Crack`em all - Effective use of "shadow"

      
-[ ьу Dr.Yirus/MDO ]------------------------------------------ 
                    
            Effective use of "shadow".               
--------------------------------------------------------------- 
                   
 So, Uncle Virus from Moderation welcomes you.  Today 
I will try to tell you about how to rip out music.  It is necessary 
to say that to rip out music, oco6oro does not require intelligence, it 
can tear out even a full kettle (of course, after 
will read this manual ;).                                        
                                                                
 As you know, on the ZX (and not only on the ZX) music is divided into 
two types: FMandDIGITAL. I will not describe them in detail, for those who wish 
I can suggest reading the eleventh issue of the Ufa newspaper 
MSD. We'll leave DIGITAL for later, and first we'll learn how to break out 
FM.                                                             
                                                                
 Hereinafter we will talk about the technique of working with a computer 
"Scorpio" with his shadow monitor. Next we will touch on the specifics 
work with debuggers, but we won’t get too close to it, because 
to get to the muse using a monitor, you have to sweat for a long time 
and this already smacks not of ripping out music, but of cracking in general, 
and this is a completely different story...                
                                                                
Okay, what are we all about?! Let's begin!            
                                                                
   Load the desired program, press MAGIC. And if everything 
passed successfully, and you ended up in the “shadow”, and notsuspended the computer 
(which can also happen), then congratulations on your first successful 
step. Now we need to find the music. Most often, Music suspends - 
for interruptions. Look at the monitor status window.   If 
you have a real Scorp, there should be an inscription  "Int mode" 
("interrupt mode"). So, if mode number two, then consider 
admit that you are lucky. We write on the command line: "meme[#xxFF]", 
where xx is the value of the interrupt vector I. If, according to the calculated 
address JP or JO, press SS+G and so on until we get 
to the start of the interrupt handling subroutine. here nothing insinuates us 
tepecyet, except for CALL nn instructions, and they are not necessary 
must be unconditional. This design is very suspicious 
LD A,#XX:CALL NNNN:CALL DDDD. It is immediately clear that most likely 
The page is switched and the player is called.  By the way, the page 
can switch here, by OVT. It's best not to 
take a steam bath, put the first CALL in the very top line of the screen 
and press one. Then press SS+G. Look what's going on there 
comes out, if there is nothing interesting, come back.  EU- 
do they leave there?There are more branches, go through them. In short 
Keys from 1 to 5 - remember the address, from 6 to 0 - restore 
updating the corresponding. That is, 6 corresponds to one, 7 
- deuce, etc.                                                 
                                                                
   You can also go through the pages: switch command 
pages -"OAM X", where X is the logical page number.  Only 
do not forget to set the meme to the address 49152=#С000, since, probably 
Most clearly, that’s where the muse that is being broken out is located. By the way, if you 
break a demo or program that uses both screens, then on the seventh 
the music page will most likely be at 56064=#DBOO.   
                                                                
   You can search by string: "fin24500 65535"PO0-TOACKEO" 
And if absolutely nothing, then at the very least, look in your memory for instructions 
OVTD. It is used in half of the music players. Search 
like this: "fin24500 65535 #ed #аь.  But in some players, 
example in ASM, OVTI is used. Her code: #ed #a3. Found it? 
Now scroll up until you see familiar instructions: 
LD HL,MVZADO:JP XXXXX:JP DDDDD.                              
                                                                
   In short, I won’t go into details of the search anymore, 
better practice, look at the code of various players, you 
show characteristic oco6ehhoctu.                                  
                                                                
   Now the found muse needs to be downloaded to disk, so that later it can be 
compile.  Decompilation must be carried out to weed out garbage 
at the end of the shipped block, since its exact length cannot be found out 
I know how. And is it necessary?                                         
                                                                
   If you have monitor version 2.95 or higher, then this is the easiest way: 
saveFILENAMEX address length, where FILENAME is the file name, X is 
extension, address and length are the address and length respectively. 
                                       
   If you have an earlier version, then you already need to do this 
cnoco6y Ruslanych, when he still had the old ROM: 
movmusadr musadr+6912 16384.Then pasteblank disk and 
press MAGIC. Then cut at the largest block (length 
192 sectors) the first 6912 bytes and put them into the decompiler. If 
the decompiler sent you, then most likely the Mouzon length is longer 
6912 bytes and the operation must be repeated:                           
movmusadr musadr+6912+6912 length, then glue the resulting 
block c first and decompile.                               
                                                                
