North & South
? Infogrames
1989
You will need following:
1. Original game ? find on emunova.net
2. An Amiga or WINUAE
3. Action Replay or ROM image
4. Pencil and paper
Start by making a copy of original game disk. You?ll notice that cylinder 01 is faulty, so we are probably dealing with a disk-based protection.
Boot copy of game and start paying attention, when the title screen appears. A few secs after, you?ll hear a drive grinding sound, the game is travelling towards cylinder 01. When this happens, enter AR. Press ? D ? to disassemble actual memory. Hold enter down and don?t release it, before bottom of screen has been reached. Scroll back up and look out for this:
Address C16532 looks like the start of a routine, and yes you guessed it; the protection. I have marked the start and end address with red. The protection returns some certain numbers in the registers if it passes. Take note of start and end address and exit with ? X ?. A few secs after, this screen will appear:
The protection is failing and asks for the REAL disk. Enter AR and insert a breakpoint in end of the protection routine, so we can grab the correct registers: ? BS C16578 ? and exit with ? X ?. Insert original disk and press ? OK ? in the requester.
The protection is executed again and return the correct vales in the registers. AR pops up when end of protection are reached. The protection restores registers D4-D7 so we don?t care about these. We are interested in register D0-D3, take note of them.
Next step is applying a crack patch to the protection. See opcodes for the first lines of code: ? M C16532 ?. We need those to be able to locate it on disk. I marked opcodes with red, in the picture below:
The protection is located on track 08 (find by trail and error or read out whole disk). Read it into memory, starting at address 30000; ? RT 10 2 30000 ?. Find protection by searching for the opcodes; ? F 48 E7 0F 00 ,30000 ?.
AR returns address 3128A. Assemble it and insert following:
3128A; MOVE.L #1,D0; set D0 to #1
31290; MOVE.L #410,D1; set D1 to #410
31296; CLR.L D2; set D2 to #0
31298; CLR.L D3; set D3 to #0
3129A; RTS; return
Write track back; ? WT 10 2 30000 ?.
Reboot and have fun!
This cracked is dedicated to ALE ? men sig det ikke til nogen?
Publication author
