261 lines
13 KiB
Plaintext
261 lines
13 KiB
Plaintext
***************************************
|
||
* KRACKOWITZ'S CRACKING TIPS *
|
||
***************************************
|
||
FROM: THE ROM RAIDER
|
||
DR. DIGITAL
|
||
|
||
CALL HER MAJESTY'S SECRET SERVICE
|
||
3 0 3 - 7 5 1 - 2 0 6 3
|
||
|
||
|
||
ALONG WITH A NUMBER OF REQUESTS FOR MATERIAL USEFUL TO THOSE WHO ARE NOT YET IN
|
||
THE RANKS OF PROFESSIONALS IN THIS FIELD, IT HAS BEEN POINTED OUT TO ME THAT I
|
||
AM ALL TOO WILLING TO SUGGEST BURNING THIS PROM, INSTALLING THAT ROM, AND
|
||
GENERALLY MAKING WHOLESALE HARDWARE CHANGES IN AN UNSUSPECTING APPLE, WITHOUT
|
||
PROVIDING BACKGROUND INFORMATION FOR THE UP-AND-COMING KRACKISTS OF THE FUTURE.
|
||
|
||
THIS SERIES, WHILE AIMED AT THE BEGINNING TO INTERMEDIATE KRACKIST, WILL STILL
|
||
ASSUME A REASONABLE KNOWLEDGE OF ASSEMBLY LANGUAGE. IF YOU FIND THESE
|
||
DISCUSSIONS ARE STILL TOO HEAVY INTO MACHINE CODE FOR YOU, THEN IT'S BEST TO
|
||
BUY A BOOK LIKE ROGER WAGNER'S "ASSEMBLY LINES" OR EQUIVALENT, AND STUDY IT
|
||
CAREFULLY (IF, ON THE OTHER HAND, YOU FIND THAT THIS IS ALL BENEATH YOU, JUST
|
||
KEEP A KNOWING SMIRK ON YOUR LIPS AS YOU SKIP LIGHTLY OVER THESE EPISODES -
|
||
THERE MIGHT BE SOMETHING YOU MISSED BECAUSE YOU HAD A BAD HANGOVER ONE DAY IN
|
||
KRACKING 101).
|
||
|
||
IN THIS AND FUTURE EPISODES IN THE 'BASICS OF KRACKING' SERIES, WE'LL DEAL WITH
|
||
THE FUNDAMENTALS OF THE KRACKIST'S ART, STARTING WITH THE HOW (AND WHY) OF
|
||
MAKING ALTERATIONS IN THE APPLE'S "PERMANENT" MEMORY. FIRST OF ALL, THE MOST
|
||
IMPORTANT SINGLE TOOL AVAILABLE TO THE ASPIRING KRACKIST IS REPLACING THE
|
||
AUTOSTART ROM ON THE MOTHER BOARD WITH AN "OLD MONITOR" ROM. WITH THIS ROM IN
|
||
PLACE, YOU CAN HIT 'RESET' WHENEVER YOU WANT, AND ALWAYS BE RETURNED TO THE
|
||
MONITOR FOR THE BEGINNING OF THE SNOOPING PROCESS. THIS CHANGE, INCIDENTALLY,
|
||
WILL MAKE AVAILABLE TO YOU A REASONABLE SET OF "STEP AND TRACE" UTILITIES (SEE
|
||
THE APPLE II REFERENCE MANUAL. PP 51-53).
