20; STA ($5A),Y. ACTUALLY, THE
|
||
NEXT INSTRUCTION IS JSR $5A91. THIS IS CRUCIAL, SINCE THIS SUBROUTINE LOADS IN
|
||
THE GAME AND DOES A NIBBLE COUNT. TO SEE A WHOLE BUNCH OF FALSE DISASSEMBLIES
|
||
IN A ROW, LOOK AT THE CODE IN THE ACTUAL SUBROUTINE:
|
||
|
||
5A91- A9 00 LDA #$00
|
||
5A93- 10 01 BPL $5A96
|
||
5A95- 20 A8 59 JSR $59A8
|
||
5A98- 00 BRK
|
||
5A99- 27 ???
|
||
5A9A- C8 INY
|
||
5A9B- D0 FA BNE $5A97
|
||
5A9D- 85 10 STA $10
|
||
5A9F- F0 01 BEQ $5AA2
|
||
5AA1- A9 A9 LDA #$A9
|
||
5AA3- 20 59 00 JSR $0059
|
||
5AA6- 27 ???
|
||
5AA7- C8 INY
|
||
5AA8- C8 INY
|
||
5AA9- D0 F9 BNE $5AA4
|
||
5AAB- 85 11 STA $11
|
||
5AAD- 49 B7 EOR #$B7
|
||
5AAF- 48 PHA
|
||
5AB0- A5 10 LDA $10
|
||
5AB2- 49 11 EOR #$11
|
||
5AB4- 48 PHA
|
||
5AB5- D0 01 BNE $5AB8
|
||
5AB7- 4C 60 08 JMP $0860
|
||
5ABA- 60 RTS
|
||
|
||
I STRONGLY URGE YOU TO SIT DOWN AND FIGURE OUT EXACTLY WHAT THE REAL PROGRAM
|
||
IS HERE, AND IF POSSIBLE, WHAT IT DOES. COVER UP THE EXPLANATION BELOW, AND GO
|
||
THROUGH THE CODE BYTE BY BYTE TO ELIMINATE THE FAKE BYTES. IT'S NOT JUST
|
||
CHARACTER-BUILDING--IF YOU GO THROUGH A FEW OF THESE, YOU'LL LEARN TO RECOGNIZE
|
||
THEM WHEN THEY POP UP.
|
||
|
||
THOSE OF YOU WHO REALLY WENT THROUGH IT, GIVE YOURSELVES FOUR KRACKING HONOR
|
||
POINTS. FOR THE REST OF YOU, HERE'S A LISTING OF THE FUNCTIONAL EQUIVALENT
|
||
(SOME ADDRESSES ARE CHANGED BECAUSE THE JUNK BYTES HAVE BEEN TAKEN OUT):
|
||
|
||
5A91- A9 00 LDA #$00
|
||
5A93- A8 TAY
|
||
5A94- 59 00 27 EOR $2700,Y
|
||
5A97- C8 INY
|
||
5A98- D0 FA BNE $5A94
|
||
5A9A- 85 10 STA $10
|
||
5A9C- A9 20 LDA #$20
|
||
5A9E- 59 00 27 EOR $2700,Y
|
||
5AA1- C8 INY
|
||
5AA2- C8 INY
|
||
5AA3- D0 F9 BNE $5A9E
|
||
5AA5- 85 11 STA $11
|
||
5AA7- 45 B7 EOR $B7
|
||
5AA9- 48 PHA
|
||
5AAA- A5 10 LDA $10
|
||
5AAC- 49 11 EOR #$11
|
||
5AAE- 48 PHA
|
||
5AAF- 60 RTS
|
||
|
||
THIS IS ALSO VALUABLE BECAUSE IT INTRODUCES THE CONCEPT OF "JUMPING THROUGH
|
||
THE STACK". THE RTS INSTRUCTION TRANSFERS THE TWO BYTES ABOVE THE STACK POINTER
|
||
IN PAGE ONE TO THE PROGRAM COUNTER, INCREMENTS THE LOW BYTE BY ONE, AND JUMPS TO
|
||
THAT LOCATION. ORDINARILY, THE BYTES ON THE STACK WERE PLACED THERE AS A RETURN
|
||
ADDRESS BY THE JSR INSTRUCTION. IN THIS CASE, IN VERY ROUNDABOUT FASHION, THE
|
||
ON-LINERS HAVE PUSHED TWO BYTES ON THE STACK AND EXECUTED AN RTS, WHICH JUMPS TO
|
||
THE LOCATION ONE HIGHER THAT THE VALUES STORED. THE STORY OF THE SUBROUTINE
|
||
GOES LIKE THIS: CREATE A CHECKSUM BY EXCLUSIVE-ORING TOGETHER ALL THE BYTES
|
||
FROM 2700 TO 27FF, AND STORE IT IN $10. THIS ALLOWS A CHECK TO SEE IF ANY OF
|
||
THE BYTES IN THE NIBBLE COUNT ROUTINE WERE ALTERED. DO A SECOND CHECKSUM ON
|
||
EVERY OTHER BYTE FROM 2700 TO 27FF, STARTING WITH A VALUE OF #$20. STORE THIS
|
||
IN $11, THEN EXCLUSIVE-OR IT WITH #$B7 TO PRODUCE THE LOW BYTE OF THE RETURN
|
||
ADDRESS:FF. PUSH THIS ON THE STACK, EXCLUSIVE-OR THE FIRST CHECKSUM WITH #$11
|
||
TO PRODUCE THE RETURN HIGH BYTE OF $26, THEN DO THE RTS TO JUMP TO 2700. WHEN
|
||
YOU LOOK AT 2700, YOU FIND THIS:
|
||
|
||
2700- CE 03 27 DEC $2703
|
||
2703- EF ???
|
||
2704- 03 ???
|
||
2705- 27 ???
|
||
2706- AD 24 27 LDA $2724
|
||
2709- 49 8A EOR #$8A
|
||
270B- D0 01 BNE $270E
|
||
270D- 20 8D 24 JSR $248D
|
||
2710- 27 ???
|
||
2711- D0 01 BNE $2714
|
||
2713- 4C A0 25 JMP $25A0
|
||
2716- 98 TYA
|
||
2717- 59 00 27 EOR $2700,Y
|
||
271A- 99 00 27 STA $2700,Y
|
||
271D- C8 INY
|
||
271E- D0 F6 BNE $2716
|
||
|
||
(YOU SEE, NOW THAT WE'RE FAMILIAR WITH THIS KIND OF TRICK, THERE'S NOTHING TO
|
||
DECODING THAT MESS, IS THERE?)
|
||
|
||
STAY TUNED FOR NEXT WEEK, WHEN WE FINISH THIS SUBJECT BY ANSWERING THE BURNING
|
||
QUESTION "WHAT IS THE WINDOW-SHADE TECHNIQUE?", AND PROCEED TO A DISCUSSION OF
|
||
MEMORY MOVING AND FILE SAVING.
|
||
|
||
---------------------------------------
|
||
***************************************
|
||
* *
|
||
* KRAKOWICZ'S KRACKING KORNER *
|
||
* *
|
||
* THE BASICS OF KRACKING 3: *
|
||
* *
|
||
* MEMORY MOVES, BINARY FILES, AND *
|
||
* KRAMMING FOR THE FINALS *
|
||
* *
|
||
***************************************
|
||
|
||
IN THE LAST EPISODE, WE PONDERED THE STARTING ADDRESS OF A PROGRAM AND WAYS TO
|
||
FIND IT IN SPITE OF THE PROTECTORS' SUBTERFUGE. THIS TIME WE'LL DISCUSS HOW TO
|
||
GET THE PROGRAM INTO SAVEABLE FORMAT, EVEN IF IT'S TOO LONG TO SAVE AS A BFILE.
|
||
ALTHOUGH WE'LL BE REFERRING AT FIRST TO SINGLE-LOAD PROGRAMS, MOST OF THESE
|
||
TECHNIQUES ARE APPLICABLE TO PROGRAMS WITH DISK ACCESS.
|
||
|
||
BEFORE WE BEGIN THE PROCESS, LET ME PHILOSOPHIZE FOR A FEW SECONDS ON THE
|
||
PROCEDURES AND PRACTICES TO BE USED. THIS IS A DISCIPLINE: PERHAPS NOT SO
|
||
DEMANDING AS CHAMPIONSHIP KARATE OR THE UNIFICATION CHURCH, BUT IT REQUIRES
|
||
KNOWLEDGE, PATIENCE, AND ATTENTION TO DETAIL. I URGE YOU TO BEGIN EACH
|
||
ADVENTURE IN KRACKING WITH A SHARP PENCIL, PLENTY OF PAPER, AND A GOOD ERASER.
|
||
FROM THIS POINT FORWARD IN OUR QUEST, RECORD-KEEPING WILL OCCUPY AN IMPORTANT
|
||
PART OF THE TOTAL ACTIVITY. IF YOU HAVE A PRINTER, PRINT OUT ANY PERTINENT
|
||
SECTIONS OF CODE AND WRITE IN YOUR OWN COMMENTS ABOUT WHAT IT MEANS. WRITE DOWN
|
||
EVERY ADDRESS OF INTEREST, AND KEEP ESPECIALLY CAREFUL NOTES OF THE NATURE AND
|
||
SEQUENCE OF ALL MEMORY MOVES, STARTING POINTS, AND TRICKS USED BY THE
|
||
PROTECTORS. DO THIS NOT JUST BECAUSE IT'S CHARACTER BUILDING, BUT BECAUSE
|
||
UNLESS YOU HAVE EXCEPTIONAL RECALL, ALL PROGRAMS WILL EVENTUALLY BLEND TOGETHER
|
||
INTO A WARM AND FUZZY MEMORY. KEEP GOOD NOTES ON EVERYTHING YOU LEARN, AND
|
||
REMEMBER: "THOSE WHO CANNOT RECALL THE MISTAKES OF THE PAST ARE DOOMED TO
|
||
REPEAT THEM."
|
||
|
||
SUPPOSE YOU HAVE LOADED IN, RESET WITH YOUR OLD MONITOR ROM, AND FINALLY
|
||
LOCATED THE STARTING ADDRESS TO THE GREATEST GAME EVER WRITTEN: "HYPERSPACE
|
||
ANDROID CLONE KILLER" OR "HACK". THE STARTING ADDRESS IS 4123, AND THE GAME
|
||
OCCUPIES MEMORY FROM 800 TO B000. YOU ALREADY KNOW THAT IF ANY MEMORY ABOVE
|
||
9D00 HAS BEEN USED BY THE PROGRAM, DOS IS DEAD, AND YOU CAN'T SAVE THE PROGRAM
|
||
TO DISK WITH A DOS COMMAND. AS YOU ALSO UNDOUBTEDLY KNOW, IF THE PROGRAM WERE
|
||
SMALLER YOU WOULD HAVE THE OPTION OF BOOTING A DISK AND SAVING THE GAME AS A
|
||
BINARY FILE. LET'S TAKE JUST A SECOND, THOUGH, AND REVIEW WHAT HAPPENS TO
|
||
MEMORY WHEN YOU BOOT A DISK.
|
||
|
||
FIRST OF ALL, DON'T USE A MASTER DISK, SINCE THE DOS ON A MASTER IS LOADED
|
||
FIRST INTO 1600-3FFF AND THEN RELOCATED TO THE HIGHER REGIONS OF MEMORY.
|
||
BOOTING A 48K SLAVE DISK WILL DISTURB ONLY 0-8FF AND 9600-BFFF, AND IF YOUR
|
||
PROGRAM LIVES WITHIN OR CAN BE REARRANGED TO FIT THESE BOUNDARIES, YOU CAN
|
||
SAFELY BOOT THE DISK AND SAVE THE PROGRAM AS A BINARY FILE.
|
||
|
||
AN OLD METHOD OF SAVING A BINARY FILE IS WELL-KNOWN TO THOSE OF US WHO BOUGHT
|
||
APPLES IN THE DARK AGES BEFORE THE DISK II, BUT THERE ARE NOW MAYBE HALF A
|
||
MILLION (!) APPLE OWNERS WHO ARE UNFAMILIAR WITH THE CASSETTE PORT AND ITS USE.
|
||
IN GENERAL, ALMOST ANY CASSETTE RECORDER THAT HAS A TONE CONTROL CAN BE USED,
|
||
BUT FOR SOME REASON THE CHEAPER ONES ARE GENERALLY BETTER. TO USE ONE, PLUG
|
||
BOTH CABLES INTO THE CORRECT CONNECTOR ("IN" MEANS INTO THE COMPUTER, NOT INTO
|
||
YOUR RECORDER), AND TURN THE TONE CONTROL ALMOST TO THE TOP OF THE TREBLE RANGE.
|
||
SAVE A SMALL BASIC PROGRAM (REFER TO THE MANUAL FOR USE OF THE BASIC COMMANDS)
|
||
AT ANY OLD VOLUME CONTROL SETTING. TRY LOADING THE PROGRAM BACK IN SEVERAL
|
||
TIMES, INCREASING THE VOLUME CONTROL SETTING UNTIL THE PROGRAM LOADS RELIABLY.
|
||
YOU'LL FIND THAT THE TAPE WORKS VERY WELL, EVEN ON LONG FILES, ESPECIALLY WHEN
|
||
THE SAME RECORDER IS USED TO RECORD AND PLAYBACK.
|
||
|
||
WHAT'S GOOD ABOUT THE TAPE SYSTEM IS THAT EVEN WHEN DOS IS COMPLETELY DEAD,
|
||
THE MONITOR COMMANDS FOR TAPE I/O ARE STILL ACTIVE (ASSUMING YOU DIDN'T WIPE
|
||
THEM OUT OF YOUR OLD MONITOR ROM). SEE THE REFERENCE MANUAL, PAGE 46 FOR A
|
||
COMPLETE DESCRIPTION. WITH TAPE, YOU CAN ALWAYS SAVE ANY PART OF MEMORY AT ANY
|
||
TIME! (WORTH KEEPING IN MIND FOR THOSE CRUCIAL SITUATIONS WHEN THE SYSTEM
|
||
CRASHES JUST AS YOU ARE FINISHING YOUR TERM PAPER ON THE WORD PROCESSOR). THE
|
||
CASSETTE ROUTINES USE ONLY LOCATIONS 3C-3F AND 42-43 IN ZERO PAGE, AND THE ONLY
|
||
PART OF MEMORY YOU SHOULDN'T TRY TO SAVE IS C000-C0FF-- SOME TERRIBLE THINGS CAN
|
||
HAPPEN IF YOU TRY. IN MOST CASES, IT'S BEST TO SAVE A LONG PROGRAM IN TWO FILES
|
||
SO IT CAN BE RELOADED IN BETWEEN 800 AND 9600 AFTER DOS IS IN MEMORY. FOR OUR
|
||
EXAMPLE OF "HACK", THE NECESSARY MONITOR COMMANDS ARE:
|
||
|
||
*0.4FFFW (LONG WAIT)
|
||
*5000.AFFFW (LONGER WAIT)
|
||
|
||
AFTER BOOTING A DISK, YOU CAN RELOAD WITH:
|
||
|
||
*1000.5FFFR (RELOAD FIRST HALF)
|
||
*BSAVE HACKLOW,A$1000,L$5000
|
||
*BSAVE HACKHI,A$1000,L$6000
|
||
|
||
NOTE THAT IN THE TAPE READ AND WRITE COMMANDS, UNLIKE DOS, THE ACTUAL STARTING
|
||
AND ENDING LOCATIONS ARE LISTED. BE SURE YOU UNDERSTAND THE ONE-BYTE DIFFERENCE
|
||
BETWEEN THE TWO BEFORE YOU USE THEM.
|
||
|
||
THERE ARE ALSO OCCASIONS WHEN YOU WOULD LIKE TO SAVE APPLESOFT OR INTEGER
|
||
BASIC PROGRAMS LOADED IN FROM A MODIFIED DOS ON A PROTECTED DISK (ARCADE MACHINE
|
||
AND THE RAPID-FIRE SERIES FROM SSI ARE EXAMPLES). THIS IS SIMPLE WITH THE TAPE
|
||
RECORDER, SINCE THE MONITOR ROUTINES ARE TOTALLY IGNORANT OF THE OPERATING
|
||
SYSTEM IN RAM. IF YOU CAN LIST A BASIC PROGRAM, YOU CAN USUALLY SAVE IT TO
|
||
TAPE. TRY THE FOLLOWING WITH ONE OF THE ABOVE PROGRAMS: LOAD IN A PROGRAM
|
||
MODULE (ANYTHING IN ARCADE MACHINE EXCEPT THE MAIN MENU), THEN HIT RESET WHILE
|
||
IT'S RUNNING. TYPE D6:00 (THIS REMOVES THE APPLESOFT INTERNAL "PROTECTION"),
|
||
THEN C081 TO SELECT THE MOTHER BOARD ROM (UNLESS YOU HAVE AN APPLE II WITH
|
||
APPLESOFT ON A ROM CARD, THEN IT'S C080 TO SELECT SLOT 0). TYPE CONTROL-C AND
|
||
YOU SHOULD BE ABLE TO LIST THE PROGRAM AND THEN SAVE IT TO TAPE WITH THE "SAVE"
|
||
COMMAND (SOMETIMES AN ADDITIONAL FAIRLY TRIVIAL PROTECTION SCHEME IS USED WITH
|
||
APPLESOFT PROGRAMS: DELETING THE FIRST LINE NUMBER SO IT WON'T LIST. IT WILL
|
||
STILL SAVE TO TAPE AND YOU CAN RECONSTRUCT THE LINE NUMBER AT YOUR LEISURE).
|
||
REMEMBER THAT THE BASIC "LOAD" AND "SAVE" COMMANDS DON'T ALLOW A FILE NAME TO BE
|
||
ADDED. IF THERE ARE MORE THAN A FEW FILES ON THE DISK, THIS IS A VERY TEDIOUS
|
||
WAY TO KRACK A PROGRAM, BUT BACK IN THE MIDDLE AGES BEFORE DEMUFFIN PLUS IT WAS
|
||
SOMETIMES THE ONLY WAY. YOU ALSO HAVE TO BE WARY OF BINARY ROUTINES WHICH ARE
|
||
CALLED FROM OR MODIFY THE BASIC PROGRAMS.
|
||
|
||
YES, YOU'RE RIGHT. GETTING OUT AND HOOKING UP THE TAPE RECORDER IS A CRAMP IN
|
||
THE CALVINS, SO IT'S USUALLY LEFT WORKS. IN GENERAL, IT'S BEST TO LEARN HOW TO
|
||
MANIPULATE MEMORY TO SCRUNCH YOUR PROGRAM DOWN INTO A DOS FILE (IT WILL ALWAYS
|
||
HAVE TO BE DONE, ANYWAY). IN THE BEST OF ALL POSSIBLE WORLDS, YOUR DOS WOULD BE
|
||
IN ROM MEMORY, AND WOULD ALLOW YOU TO SAVE ANY PROGRAM THAT RESIDED IN RAM
|
||
MEMORY. IN THE REAL WORLD, IT'S GENERALLY NECESSARY TO LOADED IN BY DOS FROM A
|
||
NORMAL DISK (WE'LL TALK LATER ABOUT THOSE THAT CAN'T BE). THIS PROCESS IS
|
||
USUALLY CALLED "MEMORY MOVING", AND THE PURPOSE IS TO "TUCK IN" ALL THE PIECES
|
||
OF THE PROGRAM THAT LIE OUTSIDE THE NORMAL PROGRAM MEMORY OF 800-9600 ALLOWED BY
|
||
DOS. THE OTHER HALF OF THE PROCESS IS THE "UNFOLDING" OF THE TUCKED-IN PORTIONS
|
||
OF MEMORY AFTER THE PROGRAM IS RELOADED UNDER DOS. TO GAIN PERSPECTIVE ON THE
|
||
PROCESS, LET'S LOOK AT MEMORY MAPS WITH DOS ACTIVE AND WITH "HACK" IN MEMORY.
|
||
_______________________________________
|
||
! !
|
||
! !
|
||
!F800-FFFF->!MONITOR ROM!AUTOSTART ROM!
|
||
!-------------------------------------!
|
||
!F000-F7FF->! INTEGER ! APPLESOFT !
|
||
!E800-EFFF->! BASIC ! " !
|
||
!E000-E7FF->! " " ! " !
|
||
!D800-DFFF->!(INSPECTOR)! " !
|
||
!D000-D7FF->! (WATSON) ! " !
|
||
!-------------------------------------!
|
||
!C800-CFFF->!PERIPHERAL SLOT ROM SPACE!
|
||
!C000-C7FF->!SOFT SWITCHES & SLOT ROMS!
|
||
!-------------------------------------!
|
||
!B800-BFFF->! ^ !
|
||
!B000-B7FF->! ! !
|
||
!A800-AFFF->! DOS !
|
||
!A000-A7FF->! ! !
|
||
!9800-9FFF->! V !
|
||
!-------------------------------------!
|
||
!9000-97FF->! ^ !
|
||
!8800-8FFF->! ! !
|
||
!8000-87FF->! ! !
|
||
!7800-7FFF->! ! !
|
||
!7000-77FF->! ! !
|
||
!6800-6FFF->! PROGRAM MEMORY !
|
||
!6000-67FF->! ! !
|
||
!------------------!------------------!
|
||
!5800-5FFF->! ! ^ !
|
||
!5000-57FF->! ! (HI-RES PAGE 2) !
|
||
!4800-4FFF->! ! ! !
|
||
!4000-47FF->! ! V !
|
||
!------------------!------------------!
|
||
!3800-3FFF->! ! ^ !
|
||
!3000-37FF->! ! (HI-RES PAGE 1) !
|
||
!2800-2FFF->! ! ! !
|
||
!2000-27FF->! ! V !
|
||
!------------------!------------------!
|
||
!1800-1FFF->! ! !
|
||
!1000-17FF->! ! !
|
||
!0800-0FFF->! V (TEXT PAGE 2) !
|
||
!--------------------------------------
|
||
!0000-07FF->!ZERO PG,STACK,TEXT PAGE 1!
|
||
---------------------------------------
|
||
AND, WITH "HACK" IN MEMORY:
|
||
_______________________________________
|
||
! ! ! !
|
||
!F800-FFFF->!MONITOR ROM!AUTOSTART ROM!
|
||
!-------------------------------------!
|
||
!F000-F7FF->! INTEGER ! APPLESOFT !
|
||
!E800-EFFF->! BASIC ! " !
|
||
!E000-E7FF->! " " ! " !
|
||
!D800-DFFF->!(INSPECTOR)! " !
|
||
!D000-D7FF->! (WATSON) ! " !
|
||
!-------------------------------------!
|
||
!C800-CFFF->!PERIPHERAL SLOT ROM SPACE!
|
||
!C000-C7FF->!SOFT SWITCHES & SLOT ROMS!
|
||
!-------------------------------------!
|
||
!B800-BFFF->! (EMPTY) !
|
||
!B000-B7FF->! ^ !
|
||
!A800-AFFF->! ! !
|
||
!A000-A7FF->! ! !
|
||
!9800-9FFF->! ! !
|
||
!------------------!------------------!
|
||
!9000-97FF->! ! !
|
||
!8800-8FFF->! ! (EMPTY) !
|
||
!8000-87FF->! ! (EMPTY) !
|
||
!7800-7FFF->! ! !
|
||
!7000-77FF->! ! !
|
||
!6800-6FFF->! PROGRAM "HACK" !
|
||
!6000-67FF->! ! !
|
||
!------------------!------------------!
|
||
!5800-5FFF->! ! ^ !
|
||
!5000-57FF->! ! (HI-RES PAGE 2) !
|
||
!4800-4FFF->! ! ! !
|
||
!4000-47FF->! ! V !
|
||
!------------------!------------------!
|
||
!3800-3FFF->! ! ^ !
|
||
!3000-37FF->! ! (HI-RES PAGE 1) !
|
||
!2800-2FFF->! ! ! !
|
||
!2000-27FF->! ! V !
|
||
!------------------!------------------!
|
||
!1800-1FFF->! ! (EMPTY) !
|
||
!1000-17FF->! ! (EMPTY) !
|
||
!0800-0FFF->! V (TEXT PAGE 2) !
|
||
!-------------------------------------!
|
||
!0000-07FF->!ZERO PG,STACK,TEXT PAGE 1!
