Zool

Hi freaks… guess what?!

Both gamedisks are not copyable so let?s enter our AR to read in the first track of disk 1!
Type in: rt 0 1 $50000 and disassemble the bootcode with: d $5000C …
As always we are going to rip off the gameloader… due to the fact that the game jumps to $70000 at adress $50090
I hardly guess that the main trackloading routine is loaded up to $70000! Let?s just replace this ‘jmp’ instruction with a
bra $50090 which will cause the processor to loop instead of executing the code at $70000.
Behave like in the picture below:

I won?t explain anything here coz it should be nothing new for you…
After the bootblockchecksum is calculated and you?ve written back the track to disk, reset your machine and boot up
the gamedisk. After you?ve recognized that nothing really happens the processor seems to hang in our loop so let?s
enter the AR again to save the loaded code beginning at $70000 to disk.
Just view the memory with n $70000 and scroll down some lines… You?ll find out that there are
$1800 bytes of data which probably is our mainloader… Let?s save that area to disk! Insert a blank one and write
the stuff like this: sm loader, $70000 $71800 !
Now let?s take a closer look to find out how the trackloader is working… Disassemble the code with
d $70000 and guess what, scroll down some lines.

The interesting trackload routine seems to start at $70656! Look at the code at $70064:

$70064 movea.l #$52000,a0 ; Loadadress
$7006a move.l #$96,d0 ; Tracknumber
$70070 move.w #$3,d1 ; Loop 4 times (dbf used)
$70074 bsr.w $70656 ; call the “Read 1 Track” routine.
$70078 add.l #$1800,a0 ; Loadadress+$1800, game uses $1800 bytes tracks!!!
$7007e addi.l #$1,d0 ; Tracknumber + 1
$70084 dbf d1, $70074 ; Continue with reading in the 4 tracks.

We will use this routine located at $70656 later on to rip off all the tracks from disk!
After I continued disassembling the code at $70000 I recognized that this loader is used to load
the “GREMLIN” logo part, the “ZOOL TITLE” logo part and the “NOVELLAPROTECTION” code which is executed at
adress $701D2 with a jump to $1002 !!! From this point on the code at $70000 is no longer used but we will
come to that later on.
Insert your gamedisk again and execute the code at $70000 with:
g $70000 followed by -ENTER- and let the game load until the Novella part appears… We will
have to get rid of this as well so …

Type in the word “SUX” or something else and enter your AR!
Now let?s search the memory for our input with:
f “SUX”
U will see exactly this adress… $24D48 ! So the game holds our input at adress $24D48.
Let?s find out where this adress is accessed in the protection code…
Type in: f 00 02 4D 48
Like shown in the picture, there are some more adresses which could be interesting for us… but I found out that the important code is stored at the
last one… Let?s disassemble the code with: d $6BC2!

Yeah… this explains all. Register -A1- points to our string “SUX” in memory! At $6BC8 -d5- is set to 2 (used as a dbf loop counter at $6C1A) so the loop
is being executed 3 times… Well, the Novella protection takes 3 bytes input so this seems to be the important comparison-part. At $6BDA the first byte of our input is
compared with the value in d0 and if equal, branching to $6C16. At $6C16 the “addq.w #1,a1” points -A1- to the next byte of our input and then the “dbf d5, $6BCA”
continues the compareloop. So if -D5- really reaches the value -1 then all bytes are compared successfull and the game continues at $6C1E with branching to $6C24!
So to get rid of this simple protection just enter the following:
g $6C24 and hit -ENTER-
That?s it!!! The protection screen disappears and the game continues loading…
Let?s remember the adress $6BDC for further cracking activities… we will replace the “beq.b $6C16″ stored at that adress with a “bra.b $6C16″ later on so that
the game will continue although we?ve entered crap at the input prompt!

