***************************************
***  MR. XEROX'S CRACKING TIPS III  ***
**   BOOT TRACE CRACKING             **
**   CRACKING BUG ATTACK             **
**   AND DEFEATING A NIBBLE COUNT    **

***                                 ***
***************************************

   IF YOU HAVE READ MY LAST TWO ARTICLES,YOU SHOULD BE AT LEAST FAMILIAR WITH HO
W TO "BOOT-TRACE" CRACK PROGRAMS, IF YOU HAVE NOT READ EITHER THAN YOU WILL BE C
OMPLETELY LOST IN THIS ONE, SO GET A HOLD OF ONE OF THEM, AND STUDY IT BEFORE PR
OCEEDING WITH THIS ONE. APPLE GALAXIAN AND SPACE RAIDERS WERE FAIRLY EASY TO CRA
CK, BUT NOW COME THE TOUGHER ONES. THE PROTECTORS CAN MAKE THINGS COMPLICATED BY
 ADDING NIBBLE COUNTS TO THE SOFTWARE. IF ANY OF YOU ARE NOT FAMILIAR WITH WHAT 
A NIBBLE COUNT IS, IT IS A CERTAIN TRACK THAT CONTAINS A SPECIFIC AMOUNT OF A CE
RTAIN BYTE. THE PROGRAM THAT IS PROTECTED ON THE DISK, SOMETIME DURING ITS RUN, 
GOES BACK TO DISK TO READS ALL OF THESE NIBBLES BACK. IF THE PROGRAM DOESN'T FIN
D THESE BYTES, OR THE RIGHT NUMBER OF THEM, IT WILL CRAP OUT. BUG ATTACK IS ONE 
OF THESE PROGRAMS. AFTER THE TITLE PAGE COMES ON, AND THERE IS THE EXPLOSION OF 
DOTS, IT WAITS FOR YOU TO PRESS A KEY, OR PUSH A BUTTON. AFTER YOU PRESS A KEY, 
IT GOES BACK TO DISK, AND DOES A NIBBLE COUNT. IF IT CAN READ ALL THESE NIBBLES,
 AND EVERYTHING CHECKS OUT, IT WILL CONTINUE WITH THE GAME. BUT, OF IT DOESN'T, 
WELL YOUR IN TROUBLE. SO, IF THIS IS TO BE CRACKED, AND PUT ONTO A NORMAL 3.3 DI
SK THAT CONTAINS NO TRACK DEDICATED TO CONTAINING THOSE BYTES THAT SHOULD BE REA
D, WE WILL NEED TO DEFEAT THE NIBBLE COUNT.LETS FIRST CRACK THE PROGRAM, AND THE
N I WILL LATER SHOW YOU HOW TO DEFEAT THIS SPECIFIC COUNT.

