[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Single-load games - cracking for fun?
On Tue, 23 Dec 2008, BLuRry wrote:
I did a quick hack of a single load game years ago with a wildcard --
but I recently sold the card on eBay a few months back. That was
supposedly the best way to break a single-load game back in the day.
If you can break to the monitor with either a reset or interrupt hook,
then you can dump out the contents of ram to a tape for later
investigation.
EDM to the rescue... xD
Even better if you can dump out the register
contents! Alternatively you may be able to spit the ram contents over
to a PC via the serial port by pressing "2 ctrl-P return" and then
have the monitor list memory contents from a starting address. Should
be trivial to rebuild the monitor dump into a binary file on a pc.
I'd prolly just do a couple passes - one to get anything located in the
lower and upper reaches, one to get the rest. Once I figure out what I
need I can export it in pieces, and then write a relocator.
From there you can do whatever disassembly you need to see where the
RWTS hooks are and NOP them. Beware self-modifying code and lots of
XOR operations, they didn't want you to easily identify the protection
mechanisms in the first place!
Which means I'll prolly want to do a "trace" or something. I can prolly
even do it automatically, with a custom emulator.
For extra fun, you can gut the apple game server's bootstrap process
to reload the memory contents via serial again.
Where there's a will, there's a way. :-) Have fun!
-Brendan
-uso.