|
||
---------------------------------------
|
||
|
||
BEFORE WE BEGIN THE DISCUSSION OF THE TECHNIQUES OF MEMORY MOVING, LET'S
|
||
RESTATE THE OBJECTIVE: WE'RE TRYING TO ARRANGE ALL THE PROGRAM INTO A SMALL
|
||
ENOUGH SPACE THAT WE CAN BSAVE A FILE UNDER DOS (THE DOS MANUAL WILL TELL YOU
|
||
THAT THE LARGEST BINARY FILE YOU CAN SAVE IS 128 SECTORS, BUT IF YOU CHANGE
|
||
LOCATION $A964 (43364) TO $BF(191) YOU CAN SAVE A FILE AS LARGE AS THE ENTIRE
|
||
RAM MEMORY). REMEMBER THAT BOOTING A SLAVE DISK WILL MESS UP 0-8FF AND
|
||
9600-BFFF, SO THE LARGEST FILE IT'S PRACTIVAL TO SAVE IS ABOUT 145 SECTORS (YOU
|
||
CAN, WITH CARE, OVERWRITE MUCH OF THE SCREEN MEMORY AND PAGES 2 & 3 TO SAVE A
|
||
BFILE OF ABOUT 151 SECTORS, BUT THAT REQUIRES KNOWLEDGE AND CONSIDERABLE CARE).
|
||
|
||
LOOKING AT THE MEMORY MAP WITH HACK, YOU CAN SEE THAT THE MEMORY FROM 9600 TO
|
||
B000 WILL HAVE TO BE STORED SOMEWHERE ELSE TO BRING THE FILE SIZE DOWN, AND THE
|
||
PAGE FROM 800-8FF WILL HAVE TO BE STASHED TEMPORARILY DURING THE DISK BOOT TO
|
||
RESTORE DOS. TO FIND OUT WHAT AREAS OF MEMORY ARE FREE, SEARCH THROUGH ALL
|
||
MEMORY WITH THE INSPECTOR AND LOOK FOR BLANK PAGES. THE FOLLOWING TRICK WILL
|
||
HELP: BEFORE YOU LOAD THE ORIGINAL, CLEAR ALL OF MEMORY TO ZERO (OR ANY OTHER
|
||
BYTE YOU LIKE) WITH:
|
||
|
||
*800:0
|
||
*801<800.95FFM
|
||
|
||
THEN YOU'LL BE ABLE TO SEE UNUSED MEMORY AREAS. THIS DOESN'T ALWAYS WORK,
|
||
SINCE MANY AREAS ARE COPIED TO A SECOND LOCATION AND NOT USED AFTERWARDS, SO IF
|
||
YOU'RE HARD PRESSED FOR STORAGE MEMORY, IT'S A GOOD IDEA TO SCAN THROUGH ONCE
|
||
WITH THE INPECTOR SET TO DECODE ASCII TO DETECT SUSPICIOUS SECTORS (LATELY, SOME
|
||
OF THE PROTECTORS HAVE TAKEN TO STORING GARBAGE SUCH AS SOURCE CODE IN UNUSED
|
||
PAGES OF MEMORY AND ON EMPTY DISK SECTORS). NOTE DOWN ANY PAGES THAT ARE
|
||
TOTALLY CLEAR, ANY THAT ARE ALL ONE BYTE, REGARDLESS OF WHAT IS IS, OR ANY THAT
|
||
CONTAIN JUNK. LET'S ASSUME FOR THIS EXAMPLE THAT LOCATIONS 1000-1FFF AND
|
||
8000-8FFF ARE BLANK. WE HAVE 1A00 (B000-9600) BYTES OF MEMORY "LEFTOVER" OR
|
||
OUTSIDE OF THE DOS BOUNDARIES, SO THEY WILL ALL FIT INTO THE $2000 BLANK
|
||
LOCATIONS THAT WE LOCATED.
|
||
|
||
STORE THE EXCESS BYTES IN THE HOLES BY TYPING:
|
||
|
||
|
||
*8000<9600.A5FFM
|
||
*1000<A600.AFFFM
|
||
|
||
OR EQUIVALENT; THE SPLIT CAN BE ANY WAY THAT HELPS YOU KEEP TRACK OF THE
|
||
PROCESS. FINALLY, STASH THE MEMORY FROM PAGE 8 WITH *1B00<800.8FFM. REMEMBER
|
||
THAT THIS IS ONLY TEMPORARY. BEFORE YOU DO ANYTHING ELSE, BOOT YOUR 48K SLAVE
|
||
DISK, THEN RESTORE PAGE 8 WITH *800<1B00.1BFFM. BEFORE YOU DO ANYTHING ELSE,
|
||
SAVE THE PROGRAM WITH "BSAVE HACKALL,A$800,L$8E00 (NINE OUT OF TEN TIMES YOU'LL
|
||
FORGET TO CHANGE $A964; CONSIDER CHANGING IT IN THE DOS IN MEMORY BEFORE YOU
|
||
INITIALIZE THE DISK SO IT WILL BE PERMANENT). YOU CAN NOW TAKE A DEEP BREATH
|
||
AND RELAX: ALL OF THE PROGRAM MEMORY IS SAFELY TUCKED AWAY. ALL THAT'S LEFT IS
|
||
TO WRITE A SHORT PROGRAM TO REVERSE THE MEMORY STORAGE.
|
||
|
||
TWO SHORT ROUTINES, SIMILAR TO THOSE SHOWN IN OUR FIRST BASICS LESSON ARE
|
||
REQUIRED. AGAIN, LET'S REVIEW THE STEPS NECESSARY FROM HERE TO RUN THE GAME:
|
||
|
||
|
||
1. LOAD THE (COMPRESSED) GAME INTO 800-95FF.
|
||
2. MOVE THE PIECE OF MEMORY AT 8000-9FFF TO 9600-A5FF.
|
||
3. MOVE THE PIECE OF MEMORY AT 1000-19FF TO A600-AFFF.
|
||
4. JUMP TO THE STARTING ADDRESS AT $4123.
|
||
|
||
THE FOLLOWING PROGRAM WILL TAKE CARE OF STEPS 2-4. IT MAY NOT BE IMMEDIATELY
|
||
OBVIOUS THAT THIS PROGRAM MUST BE STORED WITHIN THE COMPRESSED PROGRAM IN A PAGE
|
||
THAT IS BOTH EMPTY AND UNAFFECTED BY THE MEMORY MOVES YOU ARE ABOUT TO MAKE. IN
|
||
THIS CASE, PAGE 1C IS SAFE.
|
||
|
||
1C00 LDY #$0 ;CLR Y-REG
|
||
1C02 LDA $8000,Y ;GET A BYTE AT 8000+
|
||
1C05 STA $9600,Y ;STORE IT AT 9600+
|
||
1C08 INY ;INCR. COUNTER
|
||
1C09 BNE $1C02 ;IF NOT PAGEND, REDO
|
||
1C0B INC $1C04 ;INCR. SOURCE HIBYTE
|
||
1C0E INC $1C07 ;INCR. DEST HIBYTE
|
||
1C11 LDA $1C07 ;GET THE DEST HIBYTE
|
||
1C14 CMP #$90 ;IF 90,WE'RE DONE
|
||
1C16 BNE $1C02 ;IF NOT, DO MORE
|
||
1C18 LDA $1000,Y ;REPEAT THE PROCESS
|
||
1C1B STA $A600,Y ;FOR THE SECOND
|
||
1C1E INY ;BLOCK
|
||
1C1F BNE $1CA8
|
||
1C21 INC $1C1A
|
||
1C24 INC $1C1D
|
||
1C27 LDA $1C1D
|
||
1C2A CMP #$1B
|
||
1C2D BNE $1CA8
|
||
1C2F JMP 4123 ;AND JUMP TO THE
|
||
STARTING LOCATION
|
||
|
||
THIS MAY SEEM HARD AT FIRST, BUT THE FORM IS SO CONSTANT THAT YOU'LL BE ABLE
|
||
TO WRITE THESE MOVES IN YOUR SLEEP AFTER A FEW TRIES WITH THE MINI- ASSEMBLER
|
||
(THE PLACE YOU'LL MOST LIKELY MESS UP IS IN THE 'CMP #90' BY TYPING 'CMP
|
||
$90'--WATCH IT CAREFULLY!).
|
||
|
||
TIME OUT FOR A BRIEF DISCUSSION OF ONE OF THE SUBTLE POINTS OF MEMORY MOVES.
|
||
ALTHOUGH YOU'RE GENERALLY ABLE TO MAKE YOUR MEMORY MOVES NON-OVERLAPPING, YOU
|
||
CAN HAVE A PROBLEM MOVING LARGE AMOUNTS OF MEMORY. THE MEMORY MOVE ROUTINES
|
||
SHOWN ABOVE ARE "FORWARD" MEMORY MOVES: THAT MEANS THAT UST MOVED. SOMETIMES
|
||
YOU WILL NEED TO MOVE, FOR INSTANCE, LOCATIONS 6000-8FFF TO 8000-AFFF. IF YOU
|
||
USE THE FORWARD MOVES AS SHOWN, YOU CAN SEE THAT THE FIRST PAGE (PAGE 60 OR
|
||
6000-60FF) WILL LAND AT 8000-80FF, SMACK ON TOP OF THE ORIGINAL PAGE THAT WAS
|
||
SUPPOSED TO BE MOVED LATER TO PAGE A0 (A000-A0FF). TO WORKS "DOWN" IN MEMORY
|
||
INSTEAD OF UP.
|
||
|
||
IN THIS EXAMPLE, PAGE 8F IS FIRST MOVED TO AF, THEN 8E TO AE, ETC. THIS WAY,
|
||
WHEN IT FINALLY COMES TIMES TIME FOR PAGE 60 TO BE MOVED TO PAGE 80, THE
|
||
ORIGINAL PAGE 80 WILL ALREADY HAVE BEEN MOVED. A TYPICAL ROUTINE FOR THIS IS:
|
||
|
||
|
||
1000 LDY #$0
|
||
1002 LDA $8F00,Y
|
||
1005 STA $6000,Y
|
||
1008 INY
|
||
1009 BNE $1002
|
||
100B DEC $1004
|
||
100E DEC $1007
|
||
1011 LDA $1007
|
||
1014 CMP #$5F
|
||
1017 BNE $1002
|
||
|
||
OK--ALL THAT REMAINS IS TO GET TO THE START OF THE EARLIER MEMORY MOVE ROUTINE
|
||
WHEN WE "BRUN" THE GAME. THIS IS ACCOMPLISHED BY PUTTING THE CODE FOR "JMP
|
||
$1C00" OR 4C 00 1C AT LOCATION $7FD-$7FF AND MAKING THIS THE FIRST LOCATION OF
|
||
THE PROGRAM. WE CAN THEN SAVE A COMPLETE, FUNTIONING VERSION OF HACK WITH
|
||
"BSAVE HACK,A$7FD,L$8E03". THIS CREATES YOUR FINAL, 145-SECTOR FILE OF HACK
|
||
WHICH WILL BRUN WHENEVER YOU WISH.
|
||
|
||
----------A FEW HELPFUL HINTS----------
|
||
|
||
1. ALWAYS KEEP A FEW INITIALLIZED 48K SLAVE DISKS NEARBY--IT'S ALARMING HOW
|
||
FAST A DISK FILLS UP WITH SLIGHTLY DIFFERENT 145-SECTOR VERSIONS OF THE PROGRAM
|
||
UNDERGOING KRACKING.
|
||
|
||
2. MAKE YOUR PROGRAM NAMES AS DESCRIPTIVE AS YOU CAN, ESPECIALLY WHEN SAVING
|
||
A PROGRAM IN PIECES. IT'S VERY DISTURBING TO RETURN TO A KRACKING EFFORT AFTER
|
||
A LONG WEEKEND TO FIND PROGRAMS ON THE DISK TITLES "HACKHI", "HACKHIGH", "HIGH",
|
||
"HH", ETC. AND NOT BE SURE WHAT EACH ONE IS. BETTER TO TYPE IN A FEW EXTRA
|
||
LETTERS TO LET YOU KNOW THAT IT'S "HACK WITHOUT 9600UP" OR OR "HACK 4000-B000
|
||
ONLY".
|
||
|
||
3. WHENEVER POSSIBLE, COMPRESS THE GAME TO THE MINIMUM NUMBER OF SECTORS BY
|
||
DOING A FEW MORE MEMORY MOVES BEFORE AND AFTER SAVING. YOUR FRIENDS WILL
|
||
APPRECIATE YOUR THOUGHTFULNESS IN MAXIMIZING THE NUMBER OF GAMES PER DISK AND
|
||
MINIMIZING MODEM TIME.
|
||
|
||
4. =>VERY IMPORTANT<= WHEN YOU THINK YOU HAVE A COMPLETE, WORKING VERSION,
|
||
CHECK IT OUT THOROUGHLY ON ALL LEVELS AND IN ALL MODES. IT'S EXTREMELY
|
||
EMBARASSING TO HAVE TO ISSUE A "PRODUCT RECALL" WHEN YOU LEARN A MONTH LATER
|
||
THAT HACK CRASHES ON LEVEL 47 JUST AS THE HYPERGALACTIC FROG IS ABOUT TO DEVOUR
|
||
NEW PITTSBURGH ON THE MARS COLONY...
|
||
|
||
*** NEXT TIME--PICTURE PACKING AND ***
|
||
********* RAM CARD TECHNIQUES ********
|
||
|
||
---------------------------------------
|
||
***************************************
|
||
* *
|
||
* KRAKOWICZ'S KRACKING KORNER *
|
||
* *
|
||
* BASICS OF KRACKING - 104 *
|
||
* *
|
||
***************************************
|
||
|
||
WHERE DO I BEGIN?
|
||
|
||
SEVERAL PREVIOUS EPISODES OF THIS COLUMN HAVE DEALT WITH THE RELATIVELY SIMPLE
|
||
TECHNIQUES WHICH CAN BE USED TO SAVE A SINGLE-LOAD FILE TO DISK AS AN
|
||
UNPROTECTED BINARY PROGRAM, AND IT IS NOW TIME TO EXPLORE THE LARGER AREA OF
|
||
MULTIPLE-PROGRAM DISKS, PROGRAMS WITH DISK ACCESS, AND THE APPROACHES USED TO
|
||
PROTECT THEM FROM BEING COPIED. WE WILL BEGIN WITH SIZING UP A DISK PROTECTION
|
||
SCHEME, DECIDING ON A BASIC APPROACH, AND BEGINNING THE UNPROTECTION PROCESS
|
||
(THE SUBJECT OF BOOT-TRACING AS ANOTHER MEANS TO THE SAME END WILL BE DESCRIBED
|
||
IN A FUTURE EPISODE, SINCE IT IS GENERALLY USED WITH MORE SOPHISTICATED
|
||
PROTECTION SCHEMES). THE SUBJECT IS TRULY MAMMOTH, AND WILL REQUIRE SEVERAL
|
||
EPISODES TO COMPLETE. FOR NOW, SETTLE BACK, OPEN A COLD BEVERAGE OF YOUR
|
||
CHOICE, AND LET'S BEGIN A JOURNEY INTO THE FIRST LEVEL OF DISK PROTECTION: THE
|
||
MODIFIED DOS (AS WE HAVE OFTEN MENTIONED BEFORE, TWO STALWART FRIENDS IN THIS
|
||
QUEST ARE "BENEATH APPLE DOS" BY WORTH AND LECHNER, AND RANDY HYDE'S
|
||
"DOSSOURCE". IT IS POSSIBLE TO KRACK DISKS WITHOUT THEM, BUT WITH ABOUT THE
|
||
SAME EASE AS PERFORMING AN ORAL APPENDECTOMY).
|
||
|
||
APPLE'S DOS, COMBINED WITH THE DIVISION OF HARDWARE BETWEEN THE DISK
|
||
CONTROLLER CARD AND THE DISK ANALOG BOARD, IS A VERITABLE PLAYGROUND FOR THOSE
|
||
WHO PRODUCE DISK PROTECTION. THERE ARE LITERALLY THOUSANDS OF DIFFERENT THINGS
|
||
WHICH CAN BE DONE TO MAKE COPYING A DISK DIFFICULT, CHALLENGING, AND (MAYBE
|
||
SOMEDAY), IMPOSSIBLE. IN SO DOING, THEY PROVIDE HOURS OF VERY INGENIOUS
|
||
PUZZLES, BOUNDLESS INTELLECTUAL STIMULATION, AND NOT INCIDENTALLY, THE INCENTIVE
|
||
TO LEARN MUCH MORE ABOUT PROGRAMMING, THE APPLE, DOS, ASSEMBLY LANGUAGE, AND
|
||
TREACHERY THAN WE WOULD OTHERWISE HAVE THE DESIRE TO LEARN.
|
||
|
||
BY FAR THE MOST COMMON TECHNIQUE USED TO PROTECT ENTIRE DISKS IS TO MAKE
|
||
MODIFICATIONS TO THE OPERATING SYSTEM, AND SPECIFICALLY TO THE READ/WRITE TRACK
|
||
AND SECTOR (RWTS) ROUTINES WHICH DEFEAT ORDINARY COPY PROGRAMS (COPYA AND SUPER
|
||
DISK COPY 3.X ARE EXAMPLES, BUT WE'LL SEE LATER HOW BOTH OF THESE CAN BE USED TO
|
||
OUR ADVANTAGE). TO FIND THE MOST EFFICIENT APPROACH TO DEFEATING THESE
|
||
PROTECTION TECHNIQUES, WE NEED FIRST TO SPEND A FAIR AMOUNT OF TIME DESCRIBING
|
||
IT FROM THE CRACKIST'S VIEWPOINT.
|
||
|
||
(ON THE FUNDAMENTAL PRINCIPLE THAT GIVING A MAN A FISH ALLOWS HIM TO EAT FOR A
|
||
DAY WHILE TEACHING HIM TO FISH ALLOWS HIM TO EAT FOR LIFE, WE WILL NOT DWELL ON
|
||
THE SUBJECT OF "COPYING" AS SUCH. MANY OF THE TECHNIQUES DESCRIBED HERE ARE,
|
||
HOWEVER, VERY USEFUL IN DECIDING HOW TO GO ABOUT COPYING A DISK. PERHAPS AN
|
||
ASPIRING AUTHOR OUT THERE WILL BUILD FROM THE INTRODUCTION GIVEN HERE TO PURSUE
|
||
THE SUBJECT IN DEPTH...?)
|
||
|
||
BEFORE WE CAN GET TO THE CORE OF THE MATTER, WE MUST UNDERSTAND MUCH MORE OF
|
||
THE PROCESSING AND ENCODING SYSTEMS USED BY DOS TO STORE INFORMATION ON THE
|
||
DISK. THIS IS FAIRLY HEAVY STUFF, BUT YOUR KRACKING ABILITY DEPENDS MORE THAN
|
||
ANYTHING ELSE ON YOUR KNOWLEDGE OF THIS SUBJECT. TRY YOUR BEST TO WORK THROUGH
|
||
IT NOW, AND THE REST OF THE PROCESS WILL BE MUCH EASIER.
|
||
|
||
WE ALREADY KNOW THAT EACH TRACK CONSISTS OF 16 SECTORS WHICH EACH REPRESENT
|
||
ONE PAGE (256 BYTES) OF DATA. A SECTOR ACTUALLY CONSISTS OF TWO SEPARATE PARTS,
|
||
AN ADDRESS FIELD, WHICH TELLS DOS WHICH SECTOR IT IS, AND A DATA FIELD, WHERE
|
||
THE ACTUAL BYTES ARE STORED. TO BEGIN A TRIP AROUND THE DISK, LET'S LOOK FIRST
|
||
AT THE BYTE SEQUENCE TAKEN FROM A NORMAL, UNMODIFIED DOS DISK AT TRACK0, SECTOR
|
||
0 (AS WE MENTIONED EARLIER, THE TERMS 'BYTE' AND 'NIBBLE' ARE OFTEN USED
|
||
INTERCHANGEABLY TO REFER TO THE DATA READ OFF THE DISK. THE USE OF 'NIBBLE' IS
|
||
NOT REALLY ACCURATE IN REFERENCE TO DOS 3.3, BUT PERSISTS FOR HISTORICAL
|
||
REASONS).
|
||
|
||
|
||
|
||
----FF FF FF FF D5 AA 96 FF FE AA AA ->
|
||
/ \ / \ / \ /
|
||
________(1)__/ \_(2)/ (3) (4)
|
||
|
||
|
||
->AA AA FF FE DE AA EB FF FF FF FF ----
|
||
\ / \ / \ / \
|
||
(5) (6) (7) \_____(8)______
|
||
|
||
|
||
THE FIRST FEW FF'S (1) ARE KNOWN AS GAPBYTES, BUT THEY'RE CORRECTLY TERMED
|
||
SYNCBYTES, AND WE'LL TREAT THEM AS SIMPLE SEPARATORS FOR NOW. NEXT ARE THE
|
||
THREE MOST IMPORTANT BYTES ON THE DISK, D5 AA 96 (2). THIS SEQUENCE MAY NOT
|
||
OCCUR ANYWHERE ELSE ON THE DISK EXCEPT THE ADDRESS FIELD, AND SERVES AS A UNIQUE
|
||
IDENTIFICATION MARKER. THESE BYTES ARE KNOWN BY ALL SORTS OF COLLOQUIALISMS,
|
||
INCLUDING "ADDRESS MARKER", "HEADER BYTES", "LEADER BYTES", "PROLOG", AND
|
||
OTHERS. THEY WILL ALWAYS, REPEAT ALWAYS, OCCUR ON AT LEAST SECTOR 0 OF TRACK 0
|
||
OF EVERY APPLE DISK WHICH LOADS UNDER DOS 3.3 (THE FIRST LAW DEMANDS IT).
|
||
|
||
THE NEXT FOUR SEQUENCES ENCODE THE VOLUME NUMBER (3), TRACK NUMBER (4), SECTOR
|
||
NUMBER (5), AND CHECKSUM (6). EACH NUMBER IS A SINGLE BYTE, WRITTEN IN AN
|
||
OLD-STYLE ENCODING SCHEME CALLED 4+4 NIBBLIZING. THIS IS A FORMAT FOR STORING
|
||
DATA ON THE DISK IN WHICH THE EVEN BITS OF A BYTE ARE STORED IN ONE 8-BIT
|
||
SEQUENCE (REPRESENTING ONE-HALF OF THE ORIGINAL BYTE OR ONE NIBBLE), AND THE ODD
|
||
BITS ARE STORED IN THE SECOND "BYTE" (THE REQUIREMENT FOR THIS SORT OF
|
||
"BYTE-SPLITTING" OR NIBBLIZING WAS ESTABLISHED LARGELY BY THE LIMITATIONS
|
||
IMPOSED BY DISK DRIVE HARDWARE. YOU CAN FIND MUCH MORE INFORMATION IN B. A.
|
||
D., PP. 3-12 TO 3-21, BUT AN OVERSIMPLIFICATION IS THAT, IN THE OLD DAYS, AT
|
||
LEAST EVERY OTHER BIT READ FROM THE DISK HAD TO BE A LOGICAL "ONE", OR THE
|
||
CIRCUITRY THAT READ THE DISK "FORGOT" WHERE IS WAS AND WHAT IT WAS DOING). IF
|
||
YOU ARE INTERESTED IN MORE DETAIL ON THE MECHANICS OF THE 4+4 SCHEME, REFER TO
|
||
THE VERY FIRST KRACKING KORNER FILE ON CYCLOD AND THE FILE ON WAY OUT. THE
|
||
TABLE BELOW LISTS THE VALUES OF NIBBLES OF INTEREST TO US IN THIS FORMAT:
|
||
|
||
FIRST SECOND BYTE FIRST SECOND BYTE
|
||
NIBBLE NIBBLE VALUE NIBBLE NIBBLE VAL.
