1173 lines
55 KiB
Plaintext
1173 lines
55 KiB
Plaintext
|
|
CRACKING 101 - 1990 Edition
|
|
|
|
Lesson 4
|
|
revision 1
|
|
|
|
ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
|
|
³ REMOVING THE DOC CHECK FOR STAR CONTROL ³
|
|
ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
|
|
|
|
<
|
|
|
|
Added for revision 1 -
|
|
|
|
First, let me tell you about a major fuckup I made.
|
|
When I first wrote this file, I left out a major part of the
|
|
patch. For all of the user who got that version, I'm sorry
|
|
but even I make mistakes at 3:00 in the morning. Anyway,
|
|
just replace the original with this updated version
|
|
|
|
- Buckaroo Banzai
|
|
|
|
>
|
|
|
|
Hey, Buckaroo Banzai .. Cracking Guru back once again to
|
|
help you lesser crackist learn. This time, we will be going
|
|
over Star Control. This is the last lesson in the original
|
|
4. From here on out, I will simply release lessons as I
|
|
write them.
|
|
|
|
I want to say a few things about some of the groups out
|
|
there right now. Speed isn't everything. I really wish that
|
|
for example when you remove a doc check, most of us want it
|
|
REMOVED. We don't want to have to enter your group name or
|
|
even typing 1 letter is to much. We shouldn't even see the
|
|
menu for the doc check. Now, I don't direct this to all of
|
|
you, but there seems to have been a move from quality to
|
|
quickness. Let's go back to the days of SPI (and INC when
|
|
they were first getting started) and crack right. If there
|
|
is a doc check, remove it, not just fake it.
|
|
|
|
Nuff said, on with the tutorial.
|
|
|
|
Star Control (SC for here out) is a preaty good game.
|
|
The protection on it wasn't too hard, but if you didn't read
|
|
enough in to it, you would just kill the title music also.
|
|
|
|
So, how do we go about cracking SC. Well for this one I
|
|
opted to break out when SC asks for the code from the code
|
|
wheel. Originaly I did this just for the hell of it, but it
|
|
turned out to be a luck guess and made life a lot easier.
|
|
|
|
As usual we will be using periscope to crack SC. I used
|
|
PSKEY (using int 3 as the trap interrupt not int 2) to pop in
|
|
at the input routine. So lets get started. Load up PS and
|
|
PSKEY, then execute Star Control. When you get to the doc
|
|
check, break out.
|
|
|
|
Now you should be at the usual IRET insturction that's
|
|
part of PSKEY. Now comes the tricky part. Since we are
|
|
using a key trap to break out during the input sequence, we
|
|
could be anywhere inside the entire input routine. So in
|
|
cases like this I suggest finding a reference point.
|
|
|
|
So how do you pick the reference point. Well, since
|
|
this doc check must be entered via the keyboard you can bet
|
|
somewhere it will call INT 16h (bios keyboard) (although
|
|
there are times when this is not true, it rare). I think we
|
|
should go off and find that call to that interrupt.
|
|
|
|
So we trace (using the 'T' command) through some code
|
|
and finally come apon the follow subroutine ....
|
|
|
|
( NOTE: all comments were added by me )
|
|
|
|
|
|
; This is the actual routine that is used to get a key
|
|
|
|
2A00:09D4 55 PUSH BP
|
|
2A00:09D5 8BEC MOV BP,SP
|
|
2A00:09D7 8A6606 MOV AH,[BP+06]
|
|
2A00:09DA 8AD4 MOV DL,AH
|
|
2A00:09DC 80E20F AND DL,0F
|
|
2A00:09DF CD16 INT 16 ; Call to bios. We will
|
|
2A00:09E1 7509 JNZ 09EC ; use this as our
|
|
2A00:09E3 80FA01 CMP DL,01 ; reference point
|
|
2A00:09E6 7504 JNZ 09EC
|
|
2A00:09E8 33C0 XOR AX,AX
|
|
2A00:09EA EB0A JMP 09F6
|
|
2A00:09EC 80FA02 CMP DL,02
|
|
2A00:09EF 7405 JZ 09F6
|
|
2A00:09F1 0BC0 OR AX,AX
|
|
2A00:09F3 7501 JNZ 09F6
|
|
2A00:09F5 48 DEC AX
|
|
2A00:09F6 5D POP BP
|
|
2A00:09F7 CB RETF
|
|
|
|
So we write down the address of our REFERENCE point and
|
|
get ready to procede. Now, It's really kinda boring to keep
|
|
trying to trace through the entire input routine while trying
|
|
to enter the code string, so what we want to do next, is to
|
|
figure out the input routine. A quick look at this last
|
|
section of code shows that it only reads in a character but
|
|
really does not handle it.
|
|
|
|
So, we exit via the RETF at 9F7 enter the next level of
|
|
the subroutine. Again, if you manual trace through this
|
|
routine (as well as the next level up) you see that it simple
|
|
exits out rather quickly. This is definitly not the top loop
|
|
of the imput routine.
|
|
|
|
So, we trace through the next level up, and again exit
|
|
quickly to a higher level. But this time, as we trace
|
|
through, we find that the it loops back on itself. AHA, the
|
|
outer input loop. Here is the code to the entire input loop.
|
|
I have marked the place where you should enter from the lower
|
|
level.
|
|
|
|
( String input loop -- Outer level )
|
|
|
|
7C00:0835 FF365220 PUSH [2052]
|
|
7C00:0839 FF365020 PUSH [2050]
|
|
7C00:083D 9A2802FD41 CALL 41FD:0228 ; Entery here
|
|
7C00:0842 888670FE MOV [BP+FE70],AL
|
|
7C00:0946 0AC0 OR AL,AL
|
|
7C00:0848 7503 JNZ 084D
|
|
7C00:084A E99200 JMP 08DF
|
|
7C00:084D 2AE4 SUB AH,AH
|
|
7C00:084F 2D0800 SUB AX,0008
|
|
7C00:0852 745A JZ 08AE
|
|
7C00:0854 48 DEC AX
|
|
7C00:0855 48 DEC AX
|
|
7C00:0856 7503 JNZ 085B
|
|
7C00:0858 E90901 JMP 0964
|
|
7C00:085B 2D0300 SUB AX,0003
|
|
7C00:085E 7503 JNZ 0863
|
|
7C00:0860 E90101 JMP 0964
|
|
7C00:0863 8A9E70FE MOV BL,[BP+FE70]
|
|
7C00:0867 2AFF SUB BH,BH
|
|
7C00:0869 F687790B57 TEST BYTE PTR [BX+0B79],57
|
|
7C00:086E 746F JZ 08DF
|
|
7C00:0870 F687790B03 TEST BYTE PTR [BX+0B79],03
|
|
7C00:0875 740C JZ 0883
|
|
7C00:0877 F687790B02 TEST BYTE PTR [BX+0B79],02
|
|
7C00:087C 7405 JZ 0883
|
|
7C00:087E 80AE70FE20 SUB BYTE PTR [BP+FE70],20
|
|
7C00:0883 8A8670FE MOV AL,[BP+FE70]
|
|
7C00:0887 C49E7EFE LES BX,[BP+FE7E]
|
|
7C00:088B 8BB682FE MOV SI,[BP+FE82]
|
|
7C00:088F 26 ES:
|
|
7C00:0890 8800 MOV [BX+SI],AL
|
|
7C00:0892 FF8682FE INC WORD PTR [BP+FE82]
|
|
7C00:0896 FFB688FE PUSH [BP+FE88]
|
|
7C00:089A 8D8678FE LEA AX,[BP+FE78]
|
|
7C00:089E 50 PUSH AX
|
|
7C00:089F 9A56049324 CALL 2493:0456
|
|
7C00:08A4 83C404 ADD SP,+04
|
|
7C00:08A7 0BC0 OR AX,AX
|
|
7C00:08A9 7534 JNZ 08DF
|
|
7C00:08AB EB27 JMP 08D4
|
|
7C00:08AD 90 NOP
|
|
7C00:08AE 83BE82FE00 CMP WORD PTR [BP+FE82],+00
|
|
7C00:08B3 7404 JZ 08B9
|
|
7C00:08B5 FF8E82FE DEC WORD PTR [BP+FE82]
|
|
7C00:08B9 B008 MOV AL,08
|
|
7C00:08BB 50 PUSH AX
|
|
7C00:08BC 9A1003443D CALL 3D44:0310
|
|
7C00:08C1 8D8684FE LEA AX,[BP+FE84]
|
|
7C00:08C5 16 PUSH SS
|
|
7C00:08C6 50 PUSH AX
|
|
7C00:08C7 9A6A00843D CALL 3D84:006A
|
|
7C00:08CC B047 MOV AL,47
|
|
7C00:08CE 50 PUSH AX
|
|
7C00:08CF 9A1003443D CALL 3D44:0310
|
|
7C00:08D4 8D8678FE LEA AX,[BP+FE78]
|
|
7C00:08D8 16 PUSH SS
|
|
7C00:08D9 50 PUSH AX
|
|
7C00:08DA 9A8202C93C CALL 3CC9:0282
|
|
7C00:08DF 83BE8CFE00 CMP WORD PTR [BP+FE8C],+00
|
|
7C00:08E4 7503 JNZ 08E9
|
|
7C00:08E6 E94CFF JMP 0835 ; <ÄÄÄ¿
|
|
³
|
|
as you can see, at this point it loops back on itself.