|
||
|
||
TO UNDERSTAND WHAT THE DIFFERENCES ARE BETWEEN THE TWO ROMS, LET'S TAKE A
|
||
MINUTE TO EXAMINE WHAT PRESSING THE 'RESET' KEY DOES (OMIGOSH, MAUDE, THERE HE
|
||
GOES AGAIN ON THAT DETAILED TECHNICAL CRAP!). INSTEAD OF GOING THROUGH THE
|
||
KEYBOARD INPUT ROUTINE AT C000, THE RESET KEY IS CONNECTED DIRECTLY TO PIN 40
|
||
OF THE 6502 MICROPROCESSOR CHIP. WHEN THIS PIN IS CONNECTED TO GROUND (0
|
||
VOLTS), THE COMPUTER JUMPS UNCONDITIONALLY TO THE ADDRESS CONTAINED IN
|
||
LOCATIONS FFFC AND FFFD. THIS IS NOT A TRUE INTERRUPT, SINCE THE APPLE FORGETS
|
||
WHAT IT WAS DOING BEFORE THE LINE WAS "YANKED", BUT IT IS AN EXAMPLE OF
|
||
'VECTORING' OR SENDING THE COMPUTER TO A SPECIFIC PLACE BY SETTING AN ADDRESS
|
||
INTO THE PROGRAM COUNTER. IN THE AUTOSTART ROM, THESE TWO LOCATIONS CONTAIN 62
|
||
FA, SO THE NEXT INSTRUCTION TO BE EXECUTED IS AT FA62. THIS SERIES OF ROUTINES
|
||
(SEE P. 143 AND PP. 36-38 OF THE REFERENCE MANUAL) CHECKS TO SEE IF THE
|
||
COMPUTER IS BEING POWERED UP FOR THE FIRST TIME (COLDSTART) OR RESET WITH THE
|
||
POWER ON (WARMSTART). IF IT IS A WARMSTART, THE SYSTEM JUMPS TO THE
|
||
INSTRUCTIONS AT LOCATIONS 3F2 AND 3F3, AND BEGINS RUNNING THE PROGRAM FOUND
|
||
THERE (USUALLY BASIC AT E000).
|
||
|
||
THE "OLD MONITOR" ROM, HOWEVER, HAS 59 FF STORED IN FFFC-D. THIS CAUSES AN
|
||
APPLE II (OR A II+ WITH AN INTEGER CARD AND THE RED SWITCH "UP") TO GO TO
|
||
ROUTINES WHICH SET UP THE KEYBOARD FOR INPUT, THE TV FOR OUTPUT, AND WIND UP IN
|
||
THE MONITOR WITH THE '*' PROMPT DISPLAYED. IN CONTRAST TO THE AUTOSTART ROM,
|
||
WHERE ANYONE CAN TELL THE RESET BUTTON WHERE TO GO, THERE IS NO WAY TO PREVENT
|
||
A RESET FROM GOING TO FF59 AND WINDING UP IN THE MONITOR. THIS IS OBVIOUSLY
|
||
ESSENTIAL IF YOU WANT TO BREAK INTO A GAME AND START EXAMINING THE CODE, BUT IT
|
||
HAS ITS OWN SET OF PROBLEMS.
|
||
|
||
IN THE PROCESS OF SETTING UP THE I/O DESCRIBED ABOVE, ESPECIALLY IN SETTING UP
|
||
THE TEXT WINDOW ON THE SCREEN, A NUMBER OF LOCATIONS IN ZERO PAGE MUST BE
|
||
CHANGED. THE FOLLOWING LOCATIONS WILL PROBABLY BE ALTERED (ALL HEX):
|
||
20,21,22,23,24,25,28,29,32,33,35, 36,37,38,39, AND 48. WORSE THAN THAT, THE
|
||
ENTIRE SCREEN SCROLLS UP ONE LINE WHEN THE MONITOR PROMPT IS PRINTED, WHICH
|
||
LOSES THE ENTIRE TOP ROW OF THE TEXT SCREEN (LOCATIONS 400-427), AND ALTERS THE
|
||
CONTENTS OF ALL THE OTHER LOCATIONS FROM 400-7FF, WITH THE EXCEPTION OF THE
|
||
"SCRATCHPAD" REGIONS AT 478-47F, 4F8-4FF, ETC. (THE COMPUTER WIMP AT YOUR
|
||
SCHOOL SAYS THAT THE TOP LINE "FALLS INTO THE BIT BUCKET", BUT YOU KNOW HOW
|
||
EVERYONE FEELS ABOUT HIM.)