     TO CRACK THIS, FIRST TURN YOUR APPLE ON, AND PRESS "RESET" TO STOP THE DRIV
E FROM BOOTING THE DISK, AND GET INTO THE MONITOR BY TYPING "CALL-151 (RETURN)" 
IF YOU HAVE AN APPLE II PLUS, IF YOU HAVE AN APPLE II, THEN BY PRESSING RESET YO
U WILL AUTOMATICALLY BE PLACED INTO TO MACHINE LANGUAGE MONITOR. THEN TYPE "8600
<C600.C700M (RETURN)", TO MOVE BOOT  FROM THE PROM, AND INTO RAM,AND "86F8:4C 01
 88 (RETURN)", TO MAKE TO BOOT CONTINUE AT LOCATION $8801 INSTEAD OF $801, AND "
8801:4C 59 FF (RETURN)", TO FORCE THE BOOT TO STOP HERE INSTEAD ON CONTINUING IN
 MEMORY. THEN START IT UP BY TYPING "8600G (RETURN)". NOW MOVE THE SECOND STAGE 
THAT IS AT $800 UP TO $8800 BY TYPING "8800<800.900M (RETURN)", AND MODIFY IT SO
 IT WILL RUN AT $8800 BY TYPING "8803:BD 00 88 (RETURN) AND "8841:4C 01 83 (RETU
RN)", THEN TYPE "8301:4C 59 FF", AND FINALLY REBOOT BY TYPING "8600G (RETURN)" A
GAIN. NOW WE ARE AT THE THIRD STAGE THAT IS AT $300, SO MOVE THAT STUFF UP TO $8
300 BY TYPING "8300<300.400M (RETURN)" AND MODIFY THIS STUFF TO RUN AT $8300 BY 
TYPING "8313:AD CC 83 (RETURN)" AND "833C:AD CC 83 (RETURN) AND "8343:4C 0 84 (R
ETURN)" .NOW WE WILL RUN INTO THE SAME TROUBLE THAT WE HAD IN GALAXIAN IN THAT T
HE JUMP OUT OF THIS STAGE IS NOT IMMEDIATE, BUT ONLY AFTER MANY JUMPS TO A CERTA
IN SUBROUTINE, SO WE NEED THAT PROGRAM AT $8400 AGAIN THAT CHECKS TO SEE IF IT I
S GOING TO THE SUBROUTINE, OR TO THE BEGINNING OF THE PROGRAM. IF IT IS GOING TO
 THE SUBROUTINE, THEN LET IT CONTINUE, IF NOT THEN STOP. SO TYPE "8400:A5 3E C9 
D5 D0 03 6C 3E 00 4C 59 FF (RETURN)", AND REBOOT AGAIN BY TYPING "8600G (RETURN)
". NOW TO FIND OUT WHERE THE NEXT STAGE JUST LOADED IN, TYPE "83CC (RETURN)" YOU
 WILL SEE AN $A1, SO ADD ONE TO THAT, AND YOU GET $A2, SO TYPE "A200L (RETURN)".
 WE ARE NOW AT THE FINAL STAGE OF THE BOOT.

     IN THIS STAGE, THE BOOT TURNS ON THE GRAPHICS, LOADS THE PROGRAM, AND JUMPS
 TO THE BEGINNING OF IT. IF YOU TYPE "L" A FEW TIMES, YOU WILL COME ACROSS A POI
NT WHERE THIS STAGE ENDS, AND THE JUMP TO THE BEGINNING OF THE PROGRAM IS LOCATE
D. THE JUMP IS AT LOCATION $A2F8, AND IT IS AN INDIRECT ONE TO $1FF. IF YOU DON'
T KNOW, AN INDIRECT JUMP TO $1FF DOESN'T JUMP TO THE LOCATIONS THAT $1FF AND $20
0 POINT TO, BUT TO THE LOCATIONS THAT $1FF AND $100 POINT TO. SO, TO FIND OUT WH
ERE THIS JUMP IS TO, TYPE "A2F8:4C 59 FF (RETURN)" AND "8409:4C 00 A2(RETURN)" A
ND "83CC:D2 (RETURN)", AND FINALLY REBOOT BY TYPING "8600G (RETURN)". NOW WE CAN
 EXAMINE LOCATIONS $100 BY TYPING "100 (RETURN)" AND LOCATION $1FF BY TYPING "1F
F (RETURN)". FROM THIS INFORMATION YOU NOW KNOW THAT THE JUMP IS TO LOCATION $4D
36.

