English Amiga Board Amiga Lore


Go Back   English Amiga Board > Support > support.Apps

 
 
Thread Tools
Old 30 March 2009, 02:44   #1
Supamax
Da Digger :)

Supamax's Avatar
 
Join Date: Nov 2008
Location: Monza, Italy
Posts: 2,479
The Amiga Action Replay Utilities v2.01 *HELP*

Hi,

once upon a time, in a long and distant valley, I bought my shiny new Amiga Action Replay (v1.5) in a shop in Milan - Italy - named NEWEL / NUOVA NEWEL.
Along with the "official" utility floppy (which was contained in the sealed package) I received a custom floppy, made by NEWEL's staff, which I could never run on my Amiga 500.

This floppy has a strange bootblock. When you insert it in the drive, it then jumps to track 80 and there remains, with a red screen.
The strange thing is that track 80 is absolutely empty, and the disk has no protections (I remember having asked them about it). I wanted to get a replacement, but time passed, I lived far from the shop (in another city) and I never got one. I was happy with the AAR and its "official" floppy and didn't think any more about it.

However, I still have that floppy .
(perhaps I'm the only one having it, but I hope not)
So, I dumped it into a nice new .adf file.

I uploaded two versions to The Zone:

- one with the original bootblock (the one which jumps to track 80).
I don't know if it's a protection, a virus or whatever. If someone finds it out I would be glad to know, after all these years

- one with a normal bootblock.
This one loads, shows some loading screens, credits etc., but at the end it shows a severe error onscreen and you have to reset

Is someone able to tell me where is the issue?

EDIT: of course I tried it in WinUAE, with a loaded AAR 1.5 ROM, but with the same results

Last edited by Supamax; 05 April 2009 at 02:56. Reason: typos
Supamax is offline  
AdSense AdSense  
Old 05 April 2009, 01:48   #2
Supamax
Da Digger :)

Supamax's Avatar
 
Join Date: Nov 2008
Location: Monza, Italy
Posts: 2,479
Supamax is offline  
Old 05 April 2009, 02:24   #3
Galahad/FLT
Going nowhere

Galahad/FLT's Avatar
 
Join Date: Oct 2001
Location: United Kingdom
Age: 44
Posts: 6,524
The utility disk is copy protected. Same style of protection as Insector Hecti in the Interchange by Hi-Tec software.

Bootblock is encrypted, decrypts then reads protection track 80, on track 80 is a new bootblock that gets copied over the old one thats already loaded in memory, it must set up a variable that is then checked by the file 'loader'.

Et Voila

Last edited by Galahad/FLT; 05 April 2009 at 02:36.
Galahad/FLT is offline  
Old 05 April 2009, 02:32   #4
Supamax
Da Digger :)

Supamax's Avatar
 
Join Date: Nov 2008
Location: Monza, Italy
Posts: 2,479
Quote:
Originally Posted by Galahad/FLT View Post
The utility disk is copy protected. Same style of protection as Insector Hecti in the Interchange by Hi-Tec software.

Bootblock is encrypted, decrypts then reads protection track 80, if correct, sets up a variable that is checked by file 'loader', if variable not present, it crashes.

Et Voila
Nooooooooooooooooooo

So I was given a faulty disk? Damned NEWEL!

Is there a way to crack it?
Supamax is offline  
Old 05 April 2009, 02:38   #5
Galahad/FLT
Going nowhere

Galahad/FLT's Avatar
 
Join Date: Oct 2001
Location: United Kingdom
Age: 44
Posts: 6,524
Quote:
Originally Posted by Supamax View Post
Nooooooooooooooooooo

So I was given a faulty disk? Damned NEWEL!

Is there a way to crack it?
I would imagine so, the bootblock is nothing special I would think its just a standard amigados loader, but its the variable it sets that needs to be discovered.

I will take a look tomorrow for you.
Galahad/FLT is offline  
Old 05 April 2009, 02:50   #6
prowler
Global Moderator

prowler's Avatar
 
Join Date: Aug 2008
Location: Sidcup, England
Posts: 10,203
Galahad to the rescue!
prowler is offline  
Old 05 April 2009, 02:51   #7
Supamax
Da Digger :)

Supamax's Avatar
 
Join Date: Nov 2008
Location: Monza, Italy
Posts: 2,479
Quote:
Originally Posted by Galahad/FLT View Post
I would imagine so, the bootblock is nothing special I would think its just a standard amigados loader, but its the variable it sets that needs to be discovered.

