Re: Faking RWTS13: Trying to figure out how to do something

[Don Bruder <dakidd@sonic.net>]

In article 
<Pine.LNX.4.62.0511281934110.8203@static-141-149-129-16.buff.east.verizo
n.net>,
 Lyrical Nanoha <LyricalNanoha@dosius.net> wrote:

> On Mon, 28 Nov 2005, Michael J. Mahon wrote:
> 
> > Trace it carefully, and you will see that it constructs a return address
> > on the stack than then RTSs to it.
> 
> Eek.

Ah, an apparent newcomer to the joys of stack-diddling :) 



> > In fact, you may want to literally trace this code in an emulator.
> 
> OK.
> 
> Though, I think I see the code you're referring to:
> 
>          jsr     $FF58
>          tsx
>          lda     $0100,x         ; pick our address off the stack
>          pha
>          asl
>          asl
>          asl
>          asl                     ; get slot number * 16
>          sta     $2B
>          tax
>          lda     #$D0
>          pha
> 
> > Relocation to another page boundary should work as long as the code at
> > xxD1 is not moved or the constant $D0 pushed on the stack is adjusted
> > appropriately.
> 
> I was very careful to load it at 8x00 where x is the slot number.
> 
> Hm.

Where do you *THINK* it's going, based on the stack contents when the 
rts just above the $CxD1 code executes? (As in "What's the value on the 
stack just before the RTS?" - I betcha you find that the high-order byte 
is indeed $C6, rather than $86 - The card RTS-es into its own code 
unless you diddle the return address after moving it.
 
> It seems to be jumping to the wrong address for some reason, and a trace 
> doesn't seem to reveal why.

Trace carefully, grasshoppa! :) You're in the ballpark, now you just 
have to find your way to the beer stand. :) 

Betcha didn't know you're developing the most effective (not always 
fastest, but *ALWAYS* successful eventually) disk-protection cracking 
skill known for the Apple II family :) I used to do quite a bit of 
cracking in the years-and-years ago - strictly for the ability to do so 
- honest - I think only one of my cracks ever left my hand, and that was 
an "emergency crack" done on a borrowed disk that fell victim to a 3 
year old with a handful of french-fries, necessitating a duplicate copy. 
Boot-tracing was something I actually came to enjoy. I've forgotten *SO* 
much through disuse, though... <sigh> 

I've got your source code from your earlier posting partially commented 
with fairly in-depth info based on what I can remember from my days of 
"flyin' the Jolly Roger".  If you like, give a holler and when I get 
done with it, I'll ship it to you.

-- 
Don Bruder - dakidd@sonic.net - If your "From:" address isn't on my whitelist,
or the subject of the message doesn't contain the exact text "PopperAndShadow"
somewhere, any message sent to this address will go in the garbage without my
ever knowing it arrived. Sorry... <http://www.sonic.net/~dakidd> for more info