|
|
This is what tells use that it's the outer loop. Knowing
|
|
that, we can just set a code breakpoint at 8E9 (the next
|
|
instruction after the loop) and execute the code.
|
|
|
|
At this point, the SC will pause waiting for you to
|
|
enter the code key. Use the code wheel and enter the correct
|
|
key (after all, it's kinda hard to crack a game without
|
|
having the proper codes right...)
|
|
|
|
So, we have now exited the input loop with everything
|
|
intact (ie: the proper code was entered). Next step is to
|
|
figure out what happens when the proper code is entered.
|
|
Well, since you have entered the proper code, just follow
|
|
this routine out. Remember back to lesson 2. What we want
|
|
to do is find the call the to routine that does the doc check
|
|
and remove it somehow (a PROPER crack). So since everything
|
|
is in the right place, if we just keep jumping over the code
|
|
we should find our way out.
|
|
|
|
So after jumping over many instructions, we come the the
|
|
follow piece of code
|
|
|
|
7C00:0B74 8BE5 MOV SP,BP
|
|
7C00:0B76 5D POP BP
|
|
7C00:0B77 CB RETF
|
|
|
|
By now, you should know that what you are looking at is
|
|
the exit routine for a higher level language's (C or pascal)
|
|
code. So we have found the end of the doc check. After
|
|
tracing through the RETF you find yourself looking down a cmp
|
|
and a conditional jump. Here is the code (NOTE! I have
|
|
included the actual call to the doc check just for reference)
|
|
|
|
45E2:0235 9A46010F4A CALL 7C00:146 ; Call to Doc Check
|
|
45E2:023A 83C404 ADD SP,+04
|
|
45E2:023D 0BC0 OR AX,AX
|
|
45E2:023F 7465 JZ 02A6
|
|
|
|
Notice the value of the AX register. Since right after
|
|
the doc check, it is acted upon, then it has some importance.
|
|
So, now that we know where the doc check takes place, how do
|
|
we remove it.
|
|
|
|
Well, We could patch it with the code
|
|
|
|
45E2:0235 B40100 MOV AX,0001
|
|
45E2:0238 90 NOP
|
|
45E2:0239 90 NOP
|
|
|
|
This patch will work (I know, it's how I first patched
|
|
the program). But there is one small problem. If you run
|
|
the program after adding this patch, you will find that the
|
|
title music doesn't play. So, this is now a good place to
|
|
put the patch.
|
|
|
|
So where then. Well, make note of the address of the
|
|
call to the doc check. Now, restart the process but this
|
|
time right after SC switches in to graphics mode, break out.
|
|
|
|
Now, set a breakpoint at the address from above (in my
|
|
case 45E2:0235). Let SC run in to the intro. You will find
|
|
that although the title screen comes up, the music doesn't
|
|
kick in before the breakpoint is reached.
|
|
|
|
No, they couldn't...they wouldn't.. well they did. The
|
|
music routines for the intro are stored in the routine for
|
|
the doc check. Here is the entire doc check. I have
|
|
commented on some of the code
|
|
|
|
|
|
; these first few calls seem to load something from disk
|
|
|
|
|
|
7C00:0146 55 PUSH BP
|
|
7C00:0147 8BEC MOV BP,SP
|
|
7C00:0149 81EC9001 SUB SP,0190
|
|
7C00:014D 57 PUSH DI
|
|
7C00:014E 56 PUSH SI
|
|
7C00:014F 8B4608 MOV AX,[BP+08]
|
|
7C00:0152 0B4606 OR AX,[BP+06]
|
|
7C00:0155 740E JZ 0165
|
|
7C00:0157 FF7608 PUSH [BP+08]
|
|
7C00:015A FF7606 PUSH [BP+06]
|
|
7C00:015D 9A65341E2D CALL 2D1E:3465
|
|
7C00:0162 83C404 ADD SP,+04
|
|
7C00:0165 FF365220 PUSH [2052]
|
|
7C00:0169 FF365020 PUSH [2050]
|
|
7C00:016D 9A2802FD41 CALL 41FD:0228
|
|
7C00:0172 0AC0 OR AL,AL
|
|
7C00:0174 75EF JNZ 0165
|
|
7C00:0176 B80200 MOV AX,0002
|
|
7C00:0179 898664FF MOV [BP+FF64],AX
|
|
7C00:017D 898672FF MOV [BP+FF72],AX
|
|
7C00:0181 2BC0 SUB AX,AX
|
|
7C00:0183 898662FF MOV [BP+FF62],AX
|
|
7C00:0187 89866AFF MOV [BP+FF6A],AX
|
|
7C00:018B 898674FF MOV [BP+FF74],AX
|
|
7C00:018F B80100 MOV AX,0001
|
|
7C00:0192 898666FF MOV [BP+FF66],AX
|
|
7C00:0196 89866CFF MOV [BP+FF6C],AX
|
|
7C00:019A 898670FF MOV [BP+FF70],AX
|
|
7C00:019E 898676FF MOV [BP+FF76],AX
|
|
7C00:01A2 B80300 MOV AX,0003
|
|
7C00:01A5 898668FF MOV [BP+FF68],AX
|
|
7C00:01A9 89866EFF MOV [BP+FF6E],AX
|
|
7C00:01AD 898678FF MOV [BP+FF78],AX
|
|
|
|
; Although I have NO IDEA what the hell is being setup
|
|
; here I suspect that it is the must
|
|
|
|
7C00:01B1 C746860400 MOV WORD PTR [BP-7A],0004
|
|
7C00:01B6 C746880100 MOV WORD PTR [BP-78],0001
|
|
7C00:01BB C7468A0200 MOV WORD PTR [BP-76],0002
|
|
7C00:01C0 C7468C0000 MOV WORD PTR [BP-74],0000
|
|
7C00:01C5 C7468E0000 MOV WORD PTR [BP-72],0000
|
|
7C00:01CA C746900500 MOV WORD PTR [BP-70],0005
|
|
7C00:01CF C746920600 MOV WORD PTR [BP-6E],0006
|
|
7C00:01D4 C746940700 MOV WORD PTR [BP-6C],0007
|
|
7C00:01D9 C746960C00 MOV WORD PTR [BP-6A],000C
|
|
7C00:01DE 894698 MOV [BP-68],AX
|
|
7C00:01E1 C7469A0500 MOV WORD PTR [BP-66],0005
|
|
7C00:01E6 C7469C0D00 MOV WORD PTR [BP-64],000D
|
|
7C00:01EB C7469E0000 MOV WORD PTR [BP-62],0000
|
|
7C00:01F0 C746A00100 MOV WORD PTR [BP-60],0001
|
|
7C00:01F5 C746A20200 MOV WORD PTR [BP-5E],0002
|
|
7C00:01FA C746A40800 MOV WORD PTR [BP-5C],0008
|
|
7C00:01FF B80400 MOV AX,0004