|
||
|
||
AS MOST SOFTWARE PROTECTORS KNOW, THIS WILL KEEP MOST OF THE AMATEURS OUT OF
|
||
THE PROGRAM, AND YOU'LL SEE EVIDENCE OF THIS TECHNIQUE IN THE FORM OF A LOT OF
|
||
"GARBAGE" ON THE TEXT SCREEN WHEN YOU RESET OUT OF A PROTECTED GAME. OUR JOB,
|
||
THEN, IS TO KEEP THESE ZERO PAGE AND SCREEN MEMORY LOCATIONS FROM BEING LOST,
|
||
SINCE MOST PROTECTION SCHEMES USE THESE AREAS IN SOME WAY OR OTHER (BR0DERBUND,
|
||
FOR EXAMPLE, HAS RECENTLY BEEN STORING THE ADDRESS MARKER FOR THE DISK TRACK IN
|
||
LOCATIONS 20, 21, AND 22).
|
||
|
||
THE SAFE WAY TO PREVENT INFORMATION FROM BEING LOST FROM THESE "VOLATILE"
|
||
LOCATIONS IS TO TRANSFER ALL OF THE CONTENTS TO A SAFE AREA -- LOCATIONS 2000 &
|
||
UP (OR 4000 & UP) WHERE A HI-RES PICTURE NORMALLY RESIDES. IN FACT, IT WOULD
|
||
BE BEST TO SAVE EVERYTHING FROM 0 TO 8FF, SINCE BOOTING A DISKETTE TO SAVE THE
|
||
DATA ALSO DESTROYS LOCATIONS 800-8FF. (REMEMBER THE FIRST LAW OF DISK KRACKING
|
||
- TRACK 0, SECTOR 0 ALWAYS STARTS WITH D5 AA 96 AND ALWAYS LOADS INTO 800-8FF).
|
||
BECAUSE THIS IS THE BEGINNING CLASS, LET'S LOOK AT TWO EXAMPLES OF SHORT BINARY
|
||
SUBROUTINES THAT WILL DO THE "SAVE" FOR US. BOTH START, AS WILL BE EXPLAINED
|
||
LATER, AT LOCATION FECD IN THE F8 ROM. THE FIRST IS THE MOST STRAIGHTFORWARD
|
||
AND EASIST TO FOLLOW:
|
||
|
||
LDY #$00 ;CLEAR Y-REGISTER
|
||
LDA $00,Y ;GET A BYTE FROM 0+Y
|
||
STA $2000,Y ;STORE AT 2000+Y
|
||
LDA $0100,Y ;THEN FROM 100+Y
|
||
STA $2100,Y ;TO 2100+Y
|
||
LDA $0200,Y ;AND SO ON UNTIL
|
||
STA $2200,Y ;WE HAVE COVERED
|
||
LDA $0300,Y ;ALL THE MEMORY
|
||
STA $2300,Y ;'PAGES' FROM 0 TO 8
|
||
LDA $0400,Y ;AND STORED INTO
|
||
STA $2400,Y ;PAGES 20 TO 28
|
||
LDA $0500,Y
|
||
STA $2500,Y
|
||
LDA $0600,Y
|
||
LDA $2600,Y
|
||
LDA $0700,Y
|
||
STA $2700,Y
|
||
LDA $0800,Y
|
||
STA $2800,Y
|
||
INY ;THEN ADD 1 TO Y-REG
|
||
BNE $FED0 ;AND REPEAT IF < 256
|
||
JMP $FF59 ;WHEN WE'RE ALL DONE
|
||
;JUMP TO MONITOR START
|
||
|
||
THIS 61-BYTE ROUTINE, IF IT COULD BE EXECUTED AUTOMATICALLY WHEN THE RESET KEY
|
||
IS PRESSED, WOULD SAFELY STASH ALL OF THE CHANGEABLE MEMORY AND EXIT GRACEFULLY
|
||
INTO THE MONITOR.
