Programmers - The hacker club: Mortal combat description of the protection.

        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
             
                                          
(C) 1996/97 MAFIA Corp. & Max Iwamoto     
(C) 1997 MAX (Cracked)                    
------------------------------------------
                                          
   The text describes the protection on the game disc
"MORTAL KOMBAT" from MAFIA corp.Actually,
I wrote the defense for the game directly
the famous Max Iwamoto. This algorithm is
today is the most sophisticated
valuable and difficult to trace due to
features of your work from everything that
I had to see it on the Spectrum.
So I used it almost in its pure form
on your magazine. Naturally, the re-
I'm missing out on tweaks and adaptations for my needs
from this article.                         
                                          
   Autostart is carried out by the 8th sector of the size
rom 512 bytes. How does this happen?
what launch?  In short it sounds like this: TR-Dos
before working with a new disk or file
reads into a special buffer the so-called
buildableboot-sector (for lamers 8 or for
dummies 9) and tries to check some
its parameters. The working buffer is created by
address 23845. Everything that follows (system
TR-Dos and BASIC), shifted by 256 bytes
down (or up - I always confuse:-(((, in short
Th - to the end of memory). When reading a sector
the implied size is 256 bytes, but
In my case, 512/1024 bytes are read, in reality
As a result, a “spade” occurs on the shear
chopped basic and a fragment of system ones. In this
system fragment and the address is located
return to Dos in case of an error situation, which
which occurs due to the lack of a marker
TR-Dos of a disk or something else (not really
I know). The sector that covers everything brings with co-
fight your addresses in this area than the most
runs user loader.                    
                                          
   As a result of runningiwamot`algo-
rhythm, all available
128th memory, then copy 256 bytes
throughout the entire RAM from the beginning of the screen to #FFFF,
correction of transition addresses by JP all dub-
licates and then to "xorka". When"xorke"
one of the fragments of the algorithm is taken in
different places in RAM and using the registerR
is pixelated one byte at a time, and
there is a transition to a new memory area, so
the entire address space is used most
capacity 48 kilobytes. Difficulty tracking
such "mans" is to find
place for a residentSTS`and not to spoil
something during the work of bindings and xo-
Rhenia. The result of xorka is the following:
running algorithm:                          
                                          
;File: MK 9 OK .N                         
;Algorithm for loading sector #0C in the game     
;"MORTAL KOMBAT" from MAFIA               
;ORIGINAL                                 
                                          
 ORG #44A1                     
LLCHCHA1 LDIR ;zeroing memory 
        LD SP,HL ;SP,#44A1LD      A,#08                     
        LD      DE,#2F57;трек 0           
        CALL    LL44EC  ;Dos              
        LD      A,#3С                     
        LD      С,#FF                     
        CALL    LL44E9  ;OUT (С),A        
LLЧЧBЗ  XOR     A       ;контроль ошибок  
        LD      (#5CD6),A                 
        LD      HL,#4000;load sector      
        LD      A,#0С                     
        LD      С,#5F                     
        CALL    LL44E9  ;чтение сектора   
        CALL    LLЧЧDD  ;загрузки игры    
        DI                                
        LD      A,(#5CD6)                
        OR      A                         
        JR      NZ,LLЧЧBЗ                 
        LD      HL,#4100;декодирование    
        LD      R,A                       
LLЧЧDO  LD      A,R                       
        DEC     HL                        
        XOR     (HL)                      
        XOR     L                         
        XOR     #56                       
        LD      (HL),A                    
        BIT     6,Н                       
        JR      NZ,LLЧЧDO                 
        JP      (HL)    ;JP #ЗFFF...      
LLЧЧDD  LD      ВС,LLЧЧDD PUSH    ВС                        
        LD      ВС,#017F                  
        LD      DE,#2090                  
        JR      LL44EC                    
LL44E9  LD      DE,#2A53                  
LL44EC  PUSH    DE                        
        JP      #3D2F                     
                                          
LLЧЧFO  NOP             ;заполнение озу   
                                          
LLЧЧF1  JP      LLЧЧA1                    
LLЧЧFЧ  LD      HL,LLЧЧFO                 
        LD      DE,LLЧЧF1                 
        LD      ВС,#0000                  
        JR      LLЧЧF1 ;This is where the start occurs after XOR  
                                          
LLFFFF JR LLHHFCH ;RUN by IY...     
                                          
   The launch of this masterpiece takes place on IY
register containing #FFFF. Further it is clear
according to the algorithm, from which it follows that
sector is loaded #0С (#0B), which is in
in turn loads the main algorithm
the program itself.                          
                                          