|
|
7C00:0202 8946A6 MOV [BP-5A],AX
|
|
7C00:0205 8946A8 MOV [BP-58],AX
|
|
7C00:0208 C746AA0600 MOV WORD PTR [BP-56],0006
|
|
7C00:020D C746AC0800 MOV WORD PTR [BP-54],0008
|
|
7C00:0212 C746AE0700 MOV WORD PTR [BP-52],0007
|
|
7C00:0217 C746B00900 MOV WORD PTR [BP-50],0009
|
|
7C00:021C C746B20A00 MOV WORD PTR [BP-4E],000A
|
|
7C00:0221 8946B4 MOV [BP-4C],AX
|
|
7C00:0224 C746B60C00 MOV WORD PTR [BP-4A],000C
|
|
7C00:0229 C746B80300 MOV WORD PTR [BP-48],0003
|
|
7C00:022E C746BA0B00 MOV WORD PTR [BP-46],000B
|
|
7C00:0233 C746BC0D00 MOV WORD PTR [BP-44],000D
|
|
7C00:0238 C746BE0B00 MOV WORD PTR [BP-42],000B
|
|
7C00:023D C746C00500 MOV WORD PTR [BP-40],0005
|
|
7C00:0242 C746C20100 MOV WORD PTR [BP-3E],0001
|
|
7C00:0247 C746C40700 MOV WORD PTR [BP-3C],0007
|
|
7C00:024C C746C60000 MOV WORD PTR [BP-3A],0000
|
|
7C00:0251 C746C80600 MOV WORD PTR [BP-38],0006
|
|
7C00:0256 C746CA0200 MOV WORD PTR [BP-36],0002
|
|
7C00:025B C746CC0300 MOV WORD PTR [BP-34],0003
|
|
7C00:0260 C746CE0800 MOV WORD PTR [BP-32],0008
|
|
7C00:0265 C746D00900 MOV WORD PTR [BP-30],0009
|
|
7C00:026A C746D20A00 MOV WORD PTR [BP-2E],000A
|
|
7C00:026F C746D40B00 MOV WORD PTR [BP-2C],000B
|
|
7C00:0274 C746D60C00 MOV WORD PTR [BP-2A],000C
|
|
7C00:0279 C746D80A00 MOV WORD PTR [BP-28],000A
|
|
7C00:027E C746DA0500 MOV WORD PTR [BP-26],0005
|
|
7C00:0283 C746DC0D00 MOV WORD PTR [BP-24],000D
|
|
7C00:0288 C746DE0800 MOV WORD PTR [BP-22],0008
|
|
7C00:028D C746E00900 MOV WORD PTR [BP-20],0009
|
|
7C00:0292 C746E20300 MOV WORD PTR [BP-1E],0003
|
|
7C00:0297 C746E40B00 MOV WORD PTR [BP-1C],000B
|
|
7C00:029C C78692FE0000 MOV WORD PTR [BP+FE92],0000
|
|
7C00:02A2 C78694FE2B00 MOV WORD PTR [BP+FE94],002B
|
|
7C00:02A8 C78696FE0200 MOV WORD PTR [BP+FE96],0002
|
|
7C00:02AE C78698FE0300 MOV WORD PTR [BP+FE98],0003
|
|
7C00:02B4 89869AFE MOV [BP+FE9A],AX
|
|
7C00:02B8 C7869CFE0500 MOV WORD PTR [BP+FE9C],0005
|
|
7C00:02BE C7869EFE0600 MOV WORD PTR [BP+FE9E],0006
|
|
7C00:02C4 C786A0FE0E00 MOV WORD PTR [BP+FEA0],000E
|
|
7C00:02CA C786A2FE2B00 MOV WORD PTR [BP+FEA2],002B
|
|
7C00:02D0 C786A4FE0900 MOV WORD PTR [BP+FEA4],0009
|
|
7C00:02D6 C786A6FE0A00 MOV WORD PTR [BP+FEA6],000A
|
|
7C00:02DC C786A8FE0B00 MOV WORD PTR [BP+FEA8],000B
|
|
7C00:02E2 C786AAFE0C00 MOV WORD PTR [BP+FEAA],000C
|
|
7C00:02E8 C786ACFE2B00 MOV WORD PTR [BP+FEAC],002B
|
|
7C00:02EE C786AEFE0F00 MOV WORD PTR [BP+FEAE],000F
|
|
7C00:02F4 C786B0FE0D00 MOV WORD PTR [BP+FEB0],000D
|
|
7C00:02FA C786B2FE1000 MOV WORD PTR [BP+FEB2],0010
|
|
7C00:0300 C786B4FE1100 MOV WORD PTR [BP+FEB4],0011
|
|
7C00:0306 C786B6FE1200 MOV WORD PTR [BP+FEB6],0012
|
|
7C00:030C C786B8FE1300 MOV WORD PTR [BP+FEB8],0013
|
|
7C00:0312 C786BAFE1400 MOV WORD PTR [BP+FEBA],0014
|
|
7C00:0318 C786BCFE1500 MOV WORD PTR [BP+FEBC],0015
|
|
7C00:031E C786BEFE1600 MOV WORD PTR [BP+FEBE],0016
|
|
7C00:0324 C786C0FE1700 MOV WORD PTR [BP+FEC0],0017
|
|
7C00:032A C786C2FE0800 MOV WORD PTR [BP+FEC2],0008
|
|
7C00:0330 C786C4FE1800 MOV WORD PTR [BP+FEC4],0018
|
|
7C00:0336 C786C6FE2B00 MOV WORD PTR [BP+FEC6],002B
|
|
7C00:033C C786C8FE1900 MOV WORD PTR [BP+FEC8],0019
|
|
7C00:0342 C786CAFE2B00 MOV WORD PTR [BP+FECA],002B
|
|
7C00:0348 C786CCFE1A00 MOV WORD PTR [BP+FECC],001A
|
|
7C00:034E C786CEFE1B00 MOV WORD PTR [BP+FECE],001B
|
|
7C00:0354 C786D0FE1C00 MOV WORD PTR [BP+FED0],001C
|
|
7C00:035A C786D2FE1D00 MOV WORD PTR [BP+FED2],001D
|
|
7C00:0360 C786D4FE1E00 MOV WORD PTR [BP+FED4],001E
|
|
7C00:0366 C786D6FE1F00 MOV WORD PTR [BP+FED6],001F
|
|
7C00:036C C786D8FE2000 MOV WORD PTR [BP+FED8],0020
|
|
7C00:0372 C786DAFE2100 MOV WORD PTR [BP+FEDA],0021
|
|
7C00:0378 C786DCFE0700 MOV WORD PTR [BP+FEDC],0007
|
|
7C00:037E C786DEFE2200 MOV WORD PTR [BP+FEDE],0022
|
|
7C00:0384 C786E0FE2300 MOV WORD PTR [BP+FEE0],0023
|
|
7C00:038A C786E2FE2400 MOV WORD PTR [BP+FEE2],0024
|
|
7C00:0390 C786E4FE2500 MOV WORD PTR [BP+FEE4],0025
|
|
7C00:0396 C786E6FE2600 MOV WORD PTR [BP+FEE6],0026
|
|
7C00:039C C786E8FE2B00 MOV WORD PTR [BP+FEE8],002B
|
|
7C00:03A2 C786EAFE2700 MOV WORD PTR [BP+FEEA],0027
|
|
7C00:03A8 C786ECFE2800 MOV WORD PTR [BP+FEEC],0028
|
|
7C00:03AE C786EEFE2900 MOV WORD PTR [BP+FEEE],0029
|
|
7C00:03B4 C786F0FE2A00 MOV WORD PTR [BP+FEF0],002A
|
|
7C00:03BA 8D46F4 LEA AX,[BP-0C]
|
|
7C00:03BD 50 PUSH AX
|
|
7C00:03BE 8D867AFF LEA AX,[BP+FF7A]
|
|
7C00:03C2 50 PUSH AX
|
|
7C00:03C3 8D862CFF LEA AX,[BP+FF2C]
|
|
7C00:03C7 50 PUSH AX
|
|
7C00:03C8 8D8628FF LEA AX,[BP+FF28]
|
|
7C00:03CC 50 PUSH AX
|
|
7C00:03CD E832FC CALL 0002 ; Music Plays
|
|
7C00:03D0 0BC0 OR AX,AX
|
|
7C00:03D2 7503 JNZ 03D7
|
|
7C00:03D4 E99B07 JMP 0B72
|
|
7C00:03D7 FF36AA1E PUSH [1EAA]
|
|
7C00:03DB 9A0200443D CALL 3D44:0002
|
|
7C00:03E0 FF36AE1E PUSH [1EAE]
|
|
7C00:03E4 FF36AC1E PUSH [1EAC]
|
|
7C00:03E8 9A0C008D3D CALL 3D8D:000C
|
|
7C00:03ED B80201 MOV AX,0102
|
|
7C00:03F0 50 PUSH AX
|
|
7C00:03F1 9ADE02443D CALL 3D44:02DE
|
|
7C00:03F6 B80400 MOV AX,0004
|
|
7C00:03F9 BA4000 MOV DX,0040
|
|
7C00:03FC 52 PUSH DX
|
|
7C00:03FD 50 PUSH AX
|
|
7C00:03FE 8D868CFE LEA AX,[BP+FE8C]
