💾 Archived View for spam.works › mirrors › textfiles › apple › CRACKING › krackarcade.txt captured on 2023-06-16 at 21:12:56.

View Raw

More Information

-=-=-=-=-=-=-






     AFTER A NINE-MONTH DELAY,
BR0DERBUND HAS FINALLY RELEASED THE
ARCADE MACHINE (A.M.). THE PROTECTION
SCHEME IS A NEW CHALLENGE FOR COPIERS,
SINCE IT USES THE TECHNIQUE KNOWN AS
SPIRALING OR QUARTER-TRACKING, AS WELL
AS THE STANDARD BR0DERBUND SYSTEM OF A
NEW ADDRESS MARKER FOR EACH TRACK.  AN
ATTEMPT TO COPY THE DISK WITH A
CONVENTIONAL NIBBLE COPIER QUICKLY
REVEALS THAT TRACKS 0 AND 3-11 ARE
EASILY COPIED WITH AN ADDRESS MARKER OF
D5 AA 96, WHILE THE REST OF THE TRACKS
ARE A MYSTERY.  PROBING INTO THE LOADER
REVEALS THE FOLLOWING INFORMATION ABOUT
TRACK USAGE:

     TRACK     CONTENTS
     -----     --------

     T0/S0     PRELOADER --> 800-8FF
               (AS ALWAYS)
       /S1-5   LOADER --> 300-7FF

     T1-2      HIRES SPLIT "BR0DERBUND"
                LOGO AND PROGRAM

     T12-20    MAIN PROGRAM WHICH LOADS
                INTO 800-BFFF

     T12-13.5  FOUR HALFTRACKS USED FOR
                QUARTER-TRACKING

     T3-4      #1 SHAPE CREATOR

     T5-6      #2 PATH CREATOR

     T7-8      #3 GAME OPTIONS

     T9-A      #4 LEVEL OPTIONS

     TC-D      #5 BKGD/TITLE CREATOR

     TE-F      #6 LOAD/SAVE GAME

     T10-11    #7 CREATE GAME DISK

               (OPTION #8 JUMPS TO 0800
                TO RUN THE GAME)


     THE APPROACH TO KRACKING THIS TYPE
OF PROGRAM SEEMS STRAIGHTFORWARD:LOAD
THE PROGRAM INTO MEMORY, RESET IT, AND
SAVE IT OUT TO DISK AS A BINARY FILE,
WITH THE APPROPRIATE MEMORY MOVES.
HOPEFULLY, YOU'LL LOCATE THE STARTING
ADDRESS AND BE ABLE TO RUN THE BINARY
FILE AT WILL. IF YOU WISH TO INCLUDE
ALL OF THE ADVERTISING FOR BR0DERBUND
AT THE BEGINNING, THIS WORKS.  IF YOU
TRY TO DELETE THE DUAL BANNER, IT
CRASHES.  THE REASON IS THAT MODULE
SWITCHING IS VIA THE STACK--THEY PUSH
THE CORRECT LOCATION ONTO THE STACK AND
DO AN RTS. SO, UNLESS YOU HAPPEN TO
KNOW THE VALUE OF THE PROGRAM COUNTER
(THAT IS, EXACTLY WHAT THE ADDRESS WAS
WHEN YOU STOPPED), THE STACK POINTER
(S) AND THE PROCESSOR STATUS WORD (P),
AND RESTORE THEM EXACTLY AS THEY WERE
BEFORE THE RESET, THE PROGRAM PROBABLY
WON'T RUN. ANYONE WHO TRIED TO BREAK
JUGGLER FOUND THIS TO BE FRUSTRATING IN
THE EXTREME, SINCE SOMETIMES THE GAME
WOULD RUN ALL THE WAY THROUGH THE FIRST
LEVEL BEFORE CRASHING - THE SAME
TECHNIQUE WAS USED THERE, BUT WITH EVEN
MORE PROTECTION.

