Re: Faking RWTS13: Trying to figure out how to do something

[Don Bruder <dakidd@sonic.net>]

In article 
<Pine.LNX.4.62.0511290002470.8894@static-141-149-129-16.buff.east.verizo
n.net>,
 Lyrical Nanoha <LyricalNanoha@dosius.net> wrote:

> On Mon, 28 Nov 2005, Don Bruder wrote:
> 
> > In article
> > <Pine.LNX.4.62.0511281934110.8203@static-141-149-129-16.buff.east.verizo
> > n.net>,
> > Lyrical Nanoha <LyricalNanoha@dosius.net> wrote:
> >
> >> On Mon, 28 Nov 2005, Michael J. Mahon wrote:
> >>
> >>> Trace it carefully, and you will see that it constructs a return address
> >>> on the stack than then RTSs to it.
> >>
> >> Eek.
> >
> > Ah, an apparent newcomer to the joys of stack-diddling :)
> 
> I'm not used to anything beyond the "proper" 6502/65C02 stuff - actually 
> I'm rather new to 6502 ASM in general.

Wait'll you bang head-first into full-blown self-modifying machine 
language... Trying to trace that stuff can REALLY knock you for a loop!  
- pun unintentional!
 
> > Where do you *THINK* it's going, based on the stack contents when the
> > rts just above the $CxD1 code executes? (As in "What's the value on the
> > stack just before the RTS?" - I betcha you find that the high-order byte
> > is indeed $C6, rather than $86 - The card RTS-es into its own code
> > unless you diddle the return address after moving it.
> 
> It does seem like that, but putting a BRK on the RTS doesn't seem to help 
> either.

That's *LIKELY* (but not certain) to be because the BRK vector (lives on 
Page 3) either hasn't been properly set up, or is set to something 
totally bogus temporarily during the boot sequence. Once the boot 
completes, the BRK vector should be set to something useful.

> > Trace carefully, grasshoppa! :) You're in the ballpark, now you just
> > have to find your way to the beer stand. :)
> 
> LOL

> > I've got your source code from your earlier posting partially commented
> > with fairly in-depth info based on what I can remember from my days of
> > "flyin' the Jolly Roger".  If you like, give a holler and when I get
> > done with it, I'll ship it to you.
> 
> Heh.  I like to know how the machines work inside. XD

That's what got me started cracking protections - I didn't care so much 
about the "fame and fortune", I just thought that chasing through code 
that was deliberately doing sneaky things was one of the best ways of 
*REALLY* learning the trickier parts of 6502 assembly.

-- 
Don Bruder - dakidd@sonic.net - If your "From:" address isn't on my whitelist,
or the subject of the message doesn't contain the exact text "PopperAndShadow"
somewhere, any message sent to this address will go in the garbage without my
ever knowing it arrived. Sorry... <http://www.sonic.net/~dakidd> for more info