|
|
7C00:0402 50 PUSH AX
|
|
7C00:0403 9A7000963B CALL 3B96:0070 ; Music plays
|
|
7C00:0408 89868EFE MOV [BP+FE8E],AX
|
|
7C00:040C 899690FE MOV [BP+FE90],DX
|
|
7C00:0410 0BD0 OR DX,AX
|
|
7C00:0412 7471 JZ 0485
|
|
7C00:0414 2BC0 SUB AX,AX
|
|
7C00:0416 898686FE MOV [BP+FE86],AX
|
|
7C00:041A 898684FE MOV [BP+FE84],AX
|
|
7C00:041E FFB690FE PUSH [BP+FE90]
|
|
7C00:0422 FFB68EFE PUSH [BP+FE8E]
|
|
7C00:0426 9A0A00F93C CALL 3CF9:000A
|
|
7C00:042B 898688FE MOV [BP+FE88],AX
|
|
7C00:042F 89968AFE MOV [BP+FE8A],DX
|
|
7C00:0433 833EB41E00 CMP WORD PTR [1EB4],+00
|
|
7C00:0438 7514 JNZ 044E
|
|
7C00:043A 8B4608 MOV AX,[BP+08]
|
|
7C00:043D 0B4606 OR AX,[BP+06]
|
|
7C00:0440 740C JZ 044E
|
|
7C00:0442 B80100 MOV AX,0001
|
|
7C00:0445 50 PUSH AX
|
|
7C00:0446 9AF4019324 CALL 2493:01F4
|
|
7C00:044B 83C402 ADD SP,+02
|
|
7C00:044E 2AC0 SUB AL,AL
|
|
7C00:0450 50 PUSH AX
|
|
7C00:0451 9A4803443D CALL 3D44:0348
|
|
7C00:0456 9A57331E2D CALL 2D1E:3357
|
|
7C00:045B 9A9911A73B CALL 3BA7:1199
|
|
7C00:0460 8D8684FE LEA AX,[BP+FE84]
|
|
7C00:0464 16 PUSH SS
|
|
7C00:0465 50 PUSH AX
|
|
7C00:0466 9A04007E3D CALL 3D7E:0004 ; Music plays
|
|
7C00:046B FFB68AFE PUSH [BP+FE8A]
|
|
7C00:046F FFB688FE PUSH [BP+FE88]
|
|
7C00:0473 9AF001F93C CALL 3CF9:01F0
|
|
7C00:0478 FFB690FE PUSH [BP+FE90]
|
|
7C00:047C FFB68EFE PUSH [BP+FE8E]
|
|
7C00:0480 9A78068D3D CALL 3D8D:0678 ; Music plays
|
|
7C00:0485 8B4608 MOV AX,[BP+08]
|
|
7C00:0488 0B4606 OR AX,[BP+06]
|
|
7C00:048B 7429 JZ 04B6
|
|
7C00:048D 833EB41E00 CMP WORD PTR [1EB4],+00
|
|
7C00:0492 740C JZ 04A0
|
|
7C00:0494 B80100 MOV AX,0001
|
|
7C00:0497 50 PUSH AX
|
|
7C00:0498 9AF4019324 CALL 2493:01F4 ; Music Plays
|
|
7C00:049D 83C402 ADD SP,+02
|
|
7C00:04A0 9A8C341E2D CALL 2D1E:348C
|
|
7C00:04A5 FF7608 PUSH [BP+08]
|
|
7C00:04A8 FF7606 PUSH [BP+06]
|
|
7C00:04AB 9A2A006342 CALL 4263:002A
|
|
7C00:04B0 50 PUSH AX
|
|
7C00:04B1 9A54006342 CALL 4263:0054
|
|
|
|
; this is the start of the actual doc check. OH! As you can
|
|
; tell, I wasn't too intrested in the music routines, but
|
|
; thought it might be fun to track them down
|
|
|
|
7C00:04B6 9AD0098D3D CALL 3D8D:09D0 ; Show Doc check
|
|
; screen
|
|
7C00:04BB B80301 MOV AX,0103
|
|
7C00:04BE 50 PUSH AX
|
|
7C00:04BF 9ADE02443D CALL 3D44:02DE
|
|
7C00:04C4 C746F60B00 MOV WORD PTR [BP-0A],000B
|
|
7C00:04C9 C746F87900 MOV WORD PTR [BP-08],0079
|
|
7C00:04CE C746FA2801 MOV WORD PTR [BP-06],0128
|
|
7C00:04D3 C746FC4500 MOV WORD PTR [BP-04],0045
|
|
7C00:04D8 B008 MOV AL,08
|
|
7C00:04DA 50 PUSH AX
|
|
7C00:04DB 9A1003443D CALL 3D44:0310
|
|
7C00:04E0 8D867AFF LEA AX,[BP+FF7A]
|
|
7C00:04E4 16 PUSH SS
|
|
7C00:04E5 50 PUSH AX
|
|
7C00:04E6 9A36007E3D CALL 3D7E:0036 ; Show alien's face
|
|
|
|
7C00:04EB C746E6A000 MOV WORD PTR [BP-1A],00A0
|
|
7C00:04F0 C746EA0100 MOV WORD PTR [BP-16],0001
|
|
7C00:04F5 C746840300 MOV WORD PTR [BP-7C],0003
|
|
7C00:04FA 2AC0 SUB AL,AL
|
|
7C00:04FC 50 PUSH AX
|
|
7C00:04FD 9A1003443D CALL 3D44:0310
|
|
7C00:0502 8B46F8 MOV AX,[BP-08]
|
|
7C00:0505 050700 ADD AX,0007
|
|
7C00:0508 8946E8 MOV [BP-18],AX
|
|
7C00:050B FFB62EFF PUSH [BP+FF2E]
|
|
7C00:050F FFB62CFF PUSH [BP+FF2C]
|
|
7C00:0513 FFB62EFF PUSH [BP+FF2E]
|
|
7C00:0517 FFB62CFF PUSH [BP+FF2C]
|
|
7C00:051B 9AE400FC44 CALL 44FC:00E4
|
|
7C00:0520 8BF0 MOV SI,AX
|
|
7C00:0522 9A1201E245 CALL 45E2:0112
|
|
7C00:0527 B90500 MOV CX,0005
|
|
7C00:052A 8BD0 MOV DX,AX
|
|
7C00:052C 8BC6 MOV AX,SI
|
|
7C00:052E 8BDA MOV BX,DX
|
|
7C00:0530 2BD2 SUB DX,DX
|
|
7C00:0532 F7F1 DIV CX
|
|
7C00:0534 8BD0 MOV DX,AX
|
|
7C00:0536 4A DEC DX
|
|
7C00:0537 8BC3 MOV AX,BX
|
|
7C00:0539 8BDA MOV BX,DX
|
|
7C00:053B 2BD2 SUB DX,DX
|
|
7C00:053D F7F3 DIV BX
|
|
7C00:053F 42 INC DX
|
|
7C00:0540 8BC2 MOV AX,DX
|
|
7C00:0542 D1E2 SHL DX,1
|
|
7C00:0544 D1E2 SHL DX,1
|
|
7C00:0546 03D0 ADD DX,AX
|
|
7C00:0548 52 PUSH DX
|
|
7C00:0549 9A2801FC44 CALL 44FC:0128
|
|
7C00:054E 89868EFE MOV [BP+FE8E],AX
|
|
7C00:0552 899690FE MOV [BP+FE90],DX
|
|
7C00:0556 C78672FE0000 MOV WORD PTR [BP+FE72],0000
|
|
|
|
; This is the start of the loop the prints out the stupid
|
|
; message
|
|
|
|
7C00:055C 52 PUSH DX
|
|
7C00:055D 50 PUSH AX
|
|
7C00:055E 9A4602FC44 CALL 44FC:0246
|
|
7C00:0563 8946EC MOV [BP-14],AX
|
|
7C00:0566 8956EE MOV [BP-12],DX
|
|
7C00:0569 FFB690FE PUSH [BP+FE90]
|
|
7C00:056D FFB68EFE PUSH [BP+FE8E]
|
|
7C00:0571 9AF201FC44 CALL 44FC:01F2
|
|
7C00:0576 8946F0 MOV [BP-10],AX
|
|
7C00:0579 8D46E6 LEA AX,[BP-1A]
|
|
7C00:057C 16 PUSH SS
|
|
7C00:057D 50 PUSH AX
|
|
7C00:057E 9A8202C93C CALL 3CC9:0282
|
|
7C00:0583 8346E80A ADD WORD PTR [BP-18],+0A
|
|
7C00:0587 FFB690FE PUSH [BP+FE90]
|
|
7C00:058B FFB68EFE PUSH [BP+FE8E]
|
|
7C00:058F B80100 MOV AX,0001
|
|
7C00:0592 50 PUSH AX
|
|
7C00:0593 9A7E01FC44 CALL 44FC:017E
|
|
7C00:0598 89868EFE MOV [BP+FE8E],AX
|
|
7C00:059C 899690FE MOV [BP+FE90],DX
|
|
7C00:05A0 FF8672FE INC WORD PTR [BP+FE72]
|
|
7C00:05A4 83BE72FE05 CMP WORD PTR [BP+FE72],+05
|
|
7C00:05A9 7CB1 JL 055C
|
|
|
|
; Reads in the code to check (I think. Oh hell it really
|