     YOU HAVE NOW CRACKED THE PROGRAM, BUT ONE MORE MAJOR OBSTACLE REMAINS IN OU
R WAY. THE PROGRAM CONTAINS A NIBBLE COUNT. IF YOU BOOT THE ORIGINAL, AND PRESS 
BUTTON (0), YOU WILL SEE THAT IT GOES BACK TO DISK FOR A SECOND AND DOES THE COU
NT. SO THE WAY TO GET RID OF THE NIBBLE COUNT IS TO FIND WHERE IT IS IN MEMORY, 
AND JUST AVOID IT WHEN THE PROGRAM IS RUN. I HAVE EXAMINED THE PROGRAM AND FOUND
 THAT AFTER THE TITLE PAGE IS DISPLAYED, AND THE DOT GRAPHICS EXPLOSION TAKES PL
ACE, THERE IS A JUMP, AT $4E24 THAT GOES TO THE NIBBLE COUNT ROUTINE AT $4A33. A
FTER THE NIBBLE COUNT IS DONE, THERE IS A JUMP OUT OF IT AT $4A88. THIS JUMP IS 
TO THE BEGINING OF THE GAME, LOCATION $494A. NOW, WE CAN MODIFY THE WHOLE NIBBLE
 ROUTINE AT $4A33 JUST TO SKIP TURNING ON THE DRIVE, AND JUMP DIRECTLY TO THE BE
GINNING OF THE PROGRAM, BUT LIKE ALWAYS, THEY (THE PROTECTORS) HAVE STEALTHILY H
ID A ROUTINE IN THE MIDDLE OF THE GAME THAT CHECKS TO SEE IF THE NIBBLE COUNT RO
UTINE  HAS BEEN CHANGED IN ANY WAY. IF IT HAS THAN THE PROGRAM WILL CRAP OUT, IF
 NOT THEN IT WILL CONTINUE WITH THE GAME. PRETTY SNEAKY OF THE PROTECTORS, HUH ?
 (THOSE LOW-LIFE ROTTEN BASTARDS WHO MAKE EVERYTHING SO G-DDAM TOUGH). SO TO GET
 AROUND THIS PROBLEM, WE MUST SIMPLY TAKE THE JUMP AT $4E24 THAT SAYS TO GO TO T
HE NIBBLE COUNT PART AT $4A33, AND CHANGE IT TO JUMP TO THE BEGINNING OF THE PRO
GRAM AT $49A4. SO MAKE THE CHANGE BY TYPING "4E24:4C 49 A4 (RETURN)".

     AFTER THIS CHANGE HAS BEEN MADE, THE PROGRAM IS IN A FORM ABLE TO BE SAVED 
TO A NORMAL 3.3 DISK. DON'T FORGET TO SAVE PAGES $0-$8 WITH THE REST OF THE FILE
, AND LOAD THEM BACK INTO MEMORY WHEN YOU BLOAD THE FILE BACK IN NORMAL 3.3 DOS.
 IF YOU HAVE JUST READ ALL THIS, AND YOU DON'T BELIEVE THAT IT WILL ALL WORK, TR
Y THIS, HERE IS A PROGRAM THAT WILL DO THE NIBBLE COUNT CHANGES AND WILL SHOW YO
U THAT THE NIBBLE COUNT WAS REALLY DEFEATED.
      ORG $A800
START STA $AF00  ;STA TEMP
      LDA #$4C   ;JMP BYTE
      STA $4E24  ;JMP LOCATION
      LDA #$A4   ;LOW BYTE
      STA $4E25  ;JMP LOCATION+1
      LDA #$49   ;HIGH BYTE
      STA $4E26  ;JMP LOCATION+2
      LDA $AF00  ;GET OLD A VAL BACK
      JMP $4D36  ;BEGINNING OF THE PROG
                 ;THIS WILL DO THE JMP
                 ;TO PROVE THE DEFEAT
                 ;OF THE NIBBLE COUNT.

THE ASSEMBLED VERSION IS "A800:8D 00 AF A9 4C 8D 24 4E A9 A4 8D 25 4E A9 49 8D 2
6 4E AD 00 AF 4C 36 4D (RETURN)", AND WE NEED TO JUMP TO THIS LOCATION INSTEAD O
F ($1FF), SO TYPE "A2F8:4C 00 A8 (RETURN)". THIS MUST BE DONE IN THE BOOT TRACE 
INSTEAD OF ENTERING "A2F8:4C 59 FF".  WHEN YOU RUN THE BOOT, THE GAME WILL PROCE
ED NORMALLY, BUT THE DISK WILL NEVER BE ACCESSED, AND THUS WE HAVE DEFEATED THE 
NIBBLE COUNT !