   Well, we seem to have sorted out the shadow business, now let’s move on to decom- 
peelers.                                                        
                                                                
   Co6ctbehho, there’s nothing to talk about here oco6o because...  decompile 
maybe a baby, but keep in mind that the music is in KSA formats Pro So- 
und Tracker and FastTracker will be successfully decompiled only if 
case if it has not been initialized.  Therefore, post- 
Try to enter the shade area before the music starts.  You can 
also try to trace the loader of the broken program, 
load the main block, find music in it and download it to disk. 
                                                                
 Another cnoco6 of pulling out music is associated with the application 
programs "BestYiew". Download it, insert the disc with the brokenprogram, press SS+D and wait until the head passes over 
disk.  As a result, a directory of what 
BestYiew found on disk. It could just be music files 
ly, there can be packaged blocks and screens, also just ku- 
disk space sockets. We are interested in music files 
and packed blocks. Browse through the catalog and select the ones you need 
files and write down their location on the disk (keys K and L - 
scrolling the directory horizontally). Then upload them to 
STS, unpack it if necessary and download it to disk.                 
                                                                
           That seems to be all. DrYirus was showing off in front of you.   
                                                                
                                                                
-[Бу Ruslanych/MDO ]------------------------------------------ 
                                                                
 A PAIR OF USEFUL C0BET0B FOR BEGINNERS:               
--------------------------------------------------------------- 
                                                                
* The standard player for ST-Pro and Pro-Tracker2.x starts with 
standard nine bytes: LD HL,#X1X2                       
JP #Z1Z2                         
JP #Y1Y2                         
 .....                               
                                                                
 dump: 21 X2 X1 C3 Z2 Z1 C3 Y2 Y1 ...     
Pro-Tracker 3.x player looks a little different, and the first 
the bytes look like this:  LD HL,#X1X2         
 JO $-X ;DEVIATION               
JP #Y1Y2  .....                               
                                                                
 dump: 21 X2 X1 18 -X C3 Y2 Y1 ...         
                                                                
* Music written in ST-Pro is best to tear out before it is initiated. 
program implementation, i.e. before this very music starts playing 
et. Here you most often have to resort to the help of STS. The point is 
that after the music initialization command, the player binds 
sends the music module to hard-coded addresses. And to the decompiler it is 
I really don't like it. ;<                                       
                                                 
* It is better to unload music from a shadow car as follows:           
1. Having found the player's location, look at his first 
command. Usually this isld hl,#xxxx.                               
2. Go to the address specified by the previous command:meme #xxxx. 
3. In normal modules this should contain the name of the composition and 
herauthor. This text is usually legible in the dump field. 
Now we download the music module from the address to which the command indicated 
yes ld hl,#.... at the beginning of the player. i.e.:                
saveMVZ0N With #xxxx #xxxx+len_music                         
4. Now on the floppy disk you have a music module without a player.         
                                                                
* A few words about why you need to break out Mouzons in general. Well, 
firstly, this is the first step towards cracking. “You can” say 
mother Mouzon, it means over time “cmoruete” to break everything else- 
no. Secondly, the torn out Mouzon is a good 
material for studying cnco6ob "muson writing", i.e., breaking out 
Eat Mouzon, decompile it and load it into the editor. Then dis- 
looking at the internal structure of the composition, you adopt mactepct- 
yes ld hl,#.... at the beginning of the player. i.e.:                         
saveMVZ0N With #xxxx #xxxx+len_music                       
4. Now on the floppy disk you have a music module without a player.         
                                                                
* A few words about why you need to break out Mouzons in general. Well, 
firstly, this is the first step towards cracking.“You can” say 
mother Mouzon, it means over time “cmoruete” to break everything else- 
no. Secondly, the torn out Mouzon is a good 
material for studying cnco6ob "muson writing", i.e., breaking out 
Eat Mouzon, decompile it and load it into the editor. Then dis- 
looking at the internal structure of the composition, you adopt mactepct- 
in the great composers of the stage!:) And thirdly, some ;) 
There is such a weakness in listening to AY howls day and night. So, 
tearing out Mouzons onto the disk (128 pieces, won’t fit anymore;) Georgian 
those are some fancy player (such as X-player) and 8 - 10 
Hours of AY-squeals are guaranteed for you. By the way, this paragraph, I also wrote 
shu to the music, which was torn from BD#10 (Thanx mmsm!)             
 p.s. I wonder what kind of music is best to play music to? 
boviu? The only thing that comes to my mind is "WOW" ьу DNK ;)))