|
; doesn't matter)
|
|
|
|
7C00:05AB 9A1201E245 CALL 45E2:0112
|
|
7C00:05B0 B90C00 MOV CX,000C
|
|
7C00:05B3 99 CWD
|
|
7C00:05B4 F7F9 IDIV CX
|
|
7C00:05B6 895682 MOV [BP-7E],DX
|
|
7C00:05B9 9A1201E245 CALL 45E2:0112
|
|
7C00:05BE B90C00 MOV CX,000C
|
|
7C00:05C1 99 CWD
|
|
7C00:05C2 F7F9 IDIV CX
|
|
7C00:05C4 8956F2 MOV [BP-0E],DX
|
|
7C00:05C7 9A1201E245 CALL 45E2:0112
|
|
7C00:05CC B90C00 MOV CX,000C
|
|
7C00:05CF 99 CWD
|
|
7C00:05D0 F7F9 IDIV CX
|
|
7C00:05D2 8956FE MOV [BP-02],DX
|
|
7C00:05D5 9A1201E245 CALL 45E2:0112
|
|
7C00:05DA B90C00 MOV CX,000C
|
|
7C00:05DD 99 CWD
|
|
7C00:05DE F7F9 IDIV CX
|
|
7C00:05E0 8996F4FE MOV [BP+FEF4],DX
|
|
7C00:05E4 FFB62AFF PUSH [BP+FF2A]
|
|
7C00:05E8 FFB628FF PUSH [BP+FF28]
|
|
7C00:05EC FF7682 PUSH [BP-7E]
|
|
7C00:05EF 9A2801FC44 CALL 44FC:0128
|
|
7C00:05F4 89868EFE MOV [BP+FE8E],AX
|
|
7C00:05F8 899690FE MOV [BP+FE90],DX
|
|
7C00:05FC 52 PUSH DX
|
|
7C00:05FD 50 PUSH AX
|
|
7C00:05FE 8D86F6FE LEA AX,[BP+FEF6]
|
|
7C00:0602 16 PUSH SS
|
|
7C00:0603 50 PUSH AX
|
|
7C00:0604 9A9A02FC44 CALL 44FC:029A
|
|
7C00:0609 FFB62AFF PUSH [BP+FF2A]
|
|
7C00:060D FFB628FF PUSH [BP+FF28]
|
|
7C00:0611 8B46FE MOV AX,[BP-02]
|
|
7C00:0614 050C00 ADD AX,000C
|
|
7C00:0617 50 PUSH AX
|
|
7C00:0618 9A2801FC44 CALL 44FC:0128
|
|
7C00:061D 89868EFE MOV [BP+FE8E],AX
|
|
7C00:0621 899690FE MOV [BP+FE90],DX
|
|
7C00:0625 52 PUSH DX
|
|
7C00:0626 50 PUSH AX
|
|
7C00:0627 8DBEF6FE LEA DI,[BP+FEF6]
|
|
7C00:062B 16 PUSH SS
|
|
7C00:062C 07 POP ES
|
|
7C00:062D B9FFFF MOV CX,FFFF
|
|
7C00:0630 33C0 XOR AX,AX
|
|
7C00:0632 F2 REPNZ
|
|
7C00:0633 AE SCASB
|
|
7C00:0634 F7D1 NOT CX
|
|
7C00:0636 49 DEC CX
|
|
7C00:0637 8BF1 MOV SI,CX
|
|
7C00:0639 8D82F6FE LEA AX,[BP+SI+FEF6]
|
|
7C00:063D 16 PUSH SS
|
|
7C00:063E 50 PUSH AX
|
|
7C00:063F 9A9A02FC44 CALL 44FC:029A
|
|
7C00:0644 FFB62AFF PUSH [BP+FF2A]
|
|
7C00:0648 FFB628FF PUSH [BP+FF28]
|
|
7C00:064C 8B46F2 MOV AX,[BP-0E]
|
|
7C00:064F 051800 ADD AX,0018
|
|
7C00:0652 50 PUSH AX
|
|
7C00:0653 9A2801FC44 CALL 44FC:0128
|
|
7C00:0658 89868EFE MOV [BP+FE8E],AX
|
|
7C00:065C 899690FE MOV [BP+FE90],DX
|
|
7C00:0660 52 PUSH DX
|
|
7C00:0661 50 PUSH AX
|
|
7C00:0662 8DBEF6FE LEA DI,[BP+FEF6]
|
|
7C00:0666 16 PUSH SS
|
|
7C00:0667 07 POP ES
|
|
7C00:0668 B9FFFF MOV CX,FFFF
|
|
7C00:066B 33C0 XOR AX,AX
|
|
7C00:066D F2 REPNZ
|
|
7C00:066E AE SCASB
|
|
7C00:066F F7D1 NOT CX
|
|
7C00:0671 49 DEC CX
|
|
7C00:0672 8BF1 MOV SI,CX
|
|
7C00:0674 8D82F6FE LEA AX,[BP+SI+FEF6]
|
|
7C00:0678 16 PUSH SS
|
|
7C00:0679 50 PUSH AX
|
|
7C00:067A 9A9A02FC44 CALL 44FC:029A
|
|
7C00:067F FFB62AFF PUSH [BP+FF2A]
|
|
7C00:0683 FFB628FF PUSH [BP+FF28]
|
|
7C00:0687 8B86F4FE MOV AX,[BP+FEF4]
|
|
7C00:068B 052400 ADD AX,0024
|
|
7C00:068E 50 PUSH AX
|
|
7C00:068F 9A2801FC44 CALL 44FC:0128
|
|
7C00:0694 89868EFE MOV [BP+FE8E],AX
|
|
7C00:0698 899690FE MOV [BP+FE90],DX
|
|
7C00:069C 52 PUSH DX
|
|
7C00:069D 50 PUSH AX
|
|
7C00:069E 8DBEF6FE LEA DI,[BP+FEF6]
|
|
7C00:06A2 16 PUSH SS
|
|
7C00:06A3 07 POP ES
|
|
7C00:06A4 B9FFFF MOV CX,FFFF
|
|
7C00:06A7 33C0 XOR AX,AX
|
|
7C00:06A9 F2 REPNZ
|
|
7C00:06AA AE SCASB
|
|
7C00:06AB F7D1 NOT CX
|
|
7C00:06AD 49 DEC CX
|
|
7C00:06AE 8BF1 MOV SI,CX
|
|
7C00:06B0 8D82F6FE LEA AX,[BP+SI+FEF6]
|
|
7C00:06B4 16 PUSH SS
|
|
7C00:06B5 50 PUSH AX
|
|
7C00:06B6 9A9A02FC44 CALL 44FC:029A
|
|
7C00:06BB C746E8B200 MOV WORD PTR [BP-18],00B2
|
|
7C00:06C0 8D86F6FE LEA AX,[BP+FEF6]
|
|
7C00:06C4 8946EC MOV [BP-14],AX
|
|
7C00:06C7 8C56EE MOV [BP-12],SS
|
|
7C00:06CA 8DBEF6FE LEA DI,[BP+FEF6]
|
|
7C00:06CE 16 PUSH SS
|
|
7C00:06CF 07 POP ES
|
|
7C00:06D0 B9FFFF MOV CX,FFFF
|
|
7C00:06D3 33C0 XOR AX,AX
|
|
7C00:06D5 F2 REPNZ
|
|
7C00:06D6 AE SCASB
|
|
7C00:06D7 F7D1 NOT CX
|
|
7C00:06D9 49 DEC CX
|
|
7C00:06DA 894EF0 MOV [BP-10],CX
|
|
7C00:06DD B084 MOV AL,84
|
|
7C00:06DF 50 PUSH AX
|
|
7C00:06E0 9A1003443D CALL 3D44:0310
|
|
7C00:06E5 8D46E6 LEA AX,[BP-1A]
|
|
7C00:06E8 16 PUSH SS
|
|
7C00:06E9 50 PUSH AX
|
|
7C00:06EA 9A8202C93C CALL 3CC9:0282 ; Displays the code
|
|
; to check
|
|
|
|
7C00:06EF 8346E80A ADD WORD PTR [BP-18],+0A
|
|
7C00:06F3 FFB62AFF PUSH [BP+FF2A]
|
|
7C00:06F7 FFB628FF PUSH [BP+FF28]
|
|
7C00:06FB B85B00 MOV AX,005B
|
|
7C00:06FE 50 PUSH AX
|
|
7C00:06FF 9A2801FC44 CALL 44FC:0128
|
|
7C00:0704 89868EFE MOV [BP+FE8E],AX
|
|
7C00:0708 899690FE MOV [BP+FE90],DX
|
|
7C00:070C 52 PUSH DX
|
|
7C00:070D 50 PUSH AX
|
|
7C00:070E 9A4602FC44 CALL 44FC:0246
|
|
7C00:0713 8946EC MOV [BP-14],AX
|
|
7C00:0716 8956EE MOV [BP-12],DX
|
|
7C00:0719 FFB690FE PUSH [BP+FE90]
|
|
7C00:071D FFB68EFE PUSH [BP+FE8E]
|
|
7C00:0721 9AF201FC44 CALL 44FC:01F2
|
|
7C00:0726 8946F0 MOV [BP-10],AX
|
|
7C00:0729 2AC0 SUB AL,AL
|
|
7C00:072B 50 PUSH AX
|
|
7C00:072C 9A1003443D CALL 3D44:0310
|
|
7C00:0731 8D46E6 LEA AX,[BP-1A]
|
|
7C00:0734 16 PUSH SS
|
|
7C00:0735 50 PUSH AX
|
|
7C00:0736 9A8202C93C CALL 3CC9:0282 ; Displays "PROPER
|
|
; response" msg
|
|
|
|
7C00:073B 8B86F4FE MOV AX,[BP+FEF4]
|
|
7C00:073F 2B46F2 SUB AX,[BP-0E]
|
|
7C00:0742 898672FE MOV [BP+FE72],AX
|
|
7C00:0746 0346FE ADD AX,[BP-02]
