Gamma Goblins (Sirius Software, 1981)

[toinet]

Another wonderful game from Sirius Software. Fight the ennemies and kill the evil Dr. Ngo!

DISK STRUCTURE
It is a non-standard disk, only T0/S0 can be copied! Each track contains the equivalent of thirteen sectors with markers DD AD DA followed by thirteen 512 4*4 coded nibbles.

Last but not least, the first track is track 1.5


BOOT TRACE
Sirius games are actively protected against boot tracing. That is quite mandatory as, once loaded, there are no more calls to the disk, meaning all the program is loaded into memory!

- 9600<C600.C6FFM
- 96FB: AD E8 C0 60
- 9600G
Bing! At $0801, the program loads 1024 bytes from $0400 to $07FF, clears memory, EORs ZP and then jumps to the next boot stage at $0400

Let's get the code:
- 96FB: A9 14 8D 10 08 A9 18 8D 4C 08 A9 00 8D 4F 08 4C 01 08
- 9600G
Bing! We now have the $0400..$07FF code at $1400..$17FF.
We have another ZP eoring, the setting of the reset vector, another EOR and several other interesting code:
- all nibbles read are stored at $0600..$07FF, that explains the garbage on the GR screen
- moving to a specific track to put $40 bytes at $0200
- moving to a specific track to get four values saved at $4E, $4F and the two others in the stack!

The data at $0200 contains a short routine and a value that is read to activate the HGR display!

I will not go into the details of getting them, what I have done is reassemble that code at $A400, execute it and save the results in the ZP. The values you get are:
- $4E <= read value is $AA, then EOR with value $A3, save at $4E --> $09
- $4F <= read value is $EE, then EOR with value $EC, save at $4F --> $02
- PHA <= read value is $BB, then EOR with value $34, put in stack --> $8F
- PHA <= read value is $FF, then EOR with value $40, put in stack --> $BF

In another message, all of the different codes will be shown.

MEMORY ORGANIZATION
- T0/S0 - $0800..$08FF
- T0/S1..4 - $0400..$07FF
- T1.5 - $0800..$13FF
- T2.5 - $1400..$1FFF
- T3.5 - $4000..$4BFF
- T4.5 - $4C00..$57FF
- T5.5 - $5800..$63FF
- T6.5 - $6400..$6FFF
- T7.5 - $7000..$7BFF
- T8.5 - $7C00..$87FF
- T9.5 - $8800..$93FF
- TA.5 - $9400..$9FFF
- TB.5 - $0200..$023F
- TD - $4E, $4F, PHA, PHA


DISK COPY
You now have all the information to get the complete game and create a DOS binary file. As always, I believe it is better to rewrite the read routines
We will have to change some false opcodes as it prevents the game from being played on a IIgs!

That's all folks. You have all the useful information to make a backup of it

Toinet

[toinet]

Voici la routine du boot1 :

[toinet]

Voici la routine du boot2 en $0400 :

[toinet]

Gamma Goblins is now fully-cracked and works like a charm on my IIgs The complete protection removal will be written tomorrow.

You know what? I am happy...

antoine

[toinet]

My modified boot 1 code at $0800 :

[toinet]

My modified boot 2 at $0400. Please note that I load one more track at $A000 to put the right data at the right place.

The game uses lots of adresses at $04xx, so that, we cannot leave my modified boot 2 code. Everything will be correctly set!

[toinet]

Last but not least, my code at $A000 that is there to:
- copy the data at $0200
- copy the data at $0400..$07FF
- set the right values in ZP and stack
- jumps to the program...

[toinet]

Make it IIgs compatible!

The code at $8FC0 uses a lot of false opcodes that are interpreted by my IIgs. I supposed that in emulation mode, there were no issues. But that is not true!

The following is the original code where false opcodes have been HEXed. On the disk image that has been made from the software, the original code is to be found on TB/S7, the modified code on T9/S7. I have replaced them with the NOP ($EA) opcode.