I will take a look tomorrow for you.
Great, thanks!
And perhaps some day someone (owning a working original) will read this thread and dump it in extended adf format (including track 80). Or he could use Powercopy. I would give him my help in dumping it .
Supamax is offline  
Old 25 April 2009, 17:19   #8
Supamax
Da Digger :)

Supamax's Avatar
 
Join Date: Nov 2008
Location: Monza, Italy
Posts: 2,479
hi Galahad,
did you (or some other cracking genius here in EAB) have some time to give a look at the protection?

P.S. I tried to PM you, but you don't often read them
Supamax is offline  
Old 28 April 2009, 21:47   #9
StingRay
move.l #$c0ff33,throat

StingRay's Avatar
 
Join Date: Dec 2005
Location: Berlin/Joymoney
Posts: 5,529
Quote:
Originally Posted by Supamax View Post
- one with a normal bootblock.
This one loads, shows some loading screens, credits etc., but at the end it shows a severe error onscreen and you have to reset

Is someone able to tell me where is the issue?
Crash is caused by uninitialised trap #4 vector. It's used to decrypt a file which fails for obvious reasons. Not sure if it'll be possible to decrypt the file without the protection track data. But I'll have some more fun with it tomorrow at work.
StingRay is offline  
Old 28 April 2009, 22:20   #10
Supamax
Da Digger :)

Supamax's Avatar
 
Join Date: Nov 2008
Location: Monza, Italy
Posts: 2,479
@ StingRay

Thanks, your effort is very much appreciated!
Supamax is offline  
Old 29 April 2009, 10:16   #11
StingRay
move.l #$c0ff33,throat

StingRay's Avatar
 
Join Date: Dec 2005
Location: Berlin/Joymoney
Posts: 5,529
Quote:
Originally Posted by StingRay View Post
Not sure if it'll be possible to decrypt the file without the protection track data.
I decrypted it using some "common sense" (i.e. just analyzing the crypted data to figure out the decryption key), was easier than I thought. There's more to do though as there are more trap #xx calls in the decrypted file. Quite fun so far. =)
StingRay is offline  
Old 29 April 2009, 11:12   #12
StingRay
move.l #$c0ff33,throat

StingRay's Avatar
 
Join Date: Dec 2005
Location: Berlin/Joymoney
Posts: 5,529
Here's little teaser what I have managed so far (2 traps "emulated", 2 still left to do). This is all guesswork which is quite fun. =)
Attached Thumbnails
Click image for larger version

Name:	fun.png
Views:	257
Size:	10.0 KB
ID:	21174  
StingRay is offline  
Old 29 April 2009, 13:14   #13
StingRay
move.l #$c0ff33,throat

StingRay's Avatar
 
Join Date: Dec 2005
Location: Berlin/Joymoney
Posts: 5,529
Ok, had a bit more fun with it and it seems it fully works now. Didn't really test it much though. Anyway, attached is cracked disk image, have fun. Could be a nice one for a cracking tutorial.

Edit: would be nice to see the original disk one day as I'd like to see what the original bootblock does.
Attached Files
File Type: zip aar_cracked.zip (81.1 KB, 119 views)

Last edited by StingRay; 29 April 2009 at 14:11.
StingRay is offline  
Old 29 April 2009, 19:38   #14
Supamax
Da Digger :)

Supamax's Avatar
 
Join Date: Nov 2008
Location: Monza, Italy
Posts: 2,479
Quote:
Originally Posted by StingRay View Post
I decrypted it using some "common sense" (i.e. just analyzing the crypted data to figure out the decryption key), was easier than I thought. There's more to do though as there are more trap #xx calls in the decrypted file. Quite fun so far. =)
Hi StingRay,
I'm happy you're calling it "fun" ... I wouldn't know where to start, I envy you!

Quote:
Originally Posted by StingRay View Post
Ok, had a bit more fun with it and it seems it fully works now. Didn't really test it much though. Anyway, attached is cracked disk image, have fun.
WOW, I'll try it ASAP! In the meantime I'm bowing down

Quote:
Could be a nice one for a cracking tutorial.
Yes! Would you do it please? Tools used, your approach, etc.
But I understand it may be very difficult to explain it to noobs like me.

Quote:
Edit: would be nice to see the original disk one day as I'd like to see what the original bootblock does.
I SUPER-QUOTE this, and I wrote it at the beginning of the thread.
But I don't know how many people could have it . It was only sold here in Italy, from the NUOVA NEWEL shop and in bundle with the AR 1.5.