|
|
7C00:0749 898676FE MOV [BP+FE76],AX
|
|
7C00:074D 0BC0 OR AX,AX
|
|
7C00:074F 7D09 JGE 075A
|
|
7C00:0751 050C00 ADD AX,000C
|
|
7C00:0754 898676FE MOV [BP+FE76],AX
|
|
7C00:0758 EB0A JMP 0764
|
|
7C00:075A 3D0C00 CMP AX,000C
|
|
7C00:075D 7C05 JL 0764
|
|
7C00:075F 83AE76FE0C SUB WORD PTR [BP+FE76],+0C
|
|
7C00:0764 8B4682 MOV AX,[BP-7E]
|
|
7C00:0767 038672FE ADD AX,[BP+FE72]
|
|
7C00:076B 898674FE MOV [BP+FE74],AX
|
|
7C00:076F 0BC0 OR AX,AX
|
|
7C00:0771 7D09 JGE 077C
|
|
7C00:0773 050C00 ADD AX,000C
|
|
7C00:0776 898674FE MOV [BP+FE74],AX
|
|
7C00:077A EB0A JMP 0786
|
|
7C00:077C 3D0C00 CMP AX,000C
|
|
7C00:077F 7C05 JL 0786
|
|
7C00:0781 83AE74FE0C SUB WORD PTR [BP+FE74],+0C
|
|
7C00:0786 8BB6F4FE MOV SI,[BP+FEF4]
|
|
7C00:078A D1E6 SHL SI,1
|
|
7C00:078C 8BB262FF MOV SI,[BP+SI+FF62]
|
|
7C00:0790 89B672FE MOV [BP+FE72],SI
|
|
7C00:0794 8B8676FE MOV AX,[BP+FE76]
|
|
7C00:0798 D1E0 SHL AX,1
|
|
7C00:079A D1E0 SHL AX,1
|
|
7C00:079C 03F0 ADD SI,AX
|
|
7C00:079E D1E6 SHL SI,1
|
|
7C00:07A0 8B8292FE MOV AX,[BP+SI+FE92]
|
|
7C00:07A4 8986F4FE MOV [BP+FEF4],AX
|
|
7C00:07A8 3D2B00 CMP AX,002B
|
|
7C00:07AB 7515 JNZ 07C2
|
|
7C00:07AD 8BB674FE MOV SI,[BP+FE74]
|
|
7C00:07B1 D1E6 SHL SI,1
|
|
7C00:07B3 D1E6 SHL SI,1
|
|
7C00:07B5 03B672FE ADD SI,[BP+FE72]
|
|
7C00:07B9 D1E6 SHL SI,1
|
|
7C00:07BB 8B4286 MOV AX,[BP+SI-7A]
|
|
7C00:07BE 8986F4FE MOV [BP+FEF4],AX
|
|
7C00:07C2 C78684FE7800 MOV WORD PTR [BP+FE84],0078
|
|
7C00:07C8 B85100 MOV AX,0051
|
|
7C00:07CB 898686FE MOV [BP+FE86],AX
|
|
7C00:07CF 898688FE MOV [BP+FE88],AX
|
|
7C00:07D3 C7868AFE0900 MOV WORD PTR [BP+FE8A],0009
|
|
7C00:07D9 C78678FE7900 MOV WORD PTR [BP+FE78],0079
|
|
7C00:07DF C7867AFE5900 MOV WORD PTR [BP+FE7A],0059
|
|
7C00:07E5 C7867CFE0000 MOV WORD PTR [BP+FE7C],0000
|
|
7C00:07EB 8D86F6FE LEA AX,[BP+FEF6]
|
|
7C00:07EF 89867EFE MOV [BP+FE7E],AX
|
|
7C00:07F3 8C9680FE MOV [BP+FE80],SS
|
|
7C00:07F7 C78682FE0000 MOV WORD PTR [BP+FE82],0000
|
|
7C00:07FD FFB62AFF PUSH [BP+FF2A]
|
|
7C00:0801 FFB628FF PUSH [BP+FF28]
|
|
7C00:0805 8B86F4FE MOV AX,[BP+FEF4]
|
|
7C00:0809 053000 ADD AX,0030
|
|
7C00:080C 50 PUSH AX
|
|
7C00:080D 9A2801FC44 CALL 44FC:0128
|
|
7C00:0812 89868EFE MOV [BP+FE8E],AX
|
|
7C00:0816 899690FE MOV [BP+FE90],DX
|
|
7C00:081A 52 PUSH DX
|
|
7C00:081B 50 PUSH AX
|
|
7C00:081C 8D8630FF LEA AX,[BP+FF30]
|
|
7C00:0820 16 PUSH SS
|
|
7C00:0821 50 PUSH AX
|
|
7C00:0822 9A9A02FC44 CALL 44FC:029A
|
|
7C00:0827 B047 MOV AL,47
|
|
7C00:0829 50 PUSH AX
|
|
7C00:082A 9A1003443D CALL 3D44:0310
|
|
7C00:082F C7868CFE0000 MOV WORD PTR [BP+FE8C],0000
|
|
|
|
; All the code you just saw. I have no clue what it does
|
|
; (hey at least I'm honest) but it wasn't important.
|
|
|
|
; Here is the imput outer loop
|
|
|
|
7C00:0835 FF365220 PUSH [2052]
|
|
7C00:0839 FF365020 PUSH [2050]
|
|
7C00:083D 9A2802FD41 CALL 41FD:0228
|
|
7C00:0842 888670FE MOV [BP+FE70],AL
|
|
7C00:0846 0AC0 OR AL,AL
|
|
7C00:0848 7503 JNZ 084D
|
|
7C00:084A E99200 JMP 08DF
|
|
7C00:084D 2AE4 SUB AH,AH
|
|
7C00:084F 2D0800 SUB AX,0008
|
|
7C00:0852 745A JZ 08AE
|
|
7C00:0854 48 DEC AX
|
|
7C00:0855 48 DEC AX
|
|
7C00:0856 7503 JNZ 085B
|
|
7C00:0858 E90901 JMP 0964
|
|
7C00:085B 2D0300 SUB AX,0003
|
|
7C00:085E 7503 JNZ 0863
|
|
7C00:0860 E90101 JMP 0964
|
|
7C00:0863 8A9E70FE MOV BL,[BP+FE70]
|
|
7C00:0867 2AFF SUB BH,BH
|
|
7C00:0869 F687790B57 TEST BYTE PTR [BX+0B79],57
|
|
7C00:086E 746F JZ 08DF
|
|
7C00:0870 F687790B03 TEST BYTE PTR [BX+0B79],03
|
|
7C00:0875 740C JZ 0883
|
|
7C00:0877 F687790B02 TEST BYTE PTR [BX+0B79],02
|
|
7C00:087C 7405 JZ 0883
|
|
7C00:087E 80AE70FE20 SUB BYTE PTR [BP+FE70],20
|
|
7C00:0883 8A8670FE MOV AL,[BP+FE70]
|
|
7C00:0887 C49E7EFE LES BX,[BP+FE7E]
|
|
7C00:088B 8BB682FE MOV SI,[BP+FE82]
|
|
7C00:088F 26 ES:
|
|
7C00:0890 8800 MOV [BX+SI],AL
|
|
7C00:0892 FF8682FE INC WORD PTR [BP+FE82]
|
|
7C00:0896 FFB688FE PUSH [BP+FE88]
|
|
7C00:089A 8D8678FE LEA AX,[BP+FE78]
|
|
7C00:089E 50 PUSH AX
|
|
7C00:089F 9A56049324 CALL 2493:0456
|
|
7C00:08A4 83C404 ADD SP,+04
|
|
7C00:08A7 0BC0 OR AX,AX
|
|
7C00:08A9 7534 JNZ 08DF
|
|
7C00:08AB EB27 JMP 08D4
|
|
7C00:08AD 90 NOP
|
|
7C00:08AE 83BE82FE00 CMP WORD PTR [BP+FE82],+00
|
|
7C00:08B3 7404 JZ 08B9
|
|
7C00:08B5 FF8E82FE DEC WORD PTR [BP+FE82]
|
|
7C00:08B9 B008 MOV AL,08
|
|
7C00:08BB 50 PUSH AX
|
|
7C00:08BC 9A1003443D CALL 3D44:0310
|
|
7C00:08C1 8D8684FE LEA AX,[BP+FE84]
|
|
7C00:08C5 16 PUSH SS
|
|
7C00:08C6 50 PUSH AX
|
|
7C00:08C7 9A6A00843D CALL 3D84:006A
|
|
7C00:08CC B047 MOV AL,47
|
|
7C00:08CE 50 PUSH AX
|
|
7C00:08CF 9A1003443D CALL 3D44:0310
|
|
7C00:08D4 8D8678FE LEA AX,[BP+FE78]
|
|
7C00:08D8 16 PUSH SS
|
|
7C00:08D9 50 PUSH AX
|
|
7C00:08DA 9A8202C93C CALL 3CC9:0282
|
|
7C00:08DF 83BE8CFE00 CMP WORD PTR [BP+FE8C],+00
|
|
7C00:08E4 7503 JNZ 08E9
|
|
7C00:08E6 E94CFF JMP 0835
|
|
|
|
; Next comes the code that checks your entry. If you follow
|
|
; it through you will see it handles not only clearing the
|
|
; screen and printing the "GOOD GOING" message but it also
|
|
; handles bad entries, etc.
