Bop'n'Wrestle (Minscape, 1986)

[toinet]

All the thrills and excitement of Pro Wrestling. Use all the pro moves: Atomic Drops, Pile Drivers, Airplane Spins, and more than 20 others! The Apple II adaptation has been done by Beam Software.

Protection type
There are three different disk protections:
- Synchro nibble at the end of the data marker (prevents copying)
- Translation tables reordered (data EOR on a copy always fails)
- Desynchro routine (disk copy cannot be realized)

We need to remove those...

Boot tracing
- 9600<C600.C6FFM
- 96FB : 4C 59 FF
- 9600G
...we now have a standard boot0 at $800
- 96FB : A9 4C 8D 4A 08 A9 59 8D 4B 08 A9 FF 8D 4C 08 4C 01 08
- 9600G
...we now have a sort of a standard RWTS from $B700..$BFFF

The complete boot trace is the following:
- $0801 (init boot1, loads the RWTS)
- $B700 (init boot2)
- $B793 (loads boot2)
- $BFC8 (some inits)
- $B744 (nada)
- $B6B3 jsrs to $BE0D
- $BE0D jmps to $BEAF
- $BEAF loads the desynchro routine
- $0200 (executes the desynchro routine)
- $A503... the end...

Disk copy
- Launch Advanced Demuffin 1.4 (the one that can simulate the boot process of a diskette and get its RWTS)
- Press B to launch the boot process
- Copy the disk
- Launch the newly copied disk, the drive goes to track 1 but fails to load...

Remove the synchro nibble
- at $B93E, you have a JMP $BF01 instead of the standard C9 AA F0 5C
- at $BF01, you have a protection routine that checks for a synchro nibble
=> change on T0/S3/3E : C9 AA F0 5C (was 4C 01 BF EA)

Reorder the translation tables
- the table at $BA29 is ordered backward (from high to low values)
- the table at $BA96..$BAFF is ordered weirdly
=> launch your favorite sector editor and replace T0/S4 with a standard RWTS $BA00.$BAFF sector (the one on track 0, sector 4

You now have a disk that boots until the screen with padded with weird characters and the game locks... That is due to the desynchro routine...

Remove the desynchro routine
The routine is located on T22/SE and is loaded at $0200. It checks the following pattern: EE EE EE EE EE E7 E7 EE EE EE EE EE E7 EE E7. If it finds it, then it returns from the subroutine, otherwise it fills in the memory with weird characters.

The routine is called from $B6B3, just BIT offset B3.
Launch your favorite sector and T0/S0/B3: 2C (was 20)

You can now enjoy Bop'n'Wrestle...

Toinet