Crack plus Trainer

our first task is to see what type of protection this game
has, so boot the orignal up and play for a while ,notice anythign pop
up saying goto manual page XX line Xx ect….? no? ok cool then i presume
the protection is disc based, so boot up your copy of X-COPY
(what u mean u dont have it ,dont lie everyone had a copy of this) and
lets make a backup of the original disc ,now what this does is well make
a backup for us to use (if its possible) and also tells us what type of
disc protection is on the game ,so you start to make a copy and oh no,the
first track upper side has an error :O but thats ok the rest of the tracks
are clean

so what this tells us is that this game is not MFM protected
which is a bitch to crack because every track apart from the boot sector,is
protected so we only have 1 track protected thats cool it probibly means
its just a copylock protection and what this means is the error track
cant be duplicated with a standard amiga you need a special machine,so
when the game kicks and a copylock routine executes to check this track
and make sure its the original track and since it cant be duplicated it
checks and is unable to find that track and thus cause the game to crash
so load up the backup disk you just made after a while you will notice
the nothing is happening .. just a black screen there is someloading happening
but still nothing happens, so reboot and hit your action replay button
when the screen turns black and lets search for that copylock routine
,alot of copylocks start with 487a hex so lets search for that type
F 48 7A ;then hit return

after a while you will have some values 6 to be exact
lets take a look at the first one at address D118, but lets start from
the nearest 0 so type
D D100 ;press enter a few times to scroll down, ah this is interesting
it looks liek the start of the copylock notice the PEA and ILLEGAL ect…
ok take note of this address D100, so lets scroll down some more, hmm
all we see is alot of encrypted code but dont let it put you off carry
on scrolling down eventualy you will come across some recognisable code

this must be the end of the copylock look at line 00D644,

CMP.L #8488FFC4,D0 ;what this is telling the computer to do is check D0
for value 8488FFC4,
BEQ 0000D65C : and if it is equal then continue to load the game,so it
jumps to address D65C
JSR 0000D01C ; if not then lock the game in a loop
so address D65C is the point we want so take note ,lets go back to the
start of the copylock at D100 type
A D100 ;assemble code
then type
BRA D65C ;press enter twice

so we tell the game to skip the copylock routine and just BRANCH
straight to the END (the part of the code that continues to load the game,
ok now exit with X ;then enter wait a few moments and you should see this

ok so lets put this change on disk, reboot hit action
reply on the back screen then type this
M D100 ;hit return then ESC then type
M D65C ;hit return then ESC, and you will end up with this

these digits will help us find the code on the disk, now lets
read the disk into memory
type RT 50 28 010000
after a while the job will be done so lets search for some of these digits,
type F 2F 0E 4D FA
you will end up with 2 points d100 and 2F900 its not D100 cos that the
memory location we used so must be 2F900, ok write this down now lets
search for the second
type, F 20 5F 4e 75 00 00, we end up with 2 more and once again only interested
in the last one

right so armed with all these address points lets start shooting
,boom bang bang boom ..oopps got carried away there sorry ,so lets change
these points type
A 2f900 ;then hit return, then type
BRA 2FE5C ;then hit return twice, thats it code changed ,lets put it back
on disk
, type, WT 50 28 10000
once done reboot and try it out

right now this is cracked lets add a small trainer ,so
based on CybFrog’s Tutorial in the forum lets add his code, so open
action replay and type this
RT 0 01 40000, this wil read first track into memory location 40000,
scan dow nthe bootblock by typing D 4000C, scroll down till you see
JMP 000000400
notice the address this is at 40086, so lets edit this, type
A 40086 ;then enter then type
btst #6,bfe001 ;left mouse button
beq 40100 ;if the left mouse button is pressed continue to address 40100,
jmp 400 ;if its not pressed jump to address 400 to load the game, ok
once this is done lets add cybfrog’s code
type, A 40100 ;the address we jump too if left button is pressed, then
MOVE.W #4a78,A14
MOVE.W #4a79,13A0
MOVE.W #4a79,13AA
MOVE.W #4a79,13D4
MOVE.W #4a79,64FC
MOVE.W #4a79,6506
MOVE.W #4a79,A1B0
MOVE.W #4a79,A17A
ok once this is done type this small code to show the trainer is activated,
MOVE.W #F,DFF180 ;put colour red on screen
MOVE.W #FF,DFF180 ,put another colour also on screen to make the screen
BTST #A,DFF016 ;wait for right mouse button to be pressed
BNE 40138 ;if its not pressed loop colour flasher
JMP 400 ;if pressed continue to load the game
so it should look like this

once this is done fix the bootchecksum by typing this, bootchk
then write it back to disk, WT 0 01 040000
reboot and if you hold down the left mouse button while it boots untill
the black screen appears then the screen should flash to tell you trainer
activated press right mouse button to continue to load the game ,if you
dont press either button the game will load with no trainer as normal
Musashi 9 / Cybfrog


Publication author

offline 21 hours


Comments: 1160Publics: 2778Registration: 06-03-2017

Notify of

Inline Feedbacks
View all comments

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Password generation

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Would love your thoughts, please comment.x