REHABILITATION PROGRAMS (continued, beginning in the ZX Power'e
# 2) (C) 1997 Alexander Desyatnichenko
_________________________________________ 6.Vosstanovlenie
programs run by the address search. Of course, finding an old
boot vovzlome and, using its data, restore novit game is simple
enough. But takoebyvaet infrequently, usually only vsamyh older
games. Newer programmyposle download occupy the entire memory
of bu-Schrieffer printer to the last byte in 65535i, of course,
no old-ka zagruzchi you will not find them. How did the
post-drinking in this case? If you already davnokovyryaetes on
game programs, either in search for the infinite life, whether
in search of interesting algorithms, it is probably You may
have noticed that many programs similar to each other, I mean
the programming structure. Usually one Keep the text messages
another - the graphics in the third - routines, ending with the
directive RET, and, of course, somewhere in all of these
routines are invoked through the CALL from, so to speak, the
main connecting programmy.Raz such program is, then, somewhere
in it there and a beginning - the address at which to begin
Start the game after you go
at him from the BASIC loader team
RANDOMIZE USR. And if you try to find
own this place and run it with the program? That's how often,
and have recover properly hacked
game. How does look like the assembly language
beginning of the program? Usually start every game starts with
a ban interrupt the machinery stack, clear the screen and color
setting BORDER, followed by withdrawal on-screen game menu, the
formation of a table, setting IM 2, the launch of melody and
etc. Here are illustrative examples:
DI
LD SP, 32768
SUB A
OUT (# FE), A
So begins the program TURBO-BOAT
(As you know, it starts from the address
32768). Approximately the beginning of
Most renewable programs.
It happens also that the main program immediately begins with a
subroutine call by Numerous CALL, it is immediately evident. Do
not be afraid to experiment, especially if you have the ability
to multiply quickly reloaded to drive - write down all the
"suspicious" of the address and try with all their pozapuskat
game. In addition, you will find the address start-up, you
still find entry points into different
routines that you will be interested in terms of implementation
of the or other interesting algorithms, and you
then be able to use it in
own programs. This method is certainly a good fit for other
purposes, for example, to break heavily protected programs.
Why, indeed, hack loaders? Only to find the address to download
and run the game! So for now you can generally leave the boot
alone and just get yourself a code file and find the address
run it! You say, address start find and how to deal with load
address? Believe me, it is also possible. Have you seen
cassette version of the game RAINBOW ISLANDS,
loader which has deterred most
only for its length! It's not like something, and almost brand
boot company OCEAN, was filmed only protection copy of this
very boot. So, when I have not had the drive, I passed
downloader, understood with the addresses of the viewing code
file in just a half hour. Well, if you
need to find the load address codes in MAGIC-file on the drive,
then there are no problems at all - looking
his DISK DOCTOR'om, STS'om, we can immediately
determine where there useful information, and where an empty
space and, accordingly, then make a discharge. Help to find the
address of the program can run itself a stack machine. After
all, before being hacked, the program has had time to run and
perform certain operations, dig deeper in the stack, you can
try to determine what and to find a place in program, after
which "dance for him." By the way, some games are spread in a
semi-recovery, for example, THE SCEPTRE. If you look like it
starts, you'll see that in the processor registers recorded
data taken by a hacker from the stack, and then he makes a JP
at the address specified in the same way, so the program still
does not start from the beginning, and from the place where was
once stopped. And another very interesting point about the
register R. After all, as you see, is nowhere restored! Well,
some games are quite sensitive to it. Thus, For example, if you
make JP the address start Game A.M.C. in the register R Record
high value, then permanently in the boxes you will
fall the same, as follows from
"Law of meanness," the most unnecessary weapon.
If its zero, then everything is in order, in each box is
different. But in the games company OCEAN for a large value in
register R before running all the enemies that do not at all,
and then once they go in droves, and the same ammunition - that
does not fall at all, and then suddenly all at once in one
place. In other words, if you want
recovery program, in which the course
game is given a random manner, ie
depending on the value of the register R (I
I think you can guess how this
know - a few times restart the game to play and see if one
always and the same thing at the same location, or every time
differently), worked fine, then before
how to make JP the address start, reset the register R or try
to put on him a different value. Some encoders can say that
because from the moment start and to the point where, depending
R is constructed from the game, he can register
proprygat than a dozen cycles ... Well
Well, try to experiment and you will surely see a lot of
interesting things. Apparently, the authors have used games
all, who knows, maybe none ELITE can not pass because of the
fact that in case R is not what we need ...
