[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Animate Crack, English Translation by DF
Here is my attempt at a translation. Because I'm not a native speaker of
French, some of the slang was hard for me to translate. But I did my best.
There are some jokes and things that aren't meant to be taken seriously...
Beware: the original document has an addition for a newer version of Animate
(notice that there are two credit lines at the top of this document). This
addition starts with:
"And in the series...."
right after the GODFATHER & KRISTO final credit line.
Here we go:
-------------------------- CUT HERE ---------------------------
Traduction Anglais par DF
- A N I M A T E CRACK : BR0DERBUND 1986 - NOYEUX JOEL - GODFATHER & KRISTO
-
- A N I M A T E CRACK : BR0DERBUND 1986 - CORRECTION CRACK - JBart from ECB
-
Animate is a - beautiful! - animation program in double high-res... that is
the coolest of the coolest?
Laugh, my old friend. Doesn't prevent those who saw the deprotected version
from coast to cost (the Americans), and that I am sorry, but it is a bad
crack. (Try to load up a scene) Ours is Ok, of course. Me, I crack the
French way, sir! ... Yes. In the end, it's just to say, eh.
Only the 2 first sides are protected, the other 4 are sides of data or the
demo. At first look, it's DOS which is patched: the end of the field is <FF
FF> (instead of <DE AA>). There we change Airheart. (It was 18 sectors..!)
Yes, but: it's impossible to make an intact copy, even with EDD! There, I
detect a hidden trick.. We'll look at it later. We already did Demuffin, by
a *BLOAD ADVANCED DEMUFFIN, and *B935:FF, *B991:FF, *B99B:FF;
(If you are tired, a *B942:18 will suffice!)
And *800G, and copy the 2 sides.
It is ProDOS, therefore, no problem, there aren't any good headers to put
back on the disk.
On boot: the first (!) boot verification with an 'R' at top-left of the
screen as usual from Br0derbund (Lode Runner, for example).
By scanning a bit, you find in Track $00, Sector $3 a lovely routine that
has all the air of a being for verification. (Reading: LDA $C08C,X BPL..
read my file on Synchronization nibbles)
Place a CLC RTS (18 60) in the heap lightly arranged the things: on falls on
the second verification! (It prints ERRO01 and reboots); not so fast.
One must be able to do better... Try to remove a bit this first
verification: we will explain to you in details a bit later, it is not
difficult. But first, in whole: after reading physical sector 7 (program
finishes in sector $02), it reads a D5, then looks for 3 * E7 following,
makes a LDA $C08D,X (distrust!) looks for an EE, then reads 8 nibbles at
places them in $Bf40 in the verification process.
In booting the original, one finds in $BF40: FC EE EE FC E7 EE FC E7.
And on a copy, it doesn't matter what one finds.
This goes well, these values are also on the verification sector, -> in
$825B.
Therefore, first patch: P$00 S$3 A$09: D0 37 (F0 4A)
A$44: B9 5B 82 EA EA 99 40 BF EA EA EA EA
(BD 8C C0 10 FB 99 40 BF D1 48 D0 05)
This patch replaces the reading of 8 nibbles in $Bf40 with a poke of good
values en $BF40.
This verification is truly beautiful that I couldn't resist the pleasure of
telling you about it. It utilizes desynchronization, and that, it is
beautiful, it goes without saying.
Read this, I will be back soon.
81DE- LDX $2B No SLOT*10 = #$60
81E0- LDA $C089,X DRIVE ON
81E3- LDA $C08E,X reading
I skip a bit here, it's heavy (counter number test)
81F6- JSR $8263 read field address, Number of physical sector in $2D
81F9- BCS $8255 If error occurs
81FB- LDA $2D
81FD- CMP #$07 SECT.=07
81FF- BNE $81F2
8201- LDY #00 Off we go!
8203- LDA $C08C,X read one nibble
8206- BPL $8203
8208- DEY
8209- BEQ $8255 number of tries
820B- CMP #$D5 -looking for a D5!! (The beginning of field data)
820D- BNE $8203
820F- LDY #00
8211- LDA $C08C,X
8214- BPL $8211
8216- DEY number of tries
8217- BEQ $8255 I'm not going to repeat 15 times the same thing...
8219- CMP #$E7 - looking for an E7!!
821B- BNE $8211 looking..
821D- LDA $C08C,X
8220- BPL 821D
8222- CMP #$E7 -a E7 just following..
8224- BNE $8255 SI APU E7 ALORS JETE
8226- LDA $C08C,X
8229- BPL $8226
822B- CMP #$E7 - one MORE TIME E7
822D- BNE $8255
822F- LDA $C08D,X ATTENTION: this desynchoronizes itself!!
8232- LDY #$10 2 CYCLES (This says that we jump QQUES bits..)
8234- BIT $06 3 CYCLES
8236- LDA $C08C,X
8239- BPL $8236
823B- DEY
823C- BEQ $8255
823E- CMP #$EE - looking for an EE!!
8240- BNE $8236
8242- LDY #$07 going to read 8 nibbles after the EE
8244- LDA $C08C,X
8247- BPL $8244
8249- STA $BF40,Y - places it in $BF40
824C- CMP ($48),Y -(it has $48=5B, $49=82, in $825B: the true values
VALEURS!)
824E- BNE $8255 One compares them with the true values and exatracts it
if it is
8250- DEY
PAS COOL
8251- BPL $8244 I SAID 8 NIBBLES
8253- CLC
8254- RTS Return without error.
825B- HEX FC EE EE FC E7 EE FC E7.