|
|
|
|
7C00:08E9 8BB682FE MOV SI,[BP+FE82]
|
|
7C00:08ED C682F6FE00 MOV BYTE PTR [BP+SI+FEF6],00
|
|
7C00:08F2 8DBE30FF LEA DI,[BP+FF30]
|
|
7C00:08F6 8DB6F6FE LEA SI,[BP+FEF6]
|
|
7C00:08FA 16 PUSH SS
|
|
7C00:08FB 07 POP ES
|
|
7C00:08FC B9FFFF MOV CX,FFFF
|
|
7C00:08FF 33C0 XOR AX,AX
|
|
7C00:0901 F2 REPNZ
|
|
7C00:0902 AE SCASB
|
|
7C00:0903 F7D1 NOT CX
|
|
7C00:0905 2BF9 SUB DI,CX
|
|
7C00:0907 F3 REPZ
|
|
7C00:0908 A6 CMPSB
|
|
7C00:0909 7405 JZ 0910
|
|
7C00:090B 1BC0 SBB AX,AX
|
|
7C00:090D 1DFFFF SBB AX,FFFF
|
|
7C00:0910 3D0100 CMP AX,0001
|
|
7C00:0913 1BC0 SBB AX,AX
|
|
7C00:0915 F7D8 NEG AX
|
|
7C00:0917 8986F2FE MOV [BP+FEF2],AX
|
|
7C00:091B 0BC0 OR AX,AX
|
|
7C00:091D 7509 JNZ 0928
|
|
7C00:091F 837E8401 CMP WORD PTR [BP-7C],+01
|
|
7C00:0923 7703 JA 0928
|
|
7C00:0925 E91C02 JMP 0B44
|
|
7C00:0928 0BC0 OR AX,AX
|
|
7C00:092A 7506 JNZ 0932
|
|
7C00:092C 837E8403 CMP WORD PTR [BP-7C],+03
|
|
7C00:0930 740A JZ 093C
|
|
7C00:0932 0BC0 OR AX,AX
|
|
7C00:0934 745E JZ 0994
|
|
7C00:0936 837E8403 CMP WORD PTR [BP-7C],+03
|
|
7C00:093A 7358 JNB 0994
|
|
7C00:093C B047 MOV AL,47
|
|
7C00:093E 50 PUSH AX
|
|
7C00:093F 9A1003443D CALL 3D44:0310
|
|
7C00:0944 8D867AFF LEA AX,[BP+FF7A]
|
|
7C00:0948 16 PUSH SS
|
|
7C00:0949 50 PUSH AX
|
|
7C00:094A 9A36007E3D CALL 3D7E:0036
|
|
7C00:094F 83BEF2FE00 CMP WORD PTR [BP+FEF2],+00
|
|
7C00:0954 7518 JNZ 096E
|
|
7C00:0956 FF7680 PUSH [BP-80]
|
|
7C00:0959 FFB67EFF PUSH [BP+FF7E]
|
|
7C00:095D 9A1C04F93C CALL 3CF9:041C
|
|
7C00:0962 EB16 JMP 097A
|
|
7C00:0964 C7868CFE0100 MOV WORD PTR [BP+FE8C],0001
|
|
7C00:096A E972FF JMP 08DF
|
|
7C00:096D 90 NOP
|
|
7C00:096E FF7680 PUSH [BP-80]
|
|
7C00:0971 FFB67EFF PUSH [BP+FF7E]
|
|
7C00:0975 9A7204F93C CALL 3CF9:0472
|
|
7C00:097A 89867EFF MOV [BP+FF7E],AX
|
|
7C00:097E 895680 MOV [BP-80],DX
|
|
7C00:0981 B008 MOV AL,08
|
|
7C00:0983 50 PUSH AX
|
|
7C00:0984 9A1003443D CALL 3D44:0310
|
|
7C00:0989 8D867AFF LEA AX,[BP+FF7A]
|
|
7C00:098D 16 PUSH SS
|
|
7C00:098E 50 PUSH AX
|
|
7C00:098F 9A36007E3D CALL 3D7E:0036
|
|
7C00:0994 B047 MOV AL,47
|
|
7C00:0996 50 PUSH AX
|
|
7C00:0997 9A1003443D CALL 3D44:0310
|
|
7C00:099C 8D46F6 LEA AX,[BP-0A]
|
|
7C00:099F 16 PUSH SS
|
|
7C00:09A0 50 PUSH AX
|
|
7C00:09A1 9A6A00843D CALL 3D84:006A
|
|
7C00:09A6 B008 MOV AL,08
|
|
7C00:09A8 50 PUSH AX
|
|
7C00:09A9 9A1003443D CALL 3D44:0310
|
|
7C00:09AE 8D8684FE LEA AX,[BP+FE84]
|
|
7C00:09B2 16 PUSH SS
|
|
7C00:09B3 50 PUSH AX
|
|
7C00:09B4 9A6A00843D CALL 3D84:006A
|
|
7C00:09B9 83BEF2FE00 CMP WORD PTR [BP+FEF2],+00
|
|
7C00:09BE 7503 JNZ 09C3
|
|
7C00:09C0 E98500 JMP 0A48
|
|
7C00:09C3 2AC0 SUB AL,AL
|
|
7C00:09C5 50 PUSH AX
|
|
7C00:09C6 9A1003443D CALL 3D44:0310
|
|
7C00:09CB 8B46F8 MOV AX,[BP-08]
|
|
7C00:09CE 050700 ADD AX,0007
|
|
7C00:09D1 8946E8 MOV [BP-18],AX
|
|
7C00:09D4 FFB62EFF PUSH [BP+FF2E]
|
|
7C00:09D8 FFB62CFF PUSH [BP+FF2C]
|
|
7C00:09DC 2BC0 SUB AX,AX
|
|
7C00:09DE 50 PUSH AX
|
|
7C00:09DF 9A2801FC44 CALL 44FC:0128
|
|
7C00:09E4 89868EFE MOV [BP+FE8E],AX
|
|
7C00:09E8 899690FE MOV [BP+FE90],DX
|
|
7C00:09EC C78672FE0000 MOV WORD PTR [BP+FE72],0000
|
|
7C00:09F2 EB04 JMP 09F8
|
|
7C00:09F4 FF8672FE INC WORD PTR [BP+FE72]
|
|
7C00:09F8 83BE72FE05 CMP WORD PTR [BP+FE72],+05
|
|
7C00:09FD 7C03 JL 0A02
|
|
7C00:09FF E94201 JMP 0B44
|
|
7C00:0A02 52 PUSH DX
|
|
7C00:0A03 50 PUSH AX
|
|
7C00:0A04 9A4602FC44 CALL 44FC:0246
|
|
7C00:0A09 8946EC MOV [BP-14],AX
|
|
7C00:0A0C 8956EE MOV [BP-12],DX
|
|
7C00:0A0F FFB690FE PUSH [BP+FE90]
|
|
7C00:0A13 FFB68EFE PUSH [BP+FE8E]
|
|
7C00:0A17 9AF201FC44 CALL 44FC:01F2
|
|
7C00:0A1C 8946F0 MOV [BP-10],AX
|
|
7C00:0A1F 8D46E6 LEA AX,[BP-1A]
|
|
7C00:0A22 16 PUSH SS
|
|
7C00:0A23 50 PUSH AX
|
|
7C00:0A24 9A8202C93C CALL 3CC9:0282
|
|
7C00:0A29 8346E80A ADD WORD PTR [BP-18],+0A
|
|
7C00:0A2D FFB690FE PUSH [BP+FE90]
|
|
7C00:0A31 FFB68EFE PUSH [BP+FE8E]
|
|
7C00:0A35 B80100 MOV AX,0001
|
|
7C00:0A38 50 PUSH AX
|
|
7C00:0A39 9A7E01FC44 CALL 44FC:017E
|
|
7C00:0A3E 89868EFE MOV [BP+FE8E],AX
|
|
7C00:0A42 899690FE MOV [BP+FE90],DX
|
|
7C00:0A46 EBAC JMP 09F4
|
|
7C00:0A48 B084 MOV AL,84
|
|
7C00:0A4A 50 PUSH AX
|
|
7C00:0A4B 9A1003443D CALL 3D44:0310
|
|
7C00:0A50 C746E88C00 MOV WORD PTR [BP-18],008C
|
|
7C00:0A55 FFB62AFF PUSH [BP+FF2A]
|
|
7C00:0A59 FFB628FF PUSH [BP+FF28]
|
|
7C00:0A5D B85C00 MOV AX,005C
|
|
7C00:0A60 50 PUSH AX
|
|
7C00:0A61 9A2801FC44 CALL 44FC:0128
|
|
7C00:0A66 89868EFE MOV [BP+FE8E],AX
|
|
7C00:0A6A 899690FE MOV [BP+FE90],DX
|
|
7C00:0A6E 52 PUSH DX
|
|
7C00:0A6F 50 PUSH AX
|
|
7C00:0A70 9A4602FC44 CALL 44FC:0246
|
|
7C00:0A75 8946EC MOV [BP-14],AX
|
|
7C00:0A78 8956EE MOV [BP-12],DX
|
|
7C00:0A7B FFB690FE PUSH [BP+FE90]
|
|
7C00:0A7F FFB68EFE PUSH [BP+FE8E]
|
|
7C00:0A83 9AF201FC44 CALL 44FC:01F2
|
|
7C00:0A88 8946F0 MOV [BP-10],AX
|
|
7C00:0A8B 8D46E6 LEA AX,[BP-1A]
|
|
7C00:0A8E 16 PUSH SS
|
|
7C00:0A8F 50 PUSH AX
|
|
7C00:0A90 9A8202C93C CALL 3CC9:0282
|
|
7C00:0A95 2AC0 SUB AL,AL
|
|
7C00:0A97 50 PUSH AX
|
|
7C00:0A98 9A1003443D CALL 3D44:0310
|
|
7C00:0A9D 8346E80B ADD WORD PTR [BP-18],+0B
|
|
7C00:0AA1 FFB690FE PUSH [BP+FE90]
|
|
7C00:0AA5 FFB68EFE PUSH [BP+FE8E]
|
|
7C00:0AA9 B80100 MOV AX,0001
|
|
7C00:0AAC 50 PUSH AX
|
|
7C00:0AAD 9A7E01FC44 CALL 44FC:017E
|
|
7C00:0AB2 89868EFE MOV [BP+FE8E],AX
|
|
7C00:0AB6 899690FE MOV [BP+FE90],DX
|
|
7C00:0ABA 52 PUSH DX
|
|
7C00:0ABB 50 PUSH AX
|
|
7C00:0ABC 9A4602FC44 CALL 44FC:0246
|
|
7C00:0AC1 8946EC MOV [BP-14],AX
|
|
7C00:0AC4 8956EE MOV [BP-12],DX
|
|
7C00:0AC7 FFB690FE PUSH [BP+FE90]
|
|
7C00:0ACB FFB68EFE PUSH [BP+FE8E]
|
|
7C00:0ACF 9AF201FC44 CALL 44FC:01F2
|
|
7C00:0AD4 8946F0 MOV [BP-10],AX
|
|
7C00:0AD7 8D46E6 LEA AX,[BP-1A]
|
|
7C00:0ADA 16 PUSH SS
|
|
7C00:0ADB 50 PUSH AX
|
|
|
|
|
|
; Lot's of code Huh?
