Basic TVD cracking

—————————————-
Amiga cracking – A look at basic TVD’s
—————————————-

[0] Introduction
[1] A first look at a real TVD
[2] So, what now?
[3] Final words

.-=[ [0] Introduction ]=-.

TVD is an acronym for “Trace-Vector Decoder”, which is a commonly-used
method of protecting code/data as part of a copy-protection routine. It
takes its name from the fact that it uses the 68000 TRACE exception vector
to decode
something (typically the next instruction). A TRACE exception occurs when
the trace bit in the status register is set to 1.
[ pic: 68000 STATUS REGISTER]

When the trace bit is set, execution jumps to the address stored @ 00000024
(the offset in the 68000 vector table for the TRACE vector). As with other
exceptions, the current SR value (16 bits) and the return address (32
bits) are
pushed onto the stack. When the exception finishes (with an RTE instruction),
these values are used to continue execution as before – obviously this
means that unless something else changes the trace bit in the status register,
the trace vector will be called after every single instruction (since
the trace bit had to be set to get into the trace vector routine, and
it’s restored when
we leave it!). And that’s the key to TVD routines – they typically decode
the next instruction to be executed, and once that decoded instruction
has completed, they decode the next one, and so on…So, now that you
(hopefully) have some idea what this is all about, let’s dive in and have…
.-=[ [1] A first look at a real TVD ]=-.

This example was found in the game: ALTERED BEAST (C) ACTIVISION/SEGA.
You should have the original disk or a copy of the CAPS .ipf file(s) if
you want to take a look at it for yourself. It’s an early Rob Northen
“Copylock” protection that returns the “magic number” in D0 and the trace
vector (take a look at the contents of 00000024 after the drive-grinding
Track 0 check!).

The TVD in this game (as in most/all of Rob’s protections) is used to
protect the disk-protection check proper (Track 0 has a different sync,
data is read and a simple checksum routine is performed on the returned
data to calculate the “magic number” for the game). Right, power up the
Amiga+AR (or your personal choice of monitor cart/software (or even WinUAE!)),
and let’s have a look at it!
(All code is in UPPERCASE, comments are after the “;” character)
First, we have the setup:

Phew! A lot of commentary for such a little piece of
code, but I hope it was useful… right about now, you’re probably asking
yourself
.-=[ [2] So, what now? ]=-.
Well, we obviously need to get to the unencrypted code somehow in order
to see exactly what the protection is doing.
Let’s have another quick look at the original TVD:
01729A : 027C F8FF ANDI # F8FF,SR
01729E : 48E7 80C0 MOVEM.L D0/A0-A1,-(A7)
0172A2 : 43FA FEFE LEA 171A2,A1
0172A6 : 2051 MOVEA.L (A1),A0
0172A8 : 20A9 0004 MOVE.L 4(A1),(A0)
0172AC : 206F 000E MOVEA.L E(A7),A0
0172B0 : 2288 MOVE.L A0,(A1)
0172B2 : 2350 0004 MOVE.L (A0),4(A1)
0172B6 : 2028 FFFC MOVE.L -4(A0),D0
0172BA : 4680 NOT.L D0
0172BC : 4840 SWAP D0
0172BE : B190 EOR.L D0,(A0)
0172C0 : 4CDF 0301 MOVEM.L (A7)+,D0/A0-A1
0172C4 : 4E73 RTE
Now, originally I replaced the last 2 instructions of the TVD with:
0172C0 : 4EF9 0000 00C4 JMP 000000C4

so that it would jump to my routine, however…after a few crashes it
became obvious that something was going horribly wrong 🙂 I suspected
a checksum, but what I found (by a LOT of breakpoints/tracing, I won’t
bore you with all that) was quite clever… Rob uses the last 4 bytes
of the TVD (half of the MOVEM and the 2 bytes for the RTE instruction)
as one of his decryption key values – this way there’s no need for a
separate checksum routine, since if you modify them the instruction
it decodes is going to be incorrect, and… well, you know the rest!
This is not good, but now that we know that, we can move our hook up
into the routine, and avoid altering the bytes that cause the crash:
0172B6 : 2028 FFFC MOVE.L -4(A0),D0
0172BA : 4680 NOT.L D0
now becomes:
0172B6 : 4EF9 0000 00C4 JMP 000000C4
We don’t alter any other bytes in the original TVD. Now we need to insert
the following code @ 000000C4:
0000C4 : 2028 FFFC MOVE.L -4(A0),D0
0000C8 : 4680 NOT.L D0
0000CA : 4840 SWAP D0
0000CC : B190 EOR.L D0,(A0)
0000CE : 2250 MOVEA.L (A0),A1
0000D0 : 2008 MOVE.L A0,D0
0000D2 : 0080 0060 0000 ORI.L # 600000,D0
0000D8 : 2040 MOVEA.L D0,A0
0000DA : 2089 MOVE.L A1,(A0)
0000DC : 06B9 0000 0001 0000 00C0 ADDI.L #1, C0
0000E6 : 4CDF 0301 MOVEM.L (A7)+,D0/A0-A1
0000EA : 4E73 RTE
I’ve written this here without comments so you can type the bytes into
memory if you’re following along step-by-step… here’s the commented
version:

And that’s it! Now when this has all executed the game
should start, and when you look in memory @ 6171EC onwards you’ll see
the decrypted Rob Northen Copylock routine just sitting there, waiting
for you to save out to disk and then load it into your favourite disassembler
(ReSource, IRA, or even IDA on PC if you’re not an Amiga purist!). Also,
take a look at the trace counter we stored @ 000000C0, and think how
long that would’ve taken to trace by hand 🙂

.-=[ [3] Final words ]=-.

Now, I know there was no point in decoding the protection routines in
this particular game, since it performs a simple check and gives you
the magic number in the trace vector handler address @ 00000024…
however, it does illustrate the principles you’ll need if you’re going
to crack harder TVD protections in future (be prepared for cartridge
detection, checksums everywhere and worse!), so I hope you’ll agree
it was a worthwhile tutorial.
If there are any errors in the tutorial, forgive me, it’s 05:40am and
I’m starting to feel slightly tired! Thanks for reading, see you in
a future tutorial (possibly!)…Zzzzz!
BTW: De La Soul obviously never cracked Altered Beast. The magic number
isn’t 3, it’s 664E90EA.

-Wayne Kerr, May 2004 (Yes, I know, 15 years late!)