Voir le sujet pr�c�dent :: Voir le sujet suivant |
Auteur |
Message |
toinet
Inscrit le: 15 Juin 2007 Messages: 326 Localisation: Paris, France
|
Post� le: Lun 26 Avr 2010, 8:19 Sujet du message: Tetris IIgs (Spectrum Holobyte, 1988) |
|
|
Da da da... How can this wonderful program be introduced. That game was accused of being sold by the communist world to decrease the productivity of the western countries.
Protection type
Password with desktop interface
Protection removal
Launch Block Warden, follow TETRIS and at block 0, relative offset $51, replace: 20 CE 57 with 2C CE 57, save the changes.
How to locate the protection?
The interesting thing about desktop interface is that it uses the toolbox and the associated tools: the dialog manager, the control manager and the window manager.
A window that is displayed and asks for a password is a modal window. It is the only way to interact with the user.
Another possiblity is to locate the error string, "Nyet" here, in the program code.
Last but not least, the protection loops 5 times, search either for LDA #$0005 or CMP #$0005. One of those will probably be found.
What is funny is that we can find all of the above patterns starting at $57CE in the program code
The next thread will display the original program protection.
Antoine
4/2010 |
|
Revenir en haut de page |
|
![](templates/subSilver/images/spacer.gif) |
toinet
Inscrit le: 15 Juin 2007 Messages: 326 Localisation: Paris, France
|
Post� le: Lun 26 Avr 2010, 8:27 Sujet du message: |
|
|
Code: |
*
* ENTRY POINT
*
* L0FB7 is the quit flag (true or false)
L57CE STZ L0FB7
PHA
PHA
PEA ^L5AB1
PEA L5AB1
_GetNewModalDialog
PLA
STA L5AAD
PLA
STA L5AAD+2
JSR L5874
L57EB PHA
PEA $0000
PEA $0000
_ModalDialog
PLA
CMP #$0001
BNE L57EB
JSR L5A22
STZ L5904
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0003
PEA $0000
PEA $0000
_SelectIText
L581D LDA L5904 ; Number of tries
CMP #$0005
BNE L5831
LDA #$FFFF
STA L0FB7
JSR L597A
JMP L5864
L5831 PHA
PEA $0000
PEA $0000
_ModalDialog
PLA
CMP #$0001 ; OK button
BNE L5831
JSR L5899
JSR L5906 ; Check user string
LDA L5978
BEQ L5864 ; correct answer
JSR L58CB
JMP L581D ; loop if not correct
CMP #$0002 ; CANCEL button
BNE L5831
LDA #$00FF
STA L0FB7
JMP L5864
L5864 LDA L5AAD+2 ; end of protection
PHA
LDA L5AAD
PHA
_CloseDialog
RTS
*
* Get a pointer to the entered string
*
L5874 PEA $0000
PEA $0000
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0003
_GetControlDItem
PLA
STA L5895
PLA
STA L5895+2
RTS
L5895 ADRL $00000000
L5899 LDA L5AAD+2
PHA
LDA L5AAD
PHA
LDA #$0003
PHA
PEA ^L5965
PEA L5965
_GetIText
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0003
PEA ^L5965
PEA L5965
_SetIText
RTS
*
* NYET!!!
* The string entered does not match
* the desired string
*
L58CB LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0003
PEA ^L58FF
PEA L58FF
_SetIText
INC L5904
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0003
PEA $0000
PEA $7FFF
_SelectIText
RTS
L58FF STR 'Nyet'
L5904 BRK $00
*
* Compare the strings
* Check yours is the same
* as the one selected by the
* protection...
*
L5906 STZ L5978
LDA L5965
LDX #$0001
LDA L5AAB
ASL
ASL
ASL
TAY
L5916 LDA L5965,X
CMP L5D20+1,Y
BNE L5929
INX
INX
INY
INY
CPX #$0009
BNE L5916
BRA L5943
L5929 LDX #$0001
L592C LDA L5965,X
CMP L595C,X
BNE L593D
INX
INX
CPX #$0009
BNE L592C
BRA L5943
* ERROR if L5978<>0
L593D LDA #$FFFF
STA L5978
L5943 LDX #$0001
LDA L5B11+1
STA L5965
L594C LDA L5B11+1,X
STA L5965,X
INX
INX
CPX #$0009
BNE L594C
RTS
BRK $00
L595C STR 'AmberDG '
L5965 STR ' '
BRK $00
BRK $00
BRK $00
BRK $00
BRK $00
L5978 BRK $00
L597A LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0005
PEA ^L59CF
PEA L59CF
_SetIText
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0006
PEA ^L59EA
PEA L59EA
_SetIText
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0007
PEA ^L5A06
PEA L5A06