|
||
|
||
A MORE COMPACT AND GENERAL, BUT LESS OBVIOUS ROUTINE IS SHOWN BELOW. IT IS
|
||
INCLUDED BECAUSE IT IS TYPICAL OF THE "MEMORY MOVE PROGRAMS" THAT WE WILL
|
||
EVENTUALLY HAVE TO WRITE IN KRACKING ALMOST ANY PROGRAM.
|
||
|
||
LDY #$00 ;CLEAR Y-REGISTER
|
||
LDA $00,Y ;XFER THE ZERO PAGE TO
|
||
STA $2000,Y ;2000-20FF SO WE CAN USE
|
||
INY ;THE ZERO PAGE MEMORY
|
||
BNE $FED0 ;FOR THE OTHER MOVES
|
||
LDA #$00 ;SET UP LOCNS 0 & 1 AS A
|
||
STA $00 ;2-BYTE POINTER FOR THE
|
||
STA $02 ;SOURCE ADDRESS, USE 2&3
|
||
LDA #$01 ;AS 2-BYTE POINTER FOR
|
||
STA $01 ;THE DESTINATION ADDRESS
|
||
LDA #$21 ;STARTING AT $2100
|
||
STA $03
|
||
LDA ($00)<- ;GET A BYTE FROM 100-UP
|
||
STA ($02) ^ ;STORE AT 2100-UP
|
||
INC $02 ^ ;INCREMENT LO-ORDER BYTE
|
||
INC $00 ^ ;OF SOURCE & DESTINATION
|
||
BNE ->->->^ ;(BACK TO LDA ($00) IF
|
||
^ ;LO-ORDER IS <256
|
||
INC $03 ^ ;IF LO-ORDER=0, INC THE
|
||
INC $01 ^ ;HI BYTE OF EACH
|
||
LDA $01 ^ ;CHECK TO SEE IF HI-BYTE
|
||
CMP $#09 ^ ;IS 9 -WE'RE THRU AT 8FF
|
||
BNE ->->->^ ;IF NOT, LOOP BACK TO
|
||
;THE LOAD/STORE UNTIL
|
||
;WE'RE ALL DONE
|
||
JMP $FF59 ;EXIT THRU MONITOR
|
||
|
||
UNLIKE THE FIRST ROUTINE, THIS ONE (AT 47 BYTES) USES RAM LOCATIONS 0 THROUGH
|
||
3, SO THE ZERO PAGE MUST BE TRANSFERRED BEFORE IT IS ALTERED BY USING THOSE
|
||
ADDRESSES AS POINTERS. WHILE THE FIRST ROUTINE MUST GROW BY SIX BYTES FOR EACH
|
||
ADDITIONAL PAGE TRANSFERRED, THE SECOND NEEDS ONLY TO HAVE THE "9" IN THE
|
||
COMPARE STATEMENT CHANGED TO THE APPROPRIATE VALUE ONE HIGHER THAN THE LAST
|
||
PAGE NUMBER BEING TRANSFERRED.
|
||
|
||
TO RETURN TO THE BUSINESS OF ALTERING ROMS, IT IS EASY TO SEE THAT AN AUTOSTART
|
||
ROM COULD BE MADE TO BEHAVE LIKE AN OLD ROM JUST BY CHANGING LOCATIONS FFFC-D
|
||
TO 59 FF FROM 62 FA. (A NOTE TO THE FAINT-HEARTED--YOU CAN BUY AN OLD MONITOR
|
||
F8 ROM FOR ABOUT $10 AND PLUG IT DIRECTLY INTO YOU APPLE'S F8 SOCKET, BUT YOU
|
||
WON'T HAVE ALL THE BENEFITS WE'VE BEEN TALKING ABOUT). AS LONG AS WE'RE GOING
|
||
TO THE EFFORT OF MAKING A CHANGE, THOUGH, WE MIGHT AS WELL ADD ONE OF THE
|
||
ROUTINES ABOVE AND ALLOW THE NEW ROM TO SAVE THE VOLATILE MEMORY FOR US. TO DO
|
||
THIS, WE'LL HAVE TO GIVE UP SOMETHING IN THE ROM, AND THE MOST EASILY
|
||
SURRENDERED AREA FOR MOST OF US IS THE TAPE READ/SAVE ROUTINES AT $FECD. IF WE
|
||
THEN CHANGED FFFC-D TO CD FE, THE MEMORY FROM 0 TO 8FF WOULD BE SAVED TO
|
||
2000-28FF EVERY TIME THE 'RESET' KEY WAS PRESSED. SINCE IT'S SOMETIMES
|
||
INCONVENIENT TO HAVE THAT HAPPEN WHEN THE RESET KEY IS PRESSED, WE CAN REQUIRE
|
||
THAT A SPECIFIC KEY BE ALSO PRESSED TO MAKE IT OCCUR. THESE FEW INSTRUCTIONS
|
||
INSERTED BEFORE EITHER OF THE ROUTINES ABOVE WILL GIVE A "RESET AND SAVE" WHEN
|
||
THE "-" KEY IS HELD DOWN (OR WAS THE LAST KEY PRESSED), WHILE GIVING A REGULAR
|
||
"OLD RESET" THE REST OF THE TIME.
