Tearaway Thomas

I was mucking around with action replay, removing manual protections from games (it's probably just a phase ) and I got to Tearaway Thomas.

When I got to the protection screen and I tried to freeze it, it wouldn't break in! No matter how much I pushed the button, it refused! Obviously the coder had put an anti-debugger protection in (and is probably started when the disk reading speed changes since I could break in right before it did that).

What I'd like to know is (apart from how do I beat this protection....Do I have to do it the old fashioned way and disassemble from Bootblock to protection?), how many other games have this type of protection, ie. Anti-debugger. What games?

I'm interested in this

[Twistin'Ghost]

Not very many, but I have heard about games that do this. What version of Action Replay are you using? I know that more games did this to AARII than III, because that was one of the selling points of III was how they got around a lot of those wedge issues.

[Twistin'Ghost]

Oh yeah...almost forgot. You have an original copy of Tearaway Thomas? That's something you don't see everyday! You should scan the cover. That's one I have never seen. I always liked the game.

I'm using an Action Replay MK III, hence the reason this protection is cool

I do own the original Tearaway Thomas after a friend of mine sold his Amiga and gave me all his originals.

I don't have a scanner (unfortunately), so I can't provide the box scan :/

I want to deprotect this game since it uses that black on red code sheet thingy. I already have a cracked version, but I want to do it myself

[Codetapper]

Tearaway Thomas has some absolutely awful encryption which uses the state of the SR, an uneven stack and various other things as it goes to decrypt itself. It will only work on a 68000 machine. It trackloads (backwards, quite strange) a massive file, relocates it to $0 (thus wiping out all zeropage vectors and stuff) and sets the stack to an odd address for 99.9% of the decryption. Thus you hit your button, stack is uneven and it either creates a bus fault or simply crashes. (Note: You can break into this game with an Amiga 500 Kickstart 1.2 and AR3 cart - no other combinations have been tried so don't ask me!).

I'm not sure what you mean by the disk speed changes, the game itself is normal NDOS and has no special disk tricks - just that awful decryption to stop you tampering with the code and the password from the manual protection. (The way it loaded only $1fe bytes per sector was quite cool too, I did a nice trick in the imager to skip the bytes and make it load faster - although it does work with any cracked 901120 byte ADF image).

Galahad/Fairlight is the true genius behind this WHDLoad install - he managed to freeze the game at the vital point, worked out where the useful bits of memory were and which bits needed to be cleared and cracked it aswell (damn quickly too!) - the WHDLoad install "cheats" by including approx 60kb (from memory) of the decrypted file he sent me since it is impossible to decrypt it in code on every CPU.

Due to the way it decrypts, it is impossible to WHDLoad install it (or even decrypt it) without using this method! Hope that helps you somewhat and be happy in the fact that bugger all games use this kind of nightmare decryption!

Note: You can break into this game with an Amiga 500 Kickstart 1.2 and AR3 cart - no other combinations have been tried so don't ask me

I'm using an A500, Kickstart 1.3 and an AR3 cart and I couldn't break where I wanted to

I'm not sure what you mean by the disk speed changes

What I meant was,

When you insert the disk, the game loads normally, but, after about 19 (I think it's 19) loading clicks, the speed at which the disk is accessed changes (this is also heard. I haven't done any debugging of this yet).

Now. Once the 19 clicks are done and the disk speed is changed, I can't break into it anymore.

Before the 19 clicks are done (18 and below), the disk speed sounds normal and I can break in. It is from here that I assume I would have to start debugging and not from the actual manual check later on

I hope I was clear with my explanation

Basically, the clicks are the clicks you hear from the disk drive when a game loads. ie. Click <wait about 2 seconds> Click <wait 2 seconds> Click, etc.

[Codetapper]

I'm using an A500, Kickstart 1.3 and an AR3 cart and I couldn't break where I wanted to

Galahad used KS1.2, no idea if that would/should make a difference. He probably set an illegal memory watch point or something to make it quit at the appropriate place (much safer than hoping you've hit the button at the right place after 18.968 clicks).

The clicks you mention are the drive heads stepping to the next track and swapping sides - counting those to try and time hitting the button is again error prone - much better to know where the game will get to some vital code and let it break the instructions at the right place.

Jimmy White's snooker has a similar trick I believe...

[Carlos Ace]

Amigaboy, can u upload your original to the ADF Zone ???

I can't since I have no Amiga to ADF it (I refuse to use an A500 to do any ADFing). My A1200 went kablooie

Even if I wanted to, I don't think this game can be ADFed. I think it has disk protection as well as manual protection

[andreas]

I can't since I have no Amiga to ADF it (I refuse to use an A500 to do any ADFing).

Hmm. Yeah, in fact many people refuse to do so. A small story?
Well after loads of errors I got when transferring some disk with a fierce trackloader (no original, though) using 9600 bps, I went back to 4800 bps!! This means: more than HALF AN HOUR for ONE disk. But I only have an A500 This is another reason why *certain* webmasters that only own an A500 would copy images from somewhere else instead of transferring *their* disks.

[Carlos Ace]

Originally posted by Amigaboy
I can't since I have no Amiga to ADF it (I refuse to use an A500 to do any ADFing). My A1200 went kablooie

Even if I wanted to, I don't think this game can be ADFed. I think it has disk protection as well as manual protection

U can make a MFM image with his copy protection.

[Shatterhand]

It's a little off-topic, but...

I am thinking about buying an A600 or an A500, just for playing games and stuff.. is it possible to transfer ADFs BACK to disk using just an A600 or 500 with just 1Mb of RAM?

And how long it would take ?

[Paul]

If you do buy an A600 or an A500 I would recommend 2MB minimum. When I had only 1MB I was very limited before I upgraded to 2MB. You might need the extra MB as the transfer program or the cross-dos drive mount may use the whole 1MB. Almost forgot, it would be a good idea to get one with a HD.

Confession.
I may not know what I am talking about and I could be wrong, as I have only tried ADF ing once using 720k DD MS-DOS disks. Also I have not used my A600 for about 4 years as it is in the loft.

How long will it take?

When I tried '4 years' ago It took ages as I had to use transdisk, which did not work with NDOS disks, and dump the images to HD. I then found out I had to compress them with lha or lzx in order for the adfs to fit onto the 720k disks. The compression took 15 minutes per adf file. I then copied the files to pc 720k disks after booting up with messydos disk. On the PC I had to decompress the files to use them. I will never use this method again and would buy a NULL-MODEM cable if I need to transfer file again.

[andreas]

@Shatterhand:

yes it is. (That's my configuration you described)

Look at this page:
Adf Sender Terminal homepage

A small table of time amounts:

bps...............elapsed time.(min)..comment
115200.............2:30.....................Amiga->PC ONLY
57600...............5:00.....................Amiga->PC ONLY

28800.............10:00........................(use trans28!)
19200.............12:00........................(use trans28!)
14400.............15:00
9600...............30:00
4800...............60:00

NOTE (from the author): DO NOT use transwarp with BaudBandit.device for Amiga->PC transfers and speeds above 28800 bps, only vice-versa! Use transwarp with serial.device or trans28 instead. (trans28 uses serial.device by default, too)

[Amiga1992]

I really would get a 600 with a little internal HD. mine is 30MBs and works fine for transferring shit. It's a pain in the bollocks to transfer anything without an HD, IMO