We are now going to attempt to explain to you why this protection is
uncopyable, like always it is useless in deprotecting, but it is the only
thing truly interesting... (The crazy hackers are not obligated to read all
of this...)
In looking at the original with the Locksmith 6.0 disk editor, we see in
full in physical sector 7 (logical sector 4) of track 0, a group of nibbles
E7, but be careful: there it is in 32, 36, and 40 cycles! With the framing
bit analyzing (the most pleasant program of the west), we arrive at an
understanding of it all.
An E7, it is: 11100111 in 32 CYCLES
111001110 in 36 CYCLES
1110011100 in 40 CYCLES.
I recall that we must read the following: E7, E7, E7, it desynchronizes
itself, then reads EE, and: E7 FC EE E7 FC EE EE FC.
And well, all of that, it's hidden in the group of E7 the entire time! It's
cool.
Here it is on the disk, and explaining it:
NB CYC: 36 36 32 32 40 32
BITS: 111001110 111001110 11100111 11100111 1110011100 11100111
^ ^ ^ ^^^^^^ ^ ^
E7 E7 E7 ..it desynchronizes itself! looking
EE...
NB CYC: 36 40 32 36 40 32
BITS: 111001110 1110011100 11100111 111001110 1110011100 11100111
^ ^ ^ ^ ^ ^
found it!! EE E7 FC EE E7
NB CYC: 36 36 32 32
BITS: 111001110 111001110 11100111 11100111 ....
^ ^ ^
.FC EE EE FC AND THAT'S IT!!
And yes, same as EDD can't copy this, it replaces all with E7 bytes in 36
cycles. It's not troublesome, though. But this verification is all the same
very kind. I bet that it is going to be copiously pumped.
Where were we?
Ah yes, Sakharov Libere: the inventor of the Russian H bomb, Nobel peace
prize (it's all natural). Plus a need to write CAXAPOb in the margin of all
our mathematics homework. In my opinion, if he liberates it, it's because
it's nastily made and they wanted it to not wear out at home. Or his wife. I
don't know if he brush in Apple, him.
Uh, again a verification, and there are plenty more like it. We shunted the
first, and now we do the same thing on the 2nd side.
Eeeehhh!!! (to say in spreading the arms and moving slowly your hands high
and low in the manner of a fonzie who goes out with pom-pom girls) It's the
same verification as the first side. Good job, lads.
Place in side 2, track $01 Sector $1 Address $E8: 4C 34 6F (20 53 6F)
T$01 S$01 A$36: B9 4B 6F 99 40 BF EA EA EA EA
(BD 8C C0 10 FB D9 40 BF D0 05)
On boot: it looks like it's going to work.
We try the drawing options or the magnifying glass. Oh no! Another
verifcation!!
OK!! Again an 'R' printed in top-left. But in track $0C, Sector $D, we find
a very beautiful LDA #$D2 STA $400 and reboot.. Before, a move of a little
part destroyes this.. For shunting all this, it suffices to put AGAGA:
Side 1 Track $0C sector $D Address $6D: 18 60 (78 A9)
Well then, it's finished?
If we stick to Murphy's Law, guess what: (Try not to read too fast):
Another verification, yes.
When one wants, for example, to load a scene, one must be met with a crash
and a 'ProDOS error: Incompatible ProDOS version'. That's not how they're
going to have us. Oh you the other, eh.
There, it needs to trick. How are errors handled in ProDOS?
There is always a typical routine:
LDX #$XX ; number of possible errors
ERR1 CMP TABLE,X ; Check in table
BEQ ERR2 ; error found
DEX
BPL ERR1 ; or BNE
LDX #$YY ; unknown error
ERR2 LDA CODE,X ; load error code
I then searched the sequence F0 05 CA (BEQ $05 DEX) which I had found in
track $01 Sector $8 of side 2. We find that the entry point of the error
handling routine is in $6731. In changing the program at that location, we
find that the error code in question is $A.
In track $0F Sector $B, we find in $8D5: JSR $6731, and in $834: LDA #$4A
JMP
$8D5 !!
We must, therefore, modify it:
Side 2 track $0F sector $B address $34:EA EA EA EA EA (A9 4A 4C D5 08).
And there, we see with dazedly: that all is working, very well too. Me too,
I was really surprised.
Here we go, again a little summary:
* Demuffin with a *B942:18 or better as + high,
* side 1: track $00 Sector $3 Address $09: D0 37
Address $44: B9 5B 82 EA EA 99 40 BF EA EA EA EA
track $0C Sector $D Address $6D: 18 60
* side 2: track $01 Sector $1 A$E8: 4C 34 6F
Sector $F Address $36: B9 4B 6F 99 40 BF EA EA EA EA
track $0F Sector $B Address $34: EA EA EA EA EA.
- Animate Crack - (C) BR0DERBUND 1986 - (K) ZE ENFOIRES - GODFATHER & KRISTO
-
And in the series.... When one has finished, the others continue. Here are
the fixes to the latest (one hopes) sadistic verification checks by
JBart...(Elite Crack Band)
Don't worry about side A.
On side B, many verifications. To stop these verifications, modifiy the disk
in the following manner:
Track Sector Byte num change to
01 0F $49 18
02 0A $47 EA EA EA
03 03 $18 60 EA EA
08 0F $37 EA EA EA
0F 0B $43 EA EA EA
There you go, Animate is now entirely deprotected!
This was a super crack for - GODFATHER & KRISTO : Ze Enfoirés
- JBart : Elite Crack Band
-------------------------------------------------------------------------------