;File: MK 12 OK .N                         
;Loading algorithm of the main algorithm    
;"MORTAL KOMBAT" from MAFIA.              
;ORIGINAL                                 
                                          
        ORG #4000                     
LLХО00 DEFW25000   ;ЭТО ВХОД!!!      
LLЧO02  DI                                
LLЧO03  XOR     A                         
        OUT     (#FE),A                   
        LD      HL,#С9F1;рор af:ret       
        LD      (#SCC2),HL;перехват выхода
        LD      A,#83   ;в 48 ПЗУ         
        LD      (#SCC8),A                 
        LD      IY,#5C3A                  
        LD      (IY+#00),#FF              
        LD      SP,LLЧO20                 
        LD      A,#2С                     
        LD      С,#FF                     
LLЧO20  CALL    LLЧO99                    
        LD      A,#08                     
        LD      DE,#2F57;трек 0           
        CALL    LLЧO9С                    
        LD      ВС,#61A8;задержка         
LLЧO2Е  DEC     ВС                        
        LD      A,B                       
        OR      С                         
        JR      NZ,LLЧO2Е                 
        LD      HL,#2800;сканирование под 
        LD      A,#Е4   ;адрес ПЗУ с поп- 
        LD      С,#1F   ;равкой на корот- 
        CALL    LLЧO99  ;кий трек (-256). 
        LD      С,#7F                     
        LD      DE,#3FE5                  
        CALL    LLЧO9С LD      HL,#61A8;основной алгор.  
        LD      B,#01                     
LLЧO4A  XOR     A                         
        LD      (#5CD6),A                 
        PUSH    ВС                        
        PUSH    HL                        
        LD      A,B                       
        LD      С,#5F                     
        CALL    LLЧO99                    
        CALL    LLЧO8D                    
        DI                                
        POP     HL                        
        POP     ВС                        
        LD      A,(#5CD6)                 
        OR      A                         
        JR      NZ,LLЧO4A                 
        INC     Н       ;поправка на дли- 
        INC     Н       ;ну сектора и его 
        INC     B       ;номер            
        LD      A,B     ;проверка конца   
        СР      #0A     ;файла            
        JR      NZ,LLЧO4A                 
        LD      SP,LLЧO00;run #61A8       
        LD      ВС,#1201;размер осн.алг.  
        LD      A,Н                       
        LD      R,A                       
LLЧO73  LD      A,R     ;разксоривание    
        XOR     (HL)    ;основного алг.   
        XOR     B XOR     L                         
        XOR     #53                       
        LD      (HL),A                    
        CPD                               
        JP      РЕ,LLЧO73                 
        LD      HL,LLЧO02                 
        LD      DE,LLЧO03                 
        LD      ВС,#1800                  
        LD      (HL),С  ;CLS              
        JP      #33С3                     
LLЧO8D  LD      ВС,LLЧO8D                 
        PUSH    ВС                        
        LD      ВС,#017F                  
        LD      DE,#2090                  
        JR LLХО9С                    
LLХO99 LD DE,#2A53;out (c),a        
LLХО9С PUSH DE ;jp dos           
        JP #3D2F                     
                                          
   Correct one "scanning" sec-
torus is not enough. The program is in the process of development
bots in six more cases will scan the per-
new short track and will react properly
way  (will send fuck). Therefore it is necessary
thorough correction of the main algorithm
ma programs.   Address spoofing method
scan routines to another fragment
ment gave a positive result, which
finished my work on removing protection from co-
disk peering.                          
                                          
;File: MK 12OK+.N                         
;"MORTAL KOMBAT" loader game from #0С sec.
;WRITE TO SECTORS #0B,#0C STS!!!  
;Remake Compu-Studio Ltd 1997ORG     #С000   ;НАЧАЛО           
        LD      HL,ADRES                  
        LD      DE,#4000                  
        LD      ВС,#0100                  
        LDIR                              
        DI                                
        XOR     A                         
        LD      HL,#4100;ксорим нашу пере-
        LD      R,A     ;делку            
M1      LD      A,R                       
        DEC     HL                        
        XOR     (HL)                      
        XOR     L                         
        XOR     #56                       
        LD      (HL),A                    
        BIT     6,Н                       
        JR      NZ,M1                     
        EI                                
        RET             ;записать STS`ом  
                                          