|
||
------ ------ ----- ------ ------ ----
|
||
|
||
AA AA 0 AA BA 10
|
||
AA AB 1 AA BB 11
|
||
AB AA 2 AB BA 12
|
||
AB AB 3 AB BB 13
|
||
AA AE 4 AA BE 14
|
||
AA AF 5 AA BF 15
|
||
AB AE 6 AB BE 16
|
||
AB AF 7 AB BF 17
|
||
AE AA 8 AE BA 18
|
||
AE AB 9 AE BB 19
|
||
AF AA A AF BA 1A
|
||
AF AB B AF BB 1B
|
||
AE AE C AE BE 1C
|
||
AE AF D AE BF 1D
|
||
AF AE E AF BE 1E
|
||
AF AF F AF BF 1F
|
||
|
||
BA AA 20
|
||
BA AB 21
|
||
BB AA 22
|
||
|
||
FF FE FE
|
||
(VOL#254)
|
||
|
||
WE CAN NOW DECODE THE FOUR GROUPS OF BYTES AS: VOL# 254 (3), TRACK# 0 (4),
|
||
SECTOR# 0 (5), AND CHECKSUM $FE (6). THE FIRST THREE ARE SELF- EXPLANATORY, AND
|
||
THE LAST IS USED TO DETECT ANY ERRORS WHICH MAY CREEP IN AFTER MANY HOURS OF
|
||
DISK USE. FOLLOWING THESE IS A SEQUENCE OF BYTES (7) USED TO MARK THE END OF
|
||
THE ADDRESS FIELD. A TOTAL OF THREE BYTES (DE AA EB) ARE WRITTEN TO THE DISK,
|
||
BUT ONLY THE FIRST TWO ARE CHECKED WHEN THE FIELD IS READ. THIS PAIR OF BYTES
|
||
IS KNOWN VARIOUSLY AS "CLOSING BYTES", "TRAILERS", OR THE "EPILOG". FINALLY,
|
||
THERE IS ANOTHER SERIES OF GAPBYTES (8) WHICH SEPARATES THE ADDRESS FIELD FROM
|
||
THE FOLLOWING DATA FIELD.8
|
||
|
||
THE DATA FIELD HAS A SIMILAR STRUCTURE:
|
||
|
||
----FF FF FF D5 AA AD ----342 BYTES OF
|
||
/ \ / \
|
||
______(1)_/ \_(2)/ \_____(3)____->
|
||
|
||
|
||
|
||
DATA----(CKSUM) DE AA EB FF FF FF----
|
||
/ \ / \ / \
|
||
<-/ \(4)/ (5) \__(6)__
|
||
|
||
WHERE THE GAPBYTES (1) ARE SAME GROUP THAT ENDED THE ADDRESS FIELD. THE DATA
|
||
MARKER BYTES (2) ARE ALSO CALLED BY ALL THE NAMES MENTIONED FOR THE ADDRESS
|
||
MARKER, AND ARE INTERPRETED BY DOS AS "HERE COMES THE DATA..." THE BIG STRETCH
|
||
OF 342 BYTES (3) IS A VERY COMPLEX WAY OF STORING 256 BYTES ON A DISK, FOLLOWING
|
||
SOME COMPROMISES MADE WITH THE ORIGINAL LAWS OF DISK RECORDING. WITHOUT GOING
|
||
INTO EXACTLY WHY, EACH "BYTE" CAN REPRESENT ONLY 6 BITS OF AN ORIGINAL BYTE,
|
||
WHICH MEANS THAT EACH BYTE HAS TWO BITS LEFT OVER. PACKING THESE TOGETHER AT 6
|
||
BITS EACH REQUIRES ANOTHER 256/3 OR 86 DISKBYTES, FOR A TOTAL OF 256+86=342
|
||
"BYTES", WHICH NO LONGER REPRESENT A NIBBLE OR HALF A BYTE, BUT 3/4 OF A BYTE
|
||
(MAKE UP YOUR OWN NAME FOR IT, THERE'S NO REAL AGREEMENT WHAT IT SHOULD BE
|
||
CALLED).
|
||
|
||
FOLLOWING THE DATA IS A SINGLE CHECKSUM BYTE (4), WHICH WILL GIVE ZERO WHEN
|
||
EXCLUSIVE-ORED WITH ALL THE OTHER BYTES FROM THE DATA, AND THEN THE SAME ACTIVE
|
||
CLOSING BYTES THAT WERE USED IN THE ADDRESS FIELD (5). FINALLY, MORE GAPBYTES
|
||
(6) PAD THE SPACE BETWEEN THIS DATA FIELD AND THE ADDRESS FIELD WHICH COMES
|
||
NEXT.
|
||
|
||
THIS SEQUENCE IS REPEATED 15 MORE TIMES TO MAKE A COMPLETE TRACK, AND THERE IS
|
||
USUALLY A LARGE "GAP" OF UP TO 128 FF'S SEPARATING THE LAST AND THE FIRST
|
||
SECTORS ON THE TRACK. ONE FINAL ITEM OF INTEREST IS THAT THE SECTORS DO NOT
|
||
NORMALLY FOLLOW EACH OTHER IN NUMERICAL SEQUENCE OF 0,1,2...ETC. THE ACTUAL
|
||
SEQUENCE (CALLED "SKEWING" OR INTERLEAVING) IS CHOSEN FOR SPEED OF READING AND
|
||
WRITING, AND CAN VARY ON SOME DOS'S WHICH ARE OTHERWISE STRICTLY IDENTICAL IN
|
||
FORMAT TO DOS 3.3.
|
||
|
||
THIS WOULD BE A GOOD POINT, IF YOU'RE NOT ALREADY VERY COMFORTABLE WITH THE
|
||
SEQUENCES DESCRIBED ABOVE, TO GET OUT A UTILITY WHICH WILL PERFORM A "NIBBLE
|
||
READ" OF A DISK TRACK (INSPECTOR, NIBBLES AWAY, LOCKSMITH, ETC.), AND READ IN A
|
||
STANDARD DOS TRACK. SCAN THROUGH THE BYTES UNTIL YOU COME TO THE MAGICAL D5 AA
|
||
96 SEQUENCE, THEN COMPARE ALL THE BYTES WHICH FOLLOW IT TO THE DESCRIPTION GIVEN
|
||
ABOVE. TRY A FEW TRACKS AND DECODE THE START OF SEVERAL SECTORS UNTIL YOU
|
||
BECOME FAMILIAR WITH THE APPEARANCE OF THEM. YOU'LL SAVE YOURSELF A LOT OF TIME
|
||
AND EFFORT BY BECOMING FAMILIAR WITH THE APPEARANCE OF NORMAL DOS SECTORS AND
|
||
TRACKS.
|
||
|
||
KNOWING THAT ALL THESE THINGS ARE REQUIRED TO MAKE A DISK COMPATIBLE WITH DOS
|
||
3.3 (AND MAKE IT COPY WITH COPYA), YOU CAN EASILY SEE HOW TO MAKE A PROTECTED OR
|
||
MODIFIED DOS: SIMPLY CHANGE ALMOST ANY ONE OF THE IMPORTANT BYTES IN EITHER OR
|
||
BOTH FIELDS, AND MAKE THE APPROPRIATE CHANGES TO THE READ AND WRITE ROUTINES IN
|
||
DOS. IN ORDER TO APPRECIATE WHAT THIS MEANS, LET'S SPEND A MINUTE OR TWO ON THE
|
||
STRUCTURE OF DOS.
|
||
|
||
JUST AS WAS GAUL, DOS IS DIVIDED INTO THREE MAIN PARTS. THE FIRST ONE, CALLED
|
||
THE COMMAND INTERPRETER, HAS BEEN DESCRIBED IN CONSIDERABLE DETAIL BY BERT
|
||
KERSTHE DISK UNDER ANYTHING RESEMBLING A NORMAL DOS. AFTER A COMMAND (KEYBOARD
|
||
OR PROGRAM) HAS BEEN PROCESSED BY THE COMMAND INTERPRETER, AND THE RIGHT PART OF
|
||
THE RIGHT FILE HAS BEEN SELECTED BY THE FILE MANAGER, THE RWTS ROUTINES ARE
|
||
CALLED ON TO DO THE CRUCIAL JOB OF EXCHANGING INFORMATION BETWEEN THE APPLE'S
|
||
MEMORY AND THE DISKETTE.
|
||
|
||
SPACE PREVENTS US FROM LISTING ALL THE ROUTINES, BUT THOSE OF PARTICULAR
|
||
INTEREST ARE:
|
||
|
||
|
||
ADDRESS NAME FUNCTION
|
||
------- ---- ---------------------
|
||
B700-B749 -- DO 2ND STAGE BOOT LOAD, RUN HELLO PROG.
|
||
|
||
B793-B7B4 RWPAGES READ OR WRITE A GROUP OF PAGES
|
||
|
||
B7B5-B7C1 CALLRWTS DISABLE INTERRUPT AND CALL RWTS
|
||
|
||
B7E8-B7F8 IOBLOCK RWTS PARMLIST-SEE B. A. D.
|
||
|
||
B800-B829 PRENIB CONVERT BYTES TO NIB- BLES FOR WRITING
|
||
|
||
B82A-B8C1 WRITE WRITE SECTOR TO DISK
|
||
|
||
B8C2-B8DB POSTNIB CONVERT NIBBLES TO BYTES AFTER READING
|
||
|
||
B8DC-B943 READ READ SECTOR FROM DISK
|
||
|
||
B944-B99F RDADR READ AN ADDRESS FIELD
|
||
|
||
B9A0-BA28 SEEKABS POSITION READ HEAD TO THE DESIRED TRACK
|
||
|
||
BA29-BA68 NIBL WRITE TRANSLATE TABLE
|
||
|
||
BA69-BA95 (EMPTY) =>WATCH THIS SPACE<=
|
||
|
||
BA96-BAFF -- READ TRANSLATE TABLE
|
||
|
||
BB00-BBFF NBUF1 BUFFER (PRIM) USED TO STASH THE NIBBLES
|
||
|
||
BC00-BC55 NBUF2 SEC. BUFFER FOR NIBLS
|
||
|
||
BC56-BCC3 WRADR WRITE ADDRESS FIELD (ONLY DURING INIT)
|
||
|
||
BCDF-BCFF (EMPTY) =>BE SUSPICIOUS<=
|
||
|
||
BD00-BDEC RWTS MAIN READ/WRITE ORGN
|
||
|
||
BDED-BE03 RDRIGHT GOOD READ, CK TRACK #
|
||
|
||
BE10-BE25 RTTRK RIGHT TRK, CK VOL#
|
||
|
||
BE26-BE45 CRCTVOL RIGHT VOL#, CK SECT#
|
||
|
||
BEAF-BFB7 DSKFORM INITIALLIZE DISK
|
||
|
||
BFD8-BFC7 SECMAP SECTOR INTERLEAVE MAP
|
||
|
||
BFC8-BFFF PATCHES CORRECTIONS FOR SMALL DOS BUGS =>BEWARE<=
|
||
=======================================
|
||
|
||
AS BEFORE, YOU ARE STRONGLY URGED TO GET AS FAMILIAR AS YOU CAN WITH THESE
|
||
ROUTINES, USING DOSSOURCE AND B. A. D. AS YOUR PRIMARY REFERENCES.
|
||
|
||
RETURNING TO THE SUBJECT OF DETECTING AND CIRCUMVENTING MODIFIED DOS'S, YOU HAVE
|
||
A CHOICE. YOU CAN EITHER LOOK FOR CHANGES BY INSPECTING A TRACK, OR YOU CAN
|
||
SEARCH THROUGH THE ABOVE RWTS ROUTINES FOR SOMETHING THAT ISN'T NORMAL. NEITHER
|
||
APPROACH WILL WORK 100% OF THE TIME, SO IT'S BEST TO BECOME PROFICIENT AT BOTH.
|
||
THE TABLE BELOW LISTS MOST OF THE CRUCIAL LOCATIONS IN RWTS THAT ARE COMMONLY
|
||
CHANGED FOR THE PURPOSE OF PROTECTION.
|
||
|
||
NORMAL
|
||
ADDRESS VALUE USE
|
||
------- ------ ------------------------
|
||
B853 D5 DATA ADDR MARKER 1-WRITE
|
||
B858 AA DATA ADDR MARKER 2-WRITE
|
||
B85D AD DATA ADDR MARKER 3-WRITE
|
||
B89E DE EPILOG BYTE 1
|
||
B8A3 AA EPILOG BYTE 2
|
||
B8A8 EB EPILOG BYTE 3-NOT READ
|
||
B8AC FF EPILOG BYTE 4-NOT READ
|
||
B8E7 D5 DATA ADDR MARKER 1-READ
|
||
B8F1 AA " " " 2 "
|
||
B8FC AD " " " 3 "
|
||
B92A-C D9 00 BA LOCATION FOR CHECKSUM
|
||
COMPARE
|
||
|
||
B935 DE EPILOG BYTE 1-READ
|
||
B93F AA EPILOG BYTE 2-READ
|
||
|
||
B942 38 SET CARRY FOR I/O ERROR
|
||
|
||
B955 D5 ADDR DATA MARKER 1-READ
|
||
B95F AA " " " 2 "
|
||
B96A 96 " " " 3 "
|
||
|
||
B991 DE ADDR EPILOG BYTE 1
|
||
B99B AA ADDR EPILOG BYTE 2
|
||
|
||
BA29-68 * WRITE TRANSLATE TABLE
|
||
|
||
BA96-FF * READ TRANSLATE TABLE
|
||
|
||
BC5F FF SYNC BYTE VALUE
|
||
|
||
BC7A D5 ADDR MARKER WRITE-1
|
||
BC7F AA ADDR MARKER WRITE-2
|
||
BC84 96 ADDR MARKER WRITE-3
|
||
|
||
BCAE DE ADDR EPILOG BYTE 1-WRITE
|
||
BCB3 AA " " " 2 "
|
||
BCB8 EB " " " 3 "
|
||
|
||
BFB8-C7 * SECTOR INTERLEAVING
|
||
TABLE
|
||
|
||
* SEE DOSSOURCE LISTING FOR CORRECT CONTENTS.
|
||
|
||
ANY OF THE LOCATIONS ABOVE CAN BE MODIFIED, EITHER PERMANENTLY (WHICH CHANGES IN
|
||
THE DOS IMAGE ON TRACKS 0-2), OR TEMPORARILY. THE TEMPORARY DOS CHANGES ARE
|
||
MUCH TOUGHER TO FIND THAN THE PERMANENT ONES, SINCE THE CHANGES MAY BE ERASED
|
||
AFTER THEY HAVE BEEN USED. A GOOD EXAMPLE OF THIS WAS 'MASK OF THE SUN' AND
|
||
'THE SERPENT'S STAR', WHERE THE MAIN DISK IS PROTECTED (AMONG OTHER TECHNIQUES)
|
||
BY USING FF'S FOR ALL THE EPILOG BYTES, BUT THE SAVE GAME IS WRITTEN OUT AND
|
||
READ IN USING THE NORMAL DE AA'S. A PAIR OF SUBROUTINES WAS CALLED TO SWAP THE
|
||
BYTES IN AND OUT AS REQUIRED. MUCH MORE DEVIOUS WAS THE PROTECTION SCHEME USED
|
||
BY TSR ON 'COMPUTER DUNGEON' AND 'THESEUS AND THE MINOTAUR', WHERE EPILOG BYTES
|
||
WERE COMPUTED ACCORDING TO WHICH TRACK WAS BEING READ.
|
||
|
||
THERE ARE MANY OTHER EXAMPLES OF DOS MODIFICATIONS USED TO KEEP US AT BAY,
|
||
INCLUDING SOME SECONDARY PROTECTION TECHNIQUES, BUT WE'LL LOOK AT THOSE AFTER WE
|
||
DESCRIBE THE BASIC APPROACHES TO UNPROTECTING THESE DISKS IN PART 5 OF THE
|
||
BASICS OF KRACKING. IN THE MEANTIME, STUDY THE FORMAT, BECOME FAMILIAR WITH THE
|
||
STANDARD TRICKS, AND REMEMBER:
|
||
|
||
|
||
"THE NIGHT SHALL BE FILLED WITH MUSIC,
|
||
AND CARES THAT INFEST THE DAY,
|
||
SHALL FOLD THEIR TENTS LIKE THE ARABS,
|
||
AND AS SILENTLY, STEAL AWAY."
|
||
|
||
|
||
-HENRY WADSWORTH LONGFELLOW
|
||
|
||
---------------------------------------
|
||
***************************************
|
||
* *
|
||
* *
|
||
* KRAKOWICZ'S KRACKING KORNER *
|
||
* *
|
||
* *
|
||
* THE BASICS OF KRACKING 5 *
|
||
* *
|
||
* UNPROTECTION OF MODIFIED DOS DISKS *
|
||
* *
|
||
* *
|
||
***************************************
|
||
|
||
|
||
IN EPISODE 4 OF THIS SERIES, WE BEGAN A DISCUSSION OF PROTECTION SCHEMES WHICH
|
||
ARE BASED ON MODIFICATION OF A STANDARD APPLE DOS. AS WE MENTIONED, THERE ARE
|
||
MANY CHANGES WHICH CAN BE MADE, AND LITERALLY THOUSANDS OF COMBINATIONS OF WHICH
|
||
CAN BE USED TO THWART THE STANDARD COPY PROGRAMS. HOWEVER, RATHER THAN DWELLING
|
||
ON ALL THE POSSIBLE TECHNIQUES, LET'S CONCENTRATE ON THE "SHOTGUN" APPROACH
|
||
WHICH WORKS TO THE VAST MAJORITY.
|
||
|
||
REGARDLESS OF THE MODIFICATION TECHNIQUE USED, MOST OF THESE DISKS CAN BE
|
||
RENDERED COPYABLE WITH SOME UTILITY PROGRAMS (BOTH OLD AND NEW).
|
||
|
||
IN GENERAL, IT IS POSSIBLE TO IDENTIFY DISKS WITH A MODIFIED DOS BY THE
|
||
APPEARANCE OF A BASIC PROMPT AT THE BOTTOM OF THE SCREEN DURING THE BOOT. SOME
|
||
PROTECTORS HAVE BEGUN TO BYPASS THE ROUTINE WHICH OUTPUTS THE PROMPT, BUT YOU
|
||
CAN STILL GUESS THAT THERE'S A MODIFIED DOS PRESENT IF THE BOOT SOUNDS LIKE A
|
||
NORMAL DOS BOOT, BUT THE DISK WON'T COPY WITH COPYA (COMPARING THE SOUNDS MADE
|
||
BY THE BOOT UNDER DIFFERENT PROTECTION SCHEMES CAN BE VERY VALUABLE AFTER YOU
|
||
HAVE A FAIR AMOUNT OF EXPERIENCE WITH A GIVEN PUBLISHER AND HIS PROTECTION
|
||
SCHEME. IT CAN ALSO BE MISLEADING; I KNOW A LOT OF PEOPLE WHO SWORE THE LONG
|
||
HEAD MOVE DURING THE BOOT OF THE SSI RDOS DISKS WAS A NIBBLE COUNT, WHILE IT
|
||
TURNED OUT TO BE NOTHING MORE THAN LOADING IN A SHORT PROGRAM CALLED "QWERTY"
|
||
FROM TRACK 18-22).
|
||
|
||
THE CLASSIC PROGRAM FOR DEALING WITH MODIFIED DOS'S IS CALLED DEMUFFIN PLUS
|
||
(WILL THE REAL AUTHOR PLEASE STEP FORWARD SOMEDAY TO ACCEPT THE THANKS OF THE
|
||
ENTIRE WORLD OF SOFTWARE UNPROTECTORS?), AND IT WORKS IN MUCH THE SAME WAY AS
|
||
APPLE'S MUFFIN PROGRAM. MUFFIN WAS WRITTEN TO READ FILES FROM A DOS 3.2 DISK
|
||
AND THEN WRITE THEM OUT IN 3.3 FORMAT. DEMUFFIN (AND A SIMILAR PRODUCT CALLED
|
||
"NIFFUM") WERE WRITTEN TO CONVERT DOS 3.3 PROGRAMS TO 3.2 FOR THE REAL DIEHARDS.
|
||
DEMUFFIN PLUS OPERATES ON THE SAME PRINCIPLE, BUT USES WHATEVER DOS IS IN MEMORY
|
||
TO READ, THEN WRITES OUT TO AN INITIALLIZED DISK UNDER 3.3 FORMAT. WHILE THIS
|
||
IS A POWERFUL UTILITY, YOU MUST KEEP IN MIND THAT IT IS STRICTLY BASED ON DOS,
|
||
AND WILL ONLY TRANSFER PROGRAMS WHICH CAN BE LOCATED FROM A CATALOG AS NORMAL
|
||
TEXT, BINARY, INTEGER OR APPLESOFT FILES.
|
||
|
||
IT IS SAFE TO SAY THAT MORE SOFTWARE HAS BEEN UNPROTECTED WITH THIS UTILITY
|
||
THAN WITH ANY OTHER, AND PROBABLY MORE THAN WITH ALL OTHERS COMBINED. IT STILL
|
||
FINDS FREQUENT APPLICATION TODAY, SO WE'LL TAKE A LITTLE TIME HERE TO DESCRIBE
|
||
SEVERAL WAYS OF USING IT.
|
||
|
||
IN MOST CASES, THE CLASSICAL TECHNIQUE WHICH FOLLOWS FOR USING DEMUFFIN PLUS
|
||
TO KRACK A MODIFIED DOS DISK IS RESTRICTED TO THOSE WITH AN APPLE II (NOT A II+)
|
||
OR A ROMCARD OR OTHER MODIFED F8 ROM WHICH ALLOWS YOU TO RESET INTO THE MONITOR
|
||
(SEE THE BASICS OF KRACKING 1):
|
||
|
||
1. INITIALLIZE A DISK UNDER DOS 3.3, THEN DELETE THE HELLO PROGRAM (JUST TO
|
||
BE SAFE).
|
||
|
||
2. BLOAD DEMUFFIN PLUS, A$6000.
|
||
|
||
3. BOOT THE PROTECTED DISK, AND AS SOON AS A PROMPT APPEARS, HIT RESET
|
||
(GENERALLY ABOUT 3-4 SECONDS AFTER THE HEAD CLACKETY-CLACK).
|
||
|
||
4. FROM THE MONITOR, MOVE DEMUFFIN PLUS TO ITS NORMAL LOCATION WITH
|
||
803<6000.78FFM.
|
||
|
||
5. TYPE 803G AND FOLLOW THE FAMILIAR FIDDISH INSTRUCTIONS FOR SLOT AND DRIVE
|
||
USAGE.
|
||
|
||
6. IF YOU WANT THE DISK TO AUTORUN FROM THE BOOT, DETERMINE THE NAME OF THE
|
||
HELLO PROGRAM AND ENTER IT INTO TRACK 1, SECTOR 9, BYTES 75-92 WITH THE
|
||
INSPECTOR (OTHERWISE THE DISK WILL ALWAYS LOOK FOR AN ACTUAL PROGRAM NAMED
|
||
'HELLO'). IF THE HELLO PROGRAM HAPPENS TO BE A BINARY FILE, CHANGE BYTE 42 IN
|
||
TRACK 0, SECTOR D TO $34, OR USE $14 TO EXEC A TEXT FILE FOR THE START.
|
||
|
||
IN ADDITION TO HIDING THE PROMPT, A NUMBER OF PUBLISHERS HAVE ADDED ROUTINES
|
||
WHICH CLEAR OUT MEMORY DURING THE BOOT, OR LOOK FOR SPECIFIC DATA LOADED IN
|
||
PREVIOUSLY (THE PLATO SERIES IS A GOOD EXAMPLE OF THIS--WITHOUT EXTENSIVE AND
|
||
CAREFUL BOOT TRACING, IT IS VERY DIFFICULT TO GET THE DOS IN MEMORY INTACT).
|
||
THE FOLLOWING APPROACH ELIMINATES THE NEED TO RESET INTO THE MONITOR, AND ALSO
|
||
GETS AROUND MANY OF THE ROUTINES BEING ADDED TO THWART THOSE WHO WOULD RESET.
|
||
BECAUSE THERE IS NO NEED TO RESET DURING THE BOOT, THIS APPROACH CAN BE USED ON
|
||
ANY FLAVOR OF APPLE ][ (YES, NIBBLESPOCK, EVEN ON A IIE). BASICALLY, THE
|
||
DIFFERENCE LIES IN USING THE COMMAND INTERPRETER AND FILE MANAGER PORTIONS OF A
|
||
STANDARD DOS, AND ADDING TO IT THE MODIFIED RWTS FROM THE PROTECTED DISK:
|
||
|
||
1. INITIALLIZE A DISK AS BEFORE.
|
||
|
||
2. BOOT UP A STANDARD DOS DISK, AND BLOAD DEMUFFIN PLUS,A$4000 (JUST TO BE
|
||
SAFE).
