Anyone willing to dongle crack Scala MM200 NTSC?

[rhester72]

Just ripped originals that use the red dongle

[r.cade]

I know it's not what you asked, but you can make a Scala dongle pretty easily.
https://www.cameratim.com/electronics/scala-dongles

[rhester72]

@r.cade Yeah, I'm kinda going in the opposite direction - running Scala NTSC in a non-WinUAE emulated environment =) My usual strategy of "look at how someone else cracked it and adapt" is failing me because the only uncracked original Scala I can find is a Norwegian version of MM300 *laughs*

[redblade]

Originally Posted by rhester72

@r.cade Yeah, I'm kinda going in the opposite direction - running Scala NTSC in a non-WinUAE emulated environment =) My usual strategy of "look at how someone else cracked it and adapt" is failing me because the only uncracked original Scala I can find is a Norwegian version of MM300 *laughs*

Ahh the old Norwegian / English dictionary (ordbok) dongle.

[giantclam]

Not sure if it's ntsc but planetemu has a 8 disk set of MM200 cracked...

[rhester72]

Originally Posted by giantclam

Not sure if it's ntsc but planetemu has a 8 disk set of MM200 cracked...

It's PAL...and different enough that I can't see how it was done. There are no NTSC releases in the wild period (cracked or otherwise), hence the reason I went to such trouble to preserve this.

[Phantasm]

Originally Posted by rhester72

Just ripped originals that use the red dongle

i did a crack of MM400 back in the day. Of course that was a looong time ago but I can take a look if you like.

[rhester72]

Originally Posted by Phantasm

i did a crack of MM400 back in the day. Of course that was a looong time ago but I can take a look if you like.

My hero! LOL

Zoned as "Scala Multimedia MM200 v2.0 (1992)(Scala AS)(NTSC)(US)[cp dongle][HD].zip".

[Phantasm]

Originally Posted by rhester72

My hero! LOL



Zoned as "Scala Multimedia MM200 v2.0 (1992)(Scala AS)(NTSC)(US)[cp dongle][HD].zip".

I downloaded the files and had a bit of a look today. I managed to find the obfuscated/encrypted code that checks the port for the dongle but not found a way to patch it yet. It will be a few days before I have some free time to look into it further but I will keep you updated

[rhester72]

Very very much appreciated and no hurry whatsoever…it’s waited 30 years, it can wait a while longer. . Thank you!

[Phantasm]

I found a bit of spare time to look at this again this morning. Give the attached files a go. I've just included the modified files.

scalamm.device goes in devs:
ScalaMM and ScalaMMPlayer go in the main scala install folder
AnimLab goes in the Utilities folder under the scala install path.

I have only played with it for a short amount of time and its possible there are additional checks that may trigger for certain functions or after an amount of time. I managed to load up a few of the demo files and view them thats about as far as my knowledge of this program goes i'm afraid.

Let me know how you get on

[rhester72]

Will take a look ASAP, thank you so much!

[redblade]

Originally Posted by Phantasm

I found a bit of spare time to look at this again this morning. Give the attached files a go. I've just included the modified files.

scalamm.device goes in devs:
ScalaMM and ScalaMMPlayer go in the main scala install folder
AnimLab goes in the Utilities folder under the scala install path.

I have only played with it for a short amount of time and its possible there are additional checks that may trigger for certain functions or after an amount of time. I managed to load up a few of the demo files and view them thats about as far as my knowledge of this program goes i'm afraid.

Let me know how you get on

What tools did you use for that? ReSource / ARIV?

[Phantasm]

Originally Posted by redblade

What tools did you use for that? ReSource / ARIV?

I actually used ghidra. I've used it for a few reverse engineering projects recently and I'm pretty impressed with it overall but I am also a big fan of resource

[redblade]

Originally Posted by Phantasm

I actually used ghidra. I've used it for a few reverse engineering projects recently and I'm pretty impressed with it overall but I am also a big fan of resource

I read that it has a steep learning curve? How good was the code produced by it? Was Scala coded in C or ASM?

What has been your productivity increase since using ghidra? i.e it saves 30% time.

[Phantasm]

Originally Posted by redblade

I read that it has a steep learning curve? How good was the code produced by it? Was Scala coded in C or ASM?

What has been your productivity increase since using ghidra? i.e it saves 30% time.

It was written in C. The productivity is very difficult to quantify and I wouldn't claim to be an expert in its use. I'm sure there are features that I don't know about that would be useful.


its not as Amiga specific as resource obviously so you get things like this...

                             LAB_0021f034                                    XREF[1]:     0021f030(j)  
        0021f034 51 c8 ff fc     dbf        D0w,LAB_0021f032
        0021f038 26 6e 01 14     movea.l    (0x114,A6),A3
        0021f03c 70 00           moveq      #0x0,D0
        0021f03e 22 3c 00        move.l     #0x3000,D1
                 00 30 00
        0021f044 4e ae fe ce     jsr        (-0x132,A6=>exec_library_SetSignal)              BPTR dos_library_SelectOutput(BP
                                                                                             ULONG exec_library_SetSignal(ULO
                             -- Call Destination Override: exec_library_SetSignal (0025713

and its nowhere near as easy to switch the references between the different library bases (or maybe i'm just not experienced enough with it)


Navigating around the code is quick and easy and generally it does everything I need. I am not keen on the motorola syntax and I don't think you can change that.


one thing that was particularly useful in this instance was it immediately picked up the obfuscation that they had used to hide the accessing of the cia registers

                             LAB_00244e28                                    XREF[1]:     00244e20(j)  
        00244e28 20 3c 05        move.l     #0x5ff1008,D0
                 ff 10 08
        00244e2e e6 88           lsr.l      #0x3,D0
        00244e30 20 40           movea.l    D0,A0
        00244e32 19 50 00 09     move.b     (A0)=>DAT_00bfe201,(0x9,A4)=>DAT_002450a7

I have to say overall I like it

[rhester72]

Well, that took longer than I would like. LOL

There's definitely still some issues.

Without the dongle, if you do the following:

- Start ScalaMM
- Hit "Load script"
- Choose "Scripts" in the upper right
- Highlight ScalaTime.script
- Hit "OK"
- Hit "Run!"

and let it play all the way through (seemingly without issue - let it complete and cycle back to the beginning, then press Esc on the keyboard), you'll see a cascade of error messages (mostly "Internal Error" with one "Unable to load IFF" thrown in) that do not appear when using the dongle _even with the cracked binaries and device_.

[Phantasm]

Originally Posted by rhester72

Well, that took longer than I would like. LOL

There's definitely still some issues.

Without the dongle, if you do the following:

- Start ScalaMM
- Hit "Load script"
- Choose "Scripts" in the upper right
- Highlight ScalaTime.script
- Hit "OK"
- Hit "Run!"

and let it play all the way through (seemingly without issue - let it complete and cycle back to the beginning, then press Esc on the keyboard), you'll see a cascade of error messages (mostly "Internal Error" with one "Unable to load IFF" thrown in) that do not appear when using the dongle _even with the cracked binaries and device_.

I expected there might be more checks. Thanks for the detailed instructions to recreate. I'll take a look

[Phantasm]

Tried this a couple of times and I don't see the same issue. Can you provide more details of the configuration you are using. What machine, how much memory does it have, what OS version are you using.

[rhester72]

A500 with ECS, 1MB chip, 5.5MB slow-fast (AdRAM 560D), 14MHz 68000 with AdSpeed/AdIDE, Kickstart 2.04, AmigaDOS 2.1.

I have a different machine I can dig out if needed to test with. Quite surprised you can't repro - it fails 100% of the time without the dongle and 0% of the time with.