     THERE IS A HARD WAY AND AN EASY
WAY TO DO EVERYTHING, AND IF YOU ARE
COMPLETELY RESTRICTED TO SOFTWARE
DEVICES, IT IS STILL POSSIBLE TO BREAK
ARCADE MACHINE.  REFERRING TO THE
NIBBLE ALTERATION TECHNIQUES DESCRIBED
IN THE PREVIOUS EPISODE, IT IS POSSIBLE
TO LOCATE AND ALTER THE GAME LOADER SO
THAT IT HALTS WITH CONDITIONS WELL
DEFINED AFTER THE ENTIRE PROGRAM IS IN
MEMORY. IF IT IS YOUR PURPOSE IN LIFE
TO LEARN AS MUCH AS YOU POSSIBLY CAN
ABOUT DISK PROTECTION SCHEMES AND THE
CIRCUMVENTION THEREOF (ONLY A FEW
REALLY CRAZY PEOPLE ARE SO INCLINED),
THIS IS REWARDING. IF YOU ARE
INTERESTED IN PREPARING AN UNPROTECTED
VERSION OF THE GAME WITH MINUMUM
ADVERTISING AND MINIMUM EFFORT,
HOWEVER, THERE IS AN EASIER WAY.

     THIS SOLUTION IS ELEGANT, BUT
REQUIRES A VISIT TO THAT GOD OF THE
UNDERWORLD =>HARDWARE<=.  BY NOW
EVERYONE IS FAMILIAR WITH THE TERM NMI,
THANKS TO AN OVERSOLD CARD WHICH USES
THIS TECHNIQUE TO REPLAY SINGLE-LOAD
GAMES FROM DISK.  NMI STANDS FOR
NON-MASKABLE INTERRUPT, ONE OF FOUR
TYPES OF INTERRUPT AVAILABLE ON THE
6502 (THE OTHERS ARE RESET, BREAK, AND
THE IRQ OR INTERRUPT REQUEST).  AS THE
NAME OF THIS ONE IMPLIES, IT IS AN
INTERRUPT WHICH MUST BE ATTENDED,
REGARDLESS OF WHATEVER ELSE THE CPU HAD
IN MIND TO DO NEXT. THIS LINE COMES
DIRECTLY FROM PIN 6 OF THE CPU CHIP, IS
HELD AT 5 VOLTS (LOGIC 1) BY A IK
RESISTOR, AND RUN OUT TO PIN 29 OF THE
PERIPHERAL CONNECTORS.  CONNECTING THIS
PIN MOMENTARILY TO GROUND (PIN 26)
BEGINS A SMALL MICROPROGRAM WITHIN THE
6502 WHICH STORES THE PROGRAM COUNTER
('PC', TWO BYTES) AND THEN THE
PROCESSOR STATUS WORD ('P', ONE BYTE)
ON THE STACK, AND JUMPS TO THE ADDRESS
STORED IN LOCATIONS FFFA AND FFFB IN
THE F8 ROM. THIS BUSINESS OF PUSHING
ONTO THE STACK IS A LITTLE OBSCURE, SO
LET'S SPEND A FEW SECONDS DESCRIBING
THE STACK STRUCTURE.  WE ALL KNOW THAT
THE STACK IS IN PAGE ONE OF MEMORY
($100-$1FF), AND THAT THERE IS A THING
CALLED A STACK POINTER (S) WHICH POINTS
TO AN ADDRESS WITHIN THAT RANGE. IF THE
FOLLOWING PROGRAM WERE RUN, THE STACK
WOULD LOOK LIKE WHAT'S SHOWN BELOW:


      1000: TSX
            TXA
            JSR $1010

      1010: JSR $1020

      1020: JSR $1030

      1030: TSX
            BRK

---------------------------------------

                               (STACK)

FINAL STACK POINTER LOCATION-> XX (ANY)
                               22
                               10
                               12
                               10
                               04
FIRST STACK POINTER LOCATION-> 10