|
||
|
||
3. UNLESS YOU HAVE INSPECTOR IN ROM, BLOAD INSPECTOR,A$8800.
|
||
|
||
4. USING THE INSPECTOR, READ TRACK 0, SECTOR 1 THROUGH TRACK 0, SECTOR 9 INTO
|
||
$7700 TO $7FFF. USE CONTROL-I AFTER THE FIRST 'R' COMMAND TO SPEED THE LOAD
|
||
(SEE THE SECTION BELOW ON CHANGING LOCATION $B942 IF YOU CAN'T READ THE SECTORS
|
||
WITH THE INSPECTOR).
|
||
|
||
5. GET INTO THE MONITOR, THEN MOVE THE RWTS THAT YOU JUST READ IN ON TOP OF
|
||
THE RESIDENT RWTS WITH B700<7700.7FFFM.
|
||
|
||
6. MOVE DEMUFFIN AS BEFORE WITH 803<4000.58FFM.
|
||
|
||
7. TYPE 803G AND PROCEED WITH THE FILE TRANSFER.
|
||
|
||
THERE ARE A FEW CASES WHERE JUST A LITTLE MORE INTELLIGENCE IS USED TO MODIFY
|
||
DOS AFTER THE PROGRAM BEGINS TO RUN (USUALLY THE MODIFICATION OF PROLOG/EPILOG
|
||
BYTES, BUT SOMETIMES A LITTLE BIT MORE), AND IN THIS CASE YOU HAVE TO BOOT THE
|
||
DISK AND LET IT RUN A SECOND OR TWO BEFORE RESETTING. THE INSPECTOR IN ROM IS A
|
||
BIG HELP IN A CASE LIKE THIS: YOU CAN RESET AND SCAN THE ENTIRE DISK WITH THE
|
||
'SHIFT +' KEYS TO SEE IF ALL THE SECTORS CAN BE READ WITH THE DOS CURRENTLY IN
|
||
THE SYSTEM. IF THEY CAN BE, CHANCES ARE GOOD THAT YOU WILL BE SUCCESSFUL WITH
|
||
THE CONVERSION. AFTER RESETTING, SAVE THE ENTIRE DOS WITH D00<9D00.BFFFM, THEN
|
||
BOOT UP YOUR STANDARD DISK AND BLOAD DEMUFFIN PLUS. PUT THE MODIFIED DOS BACK
|
||
WITH 9D00<D00.2FFFM, AND PROCEED WITH STEPS 6 AND 7 ABOVE.
|
||
|
||
ASSUMING THAT THE ORIGINAL COPY WAS GOOD, AND THAT NO SECONDARY PROTECTION WAS
|
||
USED, YOU SHOULD NOW HAVE A COPYA VERSION OF THE PROGRAM. IN MANY CASES, IT'S
|
||
POSSIBLE TO DO THE JOB WITH EVEN LESS HASSLE THAN THIS, SO LET'S LOOK AT WHAT IS
|
||
(MAYBE) AN EVEN EASIER WAY.
|
||
|
||
MANY OF THE RWTS MODIFICATIONS ARE FAIRLY TRIVIAL, AND THE MOST COMMON CONSIST
|
||
ONLY OF CHANGING THE PROLOG OR EPILOG BYTES FOR THE ADDRESS OR DATA FIELD. YOU
|
||
CAN OFTEN PRODUCE AN UNPROTECTED VERSION OF THESE DISKS BY MAKING A FEW-BYTE
|
||
CHANGE TO THE RWTS IN MEMORY, AND THEN RUNNING COPYA. THE FOLLOWING DISASSEMBLY
|
||
CONTAINS THE ROUTINES WHICH READ IN THE ADDRESS AND DATA FIELDS, AND WHICH NEED
|
||
TO BE MODIFIED TO CIRCUMVENT A LARGE NUMBER OF RWTS CHANGE SCHEMES:
|
||
|
||
B8DC- A0 20 LDY #$20
|
||
B8DE- 88 DEY
|
||
B8DF- F0 61 BEQ $B942
|
||
B8E1- BD 8C C0 LDA $C08C,X
|
||
B8E4- 10 FB BPL $B8E1
|
||
B8E6- 49 D5 EOR #$D5
|
||
B8E8- D0 F4 BNE $B8DE
|
||
B8EA- EA NOP
|
||
B8EB- BD 8C C0 LDA $C08C,X
|
||
B8EE- 10 FB BPL $B8EB
|
||
B8F0- C9 AA CMP #$AA
|
||
B8F2- D0 F2 BNE $B8E6
|
||
B8F4- A0 56 LDY #$56
|
||
B8F6- BD 8C C0 LDA $C08C,X
|
||
B8F9- 10 FB BPL $B8F6
|
||
B8FB- C9 AD CMP #$AD
|
||
B8FD- D0 E7 BNE $B8E6
|
||
|
||
B8FF- A9 00 LDA #$00
|
||
B901- 88 DEY
|
||
B902- 84 26 STY $26
|
||
B904- BC 8C C0 LDY $C08C,X
|
||
B907- 10 FB BPL $B904
|
||
B909- 59 00 BA EOR $BA00,Y
|
||
B90C- A4 26 LDY $26
|
||
B90E- 99 00 BC STA $BC00,Y
|
||
B911- D0 EE BNE $B901
|
||
B913- 84 26 STY $26
|
||
B915- BC 8C C0 LDY $C08C,X
|
||
B918- 10 FB BPL $B915
|
||
B91A- 59 00 BA EOR $BA00,Y
|
||
B91D- A4 26 LDY $26
|
||
B91F- 99 00 BB STA $BB00,Y
|
||
B922- C8 INY
|
||
B923- D0 EE BNE $B913
|
||
|
||
B925- BC 8C C0 LDY $C08C,X
|
||
1928- 10 FB BPL $B925
|
||
B92A- D9 00 BA CMP $BA00,Y
|
||
B92D- D0 13 BNE $B942
|
||
B92F- BD 8C C0 LDA $C08C,X
|
||
B932- 10 FB BPL $B92F
|
||
B934- C9 DE CMP #$DE
|
||
B936- D0 0A BNE $B942
|
||
B938- EA NOP
|
||
B939- BD 8C C0 LDA $C08C,X
|
||
B93C- 10 FB BPL $B939
|
||
B93E- C9 AA CMP #$AA
|
||
B940- F0 5C BEQ $B99E
|
||
B942- 38 SEC
|
||
B943- 60 RTS
|
||
B944- A0 FC LDY #$FC
|
||
B946- 84 26 STY $26
|
||
B948- C8 INY
|
||
B949- D0 04 BNE $B94F
|
||
B94B- E6 26 INC $26
|
||
B94D- F0 F3 BEQ $B942
|
||
|
||
B94F- BD 8C C0 LDA $C08C,X
|
||
B952- 10 FB BPL $B94F
|
||
B954- C9 D5 CMP #$D5
|
||
B956- D0 F0 BNE $B948
|
||
B959- BD 8C C0 LDA $C08C,X
|
||
B95C- 10 FB BPL $B959
|
||
B95E- C9 AA CMP #$AA
|
||
B960- D0 F2 BNE $B954
|
||
B962- A0 03 LDY #$037
|
||
B964- BD 8C C0 LDA $C08C,X
|
||
B967- 10 FB BPL $B964
|
||
B969- C9 96 CMP #$96
|
||
B96B- D0 E7 BNE $B954
|
||
|
||
B96D- A9 00 LDA #$00
|
||
B96F- 85 27 STA $27
|
||
B971- BD 8C C0 LDA $C08C,X
|
||
B974- 10 FB BPL $B971
|
||
B976- 2A ROL
|
||
B977- 85 26 STA $26
|
||
B979- BD 8C C0 LDA $C08C,X
|
||
B97C- 10 FB BPL $B979
|
||
B97E- 25 26 AND $26
|
||
B980- 99 2C 00 STA $002C,Y
|
||
B983- 45 27 EOR $27
|
||
B985- 88 DEY
|
||
B986- 10 E7 BPL $B96F
|
||
B988- A8 TAY
|
||
B989- D0 B7 BNE $B942
|
||
|
||
B98B- BD 8C C0 LDA $C08C,X
|
||
B98E- 10 FB BPL $B98B
|
||
B990- C9 DE CMP #$DE
|
||
B992- D0 AE BNE $B942
|
||
B994- EA NOP
|
||
B995- BD 8C C0 LDA $C08C,X
|
||
B998- 10 FB BPL $B995
|
||
B99A- C9 AA CMP #$AA
|
||
B99C- D0 A4 BNE $B942
|
||
B99E- 18 CLC
|
||
B99F- 60 RTS
|
||
|
||
|
||
BEFORE WE GET INTO ALTERATIONS OF THIS CODE, LET'S GET FAMILIAR WITH THE
|
||
TERRAIN. THERE ARE TWO SUBROUTINES: 'READ', WHICH READS IN A SECTOR OF DATA
|
||
AND LIVES FROM $B8DC TO $B943; AND 'RDADR', WHICH READS IN THE ADDRESS FIELD FOR
|
||
A SECTOR FROM $B944 TO B99F. NOTE THAT THESE ARE IN THE REVERSE ORDER OF THEIR
|
||
USE IN READING A SECTOR. LET'S LOOK FIRST AT RDADR: AFTER SETTING UP SOME
|
||
PRELIMINARIES AT $B944-$B94E, WE BEGIN TO LOOK ($B94F-$B96C) FOR THE THREE
|
||
FAMOUS BYTES OF D5 AA 96 TO IDENTIFY THE START OF THE FIELD. AFTER THEY ARE
|
||
FOUND, THE VOLUME NUMBER, TRACK NUMBER, AND SECTOR NUMBER ARE STORED IN
|
||
LOCATIONS $2F, $2E, AND $2D, RESPECTIVELY, AND THE CHECKSUM FOR THE ADDRESS
|
||
FIELD IS VERIFIED ($B96D-$B98A). FINALLY, THE TWO EPILOG BYTES OF DE AND AA ARE
|
||
SOUGHT AT THE END OF THE FIELD ($B98B- $B99F).
|
||
|
||
AFTER AN ADDRESS FIELD IS SUCCESSFULLY READ, 'READ' IS EXECUTED TO READ IN THE
|
||
DATA FIELD. THE CODE FROM $B8DC TO $B8FE FINDS THE HEADER BYTES OF D5 AA AD,
|
||
AND THE DATA SECTOR IS READ INTO A PAIR OF BUFFERS WITH THE CODE AT $B8FF-B924
|
||
(THE "NIBBLIZING" PROCESS STORED THE 256 BYTES FROM A PAGE OF MEMORY AS A TOTAL
|
||
OF 342 "NIBBLES" IN THE SECTOR, BUT LET'S NOT GET TOO WORRIED ABOUT THAT YET).
|
||
FINALLY, THE CHECKSUM (ONE BYTE) IS CHECKED, AND THE EPILOG BYTES ARE ONCE AGAIN
|
||
VERIFIED ($B925-$B941). NOTICE THE INNOCENT-APPEARING "SEC RTS" AT B942-B943.
|
||
THIS IS THE HEART OF THE ERROR-DETECTION PROCESS, AND MOST FREQUENTLY MODIFIED
|
||
(FOR OUR PURPOSES) PART OF THE ENTIRE ROUTINE.
|
||
|
||
THE ONE BYTE WHICH YOU SHOULD BECOME MOST FAMILIAR WITH IN ORDER TO DO ANY
|
||
KRACKING, SNOOPING, OR DISK REPAIR IS THE $38 AT LOCATION $B942. THE CARRY BIT
|
||
(OF THE PROCESSOR STATUS WORD) IS USED THROUGHOUT THE RWTS ROUTINES TO INDICATE
|
||
A DISK I/O ERROR. WHENEVER ANYTHING GOES WRONG, THE ROUTINES BRANCH TO $B942 TO
|
||
SET THE CARRY AND RETURN. THE OTHER ROUTINES IN RWTS MONITOR THE CARRY BIT, AND
|
||
CHECK IT TO SEE IF THERE WAS A BAD ADDRESS READ, A BAD DATA READ, NO HEADER
|
||
BYTES, WRONG EPILOG BYTES, ETC., ETC.
|
||
|
||
=> THE MOST IMPORTANT CHANGE YOU <=
|
||
=> CAN LEARN TO MAKE IS CHANGING <=
|
||
=> $B942 TO $18 (OR, IF YOU ARE <=
|
||
=> HOPELESSLY BASIC-BOUND, POKE <=
|
||
=> 47426,24). <=
|
||
|
||
THE $18 IS 'CLC' OR 'CLEAR THE CARRY'. BY CHANGING IT, YOU ARE SAYING TO THE
|
||
RWTS ROUTINES: "DON'T EVEN LOOK TO SEE IF THERE WERE ANY ERRORS. ASSUME
|
||
EVERYTHING IS ALL RIGHT AND GO ON". THIS IS OBVIOUSLY NOT A GOOD GENERAL
|
||
PROGRAMMING PRACTICE, SINCE YOU'RE DEFEATING ALL OF THE CAREFUL ERROR- CHECKING
|
||
THAT DOS DOES, BUT IT'S VERY HANDY TO ALLOW COPYING OF A MODIFIED DOS. IT WILL
|
||
GENERALLY HANDLE CHANGES IN THE EPILOG BYTES OR INTENTIONAL ERRORS IN THE
|
||
CHECKSUM OF EITHER FIELD, BUT NOT IN THE HEADER BYTES. HEADER CHANGES (BECAUSE
|
||
THE BYTES ARE INDIVIDUALLY CHECKED FOR) MUST BE DONE BY MODIFYING THE
|
||
APPROPRIATE CODE IN THE SUBROUTINE. IN MANY CASES, THIS IS THE ONLY CHANGE
|
||
WHICH WILL BE REQUIRED TO MAKE A COPYA VERSION OF THE DISK.
|
||
|
||
FOR INSTANCE, LET'S SUPPOSE YOU ARE TRYING TO KRACK A PROGRAM, AND YOU SUSPECT
|
||
THAT THE PROTECTION CONSISTS OF A MODIFIED DOS. READ IN AN ENTIRE TRACK WITH
|
||
THE INSPECTOR OR NIBBLES AWAY II (THERE IS A BUG IN THE SHIFT-N COMMAND IN SOME
|
||
VERSIONS OF THE INSPECTOR--YOU CAN'T DO A NIBBLE READ ON ANOTHER TRACK UNLESS
|
||
YOU FIRST NIBBLE-READ IN TRACK ZERO). EXAMINE AN ADDRESS FIELD AND ITS DATA
|
||
FIELD. IF YOU FIND BOTH 'D5 AA 96' AND 'D5 AA AD', THEN REMOVE THE DISK AND
|
||
BOOT UP COPYA. WHILE THE PROGRAM IS ASKING FOR THE SLOT AND DRIVE INFORMATION,
|
||
PRESS RESET OR TYPE CTRL-C. DELETE LINE 70 (LINE 90 IF YOU ARE USING THE
|
||
INTEGER VERSION CALLED "COPY"), THEN FROM THE MONITOR CHANGE
|
||
|
||
*B942:18
|
||
|
||
RE-ENTER BASIC AND RUN THE PROGRAM. CHANCES ARE VERY GOOD THAT THE RESULT
|
||
WILL BE A COPYA VERSION OF THE DISK. BE AWARE, HOWEVER, THAT YOU CAN PROPAGATE
|
||
OR GENERATE ERRORS IN THIS PROCESS, SINCE ALL OF THE ERROR-CHECKING IN RWTS HAS
|
||
BEEN TURNED OFF. AS ALWAYS, CHECK THE PROGRAM OUT THOROUGHLY AFTER KRACKING.
|
||
|
||
IF YOUR EARLIER SNOOPING REVEALED NON-STANDARD HEADER BYTES, MAKE THE CHANGES
|
||
LISTED BELOW AFTER RUNNING AND INTERRUPTING COPYA:
|
||
|
||
ADDRESS FIELD: $B955 - BYTE #1
|
||
B95F - BYTE #2
|
||
B96A - BYTE #3
|
||
|
||
DATA FIELD: B8E7 - BYTE #1
|
||
B8F1 - BYTE #2
|
||
B8FC - BYTE #3
|
||
|
||
|
||
THEN PROCEED AS DESCRIBED EARLIER.
|
||
|
||
REGARDLESS OF WHETHER YOU MAKE THESE SIMPLE MODS, OR GO THROUGH THE DEMUFFIN
|
||
PLUS PROCESS, BEAR IN MIND THAT SECONDARY PROTECTION SCHEMES CAN DEFEAT THESE
|
||
ATTEMPTS AND REQUIRE YOU TO DO MUCH MORE IN THE WAY OF SNOOPING AND UNDOING.
|
||
WE'LL PICK UP WITH A DISCUSSION OF THOSE TECHNIQUES NEXT TIME, AND PERHAPS BEGIN
|
||
TO EXPLORE SOME NON-STANDARD DISK FORMATS.
|
||
|
||
OUR QUOTATION OF THE WEEK (MONTH?) IS FROM DON LANCASTER, IN THE INTRODUCTION
|
||
TO HIS BOOK "ENHANCING YOUR APPLE II, VOL. 1" (A SEMI-GOOD BUT SERIOUSLY
|
||
"STRETCHED" COMPILATION OF LITTLE HARDWARE TRICKS TO MAKE YOUR APPLE DO NEW
|
||
THINGS):
|
||
|
||
"ANY ATTEMPT AT COPY PROTECTION WILL HACK OFF AND INCONVENIENCE YOUR
|
||
LEGITIMATE USERS, AND IT WILL DRAMATICALLY INCREASE THE NUMBER OF BOOTLEG COPIES
|
||
IN CIRCULATION...
|
||
|
||
"THE BIG THING ABOUT COPY PROTECTION IS THAT IT DOESN'T. A YEAR'S EFFORT BY A
|
||
CRACKERJACK MILITARY CRYPTOGRAPY TEAM CAN USUALLY BE UNDONE IN FIFTEEN MINUTES,
|
||
BETWEEN KLINGON ZAPPINGS, BY YOUR AVERAGE FOURTEEN- YEAR-OLD. AND, MORALITY AND
|
||
ECONOMICS ASIDE, ONE FACT STANDS OUT...
|
||
|
||
UNDOING COPY PROTECTION IS FUN!
|
||
|
||
"NOT ONLY IS IT FUN, BUT CRACKING THE UNCOPYABLE IS ABOUT THE MOST CHALLENGING
|
||
AND REWARDING THING THAT YOU CAN POSSIBLY DO WITH YOUR APPLE. AND, THE THINGS
|
||
YOU LEARN ALONG THE WAY ARE EXACTLY THE SKILLS THAT YOU WILL NEED TO BECOME A
|
||
REALLY GREAT PROGRAMMER. SO, I GUESS WE SHOULD ALL BE THANKFUL FOR THE
|
||
COPY-PROTECTION PEOPLE SINCE THEY ARE ARE GIVING US ALL THIS FASCINATING
|
||
ENTERTAINMENT AND SUPERB TRAINING AT AN UNBEATABLE PRICE."
|
||
|
||
BEAUTIFULLY PUT, DON; AN EXCELLENT RENDITION OF THE "KRACKIST'S MANIFESTO".
|
||
|
||
---------------------------------------
|
||
***************************************
|
||
* *
|
||
* KRAKOWICZ'S KRACKING KORNER *
|
||
* *
|
||
* *
|
||
* THE BASICS OF KRACKING 106 *
|
||
* *
|
||
* MATING ZONE & NIBBLIZING MYSTERIES *
|
||
* *
|
||
* *
|
||
***************************************
|
||
|
||
|
||
CONGRATULATIONS ARE DUE TO TOM LUHRS AND THE PEOPLE AT DATAMOST, FOR PROVIDING
|
||
BOTH AN ENJOYABLE GAME AND AN ENJOYABLE CHALLENGE IN KRACKING THEIR LATEST
|
||
OFFERING: "MATING ZONE". THE GAME IS DEFINITELY ABOVE AVERAGE FOR A
|
||
SHOOT-EM-UP, WITH A NOVEL CONCEPT AND GOOD VARIETY IN THE BEHAVIOUR OF MATED
|
||
PAIRS, EXPLODING EGGS, AND MULTIPLE LEVELS. THE KRACK IS A LITTLE MORE
|
||
DIFFICULT THAN THE MODIFIED DOS'S WE HAVE BEEN DISCUSSING, BUT WE ARE STILL
|
||
DEALING WITH A RELATIVELY STANDARD RWTS.
|
||
|
||
AS SUPPLIED, THE GAME CAN BE COPIED WITH NIBBLES AWAY II (NO PARMS NEEDED) FOR
|
||
TRACKS 0-F AND 10.5 TO 13.5. EXCEPT FOR THE HALF TRACKING, THE ONLY DEVIATION
|
||
FROM NORMAL DOS 3.3 SECTOR STRUCTURE IS AN EPILOG OF 'DF AA' INSTEAD OF THE
|
||
NORMAL 'DE AA', FOR BOTH THE ADDRESS AND DATA FIELDS. THE DISK ACCESS IS
|
||
CONTROLLED BY AN ABBREVIATED RWTS LOADED ACROSS SCREEN MEMORY, WITH A CUTE
|
||
LITTLE SURPRISE AT THE END. I'LL START WITH A SYNOPSIS OF THE KRACKING PROCESS,
|
||
AND EXPLAIN THE JUICY PARTS IN DETAIL LATER. THE DESCRIPTION WILL BE LIMITED TO
|
||
REDUCING THE GAME TO A COPYA DISK; HOWEVER, I STRONGLY SUSPECT THAT THE GAME CAN
|
||
BE STUFFED INTO A SINGLE LONG BFILE (I KNOW, I THOUGHT THAT SIGMA 7 COULD BE,
|
||
TOO, BUT THAT'S ANOTHER STORY FOR A LATER TIME).
|
||
|
||
THE KRACKING SEQUENCE IS TO FIRST RELOCATE THE HALF-TRACKS, THEN ELIMINATE THE
|
||
SECONDARY PROTECTION. AMONG OTHER UTILITIES, NIBBLES AWAY II CAN BE USED FOR
|
||
THE MOVE AS FOLLOWS:
|
||
|
||
1. BOOT NA II AND COPY TRACKS 0-F ONTO AN INITIALIZED DISK (YOU'LL WANT THE
|
||
OTHER TRACKS COPYABLE LATER).
|
||
|
||
2. SELECT THE TRACK/BIT EDITOR (T), THEN READ IN TRACK 10.5. TYPE 'Z' TO
|
||
ALLOW NA II TO ANALYZE THE TRACK FOR WRITE-OUT.
|
||
|
||
3. CHANGE THE TRACK TO 10 EVEN, THEN INSERT THE COPY DISK. TYPE 'W' TO
|
||
WRITE, THEN 'Y' TO CONFIRM. WHAT WAS ON TRACK 10.5 OF THE ORIGINAL IS NOW
|
||
ON TRACK 10 OF YOUR COPY.
|
||
|
||
4. REPEAT STEPS 2 & 3 FOR TRACKS 11.5, 12.5, AND 13.5.
|
||
|
||
5. TELL THE PROGRAM THAT THE TRACKS HAVE BEEN CHANGED BY MODIFYING TRACK
|
||
1,SECTOR F, BYTE 19 FROM $1F TO $1E.
|
||
|
||
6. CORRECT THE EPILOG BYTE CHECK BY CHANGING $DF TO $DE IN BYTES 35 AND AB OF
|
||
T0,S5; AND BYTE 9B OF T0,SD.
|
||
|
||
7. ELIMINATE THE SECONDARY PROTECTION AND THE HIGH SCORE WRITE TO DISK BY
|
||
CHANGING THE FOLLOWING BYTES:
|
||
|
||
|
||
T0 S5 BYTES E8-EA CHANGE TO 4C B5 04
|
||
T4 SC BYTE 38 CHANGE TO 60
|
||
|
||
8. LOAD UP COPYA, DEFEAT THE CHECKSUM BY CHANGING $B942 TO $18, THEN MAKE A
|
||
COPY OF THE DISK.