Okay… now while the game is trackloading just enter your AR again to find out what is going on… The value of the -PC- register shows us that the old loader at $70000
seems not to be used anymore… Let?s have a closer look!
Type in: n $70000 and watch the ascii-dump…

Uhm! Seems like our old loadercode has been replaced by a nice filetable! 🙂
Well, to find out where the trackloading engine hides, let?s simply search for one of these table-entrys in memory…
Type in, for example: f “zool8col.chm”
After we found the adress ($9BD2 in this case) we can go on searching the part of the code that does take this filename
as a parameter…
Type in: fa $9BD2 and hit -ENTER- …

Like shown in the picture the interesting code starts at $8C9A … If you go on disassembling the code u will find out
that the trackloader is stored at $5858 taking the following parameters…

A0 => Pointer to filename
A1 => Loadadress
D0/D1 => Dunno! 😉

We won?t care of the values stored in D0/D1 because we will not use the lame fileripping method in this crack… this means we will
not have to code a complete new loader but will only replace the part whichs loads and decodes a single track!!! But to do that
we will have to find out where this part is stored in the main loader so lets disassemble that one…
Type in: d $5858 and hit -ENTER- …

Again I won?t go deeper into explanation what every single instruction in this loader does as it is always nearly the same from tutorial to tutorial…
if you want to know more about mfm and fileloading routines read the “Strider” Tutorial written by Codetapper (Greets!) and go on with reading my “Turrican 2” tut on this page!
Just some quick infos:
The game searches the filetable at $70000 for the filename that -A0- is pointing to!
The filetable has the following look:

$00 – $0f -> Filename
$10 – $13 -> Position on disk (in bytes, e.g. $90000)
$14 – $17 -> Filesize in bytes

After the loader got the correct position on disk and the size it divides the diskposition by $1800 to get the correct tracknumber where the file is stored in. The game helds the important values at
following adresses:

$5958 -> File-Loadadress
$596A -> Tracknumber
$5964 -> Rest of the divison “Filepos on disk / $1800″

The interesting instructions for us start at $58BE!

$58BE movem.l d0-d7/a0-a6, -(a7) ; save all regs on stack.
$58C2 move.w $596A, d0 ; Moves tracknumber to -D0-.
$58C8 bsr.w $5172 ; this routine moves the driveheads to the correct track.
$58CC bsr.w $521C ; the routine that reads exactly 1 track ($1800 bytes)
$58D0 movem.l (a7)+, d0-d7/a0-a6 ; restore all registers.

The adress $71800 is stored in register -A4-. The game uses the memory from $5A(A4) for the mfm encoded track and $3820(A4) for the decoded track! So this explains the follwing
instructions shown in the picture below…

After reading and decoding one track the game continues copying the decoded bytes of the track into it?s correct memoryposition.

$58D4 move.w #$1800, d0 ; Copy 1 track -> $1800 bytes
$58D8 sub.w $5964, d0 ; $1800 – rest of “Filepos/$1800″
$58De subq.w #1,d0 ; size to copy -1 coz of “dbf” loop
$58E0 lea $3820(a4),a0 ; adress of the decoded track
$58E4 move.l $5958, a1 ; moves the “where 2 load” adress into -A1-
$58EA moveq #0,d6 ; clear d6
$58EC move.w $5964, d6 ; moves rest of “Filepos/$1800″ to -D6-
$58F2 adda.w d6, a0 ; -A0- now points to correct pos in the decoded track
$58F4 move.b (a0)+, (a1)+ ; copies track bytewise to correct memorypos
$58F6 …

So well, let?s crack this shit now! The only thing we will patch in this game is the routine at $521C which reads and decodes 1 track to adress $3820(A4).
So the last thing we will use the AR freezer for is to find the instructions that are doing something using the tracksize-value $1800 !!! We will have to replace those instructions to handle $1600 bytes coz this
is the amount a normal dos track consists of! For example the game divides the fileposition on disk with $1800 to get the correct trackposition for the diskstepper… we will simply replace that “divu #$1800″ with
an “divu #$1600″ which will make the diskstepper “walk” to the correct position on our cracked version.
After using f 18 00, $5000 $8000 (the range of the diskloader) we will find the following instructions, so pick up a pen and write down these adresses so we can patch them lateron.

