Voir le sujet pr�c�dent :: Voir le sujet suivant |
Auteur |
Message |
toinet
Inscrit le: 15 Juin 2007 Messages: 326 Localisation: Paris, France
|
Post� le: Mer 05 D�c 2007, 11:36 Sujet du message: Video Vegas (Baudville, 1985) |
|
|
Play Poker, Keno and other interesting games with Baudville's program disk.
All programs are written in BASIC using Take 1 and its toolkit. Well-made, just like the protection
PROTECTION TYPE
It is a standard DOS 3.3 16-sector disk that can be copied with Locksmith but... there is a track synchro protection on the first eight tracks!
DISK COPY
Just launch Locksmith Fast disk backup and copy the disk. It won't boot...
PROTECTION REMOVAL
Launch your favorite disk editor and change the following data:
- T0/S6/1: 02 => 34
Instead of jumping to $E002 through the stack (real address $E003), we bypass the protection by calling $E034 (real address $E035)
- T0/S6/CD: 00 => 07 (not mandatory at all, just for fun)
That is the track index. As eight tracks are synchronized (0 to 7), we can put 7 here.
- T0/S6/3A: A5 2B => A9 60 (could be better)
Just force the slot to be 6...
Save the sector back to disk
Reboot and... enjoy,
Toinet
Derni�re �dition par toinet le Mer 05 D�c 2007, 11:41; �dit� 1 fois |
|
Revenir en haut de page |
|
|
toinet
Inscrit le: 15 Juin 2007 Messages: 326 Localisation: Paris, France
|
Post� le: Mer 05 D�c 2007, 11:39 Sujet du message: |
|
|
And now, the source code of the protection located at $E000. That page is located on track 0, sector 6.
Code: |
*
* ENTRY POINT
*
LE000 DDB $E002
DB $6C
* The real entry point
LE003 LDX $2B
LE005 LDA #$00
JSR LDCA0 ; Move to track 0
LE00A JSR LDC44 ; Read header field
LDA $2D
CMP #$00 ; Sector 0 read ?
BNE LE00A
JSR LE0BF ; Tempo
LDY #$01
LE018 STY LE0CD ; Track number
TYA
ASL
JSR LDCA0 ; Move to track Y
JSR LDC44 ; Read header field
JSR LE0BF ; Tempo
LDA $2D ; Are tracks synchronized?
LDY LE0CD
CMP LE0CE,Y ; If not the right sector
BNE LE005 ; Loop
INY
CPY #$08 ; The first eight tracks ?
BCC LE018 ; Loop
*
* Next code please...
* If we come here, the first
* eight tracks are synchronized
*
LE035 LDA #$00 ; Move to track 0 again
JSR LDCA0
LDA $2B ; Update RWTS table
STA LDFD0
STA LDFDE
STA LDFF2
...
LE0BF LDA #$3C ; Tempo
SEC
LE0C2 PHA
LE0C3 SBC #$01
BNE LE0C3
PLA
SBC #$01
BNE LE0C2
RTS
LE0CD DB $00
LE0CE HEX 00050A0F04090E03
HEX 080D02070C01060B
HEX 00000000000000000000
ASC "(C)1985 BAUDVILLE P.CP "
|
|
|
Revenir en haut de page |
|
|
|