|
||
|
||
9. BOOT AND ENJOY.
|
||
|
||
|
||
THAT'S THE PROCEDURE, NOW LET'S GO OVER THE THEORY: NORMALLY, RWTS OCCUPIES
|
||
THE MEMORY SPACE FROM $B700 TO $BFFF. IN ORDER TO SQUEEZE IT INTO $400-7FF,
|
||
COMPROMISES MUST BE MADE. FIRST, A MINIUMUM OF ONE COMPLETE TRACK IS READ IN,
|
||
AND THE SECTORS ARE DESTINED FOR SEQUENTIAL PAGES IN MEMORY, BUT WITHOUT THE
|
||
INTERLEAVING USED BY DOS 3.3. TRACKS ARE REFERRRED TO BY THE EQUIVALENT NUMBER
|
||
OF HALF-TRACKS: TRACK 6 IS C, F IS 1E, 10.5 IS 21, ETC. THE TRACK READ ROUTINE
|
||
INCREMENTS THE TRACK NUMBER BY TWO, THEN READS IN THE 16 SECTORS OF THE NEW
|
||
TRACK. EXAMINING THE CODE FROM $4DC-55D SHOWS A NORMAL DATA FIELD READ ROUTINE
|
||
WITH STANDARD POST-NIBBLIZING TO RECONSTRUCT THE ORIGINAL BYTES:
|
||
|
||
|
||
04DC- A0 20 LDY #$20
|
||
04DE- 88 DEY
|
||
04DF- F0 7B BEQ $055C
|
||
04E1- AD EC C0 LDA $C0EC
|
||
04E4- 10 FB BPL $04E1
|
||
04E6- 49 D5 EOR #$D5
|
||
04E8- D0 F4 BNE $04DE
|
||
04EA- EA NOP
|
||
24EB- AD EC C0 LDA $C0EC *
|
||
04EE- 10 FB BPL $04EB
|
||
04F0- C9 AA CMP #$AA
|
||
04F2- D0 F2 BNE $04E6
|
||
04F4- A0 56 LDY #$56
|
||
04F6- AD EC C0 LDA $C0EC *
|
||
04F9- 10 FB BPL $04F6
|
||
04FB- C9 AD CMP #$AD
|
||
04FD- D0 E7 BNE $04E6
|
||
04FF- A9 00 LDA #$00
|
||
0501- 88 DEY
|
||
0502- 84 26 STY $26
|
||
0504- AC EC C0 LDY $C0EC *
|
||
0507- 10 FB BPL $0504
|
||
0509- 59 00 07 EOR $0700,Y
|
||
050C- A4 26 LDY $26
|
||
050E- 99 00 03 STA $0300,Y
|
||
0511- D0 EE BNE $0501
|
||
0513- 84 26 STY $26
|
||
0515- AC EC C0 LDY $C0EC *
|
||
0518- 10 FB BPL $0515
|
||
051A- 59 00 07 EOR $0700,Y
|
||
051D- A4 26 LDY $26
|
||
051F- 99 00 02 STA $0200,Y
|
||
0522- C8 INY
|
||
0523- D0 EE BNE $0513
|
||
0525- AC EC C0 LDY $C0EC *
|
||
0528- 10 FB BPL $0525
|
||
052A- D9 00 07 CMP $0700,Y
|
||
052D- D0 2D BNE $055C
|
||
052F- AD EC C0 LDA $C0EC *
|
||
0532- 10 FB BPL $052F
|
||
0534- C9 DF CMP #$DF
|
||
0536- D0 24 BNE $055C
|
||
0538- EA NOP
|
||
0539- AD EC C0 LDA $C0EC *
|
||
053C- 10 FB BPL $0539
|
||
053E- C9 AA CMP #$AA
|
||
0540- D0 1A BNE $055C
|
||
0542- A0 00 LDY #$00
|
||
0544- A2 56 LDX #$56
|
||
0546- CA DEX
|
||
0547- 30 FB BMI $0544
|
||
0549- B9 00 02 LDA $0200,Y
|
||
054C- 5E 00 03 LSR $0300,X
|
||
054F- 2A ROL
|
||
0550- 5E 00 03 LSR $0300,X
|
||
0553- 2A ROL
|
||
0554- 99 00 3F STA $3F00,Y
|
||
0557- C8 INY
|
||
0558- D0 EC BNE $0546
|
||
055A- 18 CLC
|
||
055B- 60 RTS
|
||
055C- 38 SEC
|
||
055D- 60 RTS
|
||
|
||
(* = THESE INSTRUCTIONS START OUT AS 'C08C', AND HAVE THE SLOT-DEPENDENT VALUE
|
||
OF 'C0EC' POKED IN AT RUN-TIME. ACCORDING TO MR. SLIPPERY, "REAL MEN WRITE
|
||
SELF-MODIFYING CODE!").
|
||
|
||
THIS IS AS IT SHOULD BE FOR ALL NORMAL SECTOR READING. AT LOCATION $5E8,
|
||
HOWEVER, ANOTHER DATA FIELD READ ROUTINE BEGINS. THIS IS VERY SUSPICIOUS,
|
||
INDEED-- WHY SHOULD THEY WASTE SPACE ON A ->SECOND<- DATA FIELD READ ROUTINE,
|
||
ESPECIALLY IN A "SQUEEZED" RWTS LIKE THIS (REMEMBER THE THIRD LAW OF KRACKING:
|
||
ACCEPTANCE OF UNUSUAL CODE IS NO VIRTUE; SUSPICION TO THE POINT OF PARANOIA IS
|
||
NO VICE):
|
||
|
||
|
||
05E5- 20 44 07 JSR $0744
|
||
05E8- 20 B9 04 JSR $04B9
|
||
05EB- A0 20 LDY #$20
|
||
05ED- 88 DEY
|
||
05EE- F0 F8 BEQ $05E8
|
||
05F0- AD EC C0 LDA $C0EC
|
||
05F3- 10 FB BPL $05F0
|
||
05F5- 49 D5 EOR #$D5
|
||
05F7- D0 F4 BNE $05ED
|
||
05F9- EA NOP
|
||
05FA- AD EC C0 LDA $C0EC
|
||
05FD- 10 FB BPL $05FA
|
||
05FF- C9 AA CMP #$AA
|
||
0601- D0 F2 BNE $05F5
|
||
0603- EA NOP
|
||
0604- AD EC C0 LDA $C0EC
|
||
0607- 10 FB BPL $0604
|
||
0609- C9 AD CMP #$AD
|
||
060B- D0 E8 BNE $05F5
|
||
060D- A2 31 LDX #$31
|
||
060F- EA NOP
|
||
0610- 86 26 STX $26
|
||
0612- AC EC C0 LDY $C0EC
|
||
0615- 10 FB BPL $0612
|
||
0617- B9 00 07 LDA $0700,Y
|
||
061A- 9D 00 02 STA $0200,X
|
||
061D- EA NOP
|
||
061E- EA NOP
|
||
061F- EA NOP
|
||
0620- CA DEX
|
||
0621- 10 EF BPL $0612
|
||
0623- AD EC C0 LDA $C0EC
|
||
0626- 10 FB BPL $0623
|
||
0628- C9 DF CMP #$DF
|
||
062A- D0 BC BNE $05E8
|
||
062C- AD EC C0 LDA $C0EC
|
||
062F- 10 FB BPL $062C
|
||
0631- 49 AA EOR #$AA
|
||
0633- D0 B3 BNE $05E8
|
||
0635- A2 31 LDX #$31
|
||
0637- 5D 00 02 EOR $0200,X
|
||
063A- CA DEX
|
||
063B- 10 FA BPL $0637
|
||
063D- 0A ASL
|
||
063E- D0 A8 BNE $05E8
|
||
0640- 4C B5 04 JMP $04B5
|
||
|
||
|
||
ONCE AGAIN, THE CANONICAL PROLOG BYTES OF 'D5 AA AD' ARE LOCATED, AND THEN,
|
||
STANGELY, ONLY $31 (49 DECIMAL) NIBBLES INSTEAD OF THE NORMAL $156 (342 DECIMAL)
|
||
ARE READ IN BEFORE SEARCHING FOR THE EPILOG OF 'DF AA'. THE BYTES READ IN ARE
|
||
EOR'ED TOGETHER, AND IF THE RESULT, SHIFTED LEFT ONCE, IS NOT ZERO, THE READ IS
|
||
REDONE. THIS IS A VERY CLEVER LITTLE ANTI-COPY ROUTINE WHICH WORKS AS FOLLOWS:
|
||
WHEN THE SECTOR IS READ INTO MEMORY FROM THE DISK, ALL $156 (342 DECIMAL)
|
||
NIBBLES ARE READ IN AND POSTNIBBLIZED TO RECONSTRUCT 256 BYTES. THESE BYTES ARE
|
||
THEN RE-NIBBLIZED AND WRITTEN OUT TO THE NEW DISK BEING MADE. SINCE THE
|
||
ORIGINAL NIBBLES OF DF AND AA WERE NOT THE RESULT OF A PRENIBBLIZING PROCESS,
|
||
THEY WILL HAVE DISAPPEARED AS THE 50TH AND 51ST NIBBLES OF THE DATA FIELD, AND
|
||
BEEN REPLACED BY THE NIBBLES WHICH RESULT FROM A LEGITIMATE NIBBLIZING AND
|
||
EXCLUSIVE-ORING PROCESS. ONE PASS THROUGH ANY STANDARD DOS SECTOR-BASED COPIER
|
||
WILL THUS "DESTROY" THE SECTOR FROM THE STANDPOINT OF THE PROTECTION SCHEME.
|
||
|
||
|
||
THE SCHEME, ALTHOUGH A SUBTLE AND CUTE SECONDARY PROTECTION SYSTEM, IS RATHER
|
||
HOLLOW, SINCE NOTHING FURTHER IS DONE WITH THE CHECKSUM OF THE $31 NIBBLES.
|
||
THIS WAY, AS SOON AS THE SCHEME IS DECODED, THE ROUTINE CAN SIMPLY BE BYPASSED
|
||
WITH NO PENALTY.
|
||
|
||
NOW, I REALIZE THAT THIS DISCUSSION BROUGHT MANY OF YOU TO THE "MEGO" POINT
|
||
(GOVERNMENT-TALK ACRONYM FOR "MY EYES GLAZE OVER") AT THE FIRST USE OF THE TERMS
|
||
PRE- AND POST- NIBBLIZING. THOSE WHO KNOW IT ALL NEED READ NO FURTHER, BUT FOR
|
||
THOSE TO WHOM THIS IS STILL DIALECTIC SWAHILI, I WILL HUMBLY OFFER MY VERSION OF
|
||
AN EXPLANATION (IN FULL KNOWLEDGE THAT IT MAY DO NO MORE THAN INCREASE THE EYE-
|
||
GLAZE COEFFICIENT). ONCE AGAIN, THE PRIMARY SOURCE FOR THIS SORT OF EXPOSITION
|
||
IS "BENEATH APPLE DOS", WHICH BY NOW HAS ACHIEVED THE STATUS OF THE MOST
|
||
FREQUENTLY-REFERENCED TEXT IN ALL OF APPLE KRACKDOM, IF NOT APPLE PROGRAMMING IN
|
||
GENERAL.
|
||
|
||
WE'RE STILL NOT READY TO GO INTO THE INNERMOST WORKINGS OF THE DISK STORAGE
|
||
PROCESS (THAT'LL BE BASICS 107) BUT LET'S STIPULATE FOR THE MOMENT THAT THERE IS
|
||
A NEED TO USE ONLY BYTES WHICH MEET CERTAIN STRICT REQUIREMENTS WHEN WRITING
|
||
ONTO AN APPLE DOS 3.3 DISK. THE STONE TABLETS CARRIED UP FROM CUPERTINO LIST
|
||
THOSE REQUIREMENTS:
|
||
|
||
|
||
1. THE HIGH BIT OF THE BYTE MUST BE '1'
|
||
|
||
2. THE BYTE MUST CONTAIN NO MORE THAN ONE PAIR OF ADJACENT ZEROES.
|
||
|
||
3. THERE MUST BE AT LEAST TWO ADJACENT ONES IN THE BYTE, NOT INCLUDING THE
|
||
HIGH BIT.
|
||
|
||
AS IT TURNS OUT, THERE ARE EXACTLY 64 BYTES WHICH MEET ALL OF THESE CRITERIA.
|
||
IN ORDER TO STORE INFORMATION ON THE DISK, WE MUST "ENCODE" A TOTAL OF 256 BYTES
|
||
(ONE PAGE AND ALSO ONE SECTOR) IN THE 64 PSEUDO-BYTES WHICH CAN BE WRITTEN.
|
||
|
||
64 DIFFERENT BYTES MEANS THAT WE CAN SET UP A TABLE IN WHICH EACH BYTE
|
||
UNIQUELY CORRESPONDS TO ONE OF THE SIX-BIT NUMBERS FROM 00 TO $3F (IN BINARY,
|
||
0000 0000 TO 0011 1111). THE PROCESS OF CHOPPING UP FULL 8-BIT BYTES INTO
|
||
PIECES WHICH CAN CORRESPOND TO 6-BIT BYTES IS CALLED "NIBBLIZING". WE CAN BEGIN
|
||
TO SIMULATE THE "PRENIBBLIZING" PROCESS BY MAKING UP TWO TABLES. THE FIRST ONE,
|
||
WHICH NORMALLY RESIDES AT $BB00-BBFF, IS SET UP TO CONTAIN THE FIRST SIX BITS OF
|
||
EACH OF THE 256 BYTES:
|
||
|
||
IF THE THE CORRESPONDING
|
||
ORIGINAL BYTE ENTRY IN THE BB00
|
||
ALUE WAS: TABLE IS:
|
||
TABLE
|
||
|
||
(HEX) (BINARY) (HEX) (BINARY) ADDR
|
||
00 0000 0000 00 0000 0000 BB00
|
||
3F 0011 1111 3F 0011 1111 BB01
|
||
47 0100 0111 07 0000 0111 BB02
|
||
69 0110 1001 29 0010 1001 BB03
|
||
7F 0111 1111 3F 0011 1111 BB04
|
||
85 1000 0101 05 0000 0101 BB05
|
||
BC 1011 1100 3C 0011 1100 BB06
|
||
F0 1111 0000 30 0011 0000 BB07
|
||
FF 1111 1111 3F 0011 1111 BB08
|
||
! ! !
|
||
! ! !
|
||
V V V
|
||
|
||
|
||
AS YOU CAN SEE, IN EACH CASE THE FIRST TWO BITS HAVE BEEN CHOPPED OFF AND
|
||
REPLACED WITH ZEROES. THE RESULTING BYTE, NOW BETWEEN 0 AND $3F (0 AND 63) CAN
|
||
BE RELATED, ONE FOR ONE, TO THE WRITEABLE BYTES. HOWEVER, IF WE DON'T STORE, IN
|
||
SOME ORGANIZIED FASHION, THOSE TWO BITS WE LOPPED OFF EVERY BYTE, WE WON'T BE
|
||
ABLE TO RECONSTRUCT THE ORIGINAL BYTES WHEN WE READ THESE FUNNY LITTLE 6-BIT
|
||
NIBBLEBYTES FROM THE TRACK. THE WAY THAT'S DONE IS TO CONTRUCT A SECOND TABLE,
|
||
NORMALLY AT BC00-BC55, WHICH CONTAINS ALL THE LITTLE BITS AND PIECES (HO-HO-HO)
|
||
LEFT OVER AFTER THE TRUNCATION OF THE ORIGINAL BYTES TO SIX BITS. IN THE
|
||
EXAMPLE LIST GIVEN ABOVE, THE LEFTOVERS ARE:
|
||
|
||
|
||
00 -------------------\
|
||
00 ---------------\ \
|
||
01 -------------\ \ \
|
||
01 \ \ \
|
||
01 \ \ \
|
||
10 \ \ \
|
||
10 ! ! !
|
||
11 ! ! !
|
||
11 ! ! !
|
||
! ! !
|
||
THIS SECOND LIST WORKS ! ! !
|
||
FROM THE BOTTOM UP, SO ! ! !
|
||
THE CONTENTS WOULD BE: ! ! !
|
||
! ! !
|
||
^ ^ ^ ! ! !
|
||
! ! ! ! ! !
|
||
! ! ! ! ! !
|
||
BC4D 00XX YY11 ! ! !
|
||
BC4E 00XX YY11 ! ! !
|
||
BC4F 00XX YY10 ! ! !
|
||
BC50 00XX YY10 ! ! !
|
||
BC51 00XX YY01 ! ! /
|
||
BC52 00XX YY01 / / /
|
||
BC53 00XX YY01 -/ / /
|
||
BC54 00XX YY00 ---/ /
|
||
BC55 00XX YY00 -----/
|
||
|
||
|
||
SO, THE FIRST TWO BITS OF THE ORIGINAL BYTE BECOME THE LAST TWO BITS OF THE
|
||
BYTES IN THIS TABLE, WORKING FROM THE BOTTOM UP. AFTER $56 (86 DECIMAL) BYTES
|
||
HAVE HAD THEIR FIRST TWO BITS STUFFED INTO THE TABLE, THE NEXT ONE REPLACES THE
|
||
"YY" AT LOCATION BC55, THEN AT BC54, ETC. AFTER $AC (172) BYTES, THE NEXT PAIR
|
||
OF LEFTOVERS GOES INTO THE "XX" SLOT OF LOCATION BC55, AND WORKS UP AGAIN UNTIL
|
||
THE LAST TWO BITS ARE STUFFED INTO THE "XX" SLOT OF LOCATION BC00. REMEMBER
|
||
THAT THE TWO MOST SIGNIFICANT BITS MUST ALWAYS BE ZERO TO STAY WITHIN THE 0-3F
|
||
RESTRICTION.
|
||
|
||
AFTER THESE TWO TABLES HAVE BEEN CONSTRUCTED, EACH VALUE IN THE TABLE IS
|
||
EXCLUSIVE-ORED ON WITH THOSE THAT WENT BEFORE, TO FORM A NEW SIX-BIT BYTE. THE
|
||
RESULTING VALUE, WHICH IS STILL BETWEEN 0 AND $3F, IS TRANSLATED TO ONE OF THE
|
||
64 BYTES WHICH OBEY ALL THE LAWS LISTED ABOVE FOR THE DISK BYTES, AND THEN
|
||
REALLY AND TRULY WRITTEN TO DISK. THE TABLE WHICH DOES THIS CONVERSION IS
|
||
CALLED THE "WRITE TRANSLATE TABLE" AND LIVES AT $BA29 TO $BA68. IN OUR EXAMPLE,
|
||
THEN THE PROCESS GOES LIKE THIS:
|
||
|
||
|
||
1. GET A BYTE FROM BB00 =00
|
||
2. EXCLUSIVE-OR IT WITH 00 (IT'S THE FIRST BYTE) 00 EOR 00=00
|
||
3. LOOK UP THE BYTE AT $BA29 + 0 =96
|
||
4. WRITE IT TO DISK.
|
||
|
||
----THE NEXT BYTE-------------
|
||
|
||
|
||
1. GET THE BYTE FROM BB01 =3F
|
||
2. EXCLUSIVE-OR IT WITH THE PREVIOUS VALUE OF 00 3F EOR 00=3F
|
||
3. LOOK UP THE BYTE AT $BA29 + $3F FF
|
||
4. WRITE IT TO DISK
|
||
|
||
----AND THE THIRD BYTE--------
|
||
|
||
1. GET THE BYTE FROM BB02 =07
|
||
2. EXCLUSIVE-OR IT WITH THE PREVIOUS VALUE OF 3F 07 EOR 3F=34
|
||
3. LOOK UP THE BYTE AT $BA29 + $34 F3
|
||
4. WRITE IT TO DISK
|
||
|
||
|
||
----FOURTH AND LAST EXAMPLE---
|
||
|
||
|
||
1. GET THE BYTE FROM BB03 =29
|
||
2. EXCLUSIVE-OR IT WITH THE PREVIOUS VALUE OF 34 29 EOR 34=1D
|
||
3. LOOK UP THE BYTE AT $BA29 + $1D CE
|
||
4. WRITE IT TO DISK
|
||
|
||
|
||
AND SO ON UNTIL THE TOTAL OF $156 OR 342 BYTES FROM THE TWO TABLES IS WRITTEN
|
||
TO DISK. (LOOKING AT THIS PROCESS, YOU CAN SEE THAT A SECTOR WITH ALL ZEROES
|
||
WOULD NEVER CHANGE THE FIRST BYTE WRITTEN OUT, AND WOULD DISPLAY A SECTOR FULL
|
||
OF 96'S ON A NIBBLE READ).
|
||
|
||
WHEN THE DATA FIELD OF A SECTOR IS READ BACK IN, THE PROCESS IS REVERSED.
|
||
AFTER ALL 342 BYTES ARE READ INTO BB00-BC55, EACH BYTE IS EXCLUSIVE-ORED OFF THE
|
||
PILE, AND THE RESULT IS USED TO LOOK UP A VALUE OF 0-3F IN A "READ TRANSLATE
|
||
TABLE" AT BA96-BAFF. THROUGH SOME ELEGANT, IF INTRICATE CODE, THIS 6-BIT "BYTE"
|
||
IS RECOMBINED WITH ITS LONG-LOST 2 BITS, AND THE FINAL, REAL BYTE IS STORED
|
||
WHERE $3E AND $3F ARE POINTING.
|
||
|
||
IN THE FEW REMAINING LINES, LET ME EXPOUND FOR A MOMENT ON THE EXCLUSIVE- OR
|
||
OPERATOR. THE INSTRUCTION EOR (WHICH USES THE MNEMONIC XOR IN EVERY OTHER
|
||
ASSEMBLY LANGUAGE) WORKS LIKE THIS: FOR EACH BIT OF THE TWO BYTES TO BE
|
||
OPERATED ON, THE OUTPUT IS A ONE IF ONE AND ONLY ONE OF THE BITS IS ONE, BUT A
|
||
ZERO IF BOTH ARE ZERO OR ONE. THE TRUTH TABLE BELOW SUMMARIZES:
|
||
|
||
INPUT 1 INPUT 2 OUTPUT
|
||
0 0 0
|
||
0 1 1
|
||
1 0 1
|
||
1 1 0
|
||
|
||
AND THE LAST EXAMPLE GIVEN ABOVE IS:
|
||
|
||
|
||
0010 1001 (29)
|
||
EOR 0011 0100 (34)
|
||
---------
|
||
0001 1101 (1D)
|
||
|
||
|
||
THIS IS BASICALLY A NEAT LITTLE OPERATOR WHICH HAS BEEN FREQUENTLY PERVERTED
|
||
BY THE ENEMY TO DO THEIR DIRTY WORK. MORE ON THIS LATER--STAY TUNED FOR THE
|
||
NEXT EPISODE: "NON-STANDARD ENCODING SCHEMES."
|
||
|
||
---------------------------------------
|
||
***************************************
|
||
* *
|
||
* *
|
||
* KRAKOWICZ'S KRACKING KORNER *
|
||
* *
|
||
* THE BASICS OF KRACKING 107 *
|
||
* *
|
||
* BEYOND DEMUFFIN:NON-STANDARD *
|
||
* DISK ENCODING TECHNIQUES *
|
||
* AND DISKBIT TIDBITS *
|
||
* *
|
||
* *
|
||
***************************************
|
||
|
||
|
||
|
||
RECENTLY, WE HAVE DISCUSSED THE UNPROTECTION OF DISKS WITH A MODIFIED DOS,
|
||
PRIMARILY THROUGH THE USE OF DEMUFFIN PLUS. THIS TIME WE'LL TALK A LITTLE ABOUT
|
||
SOME OTHER APPROACHES TO CONVERTING MODIFIED DOS DISKS, THEN GET INTO SOME
|
||
SLIGHTLY HEAVIER STUFF ABOUT THOSE PROTECTION TECHNIQUES WHICH GO WAY BEYOND
|
||
MODIFYING DOS.