7.Vosstanovlenie programs
by perevzloma.
This method is based on the well-known popular saying "oil
will not spoil the porridge." It has already been an example of
how many times the game perevzlamyvalis, roaming from one
system to another. So Thus, if you again click on the MAGIC
in the same place, where once the button was pressed multifeysa
worst of it you have already do not, but his job much easier.
Only need to remember that this button spoils a few cells in
the system variables, so if there is valuable information, this
fact must be taken into account. This perevzlom
sometimes it is simply indispensable. For example, when
restoring games HYPER ACTIVE SOLOMON'S KEY and I tried to see
disassembler code blocks, and there
instead of the usual routines and text
communications - solid gibberish. Just
in hacking these programs multifeysnaya
button was pressed at a time when
game has already been loaded, but firm
multistage protection (the so-called
"Ksorka") has not yet completed the process of decoding the
main code block. To not wrestle with a decoder manually (and it
may be impossible this case) had to get ill hack program,
enabling it to fully start, and then Button fly MAGIC. AND
yet. If hacking 48K-128K programs use the machine with a floppy
drive, then why not use this technique for recovery programs!
Indeed, in our before it has a lovely 128K-disassembler STS,
which has a large opportunities. With this program,
You can download the whole file MAGIC-in
memory of the computer, view them and make any izmeneniya, then
save on disk in either sliced. So
way eliminates the need for multiple loading-unloading and
cutting-pasting the code block the main game. But you can do
48K machine, if you install the firmware into it with so-called
"shadow" monitor, this much has been said lately. Thus
restoring the program, you will sooner or later come across a
game that takes all the computer's memory. How to unload this
unit and how it then download it? It is clear that using STS on
128K-machines you have a problem with it is not, but if
someone will suffer a reduction
programs within the 48K, it would have
to do something like that done sometime
Polish hackers, loading-unloading separately long block from
the CLEAR and above and short length 1204-2048 bytes. You've
probably seen that many of the recovery program is loaded into
the end of a shaded black screen area small code blocks of
length 1704, or say, 1204 bytes, and then, using
protsedurki a native being moved
these bytes at address 23296. You can and you
to begin to try to do so. I
I would ask experienced hackers and coders are not
joking with my detailed explanations of such basic, sometimes
just lamernyh things, because its main purpose, I I think many
users attach to koderstvu way "from the simple to complex ", -
first, easiest LDIR in the restored toy, and then may
be a person wants to try and
himself to write ... In the turn, I
would like to remind them that if you
undertook the restoration game, too,
Please remove this hack all
superfluous: clogged stack fragments the data
transferred to another place with the help of
LDDR, old spouts at the end of memory
old system variables and the region
BASIC, the values of the stack, and then the stack itself
in the picture ... Suppose we have already recovered
your game looks to firm and from the inside, and then suddenly
someone wants to see how you restore it. And very much much to
ask not to change the text messages have fans inflate the year,
instead of authors' names say hello, distort the firm CHEAT.
8.Drugie recovery.
When you restore a game you can
face other challenges. Thus,
watching the game listing ELVEN WARRIOR,
You can find an old boot, which implies that the game is loaded
in three blocks: screensaver, the main unit and the music for
the coprocessor. Well, with the screen saver and music all
clear - in this case they are not recover, but the game itself
you can try. It would seem that everything is simple - to pull
out of the MAGIC-cracking unit of length 32768 bytes starting
at address 24576, and run from the address 33024. Alas, not
quite so. On the screen a lot of crashes and the game does not
work. Let's see what is available at launch. Yes, there are a
lot of "bloat" from transformation in the computer memory at
once after boot - before you display the game menu, the program
itself modifies the memory, there is transfer of codes from one
place to another, entering data into memory cells, etc. while
at the same time rubbing parts of a program, where before it
was useful The information already thrown teams
LDIR in other areas of memory. Of course,
if now upload a file of the above
length and then re-launch it from a place
old start, then again she will perform all these conversions,
transferring the other information already in the same place.
Such games can be recovered either deal with all these umklapp
and installing all the information on the place where
it should be before the start of the game,
or else unloaded all the used memory and deleting teams and
umklapp transformation, pretending that they have already
happened. Incidentally, the above example can be used for new,
original protection. For example, your program loaded, runs and
immediately destroy part of itself - the part that has just
been fulfilled, and more do not need it now, no one in your
program ends do not find it. And about ELVEN WARRIOR - I was
very depressing the fact that this and some other games
(SCEPTRE of BAGDAD, REBEL STAR 2, etc.)
have been translated into Russian ... in unrecovered (!) form.