Last edited by Supamax; 29 April 2009 at 19:45.
Supamax is offline  
Old 29 April 2009, 19:48   #15
Supamax
Da Digger :)

Supamax's Avatar
 
Join Date: Nov 2008
Location: Monza, Italy
Posts: 2,479
By the way, StingRay, since no one dumped&cracked this one before, how could we name it for - let's say - TOSEC?

It's OK for you to add [cr StingRay] ?
Supamax is offline  
Old 29 April 2009, 20:03   #16
Supamax
Da Digger :)

Supamax's Avatar
 
Join Date: Nov 2008
Location: Monza, Italy
Posts: 2,479
Hi again StingRay,

which are "good" answers (for an A500 basic config) to the following questions?

- Where can I put my ripper routine?
- Where is located the buffer?

Supamax is offline  
Old 29 April 2009, 20:09   #17
StingRay
move.l #$c0ff33,throat

StingRay's Avatar
 
Join Date: Dec 2005
Location: Berlin/Joymoney
Posts: 5,529
Quote:
Originally Posted by Supamax View Post
Yes! Would you do it please? Tools used, your approach, etc.
But I understand it may be very difficult to explain it to noobs like me.
As this one was quite interesting (yet still not too hard) to do I may write a tutorial. I just don't know when I'll do that though.


Quote:
It was only sold here in Italy, from the NUOVA NEWEL shop and in bundle with the AR 1.5.
There's still hope that some other italian guys have got the disk.


Quote:
Originally Posted by Supamax View Post
By the way, StingRay, since no one dumped&cracked this one before, how could we name it for - let's say - TOSEC?

It's OK for you to add [cr StingRay] ?
I don't mind. Feel free to name it in whichever way you want.


Quote:
Originally Posted by Supamax View Post
Hi again StingRay,

which are "good" answers (for an A500 basic config) to the following questions?

- Where can I put my ripper routine?
- Where is located the buffer?


Just use some free memory area, I used $50000/$60000.
StingRay is offline  
Old 29 April 2009, 22:17   #18
Supamax
Da Digger :)

Supamax's Avatar
 
Join Date: Nov 2008
Location: Monza, Italy
Posts: 2,479
I tried it a little, and it seems to work .
Thank you very much!

It's a pity they (the authors) didn't write a manual. Or they did and I was not given it.

Now, StingRay, are you in the mood of having more "fun" and completely crack Powercopy?
Supamax is offline  
Old 29 April 2009, 22:31   #19
StingRay
move.l #$c0ff33,throat

StingRay's Avatar
 
Join Date: Dec 2005
Location: Berlin/Joymoney
Posts: 5,529
My pleasure. As for PowerCopy, it's been quite a while since I last had a look at it but it's not forgotten, one day I'll defeat it! ATM I'm busy doing some other things tho (PSP coding etc.) so you'll have to be patient.
StingRay is offline  
Old 29 April 2009, 22:34   #20
Supamax
Da Digger :)

Supamax's Avatar
 
Join Date: Nov 2008
Location: Monza, Italy
Posts: 2,479
Quote:
Originally Posted by StingRay View Post
My pleasure. As for PowerCopy, it's been quite a while since I last had a look at it but it's not forgotten, one day I'll defeat it! ATM I'm busy doing some other things tho (PSP coding etc.) so you'll have to be patient.
and... sorry, I should have PMed you.
I spammed my own thread, too .
Supamax is offline  
AdSense AdSense  
 


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools

Similar Threads
Thread Thread Starter Forum Replies Last Post
Amiga Action Replay MKIV (A1200-3000) ProxyShare support.WinUAE 29 15 September 2015 08:31
Action Replay 3 Hungry Horace Hardware mods 45 03 October 2008 01:27
Action Replay for Amiga 1200 Phantomz New to Emulation or Amiga scene 4 08 August 2005 10:21
Action Replay? Unregistered support.Hardware 53 26 March 2005 21:52
Using Action Replay Codes in Amiga emulator Tim Janssen New to Emulation or Amiga scene 3 08 November 2001 14:25

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT +2. The time now is 07:28.


Powered by vBulletin® Version 3.8.8 Beta 1
Copyright ©2000 - 2017, vBulletin Solutions, Inc.
Page generated in 0.60318 seconds with 12 queries