|
||
|
||
IN ADDITION TO DEMUFFIN PLUS, TWO PROGRAMS HAVE RECENTLY BECOME AVAILABLE FOR
|
||
UNPROTECTING A DISK WITH MODIFIED DOS: COPYB AND ADVANCED DEMUFFIN. SINCE, AS
|
||
WE DISCUSSED EARLIER, MOST MODS ARE MADE TO THE RWTS PORTIONS OF DOS, ALL THAT'S
|
||
REALLY NECESSARY TO REMOVE THE PRIMARY PROTECTION IS TO READ THE DISK INTO
|
||
MEMORY USING ITS OWN RWTS, THEN SWITCH IN A NORMAL RWTS AND WRITE IT BACK OUT TO
|
||
ANOTHER DISK. SINCE THE FILE MANAGER IS NOT INVOKED AS IT IS IN DEMUFFIN PLUS,
|
||
THIS APPROACH HAS THE ADDED ADVANTAGE THAT A DISK WITH FAIRLY NORMAL SECTOR
|
||
STRUCTURE BUT NO DOS FILE STRUCTURE OR CATALOG CAN STILL BE CONVERTED. IN THE
|
||
EARLY DAYS, THE TECHNIQUE WAS THIS: STORE BOTH RWTS'S IN MEMORY, THEN USE THE
|
||
INSPECTOR TO READ IN ABOUT 8 TRACKS. MOVE THE NORMAL RWTS IN WITH THE MONITOR,
|
||
THEN WRITE OUT THE TRACKS TO AN INITIALIZED DISK. ABOUT 5 TIMES AROUND MAKES A
|
||
COPYA DISK AND JACK A DULL BOY. FORTUNATELY, THINGS HAVE IMPROVED.
|
||
|
||
COPYB IS A MODIFICATION OF COPYA WHICH AUTOMATICALLY SWAPS THE RWTS ROUTINES
|
||
FOR YOU. TO RUN IT, YOU BOOT THE PROTECTED PROGRAM AND INTERRUPT IT, THEN MOVE
|
||
THE RWTS ROUTINES FROM $B700 TO $8000 (YOU CAN ALSO USE THE READ-IN TECHNIQUE
|
||
DESCRIBED IN BASICS 105 TO PUT THE MODIFIED RWTS INTO MEMORY, AND YOU CAN KEEP A
|
||
LIBRARY OF RWTS'S IF YOU FIND PEOPLE LIKE MUSE AND SSI USING A PARTICULAR ONE
|
||
OVER AND OVER. THESE CAN SIMPLY BE LOADED AS BFILES INTO $8000 AFTER BOOTING
|
||
COPYB). BOOTING COPYB AND ANSWERING ONE CRYPTIC AND FOUR FIDDISH QUESTIONS
|
||
ALLOWS YOU TO PRODUCE A COPYA DISK, INCLUDING AUTOMATIC INITIALIZATION OF THE
|
||
TARGET DISK. REASONABLY COMPLETE INSTRUCTIONS, WRITTEN BY THE AUTHOR WHO HAS
|
||
ACHIEVED NATIONAL PROMINENCE FOR VERBAL DIARRHEA, ACCOMPANY THE PROGRAM, SO WE
|
||
WON'T BELABOR THEM HERE.
|
||
|
||
A MUCH MORE COMPLETE PROGRAM CALLED ADVANCED DEMUFFIN HAS RECENTLY ISSUED FROM
|
||
CORRUPT COMPUTING, UNDER THE ABLE AUTHORSHIP OF "THE STACK" AND "THE INSPECTOR".
|
||
IT ALSO MAKES UNPROTECTED COPIES VIA RWTS SWAPS, BUT IS MUCH MORE USER-FRIENDLY
|
||
AND VERSATILE. THOROUGH SOFTDOC ACCOMPANIES THAT PROGRAM AS WELL, SO WE NEEDN'T
|
||
DWELL ON IT, EXCEPT TO CONGRATULATE THE AUTHORS ON AN EXCELLENT AND HIGHLY
|
||
PROFESSIONAL CONTRIBUTION TO THE ART OF UNPROTECTION.
|
||
|
||
|
||
EXCEPT FOR SOME CLEVER AND WELL-HIDDEN SECONDARY PROTECTION, THERE IS NOT MUCH
|
||
THAT A PROTECTOR CAN DO THESE DAYS WITH A MODIFIED DOS THAT WE CAN'T UNDO IN
|
||
SHORT ORDER WITH THE TOOLS AND TECHNIQUES AVAILABLE TO US. WHY ARE THERE STILL
|
||
SOME PROGRAMS THAT TAKE A LONG TIME TO KRACK? MORE EXTENSIVE MODIFICATIONS,
|
||
EXTENDING EVEN TO COMPLETE CUSTOM DOS'S. HERE, HOWEVER, WE START TO SEPARATE
|
||
THE MEN FROM THE BOYS, SINCE WRITING YOUR OWN OPERATING SYSTEM, NO MATTER HOW
|
||
LIMITED, COSTS MONEY. WHILE DOS MODIFICATIONS, EVEN WITH SEVERAL VARIATIONS,
|
||
CAN BE WHIPPED OUT IN A FEW MINUTES BY ANY KLUTZY HACKER, READING AND WRITING IN
|
||
WAYS NOT SANCTIONED BY THE GODS OF APPLEDOS REQUIRE HIRING SOMEONE WHO KNOWS HIS
|
||
SHIT, AND HE ALSO USUALLY KNOWS HOW MUCH HE'S WORTH. THIS HAS ADVANTAGES FOR US
|
||
AS WELL, SINCE PUBLISHERS WILL TRY TO GET THEIR MONEY'S WORTH OUT OF AN
|
||
EXPENSIVE SYSTEM BY USING IT ON AS MANY PRODUCTS AS POSSIBLE. ONCE BROKEN, THE
|
||
PRICIPLES CAN BE READILY APPLIED TO ALL DISKS OF THE SAME GENERATION OF
|
||
PROTECTION.
|
||
|
||
IF A PUBLISHER IS GOING TO GO BEYOND MODIFYING DOS, HE WILL NORMALLY ALSO
|
||
ABANDON STANDARD TRACK AND SECTOR FORMAT FOR SOMETHING WHICH AFFORDS GREATER
|
||
SECURITY AND EASE OF USE (SOMETIMES, SINCE THE APPLE DISK HARDWARE IF SO
|
||
FLEXIBLE, FORMATS WHICH WERE BORN ON ENTIRELY DIFFERENT SYSTEMS FIND THEIR WAY
|
||
INTO APPLE PROTECTION SCHEMES). GAMES, ESPECIALLY, HAVE MUCH SIMPLER STRUCTURE,
|
||
AND ARE READILY ADAPTED TO A FORMAT WITH LESS COMPLEXITY. SINCE SPACE ON A GAME
|
||
DISK IS USUALLY NOT AT A PREMIUM, A VERY COMMON SIMPLIFICATION IS TO ELIMINATE
|
||
SECTORING ALTOGETHER, AND MAKE EACH TRACK ONE BIG SECTOR. THIS NOT ONLY
|
||
SIMPLIFIES THE PROGRAM THAT HAS TO READ THE DISK, BUT CAN ALSO DRAMATICALLY
|
||
INCREASE THE DATA TRANSFER RATE (SIRIUS'S HADRON BROUGHT IN A FULL 48K IN JUST
|
||
OVER FOUR SECONDS--EAT YOUR HEART OUT, DOS). BEFORE WE DISCUSS SOME OF THE
|
||
FORMATS USED, WE HAVE TO TAKE A MUCH CLOSER LOOK AT THE WAY INFORMATION IS
|
||
ACTUALLY READ FROM A DISK.
|
||
|
||
THERE ARE A FEW ABSOLUTE LAWS OF DISK WRITING AND READING WHICH MUST BE
|
||
OBSERVED, AND SEVERAL MINOR STATUTES WHICH MAY BE VIOLATED WITH ONLY A SUMMONS.
|
||
THE REAL, DEEP DOWN, TRUE WAY THAT DATA IS RECORDED ON ANY DISK IS BY WAY OF
|
||
"MAGNETIC FLUX CHANGES", THAT IS, REVERSALS IN THE DIRECTION OF MAGNETIZATION OF
|
||
A THIN COATING OF IRON OXIDE ON THE DISK SURFACE. WE ALL RECALL FONDLY THE
|
||
SCIENCE EXPERIMENTS WITH IRON FILINGS AND A BAR MAGNET; DISK RECORDING
|
||
TECHNOLOGY IS BASED ON MAKING THE PARTICLES VERY SMALL, AND IMMOBILIZING THEM ON
|
||
THE DISK SO THEY CAN BE EXAMINED LATER FOR THE STATE OF THEIR MAGNETIZATION.
|
||
DISKETTE READING IS ACTUALLY A (GASP!) ANALOG PROCESS, AND IS MADE DIGITAL BY
|
||
SOME CLEVER CIRCUITRY JUST DOWNSTREAM OF THE READ HEAD. THIS CIRCUITRY SENSES
|
||
THE MAGNETIC FIELD OVER A PRECISELY DEFINED TIME INTERVAL, AND TRANSLATES A
|
||
*CHANGE* (REVERSAL) IN THE DIRECTION OF MAGNETIZATION TO A DIGITAL "ONE", AND
|
||
INTERPRETS *NO CHANGE*, OR THE ABSENCE OF REVERSAL, AS A "ZERO".
|
||
|
||
"NIBBLE" (IN CASE YOU WERE CURIOUS, THE DISK SPINS AT 300 RPM WHICH IS 5
|
||
REVOLUTIONS PER SECOND, OR 200 MILLISECONDS (MSEC) PER ROTATION. SINCE 8 BITS =
|
||
ONE BYTE, A BYTE IS READ EVERY 32 USEC, OR 0.032 MSEC, AND EACH REVOLUTION OF
|
||
THE DISK CORRESPONDS TO 200 MSEC/0.032 MSEC OR ABOUT 6000 BYTES. THIS IS
|
||
ROUGHLY $1800 BYTES PER TRACK, WHICH IS ABOUT THE NUMBER OF BYTES YOU NORMALLY
|
||
SEE DISPLAYED DURING A NIBBLE COUNT WITH NIBBLES AWAY OR LOCKSMITH).
|
||
|
||
IT'S NOT TOO BAD A PHYSICAL PICTURE TO REPRESENT THE ORIENTATION OF THE
|
||
MAGNETIC FIELDS WITH ARROWS (UP AND DOWN ARROWS WOULD BE NICER, BUT THE APPLE
|
||
SCREEN NO GOTS). IN THE DIAGRAM BELOW, THE ORIENTATION OF MAGNETIC "DOMAINS" ON
|
||
THE DISK FOR 9 BITS ARE REPRESENTED:
|
||
|
||
|
||
READ PT 1 2 3 4 5 6 7 8 9
|
||
DIR'N -> -> <- -> -> -> <- <- -> ->
|
||
\ /\ /\ /\ /\ /\ /\ /\ /\ /
|
||
BIT VALUE 0 1 1 0 0 1 0 1 0
|
||
|
||
|
||
NOTICE THAT EACH TIME THE MAGNETIC FIELD REVERSES DURING THE READ INTERVAL,
|
||
THE BIT VALUE IS READ AS "1", AND AS "0" WITH NO REVERSAL.
|
||
|
||
THE DISK ANALOG CARD AND CONTROLLER CARD COOPERATE TO STACK UP THIS "SERIAL
|
||
BIT STREAM" INTO AN 8-BIT BYTE, USING A SHIFT REGISTER WHICH IS THE HARDWARE
|
||
EQUIVALENT OF THE "ASL" OR "ARITHMETIC SHIFT LEFT" INSTRUCTION IN APPLE ASSEMBLY
|
||
LANGUAGE. THE SHIFT REGISTER STARTS OUT FULL OF ZEROES, AND KEEPS SCHLEPPING
|
||
IN, FROM THE LEFT, THE NEW BIT READ FROM THE DISK EVERY 4 MICROSECONDS. THE
|
||
SEQUENCE BELOW REPRESENTS THE SHIFT REGISTER CONTENTS AT EACH OF THE READ POINTS
|
||
SHOWN IN THE ARROW CHART ABOVE:
|
||
|
||
|
||
SHIFT NEXT BIT
|
||
REGISTER TO BE
|
||
BIT # --> 7 6 5 4 3 2 1 0 ADDED
|
||
+---------------+ /
|
||
(# OF ! ! /
|
||
SHIFTS) 0!0 0 0 0 0 0 0 0!<- 0
|
||
! !
|
||
1!0 0 0 0 0 0 0 0!<- 1
|
||
! !
|
||
2!0 0 0 0 0 0 0 1!<- 1
|
||
! !
|
||
3!0 0 0 0 0 0 1 1!<- 0
|
||
! !
|
||
4!0 0 0 0 0 1 1 0!<- 0
|
||
! !
|
||
5!0 0 0 0 1 1 0 0!<- 1
|
||
! !
|
||
6!0 0 0 1 1 0 0 1!<- 0
|
||
! !
|
||
7!0 0 1 1 0 0 1 0!<- 1
|
||
! !
|
||
8!0 1 1 0 0 1 0 1!<- 0
|
||
! !
|
||
9!1 1 0 0 1 0 1 0!
|
||
+---------------+
|
||
|
||
NOTICE THAT THE MOST SIGNIFICANT BIT ("MSB", OR BIT 7) OF THE SHIFT REGISTER
|
||
STAYS AT "0" UNTIL THE NINTH SHIFT, WHEN A "1" IS SHIFTED IN. THIS IS THE
|
||
SIGNAL WE USE TO DECIDE WHEN WE SHOULD STOP READING AND SHIFTING, AND CALL IT A
|
||
BYTE. THE SHIFT REGISTER IS DECODED AS ADDRESS $C0EC (FOR SLOT SIX), AND THE
|
||
FAMILIAR INSTRUCTION SEQUENCE:
|
||
|
||
$B954 LDA $C08C,X (X=60 FOR SLOT 6)
|
||
BPL $B954
|
||
|
||
IS USED AS A "WAIT AND WATCH" LOOP TO DETECT WHEN THE MSB HAS FINALLY BECOME A
|
||
ONE. IF YOU ARE STILL FOLLOWING THE DISCUSSION, YOU SHOULD NOW BE ABLE TO SEE
|
||
THE REASON FOR THE FIRST LAW OF DISK BYTES (LISTED IN BASICS 106): IF THE FIRST
|
||
BIT OF THE BYTE WEREN'T A ONE, BIT 7 OF THE SHIFT REGISTER WOULD STILL HAVE A
|
||
ZERO WHEN WE SHOULD BE AT THE END, AND WE WOULD SHIFT AT LEAST ONE MORE TIME,
|
||
LOOKING IN VAIN FOR A "1". THE SECOND (NOT MORE THAT ONE PAIR OF ADJACENT
|
||
ZEROES) IS REQUIRED TO KEEP THE CIRCUITRY FROM GETTING LOST (THE THIRD LAW,
|
||
WHICH REQUIRES AT LEAST ONE PAIR OF ADJACENT ONES NOT INVOLVING BIT 7, IS ONLY
|
||
FOR DOS 3.3, AND DOES NOT AFFECT THE HARDWARE). LET'S LOOK, FOR REVIEW, AT SOME
|
||
LEGAL AND ILLEGAL NIBBLES:
|
||
|
||
|
||
BYTE BINARY LEGAL VIOLATION
|
||
---- --------- ----- ---------
|
||
7F 0111 1111 NO RULE 1
|
||
8F 1000 1111 NO RULE 2
|
||
92 1001 0010 NO RULE 2
|
||
95 1001 0101 YES NOT DOS 3.3
|
||
96 1001 0110 YES NONE
|
||
97 1001 0111 YES NONE
|
||
98 1001 1000 NO RULE 2
|
||
9A 1001 1010 YES NOT DOS 3.3
|
||
9B 1001 1011 YES NONE
|
||
D5 1101 0101 YES *
|
||
AA 1010 1010 YES *
|
||
|
||
*THESE TWO BYTES ARE NOT ALLOWED IN THE DOS 3.3 NIBBLIZING SCHEME, BUT ARE
|
||
USED IN PROLOGS AND EPILOGS.
|
||
|
||
ALSO, TUCK THIS AWAY IN THE BACK OF YOUR MIND: *N0* LEGAL DISKBYTES CAN
|
||
CONTAIN 8, 1, OR 0.
|
||
|
||
NOW, IF YOU WANT TO CREATE A NON-STANDARD DISK FORMAT TO KEEP THOSE NASTY
|
||
PIRATES OUT OF YOUR "UNKRACKABLE" SOFTWARE, ALL YOU HAVE TO DO IS PICK A
|
||
SELECTION OF LEGAL BYTES (AND MAYBE A FEW OF THE ILLEGAL ONES), AND ARRANGE YOUR
|
||
OWN ENCODING SCHEME. THE MOST COMMON TECHNIQUE IS AN ADAPTATION OF THE OLD
|
||
ENCODING SCHEME CALLED 4+4 NIBBLIZING INTRODUCED TO DISK PROTECTION (I BELIEVE)
|
||
BY MY GOOD FRIENDS AT SIRIUS SOFTWARE. THIS IS THE SAME SYSTEM APPLE USES TO
|
||
STORE VOLUME, TRACK AND SECTOR DATA IN THE ADDRESS FIELD (SEE BASICS 104). AS
|
||
WE DESCRIBED, EACH REAL BYTE IS SPLIT INTO ODD AND EVEN HALVES, AND ENCODED SO
|
||
THAT EACH BYTE STORED ON THE DISK REPRESENTS EXACTLY 4 BITS, OR ONE NIBBLE, OF
|
||
THE ORIGINAL BYTE (THE BEGINNING OF THE DISKNIBBLEBYTE CONFUSION). THE CHOICE
|
||
FOR THESE IS LIMITED: ALL DISK BYTES ARE MADE UP OF A,B,E AND F, SO YOU CAN
|
||
HAVE,ON THE DISK:
|
||
|
||
|
||
AA AB AE AF BB BA BE BF
|
||
EA EB EE EF FA FB FE FF
|
||
|
||
YOU CAN FIND (PERHAPS TOO MUCH) MORE INFORMATION ON THIS TECHNIQUE AND
|
||
DECODING IT IN THE FILES ON CYCLOD, WAY OUT, AND TYPE ATTACK.
|
||
|
||
IN GENERAL, WHILE THE APPROACH TO UNPROTECTING ALL OF THESE ODDBALL FORMATS IS
|
||
STRAIGHTFORWARD, THE WORK CAN BE LONG AND HARD, AND CAN PROVIDE SOME REAL
|
||
CHALLENGE TO OUR SKILL AS KRACKISTS AND PROGRAMMERS. IN BROAD OUTLINE:
|
||
|
||
A. TRY TO FIGURE OUT THE DISK ACCESS LOGIC AND ISOLATE THE READER/LOADER
|
||
CODE.
|
||
|
||
B. MODIFY IT TO READ IN ALL THE PERTINENT PARTS OF THE DISK.
|
||
|
||
C. SAVE THE PIECES OUT TO DISK UNDER NORMAL RWTS STRUCTURE.9
|
||
|
||
D. RECONSTRUCT THE PROGRAM, USING AS LITTLE NEW CODE AS POSSIBLE.
|
||
|
||
|
||
BY NOW YOU SHOULD KNOW WHAT A LOADER ROUTINE LOOKS LIKE, AND IN MOST CASES
|
||
THESE DISKS WILL LOAD A COMPLETE TRACK AT A TIME INTO A PREDETERMINED AREA OF
|
||
MEMORY. BY LOCATING AND ALTERING THE TABLE OF "WHERE TO READ IN", YOU CAN, IN A
|
||
FEW PASSES, READ THE TRACK INTO MEMORY, BOOT A DISK, AND WRITE THE MEMORY
|
||
CONTENTS OUT UNDER THE NORMAL DOS FORMAT. AFTER ALL THE INFORMATION IS SAVED,
|
||
YOU CAN BEGIN THE PROCESS OF RECONSTRUCTION. USUALLY, THIS CONSISTS OF LOADING
|
||
DOS (OR AT LEAST RWTS) INTO MEMORY AND USING IT TO MANIPULATE SECTIONS OF THE
|
||
ORIGINAL CODE. IN CASES LIKE CYCLOD, THE ADDITIONAL DISK ACCESS BETWEEN LEVELS
|
||
IS TOTALLY UNNECESSARY AND CAN BE ELIMINATED. IN SOMETHING LIKE BANDITS,
|
||
HOWEVER, A GREAT DEAL OF REAL DATA IS READ IN AT EACH LEVEL, AND A MEANS MUST BE
|
||
FOUND TO ACCOMMODATE THE DISK ACCESS. USUALLY, THIS MEANS TRYING TO SQUEEZE THE
|
||
ABSOLUTELY CRUCIAL SUBROUTINES FROM RWTS INTO THE SPACE ORIGINALLY OCCUPIED BY
|
||
THE LOADER ROUTINE.
|
||
|
||
THERE ARE A NUMBER OF THESE "SHORT DOS" ROUTINES IN EXISTENCE. THESE PROGRAMS
|
||
ARE ALL LESS THAN $400 BYTES LONG, AND INCLUDE TRACK SEEK, ADDRESS AND DATA
|
||
FIELD READERS, AND POSTNIBBLIZING ROUTINES. IN THE PROCESS OF KRACKING BANDITS,
|
||
BOTH THE SHY "NAMELESS" KRACKER ("THEY SAID IT COULDN'T BE DONE...") AND I WROTE
|
||
VIRTUALLY IDENTICAL ROUTINES WHICH LIVED IN TEXT MEMORY AT 400-7FF. LONG- JOHN
|
||
SILVER HAS HIS OWN VERSION OF A SHORT DOS, AND AN EXCELLENT IMPLEMENTATION HAS
|
||
RECENTLY BEEN INTRODUCED BY THE STACK AND THE INSPECTOR OF "CORRUPT COMPUTING".
|
||
IT IS EXTREMELY WELL DOCUMENTED, AND JUST AS IN THE CASE OF ADVANCED DEMUFFIN,
|
||
THE BEST UTILITY AVAILABLE TO THE PRACTICING KRACKIST.
|
||
|
||
THAT'S A CRUDE OUTLINE OF THE DISK PROTECTION SCHEMES WHICH GO BEYOND MODIFIED
|
||
DOS; UNFORTUNATELY, MOST ARE QUITE DIFFERENT IN DETAIL, AND YOUR SKILL AS A
|
||
KRACKIST MUST BE MADE EQUAL TO THE TASK OF EACH ONE. WE'LL CONTINUE THE BASICS
|
||
OF KRACKING SERIES NEXT TIME WITH THE LONG-PROMISED ARTICLE ON BOOT- TRACING.
|
||
|
||
---------------------------------------
|
||
***************************************
|
||
* *
|
||
* *
|
||
* KRAKOWICZ'S KRACKING KORNER *
|
||
* *
|
||
* *
|
||
* THE BASICS OF KRACKING 108: *
|
||
* *
|
||
* BOOT CODE TRACING PART 1 *
|
||
* *
|
||
* *
|
||
* *
|
||
***************************************
|
||
|
||
|
||
AT LAST! THE LONG-AWAITED DESCRIPTION OF BOOT-CODE TRACING AND ITS
|
||
APPLICATION TO DISK UNPROTECTION. OY KRACKING LAW #7 SAYS "WHEN ALL ELSE FAILS,
|
||
BOOT TRACE." FOR MANY KRACKISTS, NOTABLE AMONG WHOM WAS MR. XEROX (MAY HE REST
|
||
IN PEACE), THE MOTTO WAS OPPOSITE: "BEFORE YOU DO ANYTHING ELSE, TRACE THE BOOT
|
||
CODE." DEPENDING ON YOUR SKILL AND PREDISPOSITION, YOU'LL SETTLE SOMEWHERE IN
|
||
BETWEEN THESE EXTREMES.
|
||
|
||
IF MR. XEROX DIDN'T INVENT BOOT- TREACING HE WAS CERTAINLY THE FIRST TO
|
||
DOCUMENT IT CLEARLY IN THE UNDERGROUND PRESS. THE DESCRIPTION THAT FOLLOWS
|
||
BORROWS HEAVILY FROM HIS ORIGINAL TREATISE ON THE PIRATE'S HARBOR CRACKING DISO
|
||
#1. IN ADDMTION, "MYCROFT" WROTE A THOROUGH ARTICLE IN HARDCORE COMPUTING
|
||
UPDATE 3.1 DESCRIBING HIS OWN, SLIGHTLY DIFFERENT APPROACH TO BOOT-TRACING.
|
||
WHILE I FIND HIS PROCESS A LITTLE MORE LABORIOUS, IT MIGHT BE NECESSARY FOR SOME
|
||
VERY DIFFICULT CASES.