---------------------------------------


THIS "PROGRAM" STORES THE FIRST VALUE
OF THE STACK POINTER IN THE
ACCUMULATOR, JSR'S TO THREE PLACES,
STORES THE FINAL VALUE OF THE STACK
POINTER IN THE X-REGISTER, AND THEN
HALTS. (WE HAVE TO NEGLECT FOR THE
MOMENT THAT APPLE'S MONITOR DOES SOME
WEIRD THINGS TO THE STACK AFTER THE
'BRK'). IF WE EXAMINE THE STACK MEMORY
BETWEEN THE LOCATIONS IN THE ACC. AND
X-REG, WE WILL FIND THE VALUES LISTED
ABOVE. ALTHOUGH WE SPEAK OF THE STACK
AS A "PUSH-DOWN" (ALSO "LIFO" FOR
LAST-IN, FIRST-OUT) STACK, WHAT
ACTUALLY HAPPENS IS THAT THE VALUE OF
THE STACK POINTER IS DECREMENTED, SO
THAT IT POINTS TO A LOCATION ONE LESS
THAN IT WAS. THE SUBROUTINE ADDRESSES
TO WHICH THE PROGRAM WHOULD RETURN (IF
IT WERE GIVEN AN 'RTS') ARE STORED IN
NORMAL FASHION OF LOW BYTE, HIGH BYTE,
AT A LOCATION ONE HIGHER THAN THE
VALUE OF THE STACK POINTER. THE RTS
INSTRUCTION TRANSFERS THESE NUMBERS
INTO THE PROGRAM COUNTER, INCREMENTS
THE STACK POINTER BY TWO, INCREMENTS
THE LOW BYTE BY ONE, AND STARTS THE
PROGRAM EXECUTING AGAIN AT THE LOCATION
OF THE PROGRAM COUNTER. THE STACK
POINTER NOW POINTS TO (ONE BELOW) THE
NEXT SUBROUTINE RETURN ADDRESS, AND THE
NEXT 'RTS' INSTRUCTION ENCOUNTERED IN
THE PROGRAM WILL RETURN TO THAT
ADDRESS. NOTICE THAT THE FINAL LOCATION
OF THE STACK POINTER CAN HAVE ANYTHING
IN IT, SINCE IT POINTS TO THE LOCATION
WHERE THE NEXT BYTE WILL BE STORED, NOT
WHERE THE LAST ONE WAS STORED.  THE
DATA PAIRS '22,10', '12,10', AND '04,
10' CORRESPOND TO THE SUBROUTINE RETURN
ADDRESSES 1023, 1013, AND 1005 FOR THE
PROGRAM, EACH ONE BEING ONE LESS
THAN THE ACTUAL RETURN POINT.

     THAT DIGRESSION WAS INTENDED TO
CLARIFY THE STACK STRUCTURE THAT
RESULTS FROM AN NMI SIGNAL:

    STACK POINTER: (ANYTHING)
             S+1: STATUS WORD (P)
             S+2: PROGRAM CTR LOW (PCL)
             S+3: PROGRAM CTR HI (PCH)

THIS WAS SET UP TO ALLOW AN EXTERNAL
DEVICE TO INTERRUPT THE APPLE, AND THEN
TO RESUME THE INTERRUPTED PROGRAM
EXACTLY WHERE IT WAS BEFORE THE
INTERRUPT OCCURRED.  THE INSTRUCTION
THAT MAKES IT ALL HAPPEN IS 'RTI',
WHICH OBLIGINGLY PUTS THE PROCESSOR
STATUS WORD BACK, RESTORES THE ORIGINAL
VALUE OF THE PC, AND CRANKS UP THE
PROGRAM JUST AS IT WAS BEFORE THE NMI
LINE WAS YANKED.

     THE PRACTICAL IMPLEMENTATION OF
THIS TRICK IN KRACKING REQUIRES A
MINIMUM OF TWO THINGS: AN ALTERED F8
ROM AND A SWITCH. A NORMAL F8 ROM HAS
FB 03 AT FFFA-FFFB, WHICH MEANS THAT AN
NMI SIGNAL WILL EXECUTE THE INSTRUCTION
AT 03FB.  PRUDENT SOFTWARE PUBLISHERS
WILL PUT THERE EITHER A JUMP TO THE
BEGINNING OF THE GAME OR TO A REBOOT:
4C 00 C6.  TO GET AROUND THE PROBLEM,
THE F8 ROM MUST BE MODIFIED. SINCE MOST
SERIOUS KRACKISTS ALREADY HAVE A
KRAKROM OR LOCKBUSTER, ETC., WHICH
RELOCATES THE 0-7FF MEMORY WHEN RESET
IS PRESSED, THIS IS NOT A MAJOR
PROBLEM.  YOU SHOULD PUT THE STARTING
ADDRESS OF THE MEMORY MOVE ROUTINE IN
LOCATIONS FFFA-B, AND BURN A NEW 2716
EPROM.  AFTER THIS PROM IS INSTALLED IN
THE F8 SOCKET, ACTIVATING THE NMI LINE
WILL SAVE ALL OF THE VOLATILE MEMORY AS
WELL AS THE PC AND P (A WORD OF CAUTION
- IF YOU DON'T HAVE A SOLID-STATE
SWITCH ON THE NMI LINE, YOU'LL STORE
SOME ADDITIONAL GARBAGE ON THE STACK,
BUT THE SYSTEM WILL STILL WORK).