|
|
|
|
|
|
7C00:0ADC 9A8202C93C CALL 3CC9:0282
|
|
7C00:0AE1 C746E8BC00 MOV WORD PTR [BP-18],00BC
|
|
7C00:0AE6 FFB690FE PUSH [BP+FE90]
|
|
7C00:0AEA FFB68EFE PUSH [BP+FE8E]
|
|
7C00:0AEE B80100 MOV AX,0001
|
|
7C00:0AF1 50 PUSH AX
|
|
7C00:0AF2 9A7E01FC44 CALL 44FC:017E
|
|
7C00:0AF7 89868EFE MOV [BP+FE8E],AX
|
|
7C00:0AFB 899690FE MOV [BP+FE90],DX
|
|
7C00:0AFF 52 PUSH DX
|
|
7C00:0B00 50 PUSH AX
|
|
7C00:0B01 9A4602FC44 CALL 44FC:0246
|
|
7C00:0B06 8946EC MOV [BP-14],AX
|
|
7C00:0B09 8956EE MOV [BP-12],DX
|
|
7C00:0B0C FFB690FE PUSH [BP+FE90]
|
|
7C00:0B10 FFB68EFE PUSH [BP+FE8E]
|
|
7C00:0B14 9AF201FC44 CALL 44FC:01F2
|
|
7C00:0B19 8946F0 MOV [BP-10],AX
|
|
7C00:0B1C 8D46E6 LEA AX,[BP-1A]
|
|
7C00:0B1F 16 PUSH SS
|
|
7C00:0B20 50 PUSH AX
|
|
7C00:0B21 9A8202C93C CALL 3CC9:0282
|
|
7C00:0B26 B80100 MOV AX,0001
|
|
7C00:0B29 50 PUSH AX
|
|
7C00:0B2A 9AF4019324 CALL 2493:01F4
|
|
7C00:0B2F 83C402 ADD SP,+02
|
|
7C00:0B32 B047 MOV AL,47
|
|
7C00:0B34 50 PUSH AX
|
|
7C00:0B35 9A1003443D CALL 3D44:0310
|
|
7C00:0B3A 8D46F6 LEA AX,[BP-0A]
|
|
7C00:0B3D 16 PUSH SS
|
|
7C00:0B3E 50 PUSH AX
|
|
7C00:0B3F 9A6A00843D CALL 3D84:006A
|
|
7C00:0B44 83BEF2FE00 CMP WORD PTR [BP+FEF2],+00
|
|
7C00:0B49 7508 JNZ 0B53
|
|
7C00:0B4B FF4E84 DEC WORD PTR [BP-7C]
|
|
7C00:0B4E 7403 JZ 0B53
|
|
7C00:0B50 E9A7F9 JMP 04FA
|
|
7C00:0B53 FF76F4 PUSH [BP-0C]
|
|
7C00:0B56 8D867AFF LEA AX,[BP+FF7A]
|
|
7C00:0B5A 50 PUSH AX
|
|
7C00:0B5B FFB62EFF PUSH [BP+FF2E]
|
|
7C00:0B5F FFB62CFF PUSH [BP+FF2C]
|
|
7C00:0B63 FFB62AFF PUSH [BP+FF2A]
|
|
7C00:0B67 FFB628FF PUSH [BP+FF28]
|
|
7C00:0B6B E88EF5 CALL 00FC
|
|
7C00:0B6E 8B86F2FE MOV AX,[BP+FEF2]
|
|
7C00:0B72 5E POP SI
|
|
7C00:0B73 5F POP DI
|
|
|
|
; Here is the exit code I was talking about
|
|
|
|
7C00:0B74 8BE5 MOV SP,BP
|
|
7C00:0B76 5D POP BP
|
|
7C00:0B77 CB RETF
|
|
7C00:0B78 B85A06 MOV AX,065A
|
|
7C00:0B7B CB RETF
|
|
7C00:0B7C B89006 MOV AX,0690
|
|
7C00:0B7F CB RETF
|
|
|
|
|
|
Ok, after looking through all of that, can you tell me
|
|
where to put the patch. Simple. How about right at the
|
|
begining of the doc check right after the music routines (ie
|
|
address 7C00:04B6). Hey yeah ... good idea. But how do we
|
|
want to patch it. Well, since this is a higher level
|
|
language, we just can't use RETF. We must reset the stack.
|
|
Since I hate large patches, a simply decided on the
|
|
follow patch
|
|
|
|
7C00:04B6 E9BB06 JMP B74
|
|
|
|
Ok, by jumping to 0B74, we still get the music but the
|
|
actual doc check is not executed. But there is still a
|
|
problem. Remember how I said that AX was tested after the
|
|
doc check. Well, we still have to fake the check. The
|
|
easiest way, is to simply NOP the condition jmp. Here is the
|
|
section of code again
|
|
|
|
|
|
45E2:0235 9A46010F4A CALL 7C00:146 ; Call to Doc Check
|
|
45E2:023A 83C404 ADD SP,+04
|
|
45E2:023D 0BC0 OR AX,AX
|
|
45E2:023F 7465 JZ 02A6
|
|
|
|
If you remember, when you enter the right code, AX will
|
|
be set to 0001 when we exit to 45E2:023A. If we OR 0001 and
|
|
0001 we get 0001. Here is the binary ...
|
|
|
|
|
|
0000 0000 0000 0001 ( remember OR means
|
|
if either is bit
|
|
or 0000 0000 0000 0001 is 1 )
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
|
0000 0000 0000 0001
|
|
|
|
Clearly we don't want to branch at the JZ at 45E2:023F.
|
|
So, to finish the patch we simply NOP that jmp.
|
|
|
|
Oh boy.. that was hard. So let's test it out. But
|
|
first, a little forsight. We will need a unique string of
|
|
bytes to search for when making the patch. I say we use the
|
|
code from 7C00:04C4 to 7C00:04CE and from 45E2:0235 to
|
|
45E2:023F. Yea, write down the hex equivelent and then
|
|
restart. Again break in right after the switch to graphics.
|
|
Now add the patch (ie A 7C00:04B6 <ENTER>, etc.). Now
|
|
execute the program.
|
|
|
|
SHIT! It worked, we are fucking amazing. Ok, now
|
|
adding the patch permenatly. Using PCTOOLS (or whatever)
|
|
search the file STARCON.EXE for the bytes mention above
|
|
(ie: C746F60B00C746F87900C746FA2801) But wait, now
|
|
matches...Hmmm strange. It was there just a minute ago...but
|
|
wait there... another file STARCON.OVL (as we all know .OVL
|
|
mean OVERLAY). Let's try searching this one.
|
|
|
|
There we go, that's better (it should should up on the
|
|
13 sector read in). Now to add the patch. Simply find the
|
|
search bytes and the go backwards until the first occurance
|
|
of the hex byte 9A. Add the patch here. Save it.
|
|
|
|
Next, add the patch to 45E2:023F. Search for the bytes
|
|
83C4040BC07465. The should appear on sector 3 (give or take
|
|
a few sectors). Now simply change the 2 bytes 74 65 to 90 90
|
|
and save the sector. Now, you are good to go.
|
|
|
|
Well shit, this has been some hell of a textfile. 1113
|
|
lines in all. But what detail. Ok I hope you learned
|
|
something from all of this. And this end the first part of
|
|
CRACKING 101 - the 1990 edition. From here out all lessons (
|
|
lesson 5 and up) will be released on their own.
|
|
|
|
I would like the thank Phantom Phlegm for pushing me to
|
|
finish this shit.
|
|
|
|
Till lesson 5 this is Buckaroo Banzai, signing off.
|
|
|
|
|
|
OH... I can be reached for personal help via E-MAIL on LORD
|
|
WOLFEN's CASTLE or TOS...
|