Amiga ISO Collection/AmigaUtilCD2.iso/Misc/GXY-INF.LHA/infos/vol2.txt

Text File | 1996-03-09 | 7.7 KB | 163 lines

Welcome to CRACKER JOURNAL VOLUME 2: BUDOKAN: THE MARTIAL SPIRIT

HARDWARE REQUIREMENTS:
 ROM 1.2 or higher
 1 meg of memory or more
 Extra 3.5 floppy
 Hard Drive  -Makes things easier!

SOFTWARE REQUIREMENTS:
 Software for each project will be included.

The CRACKER JOURNAL project was created by Apollo 69! and Psycho of
 AMIGA SYNDROME.

In this second volume. we are going to walk through a deprotection of a
program. This is a DOS based disk and requires a MANUAL for protection.
Our object for Volume 2 is BUDOKAN.

GOAL: Crack BUDOKAN so that the manual is never needed

ANALYSIS: We want to decode some of the program to find out where the
          protection is.
First thing always is boot up the game and see where the protection is. As
you can see, the manual protectioncomes up just after the game is booted.
This will give you a rough idea where the code we are looking for is. If you
select the wrong family crest, and if you go to competition, you return back
to the start of the game. So this tells you that it is checking for the
correct response you entered. The most common way this is done is by using a
flag variable. Say if the flag is 1 then the wrong code was entered. If the
flag was 0 then the correct code was entered. So this tells you that we need
to find the routine that checks for a response & flags a memory location. If
possible, we want to skip the entire routine. This means we must defaut the
flag so the computer thinks the correct response is entered and to do so, we
must also go around the manual protection routine.

OK all you brave souls here is where we get busy! All chickens back out NOW!

You have just done step 1, now get familiar with the game. Next, boot up
your system with the utility disk and put BUDOKAN disk 1 in df1: Get a
directory of df1: ...SHIT... No Files! This is where the fun begins!!!

For you experienced hackers, we must dissassemble the boot routine and see
what is going on, but since this is a beginner's journal, I'll tell you what
to do!

Type "MONITOR" <RETURN>

Place BUDOKAN 1 in df0: At the "." prompt type:
.<s 30000 0 0 0     *Read block 0 into memory location $30000
.<s 30200 0 0 1     *Read block 1 into memory location $30200

What did we just do? We read the boot block off of BUDOKAN into memory
$30000. The boot block actualy consists of 2 blocks, block 0 & 1. We read
block 1 into #30200 because each block on a normal DOS disk is 512 bytes
(HEX = $200). Now we dissassemble the boot block. Do the following:
.d 30000 <RETURN>
$3000c is where the boot program starts. $30000-$3000b is just header stuff.
You can see at $3000c it says "BRA.S $3001c" so we enter:
.d 3001c <RETURN>
This next routine opens the "disk.resource" and goes through a bunch of
garbage. Now as we decode the boot we come across some code that loads up
some more stuff.
All this will be covered in a later journal... And so to make things shorter
this routine loads a routine that loads the main game, but before it starts
the game, it does the manual protection routine... By tracing down the boot
routine we come accross the actual protection routine, now reset your
machine and boot up with the AMIGA SYNDROME UTILITY DISK VOLUME 2.

All this boot coding leads us to block 82 in the BUDOKAN disk 1.
type "WORKSHOP" <RETURN>
Press R-MOUSE & select DRIVE/DF1: You come up on block 880. Click on BLOCK
and change it to BLOCK 82!

This information doesnt look important se we sjip through some sectors to
see what we can find... As we skip, the numbres appear to be some sort of
data, not enough of them look like 68000 intsruction numbers so we keep on
going (use the = key to go up 1 sector at a time)
As we keep on flipping, we come accross what looks like code on block 88.