|
||
|
||
THE PROCESS IS BASED FIRMLY ON THE FRIST LAW: TRACK 0, SECTOR 0 OF EVGRY DISK
|
||
MUST <ALWAYS> LOAD INTO PAGE 8 ($800-8FF). THE FURTHER ASSUMPTION IS THAT, IF
|
||
WE CAN VIEW EVERY STAGE OF THE BOOT PROCESS, WE CAN LEARN ENOUGH TO PRODUCE AN
|
||
UNPROTECTED VGRSION OF THE PROGRAM. IT DOES NOT HAVE MYSTICAL POWERS, AND STILL
|
||
REQUIRES THE ABILITY TO TEAR APART AND UNDERSTAND ASSEMBLY LANGUAGE, MUCH OF
|
||
WHICH IS INTENTIONALLY MISLEADING. WE'LL BEGIN WITH BACKGROUND MATERIAL AND A
|
||
REVIEW OF THE NORMAL BOOT PROCESS (DAMMIT, MAUDE, WE ALWAYS HAVE TO SIT THROUGH
|
||
THE SERMON FIRST!), AND PROCEED THROUGH AN EXAMPLE OF A NEW PROGRAM.
|
||
|
||
(AS WITH MOST KRACKING ACTIVITIES, INITIALLIZED DISK FOR SAVING PIECES OF THE
|
||
CODE AS THEY BECOME AVAILABLE).
|
||
|
||
ORDINARILY, WHEN YOU BOOT A 48K SLAVE DISK (A MASTER IS SLIGHTLY DIFFERENT,
|
||
BUT WE'LL IGNORE THAT FOR THE TIME BEING), A THREE-STAGE PROCESS IS STARTED
|
||
WHICH ENDS UP WITH THE DESIRED (HELLO) PROGRAM RUNNING. FIRST, THE CONTROLLER
|
||
CARD ROM AT $C600-C6FF LOADS T0, S0 INTO PAGE 8, THEN JUMPS TO LOCATION $801.
|
||
THIS IS A SHORT PROGRAM THAT LOADS ALL 10 SECTORS OF RWTS FROM T0, S0 THROUGH
|
||
T0,S9 INTO PAGES $B6-BF ($B600-BFFF), THEN JUMPS TO LOCATION $B700. THIS
|
||
PROGRAM, IN TURN, LOADS $1B (27) PAGES INTO $9D00-B5FF FROM T2, S4 THROUGH T0,
|
||
SB (NOTE-THIS IS A "BACKWARDS LOAD" FOR SPEED. APPLE KNEW ABOUT IT, SO WHY
|
||
DIDN'T DOS EVER USE IT FOR QUICKLOADING FILES???). AFTER A LITTLE HOUSEKEEPING,
|
||
THE PROGRAM JUMPS TO THE DOS COLDSTART IN $9D84, WHICH RUNS OR EXECS THE HELLO
|
||
PROGRAM. IN SUMMARY:
|
||
|
||
CODE # OF DEST NAME NEXT
|
||
LOCATION SECT. PAGE JUMP
|
||
-------- ----- ---- ------- ----
|
||
C600-C6FF 1 08 STAGE 0 801
|
||
0801-08FF 9 B6-BF STAGE 1 B700
|
||
B700-B7FF 27 9D-B5 STAGE 2 9D84
|
||
|
||
|
||
OF COURSE, IN A NONSTANDARD FORMAT INTENDED FOR PROTECTION, THINGS AREN'T
|
||
NECESSARILY THE SAME. TO SEE THE DIFFERENCES, YOU NEED TO EXAMINE EACH STAGE
|
||
SEPARATELY TO SEE WHAT IT DOES AND WHERE IT GOES.
|
||
|
||
THE THEORY OF BOOT-TRACING IS STRAIGHTFORWARD: FOLLOW THE BOOT PROCESS ONE
|
||
STEP AT A TIME TO SEE WHERE IS LEADS YOU, BY CREATIVELY ALTERING THE THE CODE TO
|
||
PREVENT IT FROM RUNNING AWAY FROM YOU. IN SUMMARY, WE WILL:
|
||
|
||
1. READ IN THE STAGE 1 BOOT CODE, BUT NOT ALLOW IT TO EXECUTE,
|
||
|
||
2. ALTER THE FIRST STAGE BOOT SO IT WILL EXECUTE TO LOAD IN STAGE TWO, WHILE
|
||
PREVENTING THE NEW STAGE FROM RUNNING,
|
||
|
||
3. IF NECESSARY, REPEAT THE PROCESS OF ALTERING, LOADING, AND HALTING UNTIL
|
||
ALL THE STAGES OF THE BOOT HAVE BEEN EXAMINED AND UNDERSTOOD.
|
||
|
||
IN PRACTICE, THE FIRST TWO STEPS ARE RELATIVELY STANDARD, BUT STEP THREE CAN
|
||
GET QUITE INVOLVED AS THE TRACE PROGRESSES.
|
||
|
||
THE TECHNIQUE FOR INTERRUPTING THE ORDERLY FLOW OF THE BOOT IS REFERRED TO AS
|
||
"SETTING BREAK POINTS". THE TERMINOLOGY IS BORROWED FROM THE DARK AGES WHEN
|
||
COMPUTERS HAD REAL FRONT PANELS WITH KNOBS AND SWITCHES AND LIGHTS, AND YOU
|
||
COULD ACTUALLY "DIAL-IN" AN ADDRESS WHERE YOU WANTED THE COMPUTER TO HALT FOR
|
||
EXAMINATION (IS ANYONE OUT THERE OLD ENOUGH TO SHARE MY FOND RECOLLECTION OF
|
||
'EXECUTE-STOP' AND 'FETCH-STOP' KNOBS?). SOPHISTICATED SYSTEMS WITH HIGH-LEVEL
|
||
EXECUTIVE PROGRAMS STILL ALLOW THIS TODAY, BUT IN THE APPLE WE HAVE TO BE A
|
||
LITLE MORE IMAGINATIVE.
|
||
|
||
IN ALL APPLE II SYSTEMS, THE INSTRUCTION SEQUENCE '4C 59 FF' OR JMP FF59 GOES
|
||
TO THE RESET CODE AND PROVIDES A POSITIVE, PERMANENT STOPPING PLACE FROM
|
||
ANYPLACE IN ASSEMBLY LANGUAGE CODE, AND HALTS WITH A WELL-DEFINED MACHINE STATE.
|
||
WHENEVER WE WANT TO SET A "BREAKPOINT" IN THE APPLE, WE CAN REPLACE ANY THREE
|
||
BYTES OF CODE WITH '4C 59 FF'.
|
||
|
||
TO BEGIN THE PROCESS, LETS LOOK AT SOME CODE FROM PART OF THE CONTROLLER CARD
|
||
BOOT ROM:
|
||
|
||
C600- A2 20 LDX #$20
|
||
C602- A0 00 LDY #$00
|
||
C604- A2 03 LDX #$03
|
||
!
|
||
!
|
||
C621- 20 58 FF JSR $FF58
|
||
C625- BD 00 01 LDA $0100,X
|
||
C628- 0A ASL
|
||
C629- 0A ASL
|
||
C62A- 0A ASL
|
||
C62B- 0A ASL
|
||
C62C- 85 2B STA $2B
|
||
C62E- AA TAX
|
||
C62F- BD 8E C0 LDA $C08E,X
|
||
!
|
||
!
|
||
C658- A9 08 LDA #$08
|
||
C65A- 85 27 STA $27
|
||
C65C- 18 CLC
|
||
C65D- 08 PHP
|
||
C65E- BD 8C C0 LDA $C08C,X
|
||
C661- 10 FB BPL $C65E
|
||
C663- 49 D5 EOR #$D5
|
||
C665- D0 F7 BNE $C65E
|
||
C667- BD 8C C0 LDA $C08C,X
|
||
C66A- 10 FB BPL $C667
|
||
C66C- C9 AA CMP #$AA
|
||
C66E- D0 F3 BNE $C663
|
||
C670- EA NOP
|
||
C671- BD 8C C0 LDA $C08C,X
|
||
C674- 10 FB BPL $C671
|
||
C676- C9 96 CMP #$96
|
||
C678- F0 09 BEQ $C683
|
||
!
|
||
!
|
||
C6E6- 91 26 STA ($26),Y
|
||
C6E8- C8 INY
|
||
C6E9- D0 EE BNE $C6D9
|
||
C6EB- E6 27 INC $27
|
||
C6ED- E6 3D INC $3D
|
||
C6EF- A5 3D LDA $3D
|
||
C6F1- CD 00 08 CMP $0800
|
||
C6F4- A6 2B LDX $2B
|
||
C6F6- 90 DB BCC $C6D3
|
||
C6F8- 4C 01 08 JMP $0801
|
||
C6FB- 00 BRK
|
||
C6FC- 00 BRK
|
||
C6FD- 00 BRK
|
||
|
||
|
||
NOTICE THE INSTRUCTION 'JMP $0801' AT C6F8. THIS IS THE "LINK" TO STAGE 1 OF
|
||
THE BOOT. IF WE COULD CHANGE IT TO 'JMP FF59', *EVERY* DISK WE BOOTED WOULD
|
||
LOAD IN THE FIRST SECTOR, BEEP INTO THE MONITOR, AND OBLIGINGLY WAIT WHILE WE
|
||
SNOOP THROUGH PAGE 8 TO OUR HEART'S CONTENT. SINCE THE PROGRAM IS IN ROM, WE
|
||
CAN'T ALTER IT, BUT WE CAN COPY IT DOWN TO A COMPATIBLE LOCATION AND ALTER IT SO
|
||
THAT THE PROGRAM HALTS INSTEAD OF CONTINUING WITH THE BOOT PROCESS. BECAUSE THE
|
||
BOOT CODE HAS TO EXECUTE FROM AN} SLOT, IT CONTAINS A "WHERE ARE WE" ROUTINE AT
|
||
C621-C62E TO FIND OUT WHAT ITS CURRENT LOCATION IS. HAPPILY FOR US, THIS KIND
|
||
OF RELOCATABLE CODE WILL RUN MANY PLACES BESIDES THE C100-C7FF PERIPHERAL ROM
|
||
SPACE (SEE THE REFERENCE MANUAL P. 81 FOR A DESCRIPTION OF THE "WHERE ARE WE"
|
||
ROUTINE). MR. XEROX'S FAMOUS MONITOR INSTRUCTIONS WHICH RELOCATE THE BOOT ROM
|
||
CODE AND INSERT THE FIRST BREAKPOINT ARE:
|
||
|
||
|
||
9600<C600.C6FFM
|
||
96F8:4C 59 FF
|
||
|
||
(NOTE-PAGE 96 IS NOT REQUIRED, BUT THE PAGE YOU USE MUST END IN 6 SO THAT SLOT
|
||
6 IS DECODED AS THE CONTROLLER CARD LOACTION). THE LAST FEW LINES OF THE
|
||
(RELOCATED) BOOT ROM CODE NOW READ:
|
||
|
||
96F4- A6 2B LDX $2B
|
||
96F6- 90 DB BCC $96D3
|
||
96F8- 4C 59 FF JMP $FF59
|
||
|
||
SO THAT TYPING:
|
||
|
||
9600G
|
||
|
||
|
||
WILL INITIATE A BOOT SEQUENCE FROM OUR CODE AT 9600 WHICH ENDS AT THE "BREAK
|
||
POINT" AT $96F8, RATHER THAN CONTINUING THE BOOT. IF YOU TRY THIS, YOU'LL FIND
|
||
THAT THE DISK IS STILL SPINNING, AND YOU CAN TURN IT OFF BY INCLUDING THE
|
||
INSTRUCTION '2C E8 C0' (BIT C0E8) AT 96F8 BEFORE THE JMP FF59, OR YOU CAN JUST
|
||
TYPE 'C0E8' FROM THE MONITOR. AFTER PAGE 8 HAS BEEN LOADED WITH THE STAGE 1
|
||
BOOT CODE, THE FUN BEGINS (UNTIL YOU GET GOOD AT THIS, IT'S A GOOD IDEA TO SAVE
|
||
EACH PIECE OF BOOT CODE AS A BFILE ON A SPARE DISK BEFORE PROCEEDING. IT'S
|
||
USUALLY EASIER THAN RUNNING THROUGH THE ENTIRE SEQUENCE EACH TIME A STEP DOESN'T
|
||
WORK AS YOU EXPECT, AND IT WILL MAKE IT EASIER TO PRINT OUT A DISASSEMBLY OF THE
|
||
CODE TO FIGURE OUT WHAT IT DOES.
|
||
|
||
|
||
AT THIS POINT, PAGE 8 MUST CONTAIN STAGE 1 OF THE BOOT WITH LOCATION $801 AS
|
||
THE STARTING POINT. IF THE FIRST STAGE IS KOSHER, LOCATION $84A CONTAINS '6C FD
|
||
08', WHICH IS AN INDIRECT JUMP THROUGH THE LOCATION IN 8FD & 8FE. THIS IS THE
|
||
EXIT POINT OF THE STAGE ONE BOOT, AND NORMALLY JUMPS TO B700 TO BEGIN READING IN
|
||
THE CODE FOR STAGE 2 (THE B6 AT 8FE BECOMES B7 DURING THE 10-SECTOR LOAD). TO
|
||
CONTINUE OUR MISSION, WE MUST LOCATE THE EXIT POINT OF THIS STAGE AND INSERT A
|
||
BREAKPOINT.
|
||
|
||
|
||
|
||
0801- A5 27 LDA $27
|
||
0803- C9 09 CMP #$09
|
||
0805- D0 18 BNE $081F
|
||
0807- A5 2B LDA $2B
|
||
0809- 4A LSR
|
||
080A- 4A LSR
|
||
080B- 4A LSR
|
||
080C- 4A LSR
|
||
080D- 09 C0 ORA #$C0
|
||
080F- 85 3F STA $3F
|
||
0811- A9 5C LDA #$5C
|
||
0813- 85 3E STA $3E
|
||
0815- 18 CLC
|
||
0816- AD FE 08 LDA $08FE
|
||
0819- 6D FF 08 ADC $08FF
|
||
081C- 8D FE 08 STA $08FE
|
||
081F- AE FF 08 LDX $08FF
|
||
0822- 30 15 BMI $0839
|
||
0824- BD 4D 08 LDA $084D,X
|
||
0827- 85 3D STA $3D
|
||
0829- CE FF 08 DGC $08FF
|
||
082C- AD FE 08 LDA $08FE
|
||
082F- 85 27 STA $27
|
||
0831- CE FE 08 DEC $08FE
|
||
0834- A6 2B LDX $2B
|
||
0836- 6C 3E 00 JMP ($003E)
|
||
0839- EE FE 08 INC $08FE
|
||
083C- EE FE 08 INC $08FE
|
||
083F- 20 89 FE JSR $FE89
|
||
0842- 20 93 FE JSR $FE93
|
||
0845- 20 2F FB JSR $FB2F
|
||
0848- A6 2B LDX $2B
|
||
084A- 6C FD 08 JMP ($08FD)
|
||
084D- 00 BRK
|
||
084E- 0D 0B 09 ORA $090B
|
||
0851- 07 ???
|
||
0852- 05 03 ORA $03
|
||
0854- 01 0E ORA ($0E,X)
|
||
0856- 0C ???
|
||
0857- 0A ASL
|
||
0858- 08 PHP
|
||
0859- 06 04 ASL $04
|
||
085B- 02 ???
|
||
085C- 0F ???
|
||
085D- 00 BRK
|
||
!
|
||
!
|
||
08FD- 00 BRK
|
||
08FE- B6 09 LDX $09,Y
|
||
|
||
NONSTANDARD FORMATS CAN HAVE ANY NUMBER OF EXIT INSTRUCTIONS, AND THIS IS
|
||
WHERE YOUR KNOWLEDGE OF ASSEMBLY LANGUAGE AND EXPERIENCE AT READING CODE WILL
|
||
START TO PAY OFF. UNLESS THE FIRST STAGE IS RELATIVELY STANDARD, IT'S NECESSARY
|
||
TO SPEND TIME EXAMINING AND TEARING APART THE CODE UNTIL YOU UNDERSTAND WHAT'S
|
||
GOING ON. LOOK FIRST FOR A JUMP OR INDIRECT JUMP TO SOMEPLACE OUTSIDE OF PAGE
|
||
8, AND CHANGE THAT TO JMP FF59. IF NONE APPEARS, LOOK FOR A "JUMP THROUGH THE
|
||
STACK" TRICK AS DESCRIBED IN THE ARCADG MACHINE FILE: FOR EXAMPLE, TO GO TO
|
||
$BB00 THERE WILL BE, SOMEWHERE IN THE CODE, TWO "PHA'S" AND AN "RTS". THE FIRST
|
||
PUSH ONTO THE STACK WOULD BE $BA; THE SECOND $FF. WHEN THE RTS IS EXECUTED, THE
|
||
TWO BYTES ARE PULLED OFF THE STACK, INCREMENTED BY ONE TO BB00, AND JUMPED TO.
|
||
IN ADDITION, MORE THAN ONE PAGE CAN BE LOADED UNDER STAGE 0, AND ACCESSED BY A
|
||
RELATIVE BRANCH INSTRUCTIoN, SO YOU'LL HAVE TO EXAMINE <ALL> THE CODE LOADED IN
|
||
(IT'S GOOD PRACTICE TO CLEAR OUT ALL OF MEMORY BEFORE STARTING; THIS WILL WORK
|
||
IF DOS IS NOT ACTIVE:
|
||
|
||
800:0 N 801<800.BFFFM).
|
||
|
||
WHEN YOU FIND THE EXIT POINT, MAKE IT A BREAKPOINT WITH '4C 59 FF' TO PREVENT
|
||
THE CONTINUATION OF THE BOOT. BEFORE PROCEEDING, TAKE A GOOD LOOK AT ALL THE
|
||
CODE TO BE SURE YOU UNDERSTAND WHERE THE NEXT STAGE LOADS, AND ANY UNUSUAL
|
||
CONDITIONS OR INSTRUCTIONS.
|
||
|
||
|
||
THE ALTERED PORTION OF CODE IS NOW:
|
||
|
||
|
||
0839- EE FE 08 INC $08FE
|
||
083C- EE FE 08 INC $08FE
|
||
083F- 20 89 FG JSR $FE89
|
||
0842- 20 93 FE JSR $FE93
|
||
0845- 20 2F FB JSR $FB2F
|
||
0848- A6 2B LDX $2B
|
||
084A- 4C 59 FF JMP $FF59
|
||
084D- 00 BRK
|
||
|
||
THE THEORY NOW IS TO ALLOW THE BOOT TO PROCEED THROUGH ONE MORE STAGE, HALTING
|
||
AFTER RWTS HAS BEEN READ IN, AND GIVING US A CHANCE TO EXAMINE THAT PORTION OF
|
||
THE PROGRAM FOR ALTERATIONS. IF WE JUST REBOOTED WITH '9600G', THE ORIGINAL
|
||
CODE WOULD OVERWRITE OUR ALTERED PAGE 8, SO WE HAVE TO ARRANGE IT SO THAT THE
|
||
FIRST STAGE BOOT CODE IS SENT OFF INTO OBLIVION. REFERRING BACK TO THE BOOT
|
||
CODE, LOCATION 9658 (ORIGINALLY C658) CONTAINS THE PAGE NUMBER WHERE T0, S0
|
||
LOADS IN, NORMALLY 08. CHANGING IT TO $20 WILL CAUSE T0, S0 TO LOAD INTO $2000
|
||
INSTEAD OF $0800, AND THE BOOT WILL CONTINUE THROUGH OUR ALTERED PAGE 8. NOTE
|
||
THAT WE HAVE TO REMOVE THE FIRST BREAK POINT AT 96F8 AND RESTORE THE ORIGINAL
|
||
JMP $0801:
|
||
|
||
9658:20
|
||
96F8:4C 01 08
|
||
|
||
NOW, WHEN WE TYPE '9600G', THE BOOT CODE WILL LOAD T0, S0 INTO $2000-20FF,
|
||
WHERE IT WON'T BOTHER US AT ALL, THEN JUMP TO 801 TO EXECUTE OUR CODE. AFTER
|
||
RWTS HAS BEEN LOADED IN, INSTEAD OF JUMPING TO $B700 TO CONTINUE LOADING DOS,
|
||
THE PROGRAM HITS THE (SECOND) BREAK POINT AT 84A AND HALTS.
|
||
|
||
THE FINAL PHASE OF THIS PROCESS IS TO LOCATE THE EXIT POINT FROM THIS AREA OF
|
||
CODE, INSERT ANOTHER BREAKPOINT, AND EXAMINE ALL THE CODE LOADED IN BY STAGE 2.
|
||
AGAIN, WE HAVE TO MAKE SURE THAT THE BOOT PROCESS DOESN'T OVERWRITE THE CHANGES,
|
||
WHICH MEANS WE HAVE TO UNDERSTAND HOW THE DESTINATION ADDRESSES ARE SET UP IN
|
||
STAGE 1. EVEN IN NORMAL DOS IT'S NOT OBVIOUS, BUT ENOUGH HEAD-SCRATCHING OR
|
||
READING OF BENEATH APPLE DOS WILL REVEAL DHAT THE BYTE IN LOCATION 8FE IS ONE
|
||
HIGHER THAN THE FIRST PAGE LOADED INTO, AND THE BYTE AT 8FF IS ONE LESS THAN THE
|
||
NUMBER OF SECTORS TO BE LOADED. AS BEFORE, WE REMOVE THE PREVIOUS BREAKPOINT,
|
||
ALTER THE DESTINATION OF THE REAL CODE LOADED IN UNDER THIS STAGE, AND SET THE
|
||
NEW BREAKPOINT:
|
||
|
||
B700- 8E E9 B7 STX $B7E9
|
||
B703- 8E F7 B7 STX $B7F7
|
||
B706- A9 01 LDA #$01
|
||
B708- 8D F8 B7 STA $B7F8
|
||
B70B- 8D EA B7 STA $B7EA
|
||
B70E- AD E0 B7 LDA $B7E0
|
||
B711- 8D E1 B7 STA $B7E1
|
||
B714- A9 02 LDA #$02
|
||
B716- 8D EC B7 STA $B7EC
|
||
B719- A9 04 LDA #$04
|
||
B71B- 8D ED B7 STA $B7ED
|
||
B71E- AC E7 B7 LDY $B7E7
|
||
!
|
||
!
|
||
B738- 20 93 B7 JSR $B793
|
||
B73B- A2 FF LDX #$FF
|
||
B73D- 9A TXS
|
||
B73E- 8E EB B7 STX $B7EB
|
||
B741- 4C C8 BF JMP $BFC8
|
||
B744- 20 89 FE JSR $FE89
|
||
B747- 4C 84 9D JMP $9D84
|
||
|
||
THE CHANGES ARE:
|
||
|
||
|
||
84A:4C 00 B7
|
||
(WE CAN'T USE THE INDIRECT JUMP IN THE ORIGINAL, SMNCE WE HAVE REDIRECTED THE
|
||
BOOT)
|
||
|
||
8FE:20 09
|
||
(PAGE 20 OR ANYPLACE ELSE WHERE 10 PAGES OF CODE WON'T HURT ANYTHING)
|
||
|
||
|
||
B747:4C 59 FF
|
||
(JMP 9D84 IS THE DOS COLD- START. THE JMP BFC8 IS A PATCH WHICH RETURNS WITH
|
||
A JMP B744)
|
||
|
||
|
||
|
||
THE LAST FEW LINES OF CODE ARE NOW:
|
||
|
||
|
||
B741- 4C C8 BF JMP $BFC8
|
||
B744- 20 89 FE JSR $FE89
|
||
B747- 4C 59 FF JMP $FF59
|
||
|
||
NOW TYPE '9600G', AND LET'S RECAP THE PROCESS THAT WILL OCCUR:
|
||
|
||
1. THE MODIFIED STAGE 0 CODE AT 9600-96FF WILL LOAD T0, S0 INTO PAGE 20
|
||
(SINCE WE DON'T WANT IT), THEN JUMP TO THE START OF OUR MODIFIED PAGE 8 AT 801.
|
||
|
||
2. THE MODIFIED PAGE 8 WILL LOAD T0, S0 THROUGH T0, S9 INTO PAGES 20 TO 2=,
|
||
THEN JUMP TO OUR MODIFIED CODE AT B700.