ADRES   DISP    #4000                     
LLЧO00  DEFW    25000   ;RUN программы    
LLЧO02  DI                                
LLЧO03  XOR     A                         
        OUT     (#FE),A                   
        LD      HL,#С9F1                  
        LD      (#SCC2),HL                
        LD      A,#83                     
        LD      (#SCC8),A                 
        LD      IY,#5C3A                  
        LD      (IY+#00),#FF              
        LD      SP,LLЧO20                 
        LD      A,#2С                     
        LD      С,#FF                     
LLЧO20  CALL    LLЧO99                    
        LD      A,#08                     
        LD      DE,#2F57                  
        CALL    LLЧO9С                    
        LD      HL,#61A8;адрес программы  
        LD      B,#01   ;номер сектора    
LLЧO4A  XOR     A                         
        LD      (#5CD6),A;еггог load?     
        PUSHВС                        
        PUSH    HL                        
        LD      A,B                       
        LD      С,#5F                     
        CALL    LLЧO99                    
        CALL    LLЧO8D                    
        DI                                
        POP     HL                        
        POP     ВС                        
        LD      A,(#5CD6)                 
        OR      A                         
        JR      NZ,LLЧO4A                 
        INC     Н       ;поправка на но-  
        INC     Н       ;вый сектор       
        INC     B       ;новый секторLD      A,B                       
        СР      #0A     ;конец?           
        JR      NZ,LLЧO4A                 
        LD      ВС,#1201;длина блока      
        LD      A,Н                       
        LD      R,A                       
LLЧO73  LD      A,R                       
        XOR     (HL)                      
        XOR     B                         
        XOR     L                         
        XOR     #53                       
        LD      (HL),A                    
        CPD                               
        JP      РЕ,LLЧO73                 
        CALL    #6F08   ;системные бейсика
        LD      HL,ADRES1                 
        LD      DE,#6F08                  
        PUSH    DE                        
        LD      ВС,13                     
        LDIR            ;блокир. сканиров.
        POP     HL                        
        INC     HL                        
        LD      (#6386),HL;замена адресов 
        LD      (#6441),HL;в CALL #61AB   
        LD      (#644B),HL                
        LD      (#6681),HL                
        LD      (#6E0F),HL                
        LD      (#бЕЕ2),HL                
        LDSP,#4000;на старт програм.
        LD      HL,LLЧO02                 
        LD      DE,LLЧO03                 
        LD      ВС,#1800                  
        LD      (HL),С                    
        JP      #33С3   ;clear screen     
                                          
;Чтение сектора                           
                                          
LLЧO8D  LD      ВС,LLЧO8D                 
        PUSH    ВС                        
        LD      ВС,#017F                  
        LD      DE,#2090                  
        JR      LLЧO9С                    
                                          
;OUT в порт                               
                                          
LLЧO99  LD      DE,#2A53                  
LLЧO9С  PUSH    DE                        
        JP      #3D2F                     
                                          
;Заменитель сканирования                  
                                          
ADRES1  RET                               
        CALL    #6376   ;page 0           
        LD      A,#01                     
        CALL    #62D1   ;trek 1           
        DI                                
        JP      #61D5   ;load sistems     
                                          
   Спасибо MAFIA за классную идею по защи-
те алгоритма от просмотра и взлома. Ламать
можно всё, но это действительно круто. Три
дня ушло на расксорку и т.д...            
                                          
   Значения регистров процессора до начала
ксорки:                                   
                                          
HL,#0000    HL`,#29Е2    РС,#AA24    R,#8Е
DE,#3F01    DE`,#0100    SP,#4001    I,#00
ВС,#40D0    ВС`,#0004    IX,#4000       DI
AF,#0044    AF`,#0044    IY,#FFFF    IM  1
                                          
   Здесь значения  альтернативного  набора
не имеют значения, важно только  основного
набора!                                   
                                          
   Итак, разбор полётов.There are weak points
even in the most perverted defense. But if
there is no desire to break it, then you can immiti-
to sleep For example, if a short
track (programADS v2.0orAfrodita v3.0
showed the length of some track less than
than  6200 bytes), then take the Soviet
disk drive, find the speed controller on it
disk rotation, download the program ADS v2.0
or any other version. Then follows
enter the speed analysis mode in the program
disk rotation and set the indicator 310
rpm.The normal value is 300
revolutions or very close to this value
nu. It should be taken into account that at such a speed
when the disk rotates, the reading quality even with
presence of AFC drops significantly, so on
over-adjusted drive is needed ONLY
write. Do you have two drives? If not, then
forget what you read here :`(         
                                          
   Another weak point of the protection ties
and the game algorithm is that the al-
The rhythm is not compressed. This is a circumstance
made it possible to commit impunity with impunity
lyeto the program. But if there was an iso-
advanced compression, then this task
was less solvable, i.e. more difficult to resolve
Shay.  Here. And so - everything is fine, wonderful -
naya marquise; everything is fine, everything is fine...