So our piece of paper should contain the following informations:

Adresses for moving value $1600 to:
$5032, $5654, $580A, $58D6

Other important patch adresses:
$6BDC -> Novella Protection, set this to “BRA.B $6C24″

Okay finally let?s reset our machine and boot up the ASMONE assembler to write some lines of code
that will extract all tracks of the gamedisks!
Reserve about 1200 kb chip ram and type in (or copy / paste) the following code (source is commented)…
We will use the first gameloader that we?ve ripped in the beginning of this tutorial from adress $70000 to read in the tracks…
Remember it took the following parameters:

A0 -> Loadadress of the track.
D0 -> Tracknumber to load.
(Adress of trackloader: $70656)

; Small Trackgrabber for ZOOL.
; ============================

move.w $dff01c,oldintena ; Save interrupt registers…
move.w $dff01e,oldintreq ;
bset #7,oldintena
bset #7,oldintreq
move.w #$7fff,$dff09a ; Kill interrupts
move.w #$7fff,$dff09c ;
lea $bfd100,a4 ; Set up neccessary registers
lea $bfe001,a5 ;
lea $dff000,a6 ;
move.b #$7d,(a4) ; Turn diskmotor on.
nop
nop
move.b #$75,(a4)
moveq #2,d0 ; Begin reading from Track 2 (0 & 1 were dos-readable)!
lea buffer,a0 ; Gameloader needs “loadadress” in a0.
read:
jsr $70656 ; Jump to gameloader, reads 1 Track.
cmp.l #159,d0 ; Already reached track 159?
beq.b ready ; Yep… finish reading!
addq.l #1,d0 ; Add 1 to tracknumber
add.l #$1800,a0 ; Increase bufferadress.
bra.b read ; Continue reading.
ready:
move.w oldintena(pc),$dff09a ; Restore Interrupts.
move.w oldintreq(pc),$dff09c ;
moveq #0,d0
rts

oldintena: dc.w 0 ; saveadresses for our interrupt-registers.
oldintreq: dc.w 0 ;

org $70000 ; Places the loader into the correct adress!
zoolloader: incbin “yourpath:loader” ; The original gameloader.

org $75000
buffer: blk.b 160*$1800,0 ; Space for 160 “$1800 byte” tracks.

Okay, now insert gamedisk 1 into drive 0, press -ESC- to swich into command-mode and type in: A followed by -ENTER-…
After the program is assembled, execute the code with J and -ENTER- !!!
Wait about 40 seconds until the program has finished loading…

Now the tracks 2 – 159 should be stored in our buffer… Let?s check this with ascii-viewing that memory area…
Type in: N buffer, again followed by -ENTER- of course and scroll down some lines…
You?ll see something like this:

At buffer-Offset $1800 the filetable appears that we?ve seen before at $70000! So I guess our ripping was succesfull.
Now let?s save the tracks to our harddisk as one big file, type in:
wb and hit -ENTER-, choose a filename and tell the assembler to write the range from buffer till buffer+158*$1800!
So while we are at it, let?s do the same with the second disk. But this time we will have to tell the source not just to grab the tracks from 2 – 159 but
from 0 – 159!!! So press -ESC- and replace the “moveq #2, d0” to a “moveq #0, d0” ! Then insert the second disk and behave like done before. Write these tracks
back to your harddisk as well, choosing the range from buffer till buffer+160*$1800!
So now Congratulations, the original disks are not needed anymore!

Now let?s start with a really easy thing… cracking the second disk now only means to write back the range from our label buffer back to a fresh
formatted disk!!! You may say: Hey, we?ve just ripped 160 $1800 byte tracks, this will never fit to a normal dos-disk as it uses only $1600 bytes each track. Well, that?s true. But
I used a cheat to play through all 6 levels of the game while testing if it was enough to write the 901120 (160*$1600) bytes back to a new disk. The trackloader is stored on the first disk
so there is nothing more to do with Disk 2 than writing it back. So…
Type in: wt followed by -ENTER-
Now tell ASM-ONE to write from our label buffer from track 0 till track 159, that?s it for the second disk!

Now let?s see what has to be done with our first disk…
First of all… let?s save this “grabtrack” source and continue with a new one… Type in: zs and hit -ENTER- …
Change into Editor-Mode using -ESC- again and type in the following 2 lines:

DISK1: BLK.B 2*$1800,0 ; Track 0 and 1 😉
INCBIN “YOURPATH:TRACKS2-159”

If you take a look at the loader that we?ve picked from $70000 again you will find out that it does the following:

It reads in 4 tracks to adress $52000 beginning from track $96 (!150), followed by reading in track number $95 (!149).