|
||
|
||
3. THE MODIFIED CODE AT B700 WILL LOAD 27 SECTORS OF DOS INTO PAGES 9A-B5,
|
||
THEN HALT WHEN IT HITS THE BREAKPOINT AT B747.
|
||
|
||
|
||
---------------------------------------
|
||
***************************************
|
||
* *
|
||
* *
|
||
* *
|
||
* THE BASICS OF KRACKING 109: *
|
||
* *
|
||
* BOOT-TRACING PART 2- RDF 1985 *
|
||
* *
|
||
* *
|
||
* *
|
||
***************************************
|
||
|
||
THIS IS THE SECOND PART OF THE BOOT-TRACING EPISODE--IT'S PROBABLY NOT HAZARDOUS
|
||
TO YOUR HEALTH TO READ THIS BEFORE YOU LOOK AT PART 1 (BASICS 108), BUT IT'LL
|
||
MAKE A MORE SENSE TO READ 108 FIRST IF YOU'RE NOT INTIMATELY FAMILIAR WITH THE
|
||
SUBJECT. THE THEORY (?) WAS ALL IN THE FIRST PART; THIS IS JUST AN EXAMPLE,
|
||
WITH A LOT OF DISASSEMBLED CODE, OF THE USE OF BOOT-TRACING TO LOOK AT (BUT NOT
|
||
REALLY TO KRACK) A NOT-TOO-UNUSUAL DISK: RDF 1985 FROM THOSE FUN-LOVING WAR
|
||
GAME FREAKS AT SSI. THIS LOADER/DOS APPEARS TO BE THE SUCCESSOR TO RDOS 2.1,
|
||
WHICH WAS THE LATE UNLAMENTED OPERATING SYSTEM THAT KEPT SO MANY DISKS FROM
|
||
BEING UNPROTECTED FOR SO LONG.
|
||
|
||
APPROACHING THIS DISK AS WE WOULD ANY OTHER, WE ENTER THE MONITOR AND SET THE
|
||
FIRST BREAKPOINT BY TYPING:
|
||
|
||
9600<C600.C6FFM
|
||
96F9:59 FF
|
||
9600G
|
||
|
||
AFTER THE BEEP, AND C0E8 TO DESPIN THE DISK, 801LLLL GETS US THE FOLLOWING:
|
||
|
||
0801- A6 2B LDX $2B
|
||
0803- 8E 1F 02 STX $021F
|
||
0806- A9 02 LDA #$02
|
||
0808- 8D 20 02 STA $0220
|
||
080B- 18 CLC
|
||
080C- 08 PHP
|
||
080D- BD 8C C0 LDA $C08C,X
|
||
0810- 10 FB BPL $080D
|
||
0812- 49 D5 EOR #$D5
|
||
0814- D0 F7 BNE $080D
|
||
0816- BD 8C C0 LDA $C08C,X
|
||
0819- 10 FB BPL $0816
|
||
081B- C9 AA CMP #$AA
|
||
081D- D0 F3 BNE $0812
|
||
081F- EA NOP
|
||
0820- BD 8C C0 LDA $C08C,X
|
||
0823- 10 FB BPL $0820
|
||
0825- C9 B5 CMP #$B5
|
||
0827- F0 09 BEQ $0832
|
||
0829- 28 PLP
|
||
082A- 90 DF BCC $080B
|
||
082C- 49 AD EOR #$AD
|
||
082E- F0 20 BEQ $0850
|
||
0830- D0 D9 BNE $080B
|
||
0832- A0 03 LDY #$03
|
||
0834- 84 2A STY $2A
|
||
0836- BD 8C C0 LDA $C08C,X
|
||
0839- 10 FB BPL $0836
|
||
083B- 2A ROL
|
||
083C- 85 3C STA $3C
|
||
083E- BD 8C C0 LDA $C08C,X
|
||
0841- 10 FB BPL $083E
|
||
0843- 25 3C AND $3C
|
||
0845- 88 DEY
|
||
0846- D0 EE BNE $0836
|
||
0848- 28 PLP
|
||
0849- CD 20 02 CMP $0220
|
||
084C- D0 BD BNE $080B
|
||
084E- B0 BC BCS $080C
|
||
0850- A0 00 LDY #$00
|
||
0852- A9 00 LDA #$00
|
||
0854- 85 47 STA $47
|
||
0856- BD 8C C0 LDA $C08C,X
|
||
0859- 10 FB BPL $0856
|
||
085B- 29 55 AND #$55
|
||
085D- 0A ASL
|
||
085E- 85 46 STA $46
|
||
0860- BD 8C C0 LDA $C08C,X
|
||
0863- 10 FB BPL $0860
|
||
0865- 29 55 AND #$55
|
||
0867- 05 46 ORA $46
|
||
0869- 45 47 EOR $47
|
||
086B- 85 47 STA $47
|
||
086D- 99 00 10 STA $1000,Y
|
||
0870- C8 INY
|
||
0871- D0 E3 BNE $0856
|
||
0873- BD 8C C0 LDA $C08C,X
|
||
0876- 10 FB BPL $0873
|
||
0878- 29 55 AND #$55
|
||
087A- 0A ASL
|
||
087B- 85 46 STA $46
|
||
087D- BD 8C C0 LDA $C08C,X
|
||
0880- 10 FB BPL $087D
|
||
0882- 29 55 AND #$55
|
||
0884- 05 46 ORA $46
|
||
0886- 45 47 EOR $47
|
||
0888- F0 02 BEQ $088C
|
||
088A- D0 A4 BNE $0830
|
||
088C- 4C 00 10 JMP $1000
|
||
|
||
|
||
A FEW THINGS ARE WORTH POINTING OUT BEFORE WE CONTINUE THE TRACE. NOTICE THAT
|
||
THE EARLY PART IS AN ADAPTATION OF THE BOOT ROM CODE: IF THE CARRY BIT IS
|
||
CLEAR, IT'S LOOKING FOR D5 AA B5 TO READ IN THE ADDRESS FIELD (SOME THINGS NEVER
|
||
CHANGE), IF THE CARRY IS SET, D5 AA AD IS BEING SOUGHT FOR THE DATA FIELD
|
||
PROLOG. AFTER VERIFYING THE VOLUME, TRACK, AND SECTOR (832-846), WE READ IN A
|
||
SINGLE "PSEUDO-SECTOR" IN 4+4 NIBBLIZING, STORING IT AT $1000. IF THE CHECKSUM
|
||
IS RIGHT ($888), THEN WE JUMP TO 1000 TO CONTINUE THE BOOT. IF YOU'VE BEEN
|
||
KEEPING UP, YOU KNOW THE NEXT SERIES OF MONITOR INSTRUCTIONS TO SET BREAKPOINT
|
||
#2:
|
||
|
||
96F9:01 08
|
||
9659:20
|
||
088C:4C 59 FF
|
||
9600G
|
||
|
||
THE CODE LOADED INTO PAGE $10 IS:
|
||
|
||
1000- D8 CLD
|
||
1001- D8 CLD
|
||
1002- A9 00 LDA #$00
|
||
1004- 8D F2 03 STA $03F2
|
||
1007- A9 E0 LDA #$E0
|
||
1009- 8D F3 03 STA $03F3
|
||
100C- 49 A5 EOR #$A5
|
||
100E- 8D F4 03 STA $03F4
|
||
1011- A9 4C LDA #$4C
|
||
1013- 8D D0 03 STA $03D0
|
||
1016- A9 00 LDA #$00
|
||
1018- 8D D1 03 STA $03D1
|
||
101B- A9 BD LDA #$BD
|
||
101D- 8D D2 03 STA $03D2
|
||
1020- AD 1F 02 LDA $021F
|
||
1023- 8D D3 03 STA $03D3
|
||
1026- A9 01 LDA #$01
|
||
1028- 8D D4 03 STA $03D4
|
||
102B- A9 03 LDA #$03
|
||
102D- 8D 20 02 STA $0220
|
||
|
||
1030- A9 BD LDA #$BD
|
||
1032- 8D 99 10 STA $1099
|
||
|
||
1035- 18 CLC
|
||
1036- 08 PHP
|
||
1037- BD 8C C0 LDA $C08C,X
|
||
103A- 10 FB BPL $1037
|
||
103C- 49 D5 EOR #$D5
|
||
103E- D0 F7 BNE $1037
|
||
1040- BD 8C C0 LDA $C08C,X
|
||
1043- 10 FB BPL $1040
|
||
1045- C9 AA CMP #$AA
|
||
1047- D0 F3 BNE $103C
|
||
1049- EA NOP
|
||
104A- BD 8C C0 LDA $C08C,X
|
||
104D- 10 FB BPL $104A
|
||
104F- C9 B5 CMP #$B5
|
||
1051- F0 09 BEQ $105C
|
||
1053- 28 PLP
|
||
1054- 90 DF BCC $1035
|
||
1056- 49 AD EOR #$AD
|
||
1058- F0 20 BEQ $107A
|
||
105A- D0 D9 BNE $1035
|
||
105C- A0 03 LDY #$03
|
||
105E- 84 2A STY $2A
|
||
1060- BD 8C C0 LDA $C08C,X
|
||
1063- 10 FB BPL $1060
|
||
1065- 2A ROL
|
||
1066- 85 3C STA $3C
|
||
1068- BD 8C C0 LDA $C08C,X
|
||
106B- 10 FB BPL $1068
|
||
106D- 25 3C AND $3C
|
||
106F- 88 DEY
|
||
1070- D0 EE BNE $1060
|
||
1072- 28 PLP
|
||
1073- CD 20 02 CMP $0220
|
||
1076- D0 BD BNE $1035
|
||
1078- B0 BC BCS $1036
|
||
107A- A0 00 LDY #$00
|
||
107C- A9 00 LDA #$00
|
||
107E- 85 47 STA $47
|
||
1080- BD 8C C0 LDA $C08C,X
|
||
1083- 10 FB BPL $1080
|
||
1085- 29 55 AND #$55
|
||
1087- 0A ASL
|
||
1088- 85 46 STA $46
|
||
108A- BD 8C C0 LDA $C08C,X
|
||
108D- 10 FB BPL $108A
|
||
108F- 29 55 AND #$55
|
||
1091- 05 46 ORA $46
|
||
1093- 45 47 EOR $47
|
||
1095- 85 47 STA $47
|
||
|
||
1097- 99 00 10 STA $1000,Y
|
||
|
||
109A- C8 INY
|
||
109B- D0 E3 BNE $1080
|
||
109D- BD 8C C0 LDA $C08C,X
|
||
10A0- 10 FB BPL $109D
|
||
10A2- 29 55 AND #$55
|
||
10A4- 0A ASL
|
||
10A5- 85 46 STA $46
|
||
10A7- BD 8C C0 LDA $C08C,X
|
||
10AA- 10 FB BPL $10A7
|
||
10AC- 29 55 AND #$55
|
||
10AE- 05 46 ORA $46
|
||
10B0- 45 47 EOR $47
|
||
10B2- F0 02 BEQ $10B6
|
||
10B4- D0 A4 BNE $105A
|
||
10B6- EE 99 10 INC $1099
|
||
10B9- AD 99 10 LDA $1099
|
||
10BC- C9 C0 CMP #$C0
|
||
10BE- F0 06 BEQ $10C6
|
||
10C0- EE 20 02 INC $0220
|
||
10C3- 4C 35 10 JMP $1035
|
||
10C6- A9 BA LDA #$BA
|
||
10C8- 85 00 STA $00
|
||
10CA- A9 BC LDA #$BC
|
||
10CC- 85 01 STA $01
|
||
10CE- A9 01 LDA #$01
|
||
10D0- 85 03 STA $03
|
||
10D2- A9 00 LDA #$00
|
||
10D4- 85 04 STA $04
|
||
10D6- A9 06 LDA #$06
|
||
10D8- 85 05 STA $05
|
||
10DA- 20 D0 03 JSR $03D0
|
||
10DD- A9 F0 LDA #$F0
|
||
10DF- 85 36 STA $36
|
||
10E1- A9 FD LDA #$FD
|
||
10E3- 85 37 STA $37
|
||
10E5- 4C 00 BA JMP $BA00
|
||
|
||
THE EARLY PART FROM 1002-102D SETS UP THE 3D0-3FF REGION AS VECTORS FOR THE
|
||
"DOS" CALLS TO BE MADE, THEN STORES $BD IN $1099 FOR THE PAGE NUMBER TO BEGIN
|
||
LOADING IN THE NEXT PORTION OF THE BOOT. AFTER THAT, THE CODE FROM 80C-847 IS
|
||
MIRRORED TO LOAD IN THE NEXT STAGE. THE THREE LINES AT 10B6-10BF INDICATE THAT
|
||
THE LOAD CONTINUES UNTIL PAGES BD, BE, AND BF HAVE BEEN LOADED, THEN QUITS AT
|
||
PAGE $C0. YOU WOULD NORMALLY EXPECT TO FIND A "JMP BD00" AS THE EXIT POINT FROM
|
||
THIS STAGE OF THE BOOT; INSTEAD THERE IS A "JMP BA00" AT 10E5. THE REASON IS
|
||
THAT LINES 10C6- 10DA CALL THE NEWLY-LOADED LOADER ROUTINE AT BD00 THROUGH THE
|
||
VECTOR AT 3D0. BY LOOKING AT THE SETUP FOR THAT LOAD, WE CAN LEARN A LITTLE
|
||
ABOUT THE LOADER. THE IMPORTANT PARTS OF ANY LOADER ROUTINE ARE THE DESTINATION
|
||
PAGE, THE LENGTH OF THE LOAD, AND THE TRACK AND SECTOR TO BEGIN LOADING FROM.
|
||
IN THIS CASE, THE FIRST AND LAST DESTINATION PAGE ARE LOADED INTO LOCATIONS 0
|
||
AND 1, AND THE TRACK AND SECTOR IN 4 AND 5. AFTER THAT, A CALL TO THE 3D0
|
||
VECTOR JUMPS MERRILY UP TO BD00, WHICH IS THE "RWTS" ROUTINE FOR THIS PROGRAM.
|
||
|
||
|
||
WE CAN VIEW ALL OF THAT BY SETTING THE NEXT BREAKPOINT AT 10E5 AND REBOOTING
|
||
FOR WHAT IS HOPEFULLY THE LAST TIME:
|
||
|
||
086F:20
|
||
088C:4C 00 10
|
||
10E5:4C 59 FF
|
||
9600G
|
||
|
||
SINCE THE EXIT POINT SAID JUMP BA00, LETS LOOK AT THAT CODE:
|
||
|
||
|
||
BA00- D8 CLD
|
||
BA01- 4C 00 BC JMP $BC00
|
||
BA04- A5 8D LDA $8D
|
||
BA06- 9E ???
|
||
|
||
THE REST OF THE PAGE IS OF NO INTEREST, SO LET'S FOLLOW THE JUMP TO BC00:
|
||
|
||
BC00- AD 00 08 LDA $0800
|
||
BC03- C9 EA CMP #$EA
|
||
BC05- D0 0D BNE $BC14
|
||
BC07- A2 05 LDX #$05
|
||
BC09- BD BE BC LDA $BCBE,X
|
||
BC0C- 95 00 STA $00,X
|
||
BC0E- CA DEX
|
||
BC0F- 10 F8 BPL $BC09
|
||
BC11- 20 D0 03 JSR $03D0
|
||
BC14- AD D7 BC LDA $BCD7
|
||
BC17- D0 48 BNE $BC61
|
||
BC19- AD 81 C0 LDA $C081
|
||
BC1C- A9 00 LDA #$00
|
||
BC1E- 8D F2 03 STA $03F2
|
||
BC21- A9 BC LDA #$BC
|
||
BC23- 8D F3 03 STA $03F3
|
||
BC26- A9 19 LDA #$19
|
||
BC28- 8D F4 03 STA $03F4
|
||
BC2B- A9 00 LDA #$00
|
||
BC2D- 8D 11 03 STA $0311
|
||
BC30- A9 00 LDA #$00
|
||
BC32- 8D 13 03 STA $0313
|
||
BC35- A2 05 LDX #$05
|
||
BC37- BD AC BC LDA $BCAC,X
|
||
BC3A- 95 00 STA $00,X
|
||
BC3C- CA DEX
|
||
BC3D- 10 F8 BPL $BC37
|
||
BC3F- 20 D0 03 JSR $03D0
|
||
BC42- A9 00 LDA #$00
|
||
BC44- 8D 12 03 STA $0312
|
||
BC47- 20 00 A8 JSR $A800
|
||
BC4A- EE D7 BC INC $BCD7
|
||
BC4D- AD 12 03 LDA $0312
|
||
BC50- C9 02 CMP #$02
|
||
BC52- F0 70 BEQ $BCC4
|
||
BC54- A2 05 LDX #$05
|
||
BC56- BD B2 BC LDA $BCB2,X
|
||
BC59- 95 00 STA $00,X
|
||
BC5B- CA DEX
|
||
BC5C- 10 F8 BPL $BC56
|
||
BC5E- 20 D0 03 JSR $03D0
|
||
BC61- AD 12 03 LDA $0312
|
||
BC64- D0 5E BNE $5CC4
|
||
BC66- A9 25 LDA #$25
|
||
BC68- 85 03 STA $03
|
||
BC6A- A9 00 LDA #$00
|
||
BC6C- 8D 10 03 STA $0310
|
||
BC6F- 2C 10 C0 BIT $C010
|
||
BC72- A2 06 LDX #$06
|
||
BC74- A9 80 LDA #$80
|
||
BC76- 95 F6 STA $F6,X
|
||
BC78- CA DEX
|
||
BC79- 10 FB BPL $BC76
|
||
BC7B- AD 50 C0 LDA $C050
|
||
BC7E- AD 54 C0 LDA $C054
|
||
BC81- AD 57 C0 LDA $C057
|
||
BC84- AD 09 03 LDA $0309
|
||
BC87- F0 06 BEQ $BC8F
|
||
BC89- AD 52 C0 LDA $C052
|
||
BC8C- 4C 92 BC JMP $BC92
|
||
BC8F- AD 53 C0 LDA $C053
|
||
BC92- A9 00 LDA #$00
|
||
BC94- 8D 14 03 STA $0314
|
||
BC97- 8D 07 03 STA $0307
|
||
BC9A- 20 00 65 JSR $6500
|
||
BC9D- AD 11 03 LDA $0311
|
||
BCA0- D0 8E BNE $BC30
|
||
BCA2- AD 12 03 LDA $0312
|
||
BCA5- C9 01 CMP #$01
|
||
BCA7- F0 1B BEQ $5CC4
|
||
BCA9- 4C 00 E0 JMP $E000
|
||
|
||
BCAC- A8 TAY
|
||
BCAD- BB ???
|
||
BCAE- 00 BRK
|
||
BCAF- 01 01 ORA ($01,X)
|
||
BCB1- 00 BRK
|
||
|
||
BCB2- A8 TAY
|
||
BCB3- BB ???
|
||
BCB4- 00 BRK
|
||
BCB5- 01 13 ORA ($13,X)
|
||
BCB7- 00 BRK
|
||
|
||
BCB8- A8 TAY
|
||
BCB9- BB ???
|
||
BCBA- 00 BRK
|
||
BCBB- 01 15 ORA ($15,X)
|
||
BCBD- 00 BRK
|
||
|
||
BCBE- 08 PHP
|
||
BCBF- 14 ???
|
||
BCC0- 00 BRK
|
||
BCC1- 01 03 ORA ($03,X)
|
||
BCC3- 00 BRK
|
||
|
||
BCC4- A2 05 LDX #$05
|
||
BCC6- BD B8 BC LDA $BCB8,X
|
||
BCCB- CA DEX
|
||
BCCC- 10 F8 BPL $BCC6
|
||
BCD1- 20 00 A8 JSR $A800
|
||
BCD4- 4C 54 BC JMP $BC54
|
||
|
||
|
||
FINALLY, HERE'S THE MEAT OF THE PROGRAM. BC00 IS A TEST TO SEE IF IT'S THE
|
||
FIRST TIME THROUGH--LOCATION 800 IS 01 THE FIRST TIME, SO WE TRANSFER THE 5
|
||
VALUES FOUND AT BCBE-BCC3 INTO LOCATIONS 0-5, THEN CALL THE LOADER ROUTINE, AND
|
||
PAGES 8-14 ARE LOADED FROM TRACK 3, SECTOR 0. AT BC1C-BC2B, WE SET THE RESET
|
||
VECTOR TO RETURN TO BC00 (AND RESTART THE GAME) WHENEVER RESET IS PRESSED (THE
|
||
REFERENCE MANUAL TELLS YOU HOW ON P. 37; IT'S P. 82 IN THE IIE MANUAL, IF YOU
|
||
GOT RIPPED OFF FOR THAT ONE). NEXT, PAGES A8-BB ARE LOADED FROM T1, S0, AND THE
|
||
GAME BEGINS IN EARNEST.
|
||
|
||
ORDINARILY, THIS IS ABOUT AS FAR AS BOOT-TRACING CAN TAKE YOU INTO THE
|
||
ORGANIZATION OF A DISK. JUST FOR THE EXERCISE, HOWEVER, LET'S PRETEND WE REALLY
|
||
WANT TO FIND OUT WHAT GETS LOADED INTO PAGES A8-BB BEFORE THE GAME STARTS. THE
|
||
BREAKPOINT GOES IN...
|
||
|
||
10E5:4C 00 BA
|
||
1099:20
|
||
10BD:23 (UNLESS YOU KNOW
|
||
IT'S SAFE, KEEP
|
||
THE # OF PAGES THE
|
||
SAME)
|
||
BC47:4C 59 FF
|
||
|
||
SEE WHAT THAT CODE LOOKS LIKE BEFORE IT HAS A CHANCE TO UNSCRUNCH A PICTURE OR
|
||
WHATEVER ELSE IT IS GOING TO DO. ALSO, NOTICE THAT THE CODE AT BC54 AND AT THE
|
||
ALTERNATIVE DESTINATION OF BCC4 BOTH LOAD OVER PAGES A8-BB. IF NECESSARY, WE
|
||
COULD CONTINUE WITH THIS PROCESS, PUTTING A BREAKPOINT AFTER EACH LOAD, UNTIL WE
|
||
HAVE EXAMINED, SAVED, OR ALTERED EVERY ACCESSIBLE PART OF THE PROGRAM.
|
||
|
||
SO MUCH FOR THE "EASY" PART--NOW THE HARD WORK BEGINS. WE HAVE LEARNED ABOUT
|
||
ALL WE NEED TO KNOW ABOUT THE LOADER, BUT NOW WE HAVE TO FIND A WAY TO PUT ALL
|
||
OF THIS INTO A FORMAT WHICH UNLESS WE CAN USE DOS ON THE LANGUAGE CARD,
|
||
CONSIDERING THAT ALL OF THESE FILES LOAD RIGHT OVER THE MIDDLE OF DOS), OR
|
||
CONVERT THE 4+4 NIBBLIZED SECTORS INTO STANDARD DOS 3.3 SECTORS (ALSO NOT TOO
|
||
EASY, CONSIDERING THAT WE ONLY HAVE 3 PAGES FOR THE "DOS").
|
||
|
||
IN CONCLUSION, YOU SHOULD BE AWARE THAT THE TECHNIQUES DESCRIBED HERE WORK
|
||
EQUALLY WELL ON AN APPLE IIE (I HELD OUT FOR ALMOST 8 MONTHS, BUT NOW I CAN
|
||
CONTEND THAT ALL THE TYPOS IN THIS EPISODE ARE THE RESULT OF HAVING FUNNY KEYS
|
||
LIKE "][" ON AN APPLE KEYBOARD AFTER 5+ YEARS OF TYPING ON GOOD OLD APPLE II S/N
|
||
3603). STAY TUNED FOR AN EXAMPLE WHICH IS A LITTLE MORE COMPLICATED THAN THIS
|
||
ONE, AND REQUIRES CHANGES IN THE BOOT-TRACE TECHNIQUE. ALSO IN THE WINGS IS
|
||
(WHAT ELSE) HARDWARE MODIFICATIONS TO THE IIE (NO MOTHER BOARD SURGERY, I
|
||
PROMISE) TO ALLOW KRAKROMS, HARD RESETS, AND KREATIVE KRACKING USE OF THE 64K
|
||
80-COLUMN BOARD.
|
||
|
||
-------------------------------------
|
||
|