_SetIText
LDX #$0000
LDY #$0028
L59C8 DEX
BNE L59C8
DEY
BNE L59C8
RTS
L59CF STR ' Hooligan Security Breach'
L59EA STR 'Log Off Procedure Initiated'
L5A06 STR ' '
*
* Select protection string
* among 32 different possibilities
*
L5A22 PEA $0000
PEA $0000
_TickCount
_SetRandSeed
PHA
_Random
PLA
AND #$001F
STA L5AAB
ASL
ASL
ASL
TAX
LDY #$0008
LDA L5C1F+2,X
STA L5B87,Y
INX
INX
LDA L5C1F+2,X
STA L5BB6,Y
INX
INX
LDA L5C1F+2,X
STA L5BE5,Y
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0005
PEA ^L5B87
PEA L5B87
_SetIText
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0006
PEA ^L5BB6
PEA L5BB6
_SetIText
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0007
PEA ^L5BE5
PEA L5BE5
_SetIText
RTS
L5AAB DS 2
L5AAD DS 4
|
Derni�re �dition par toinet le Lun 26 Avr 2010, 8:41; �dit� 2 fois |
|
Revenir en haut de page |
|
![](templates/subSilver/images/spacer.gif) |
toinet
Inscrit le: 15 Juin 2007 Messages: 326 Localisation: Paris, France
|
Post� le: Lun 26 Avr 2010, 8:34 Sujet du message: |
|
|
Code: |
*
* ENTRY POINT
*
* L0FB7 is the quit flag (true or false)
L57CE STZ L0FB7
PHA
PHA
PEA ^L5AB1
PEA L5AB1
_GetNewModalDialog
PLA
STA L5AAD
PLA
STA L5AAD+2
JSR L5874
L57EB PHA
PEA $0000
PEA $0000
_ModalDialog
PLA
CMP #$0001
BNE L57EB
JSR L5A22
STZ L5904
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0003
PEA $0000
PEA $0000
_SelectIText
L581D LDA L5904 ; Number of tries
CMP #$0005
BNE L5831
LDA #$FFFF
STA L0FB7
JSR L597A
JMP L5864
L5831 PHA
PEA $0000
PEA $0000
_ModalDialog
PLA
CMP #$0001 ; OK button
BNE L5831
JSR L5899
JSR L5906 ; Check user string
LDA L5978
BEQ L5864 ; correct answer
JSR L58CB
JMP L581D ; loop if not correct
CMP #$0002 ; CANCEL button
BNE L5831
LDA #$00FF
STA L0FB7
JMP L5864
L5864 LDA L5AAD+2 ; end of protection
PHA
LDA L5AAD
PHA
_CloseDialog
RTS
L5874 PEA $0000
PEA $0000
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0003
_GetControlDItem
PLA
STA L5895
PLA
STA L5895+2
RTS
L5895 ADRL $00000000
L5899 LDA L5AAD+2
PHA
LDA L5AAD
PHA
LDA #$0003
PHA
PEA ^L5965
PEA L5965
_GetIText
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0003
PEA ^L5965
PEA L5965
_SetIText
RTS
L58CB LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0003
PEA ^L58FF
PEA L58FF
_SetIText
INC L5904
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0003
PEA $0000
PEA $7FFF
_SelectIText
RTS
L58FF STR 'Nyet'
L5904 BRK $00
L5906 STZ L5978
LDA L5965
LDX #$0001
LDA L5AAB
ASL
ASL
ASL
TAY
L5916 LDA L5965,X
CMP L5D20+1,Y
BNE L5929
INX
INX
INY
INY
CPX #$0009
BNE L5916
BRA L5943
L5929 LDX #$0001
L592C LDA L5965,X
CMP L595C,X
BNE L593D
INX
INX
CPX #$0009
BNE L592C
BRA L5943
L593D LDA #$FFFF
STA L5978
L5943 LDX #$0001
LDA L5B11+1
STA L5965
L594C LDA L5B11+1,X
STA L5965,X
INX
INX
CPX #$0009
BNE L594C
RTS
BRK $00
L595C STR 'AmberDG '
L5965 STR ' '
BRK $00
BRK $00
BRK $00
BRK $00
BRK $00
L5978 BRK $00
L597A LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0005
PEA ^L59CF
PEA L59CF
_SetIText
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0006
PEA ^L59EA
PEA L59EA
_SetIText
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0007
PEA ^L5A06
PEA L5A06
_SetIText
LDX #$0000
LDY #$0028
L59C8 DEX
BNE L59C8
DEY
BNE L59C8
RTS
L59CF STR ' Hooligan Security Breach'
L59EA STR 'Log Off Procedure Initiated'
L5A06 STR ' '
L5A22 PEA $0000
PEA $0000
_TickCount
_SetRandSeed
PHA
_Random
PLA
AND #$001F
STA L5AAB
ASL
ASL
ASL
TAX
LDY #$0008
LDA L5C1F+2,X
STA L5B87,Y
INX
INX
LDA L5C1F+2,X
STA L5BB6,Y
INX
INX
LDA L5C1F+2,X
STA L5BE5,Y
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0005
PEA ^L5B87
PEA L5B87
_SetIText
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0006
PEA ^L5BB6
PEA L5BB6
_SetIText
LDA L5AAD+2
PHA
LDA L5AAD
PHA
PEA $0007
PEA ^L5BE5
PEA L5BE5
_SetIText
RTS
L5AAB DS 2
L5AAD DS 4
|
|
|
Revenir en haut de page |
|
![](templates/subSilver/images/spacer.gif) |
|