|
||
|
||
LDA $C000 ;LOOK AT THE KEYBOARD
|
||
ROL ;MASK OFF HIGH BIT
|
||
CMP #$5A ;WAS IT "-"?($2D X 2=$5A)
|
||
BNE ->->-> ;IF NOT, BRANCH TO THE
|
||
! ;LOCATION WITH THE
|
||
! ;"JUMP FF59" INSTRUCTION
|
||
! ;AT THE END OF THE SAVE
|
||
! ;SUBROUTINE.
|
||
|
||
|
||
OK, OK - WE ALL AGREE THAT THESE WOULD BE NEAT THINGS TO HAVE IN THE F8 ROM, SO
|
||
HOW DO WE GET IT THERE? FIRST, GET HOLD OF A PROMBURNER (PROMBLASTER, EPROM
|
||
PROGRAMMER, ETC.) THAT WILL PROGRAM 2716 EPROMS. EACH ONE IS DIFFERENT, SO I
|
||
WON'T TRY TO GIVE DETAILED INSTRUCTIONS ON THE ACTUAL PROGRAMMING. BUY OR
|
||
BORROW A FRIEND'S OLD F8 ROM (OR GET THE BINARY FILE) THEN TYPE IN OR LOAD IN
|
||
THE CHANGES YOU WANT TO MAKE AT FECD & UP AND AT FFFC-D, AND PROGRAM A 2716
|
||
EPROM WITH OUR MODIFIED VERSION OF APPLE'S F8 MONITOR ROM.
|
||
|
||
ALL THAT REMAINS TO TAKE FULL ADVANTAGE OF THE NEW F8 ROM IS TO MAKE A SLIGHTLY
|
||
MODIFIED SOCKET AND PLUG IT IN. BOTH THE 2716 AND THE ORIGINAL 9316 ROM USED
|
||
BY APPLE ARE READ-ONLY-MEMORY DEVICES HOLDING 2K BY 8 BITS OF INFORMATION
|
||
("16K" ROMS), BUT THE PINOUT, OR ASSIGNMENT OF CHIP FUNCTIONS TO PIN NUMBERS IS
|
||
SLIGHTLY DIFFERENT. TO USE THE 2716 IN A BOARD DESIGNED FOR A 9316, YOU NEED
|
||
TO TIE PIN 21 TO 5 VOLTS (PIN 24) AND TIE PIN 18 TO GROUND (PIN 12). YOU COULD
|
||
MODIFY THE PROM ITSELF, BUT YOU'RE LIABLE TO RUIN THE CHIP, AND IT CREATES A
|
||
REAL MAGILLA IF YOU NEED TO REPROGRAM IT. (A ROM CARD, SUCH AS AN INTEGER
|
||
CARD, CAN BE USED FOR 2716'S IF TWO JUMPERS ARE CONNECTED AT THE TOP OF THE
|
||
CARD, AND ->ONLY<- 2716'S ARE USED IN ALL OF ITS SOCKETS AFTER THAT).
