Subliminal Extacy #03
01 апреля 2001

Cheat's Guide To TR-DOS Cracking: An Incomprehensible Techy

Cheat's Guide To TR-DOS Cracking: An Incomprehensible Techy
  Cheat's Guide To TR-DOS Cracking: An Incomprehensible Techy
                     Article By Gasman / RA

There's  a heated  debate going  on elsewhere  in this  magazine
about using custom loading routines on TR-DOS demos, and I don't
propose to continue it here.  Clearly it *would* be nice  if all
demo coders were to supply their releases in both  speed-loading
custom  TR-DOS  versions  and  portable  BASIC-loader  versions.
Whether or not that happens  in the near future, we'll  still be
left with  a backlog  of old  demos which  only exist  in TR-DOS

To deal with this, we'd have  to learn about every trick in  the
TR-DOS system,  and then  disassemble the  loader to  each demo,
extracting each code block and rewriting the loader in BASIC.

Or we can cheat.

To begin with,  here's a list  of the things  you need -  or the
things I  use, anyway.  Some demos in TRD  format, R80  emulator
WinZ80 (the unregistered shareware version will probably do) Z80
Bintap by Lee 'Blood' Tonks. There may well be a simpler  method
to  do all  this which   doesn't involve  hopping between  three
different emulators.  I just  happen to  like the  debugger that
comes with WinZ80, that's all.

Okay then. What we're essentially  looking for is a copy  of the
demo stored after all the  code has been loaded, but  before the
demo itself has started. By the way, this method only works  for
demos  that load  in one  go -  multiloads will  need a  bit of
fiddling with the loader, and I'd rather not go into that until,
er, I've tried it myself.

To work out where the  demo starts, you just guess.  Programmers
like nice round numbers, so it almost certainly starts at  24576
(#6000),  25000 (#61A8),  26000 (#6590),  32768 (#8000),  or if
you're  unlucky,  23296  (#5B00), which  is  probably  the least
helpful place in  the entire memory.  So, start up  R80, and use
the  built-in monitor  to  bung  in a  few breakpoints  at those
addresses. Then load the demo  from the TRD file, and  hopefully
it will stop at one  of the breakpoints. However, at  this point
you don't know whether all the code has finished loading, so you
need  to  check by  making  a snapshot,  and  loading this  into
another emulator, such  as WinZ80. If  the demo runs  OK, you've
found the right place. If not,  go back to R80 and try  the next
breakpoint that comes up.

A little note at this point: R80 doesn't let you save  snapshots
from within  the monitor.  You can  get around  this as follows:
Let's say the demo has  stopped at address #6000. Note  down the
first few assembler instructions at this point, and then go into
the memory editor section and  edit the code at #6000  to become
the hex codes  18FE. This happens  to be a  'JR -2' instruction,
which is our old friend, the infinite loop. Now, you can  return
to the emulator with the  program safely stopped in its  tracks,
and  make  the snapshot.  Load  this into  WinZ80,  and use  the
debugger to put the code back to how it was before (y'know,  the
bit that you wrote down).

So, now you should have a snapshot that works in WinZ80. Now for
the boring bit!  Flick through the  memory noting down  the bits
that contain data. There's bound to be some un-necessary  stuff,
such as the code from the loader, so try deleting likely looking
bits (a good way is to type 'asm nop' into the debugger and hold
down enter until you've overwritten what you want) and seeing if
it still runs. Yep, that means  lots of trial and error. And  to
make matters worse, bear in mind that if it's a 128K demo -  and
what isn't nowadays? - you have to trawl through all the  memory
pages too. To get  at the extra pages,  you'll need to put  in a
bit  of  code at  #6000  (or wherever):  LD  BC,#7FFD LD  A,page
;(this is a page  number, from #10 to  #17) OUT (C),A For  every
page that contains some data,  make a snapshot - you'll  need it
in a minute. While you're at  it, make a note of which  page was
there to begin with.

The next step is to save out the individual blocks of data  that
you've found. There doesn't seem to be an easy way of doing this
in WinZ80, so it's  time to move to  yet another emulator -  Z80
(the DOS version). If you load  a snapshot by typing F10 then  L
(rather than  F3), you'll  get back  to the  Z80 main menu, from
which you can press X,  then save the required blocks  of memory
to disc. Now you've got the raw data blocks, so run them through
Bintap to turn them into lovely TAP files.

And that's it... sort  of! If you load  all the blocks into  the
right place, then RANDOMIZE USR 'start' , the demo should  work.
Of course,  it's a  bit silly  to keep  it as  ten zillion small
blocks, so  if you  want to  do the  job properly, you'll bundle
them all together with a decent compressor, and a bit of code to
move things into the right place. But that's another story...


Другие статьи номера:

One more boring text from Yerzmyey

23 Things Which You Can Do If A Program Crashes


Alternatives to LOL

The Spectrum SE - Andy Owen Interview

Are You A Communist?

Assholes Speak Russian

Beginners Guide to Russian

brief information about CC1

Can You Say Dezign?

Cheat's Guide To TR-DOS Cracking: An Incomprehensible Techy

Chocasutra - A Chocoholics Guide To Sex

Circulation Of Warez On Today's Scene

Compatibility: An open letter to the Russian scene

Complex 99, And The East/West Divide

Project: Describe Your Disk Interface

Devious and Lethal Cocktails

Demo Parties: Breaking The Mould

Draw Routine with Bresenham Algorithms



How To Become The Best PC Swapper In The World ... EVER!

How To Contribute To Subliminal Extacy

How to use Subliminal Extacy... and more

How Demos Are REALLY Made


Independent Films

Interview with K-0s / Raww Arse

Is C64 Better Than Speccy?

Just Intonation: Making music come to life

Party report: ZX Party 2000; Wroclaw, Poland; 25-27 August 2000

Questions that Still Remain Unanswered (Well, not anymore)

Some Stupid Shitty Rubbish From Yerzmyey


News From Ukraine: Still Enough Haxxors In Smash!

The Art of Spectrum Coding - Chapter I

The Prince Of 4096 Bytes Conquers New Lands

The Smallest Article in the World

Timex in Portugal

Tips - OLD telephone directories make ideal personal address books.

What A Shame!

Whopping Great Big Lists: A discussion

Your Stars

Your Horoscopes by Mystic Bogie

Zilog: Dep Is Ugly But I Am More

Zm_Polyhedron - Speccy of the future

Темы: Игры, Программное обеспечение, Пресса, Аппаратное обеспечение, Сеть, Демосцена, Люди, Программирование

Похожие статьи:
Проект Зомби - В самый разгар "перестройки" редактор ташкентской газеты, в которой я сотрудничал, заказал мне очерк с первого конгресса Aссоциации экстрасенсов CCCP...
Некролог - Эта газета в основном ориентирована на различные horror направления, но разумеется будет присутствовать парочка разделов посвященных нашему горячо любимому Спеку.
Секреты - Секретные кнопки в разных приложениях: Wolfenstein'2004, IG#5, ACEdit, DNA OS, Wild Disk Copier.
Новости - О новинках ПО: Ultra Sonic, Огни Саламандры, Черный ворон 2, Homer Simpson в России, Spectrum Progress 4, ZX-Format 9.

В этот день...   3 декабря