Now if we multiply track number $95 with the tracksize of $1800 we will come to the conclusion that the “GREMLIN” Logo-Part and the
“ZOOL TITLE” Logo-Part are stored on disk beginning at Position $DF800 (!915456) which does in no way fit onto a normal dos-disk, which can only take up to $DC000 (!901120) bytes.
So due to the fact that we do not want to cut the logoparts on the crack we will have to search within the buffer if we are able to find some free space for these
5 tracks (a range of 5 * $1800 = $7800 (!30720) bytes is needed). Luckily I found a huge range of $D800 (!55296) bytes at trackbuffer offset $9F000 (!651264), which means
at trackposition:
$9F000 / $1800 = $6A (!106).
Leave the Editor again and assemble the whole thing using A…
Then try looking at the free diskspace with n DISK1+106*$1800 and scroll down some lines…

I guess we can overwrite this bullshit without making the game missing something. 🙂
Press -ESC- again to switch into command mode and follow the instructions shown in the picture below to move these 5 tracks into that new position!

We use the C (copy) command to transfer the range from DISK1+$95*$1800 till DISK1+$9a*$1800 to DISK1+$6A*$1800! Now if the tracks are moved, continue
with tracking the whole buffer to a new formatted disk beginning from label DISK1 from track 0 – 159 using the WT command. So if that is finished we only need to take care
about the important datas on track 0 and 1 to finish our crack! Here comes the complete sourcecode which manages the area to be
written on track 0 and 1!!! The explanation for the 6 ‘move’ instructions in front of the diskstart at label BOOT follows right after…

; Creating Track 0 & 1 for Zool
; =============================

MOVE.L #$6B,LOADER+108
MOVE.L #$6A,LOADER+144
MOVE.W #$4EF9,LOADER+$656
MOVE.L #$70000+(NEWLOADER-LOADER),LOADER+$658
MOVE.L #$4E714E71,LOADER+204
MOVE.L #$71800,LOADER+468
RTS

BOOT:

DC.B “DOS”,0
DC.L 0
DC.L 0
MOVE.W #$2,$1C(A1) ; Standard bootcode, just tracking our loader to $70000.

MOVE.L #$1C00,$24(A1)
MOVE.L #$70000,$28(A1)
MOVE.L #$400,$2C(A1)
JSR –$1C8(A6)
MOVE.W #$09,$1C(A1)
MOVE.L #$0,$24(A1)
JSR –$1C8(A6)
MOVE.W #$7FFF,$DFF096
MOVE.W #$7FFF,$DFF09A
MOVE.L #$70000,$80.W
TRAP #0
BOOTEND:

BLK.B 1024-(BOOTEND-BOOT),0

LOADER:
INCBIN “YOURPATH:LOADER” ; The $1800 Byte loaderfile
MOVE.W #$6038,$6BDC ; Insert “bra.b $6c16″ into novellacode
MOVE.W #$1600,$5032 ; Replace some $1800 values…
MOVE.W #$1600,$5654
MOVE.W #$1600,$580A
MOVE.W #$1600,$58D6
MOVE.W #$08ED,$5174
MOVE.W #$08AD,$5180
LEA MAINLOAD(PC),A0 ; Replace *ReadTrack* Routine at $521C with own one
LEA $521C,A1
MOVE.L #(MAINLOADEND-MAINLOAD)-1,D0
COPYMAINLOAD:
MOVE.B (A0)+,(A1)+
DBF D0,COPYMAINLOAD
JMP $1002 ; Continue game…
NEWLOADER: ; New loader that is used till Novellaprotection
MOVEM.L D0-A6,-(A7)
MOVEQ #0,D2 ; Clear d2 🙂
MOVE.L D0,D1 ; d1 = tracknumber to read on original disk
MULS #$1800,D1 ; get byteposition of the track on original disk
DIVU #$1600,D1 ; change tracknumber to new position on our cracked disk
SWAP D1 ; get the rest of division …
MOVE.W D1,D2 ; … which is our byteoffset on track!
MOVE.W #0,D1 ; clear rest in d1
SWAP D1 ; now d1 is our tracknumber.l
MOVE.L #$1800,D0 ; d0 = bytes to read
LEA $DFF000,A6 ; guess what…
BSR.W TRACKLOADER ; call our trackloader!
MOVEM.L (A7)+,D0-A6
RTS

TRACKLOADER:

; Parameters:
; D0 = Bytes to read.l, D1 = Tracknumber.l, D2 = Byteoffset.l
; A0 = Loadadress, A6 = $DFF000