Now a little bit to restore the graphics. After the restoration
of the game was CURRO JIMENEZ, that all game actions are
developed in middle of the screen, the rest of the screen was
black, itself begs the question
that probably during the game screen
framed by a beautiful static graphics
form of frames. When I carefully examined
Available in scraps of playing the game menu and
and uploaded it to the screen with no attributes
(6144 instead of 6912 bytes), the screen clearly vyrisovalas
black and white, carefully traced frame. It only remains
paint it and display the following
choice of management. Spoiled static graphics treated fairly
simple. We need to find a place in the program where she
stored (which can be determined by looking at all the transfer
addressed in the screen area), unload, correct in photo editor
and put in place. In another is the case with sprites,
especially working on a mask, for their Recovery can not do
without special software such as SCE or SPRITE TOOLS. About
loadable games. Many of them have cracked already,
when the memory has been loaded the first level. After the
restoration of such a program goes directly to the game,
without requiring podgruzki, since it is already there, on the
as evidenced by the internal system
variables of the game. So we got RICK DANGEROUS 2, STRIDER, and
many other games, in which the first level
presented twice: in the game and
tape or disk immediately after the game. Naturally, if you want
to restore everything as it was, then you can try to remove
from the memory of this level and make appropriate changes to
the system variables of the program. Frequent errors and within
levels, for example, contained in They chart. Most also have
still engaged in recovery mode
48/128K. After all, many games released
universal, working with any memory. And the definition of the
type computer (48/128K) was carried out of the boot and if it
was a 128K machine, the game has to finish loading additional
blocks music, graphics, fonts, etc. in the other pages in
memory. In addition, the designated memory cell were recorded a
certain value. During operation program appealed to the cell
and thus build. Of course, if a game has been hacked in the
mode of 128K, then it can not work after a break in the 48K
machine and vice versa. Especially This applies to games firm
CODEMASTERS. So, for example, have been widely
dissemination of such games as KAMIKAZE,
PANIC DIZZY, NINJA MASACRE, COLUMBUS JUMBO 1, 2, SLIGHTLY MAGIC
and others that work only on 128K, computers, although They
were issued universal. So, virtually all branded loaders
CODEMASTERS were checking machine type and record in a separate
dedicated memory cell "mark" about it. When the game itself
starts, it refers to those cells, and if there is recorded a
value corresponding to 128K, it permitted an appeal to other
pages in memory and the game is accompanied by more music and
graphics, but if your computer has only 48K, all this was
ignored and the game was as usual. Thus, if
your game is at 128K and refuses to run in 48K, then, first of
all, check to which cell it becomes, and what is there. If such
treatment there is, then you will only organize from the
bootloader checks the type computer with entering a
corresponding values in the desired cell and memory,
respectively, downloading, or ignoring additional blocks.
Checking procedure might look something like this:
XOR A; record in the major
; Page
LD (# C000), A; at # S000 zero
LD A, # 17
LD BC, # 7FFD
OUT (C), A; trying to choose
; Additional
; Page
LD (# C000), A; enters the cell
; # C000 number # 17
LD A, # 10
OUT (C), A; choose a major
; Page
LD A, (# C000); read from # C000
CP # 17, # 17 here if we have
, 48 machine, and if 0, then
; A 128 machine
JR NZ, LOOP
XOR A; zero out accumulator
, A constant 48 kB
JR LOOP1
LOOP LD A, # FF; as a constant for
, 128 KB
LOOP1 LD (23627), A; puts constant
; The type of computer in
; System variable
RET
Now, when this routine work is over, the main program will
be as previously envisaged, is in cell number 23627,
corresponding to the type of machine. Recently, much added work
for those involved in the restoration of names of these modes
in games, because some hackers, apparently ignoring the
interests of 48K users, intentionally make universal
48/128K-igry (The FLINTSTONES, LED STORM, YOGI BEAR GREAT
ESCAPE, and many others) 128K ONLY. And even worse, when the two
48K-games make one at 128K (PHANTOM F4,
MORTADELLO 'FILEMON 2, etc.), or add different nonsense, that
stretch the game to all the 128K, as was done with SATAN. Very
kindly requested to bring this fellow did not spoil the game
more!
To be continued ...
_________________________________________