Towards thebottom we see some 68000 instructions, so we will flip to the
next block & see what we see... Looks like more data. So we write down all
of the blocks we want to check out. So far we have block 88 & 89. We go on
to the next sector & see some code so we write down 90 also. Blocks 91-100
look like code information so we want to check it out. Quit WORKSHOP and
type: "DEKSID" <RETURN>
With BUDOKAN in df1: we select df1: from the menu. We will come up on block
0. Click on BLOCK and enter 88 and write down the TRACK,SECTOR,HEAD (4 0 0).
Go to block 90 (T=4,S=2,H=0) 91 (T=4,S=3,H=0) etc....
Quit DEKSID and type "MONITOR" <RETURN>
Now put BUDOKAN in df0: Press <RETURN> to see a list of commands for
monitor. Look for Read Sector (<s [s][ths]). So at the "." prompt, enter:
.<s 30000 4 0 0 <RETURN>      -<s   = Read Sector
                              -[s]  = Start Address to put info read in
                              -[ths]= Track, Head, Sector
NOTE: DEKSID displays TSH and MONITOR displays THS

Now we dissassemble $30000
We keep pressing <RETURN> because there is nothing important yet. We get
down to $301b2 & we see some code. We need some more because we only read in
one sector which is $30000-$301ff After $301ff there is nothing but regular
memory. So we load in the next sector (89) after the previous sector at
$30000. So our new address is $30200, so enter:
.<s 30200 4 0 1 <RETURN>
.d $30200 <RETIURN>

So far nothing important, just more data. So we keep on pressing <RETURN>.
We get down to $305ff & see nothing important, so we go on and read the next
sector. So enter the following:
.<s 30600 4 0 2 <RETURN>
.D 30600

Looks like more data so just hit <RETURN>. Now were at $3070e. We come
accross some code. We look carefully at this code.

At $3071e we see "MOVE.Q $FF,$685C"... Looks like some sort of flag because
the next line says "MOVE.Q $00,$00C2CF". At $30780, we see several compares
and branches so we write this down. On our notes we write that we are on
block 90 and our block is loaded into location $30600

Now exit MONITOR (x <RETURN>)
Place the Utility Disk in df0: & BUDOKAN in df1: Now type:
WORKSHOP <RETURN>

Select DRIVE/DF1: Click on BLOCK and enter 90. Now what do we look for?
If you wrote down the MOVE.Q #ff,$685c, this tells us to look for:
13FC 00FF0000 685C
You can get these numbers from monitor by typing "M 3071e" -while in monitor
But for some of use, we know MOVE.Q =$13FC and so on....
After you find it (12th Row, 6th Column Accross), change the 00FF to 0000
(13th Row, CLMN 1). If you boot up the game now, the game will still have
the manual protection, so now we must find the manual routine. Now we exit
workshop and type "MONITOR" <RETURN> and the type :
.<s 30600 4 0 2 <RETURN>
.d 3071e
We keep on dissassembling until we get to $307A2 because we see "TST.W D2"
and the next line is "BEQ" so we write down :
307A2 4A42 TST.W  D2
307A4 6700 BEQ.L  $307B4
307A8 6100 BSR.L  $303B2

By looking at this code, we see that if the condition of TST.W D2 is
positive then we jump to $307B4 & if not, we jump back to $303B2. So lets
take out the BEQ and BSR and see what we get.
Place the Utility disk in df0: and BUDOKAN in df1: Quit MONITOR and type:
WORKSHOP <RETURN>  Now select DRIVE/DF1: and go to block 90.
Now we need to find "6700000E 6100FC08". Again, you could have got these
numbers from MONITOR by typing "m 307A4".
Find it? Row 18, Clmn 4 & 5.
Select BLOCK/EDIT HEX.. Now change the 6700000E & 6100FC08 to 4E714E71 &
4E714E71

Exit edit mode, now select BLOCK/WRITE BLK and now click on "NO CHECKSUM"
Now reboot & see what we have done.
If it works, then CONGRATULATIONS!, if not, then your a LAMER!
There were several things left out due to much explanation be needed!

This is a simple crack, but to the beginner this may be difficult, so bear
in mind that it only gets tougher... Next volume will have another manual
protect since these are the most common. Density protectons are beyond the
scope of this project and should be left up to us experts on DISK
DESTRUCTION!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!