     EACH TIME YOU USE THE NMI ROM,
YOU'LL HAVE TO EXAMINE THE MEMORY AREA
WHERE THE STACK IS STORED.  SINCE THE
STACK POINTER IS ALWAYS ONE LESS THAN
THE LAST LOCATION STORED INTO, YOU
SHOULD HAVE NO TROUBLE IDENTIFYING THE
CORRECT VALUE OF PC AND P.  AFTER
SAVING THE GAME, WITH MEMORY MOVES IF
REQUIRED, SET THE STACK POINTER TO THE
LOCATION OF THE STATUS WORD-1 (USE LDX
#NN, TXS), AND DO AN RTI INSTRUCTION.
THE PROGRAM WILL START RIGHT BACK UP AS
IF IT HAD NEVER BEEN INTERRUPTED.  BE
SURE THAT YOUR MEMORY RELOCATE ROUTINE
IN ROM SAVES THE VALUE OF THE A, X, AND
Y REGISTERS, AND RESTORES THE CORRECT
VALUES BEFORE THE RTI.

     ONE FINAL CAUTION - SOME GAMES
(LIKE JUGGLER) REQUIRE THAT YOU HAVE AN
UNMODIFIED ROM IN THE F8 SOCKET - THIS
REQUIRES A LITTLE MORE ASSISTANCE FROM
THE GOD OF HARDWARE, AND WILL BE DEALT
WITH IN A FUTURE EPISODE DESCRIBING
OTHER APPLICATIONS OF THE NMI
TECHNIQUE.

     RETURNING TO THE A.M. KRACK, YOU
NOW CAN BOOT THE DISK AND GET TO THE
MAIN MENU. DO THE NMI TRICK BY CLOSING
A SWITCH WIRED BETWEEN PINS 29 AND 26
OF ANY PERIPHERAL CARD, AND MOVE THE
EXCESS MEMORY TO 2000-3FFF (THE
NORWEGIAN NURDS WERE NICE ENOUGH TO
LEAVE US HI-RES PAGE ONE OPEN -- TAK!),
INCLUDING 0-8FF AND B600-BFFF.  ADD THE
APPROPRIATE MEMORY MOVE ROUTINES AS
WELL AS THE REGISTER RESTORE, STACK
POINTER ADJUST, AND RTI, THEN BOOT A
SLAVE DISK AND BSAVE THE MEMORY FROM
900-9600.

     COPY TRACKS 3-11 FROM THE ORIGINAL
A.M. WITH YOUR FAVORITE COPIER, AND
TELL THE VTOC THAT THOSE TRACKS ARE
OCCUPIED. SAVE THE FILE ONTO ANY TRACKS
ABOVE 11, AND, USING THE BOOT MODIFIER
DESCRIBED IN THE KKK III ON WAY OUT,
LOAD IN THE MAIN PROGRAM AS PART OF THE
BOOT. YOU SHOULD NOW BE OFF AND RUNNING
WITH YOUR OWN FRESHLY BROKEN COPY OF
ARCADE MACHINE.

     IT'S NOT REALLY AS HARD AS IT
SOUNDS, AND IF YOU REALLY LIKE TO
PROGRAM YOUR OWN LEFT-RIGHT
SHOOT-EM-UPS WITHOUT LEARNING TO
PROGRAM, THE RESULT IS WORTH THE
EFFORT.



             =>KRAKOWICZ<=