LEA $BFD100,A4
LEA $BFE001,A5
LEA CURRENTTRACK(PC),A3
MOVEQ #0,D7
ADD.L D2,D0
MOVE.L D0,D3
DIVS.W #$1800,D3
MOVE.B D3,1(A3)
MOVE.B #$7D,(A4)
NOP
NOP
MOVE.B #$75,(A4)
BSR.W DISKREADY
CMP.B #$FF,(A3)
BNE.B MOVETOCYLINDER
MOVE.B #0,(A3)
BSET #1,(A4)
MOVETOZERO:
BTST #4,(A5)
BEQ.B MOVETOCYLINDER
BSR.W MOVEHEAD
BSR.W DELAY
BRA.B MOVETOZERO
MOVETOCYLINDER:
BSET #2,(A4)
BTST #0,D1
BEQ.B HEADOK
BCLR #2,(A4)
HEADOK:
MOVEQ #0,D3
MOVEQ #0,D5
MOVE.B D1,D3
MOVE.B (A3),D5
MOVE.B D1,(A3)
LSR.W #1,D3
LSR.W #1,D5
SUB.W D3,D5
BEQ.B READTRACK
BMI.B OTHERDIRECTION
BSET #1,(A4)
BRA.B CHOSEN
OTHERDIRECTION:
BCLR #1,(A4)
NEG.W D5
CHOSEN:
BSR.W MOVEHEAD
BSR.W DELAY
SUBQ.B #1,D5
BNE.B CHOSEN
READTRACK:
BSR.W DISKREADY
MOVE.W #$8210,$96(A6)
MOVE.W #$7F00,$9E(A6)
MOVE.W #$8500,$9E(A6)
MOVE.W #$4489,$7E(A6)
MOVE.W #$4000,$24(A6)
MOVE.L #$60000,$20(A6)
MOVE.W #$9900,$24(A6)
MOVE.W #$9900,$24(A6)
MOVE.W #$2,$9C(A6)
TRACKREADY:
BTST #1,$DFF01F
BEQ.B TRACKREADY
MOVE.W #$4000,$24(A6)
MOVEQ #0,D5
DECODE:
LEA $60000,A1
MOVE.L #$55555555,D4
FINDSYNC:
CMP.W #$4489,(A1)+
BNE.B FINDSYNC
CMP.W #$4489,(A1)
BEQ.B FINDSYNC
MOVE.L (A1),D3
MOVE.L 4(A1),D1
AND.L D4,D3
AND.L D4,D1
ASL.L #1,D3
OR.L D1,D3
ROR.L #8,D3
CMP.B D5,D3
BEQ.B SECTORFOUND
ADD.L #1086,A1
BRA.B FINDSYNC
SECTORFOUND:
ADD.L #56,A1
MOVE.L #(512/4)-1,D6
DECODESECTOR:
MOVE.L 512(A1),D1
MOVE.L (A1)+,D3
AND.L D4,D3
AND.L D4,D1
ASL.L #1,D3
OR.L D1,D3
CMP.L D7,D2
BGT.B BELOWOFFSET
MOVE.L D3,(A0)+
BELOWOFFSET:
ADDQ.L #4,D7
CMP.L D7,D0
BLE.W READREADY
DBF D6,DECODESECTOR
ADDQ.B #1,D5
CMP.B #11,D5
BNE.B DECODE
TRACKDONE:
BTST #2,(A4)
BEQ.B ONTONEXT
BCLR #2,(A4)
BRA.W READTRACK
ONTONEXT:
BSET #2,(A4)
BCLR #1,(A4)
BSR.W MOVEHEAD
BSR.W DELAY
BRA.W READTRACK
READREADY:
MOVE.B #$FD,(A4)
NOP
NOP
MOVE.B #$E7,(A4)
MOVE.B 1(A3),D0
ADD.B D0,(A3)
RTS
DELAY:
MOVE.L #$3000,D4
LOOP:
DBF D4,LOOP
RTS
DISKREADY:
BTST #5,(A5)
BNE.B DISKREADY
RTS
MOVEHEAD:
BCLR #0,(A4)
NOP
NOP
BSET #0,(A4)
RTS
CURRENTTRACK:
DC.B $FF,0

; —————————————————

MAINLOAD:

; Simple routine that just loads and decodes one single track.
; This replaces the original readtrack-routine at $521c in the main gamecode
; so if this routine is called, the driveheads were already moved to the correct
; position for reading.