|
||
|
||
GET A 24-PIN, PREFERABLY LOW-PROFILE IC SOCKET, AND ORIENT IT WITH THE PINS UP
|
||
AND THE NOTCH INDICATING THE 'PIN ONE' END TO THE RIGHT. IT SHOULD LOOK LIKE:
|
||
|
||
|
||
---------------------------------------
|
||
! 13 14 15 16 17 18 19 20 21 22 23 24!
|
||
! ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ !
|
||
! !
|
||
! !
|
||
! /
|
||
! (NOTCH)->!
|
||
! \
|
||
! !
|
||
! . . . . . . . . . . . . !
|
||
!/ / / / / / / / / / / / !
|
||
!12 11 10 9 8 7 6 5 4 3 2 1 !
|
||
---------------------------------------
|
||
|
||
|
||
USING A LOW-WATTAGE SOLDERING IRON, SOLDER A SHORT PIECE OF 26-30 GAUGE WIRE
|
||
BETWEEN PINS 21 AND 24, AND ANOTHER ONE BETWEEN PINS 12 AND 18. MAKE THE
|
||
CONNECTION AS CLOSE TO THE SOCKET AS POSSIBLE, AND TRY TO AVOID GETTING ANY
|
||
SOLDER ON THE ENDS OF PINS 12 AND 24. CUT OFF PINS 21 AND 18, AGAIN AS CLOSE
|
||
AS POSSIBLE TO THE SOCKET. (PLUGGING ANOTHER SOCKET INTO THE ONE BEING
|
||
MODIFIED WILL HELP TO PREVENT DISTORTION DURING THE SURGERY). THE SOCKET NOW
|
||
LOOKS LIKE:
|
||
|
||
---------------------------------------
|
||
! 13 14 15 16 17 18 19 20 21 22 23 24!
|
||
! ./ ./ ./ ./ ./ / ./ ./ / ./ ./ ./ !
|
||
! X X / !
|
||
! / / / !
|
||
! / /-------/ /
|
||
! /---------/ !
|
||
! / \
|
||
! / !
|
||
! / . . . . . . . . . . . !
|
||
!/ / / / / / / / / / / / !
|
||
!12 11 10 9 8 7 6 5 4 3 2 1 !
|
||
---------------------------------------
|
||
|
||
|
||
X=NO PIN
|
||
|
||
DOUBLE CHECK THE CONNECTIONS ON THE BOTTOM OF THE SOCKET, AND PLUG THE 2716
|
||
INTO THE SOCKET, BEING CAREFUL TO MATCH THE NOTCHED END OF THE CHIP TO THE
|
||
SOCKET. MAKE SURE THAT THE POWER TO THE APPLE IS TURNED OFF, AND PLUG THE
|
||
ASSEMBLY INTO THE F8 SOCKET ON THE MOTHER BOARD WITH THE NOTCH TOWARD THE FRONT
|
||
(KEYBOARD) END OF THE APPLE. CROSS YOUR FINGERS AND TURN ON THE APPLE. IF
|
||
THERE IS NO FAMILIAR "BEEP", OR IF THE TV SCREEN STAYS WHITE, OR IF THE SYSTEM
|
||
DOESN'T RESPOND TO THE RESET KEY, TURN OFF THE POWER AND EXAMINE THE CHIP AND
|
||
SOCKET CAREFULLY TO FIND THE ERROR. IF BLACK CLOUDS OF SMOKE ROLL OUT FROM THE
|
||
APPLE, FORGET WHERE YOU READ THIS. ACTUALLY, THE MOST COMMON MISTAKE OF
|
||
INSERTING THE CHIP BACKWARDS IS SELDOM HARMFUL TO IT, BUT DOES LOCK UP THE
|
||
APPLE'S BUS. REMEMBER THAT BOTH THE 2716 AND THE 9316 THAT YOU REMOVED CAN BE
|
||
DAMAGED BY STATIC ELECTRICITY, SO HANDLE WITH CARE AND DON'T SCUFF YOUR FEET ON
|
||
THE CAT.
|
||
|