BTST #5,$BFE001
BNE.B MAINLOAD
MOVE.W #$8210,$96(A6)
MOVE.W #$7F00,$9E(A6)
MOVE.W #$8500,$9E(A6)
MOVE.W #$4489,$7E(A6)
MOVE.W #$4000,$24(A6)
LEA $5A(A4),A1
MOVE.L A1,$20(A6)
MOVE.W #$9900,$24(A6)
MOVE.W #$9900,$24(A6)
MOVE.W #$2,$9C(A6)
WAITDSKRDY:
BTST #1,$DFF01F
BEQ.B WAITDSKRDY
MOVE.W #$4000,$24(A6)
MOVEQ #0,D5
LEA $3820(A4),A0
DECODEPARTY:
LEA $5A(A4),A1
MOVE.L #$55555555,D4
FINDSYNCY:
CMP.W #$4489,(A1)+
BNE.B FINDSYNCY
CMP.W #$4489,(A1)
BEQ.B FINDSYNCY
MOVE.L (A1),D3
MOVE.L 4(A1),D1
AND.L D4,D3
AND.L D4,D1
ASL.L #1,D3
OR.L D1,D3
ROR.L #8,D3
CMP.B D5,D3
BEQ.B SECTORFOUNDY
ADD.L #1086,A1
BRA.B FINDSYNCY
SECTORFOUNDY:
ADD.L #56,A1
MOVE.L #(512/4)-1,D6
DECODESECTORY:
MOVE.L 512(A1),D1
MOVE.L (A1)+,D3
AND.L D4,D3
AND.L D4,D1
ASL.L #1,D3
OR.L D1,D3
MOVE.L D3,(A0)+
DBF D6,DECODESECTORY
ADDQ.B #1,D5
CMP.B #11,D5
BNE.B DECODEPARTY
RTS
MAINLOADEND:

So….. first of all this sourcecode includes a new bootblock for the game at label BOOT which reads in
the old loader ($1800 bytes) expanded by my own code back to $70000 again and then executing it. The BLK instruction right after the bootblock at label
BOOTEND just fills up the remaining bytes of the bootblock with zero’s so that the loader that is included right after has an even position at $400 (!1024) on disk! The instructions that are coded right behind
the included loader is my special expansion part that e.g. consists of the new trackloader(s). So now you may ask: ‘Hey, at what time are these instructions executed then?’ Well, look at the instructions that are placed in front of
the bootcode! Before we are going 2 write the memory beginning at label BOOT back onto our crackdisk we will have to run this sourcecode so that the few ‘move’ instructions at the beginning are executed. The first two are moving
the two changed trackpositions into the loadercode (remember we copied 5 tracks some lines before), the next two are placing a “jmp newloader” instruction right into the beginning of the old trackload adress $70656 so that the code beginning
at label NEWLOADER is been executed instead of the old trackloader. The fifth ‘move’ just nop’s out a branch instruction that makes the driveheads step onto track zero… this is a must coz my trackloader uses an internal track counter and
it would cause the game to crash if the diskstepper suddenly changes its position. Last but not least the sixth ‘move’ patches the “JMP $1002″ instruction that finally runs the Novellaprotection + the Mainloader and
simply replaces the jumpadress from $1002 to $71800. So if booted from our crackdisk, my special expansion part that follows right after the included loaderfile is been executed then (remember the loader has a size of $1800 bytes and is loaded up to $70000, so the
‘expansion-part’ is beginning at $71800)!

FINALLY… assemble the stuff using A and write back the 2 tracks from label BOOT to your Disk 1 beginning at track 0 (like shown in the pic above). Calculate the Bootblock-Checksum with the CC command, reset your machine and have a play.

This tutorial was written in a hurry so if I missed an explanation or there is something you absolutely do not understand then don?t hesitate to e-mail me!
At last… this tutorial is dedicated to our Copylocker – Rob – ! 🙂
See you lateron in the next one which is already in work… 🙂
..:: Alpha One in ?2004 ::..

0

Publication author

offline 3 months

aLpHa oNe

0

Comments: 260Publics: 7Registration: 07-08-2007