Disassembling games for fun

[cosmicfrog]

any chance of zoneing ReSource 6.01, 6.06 packages?
mark pleas & thank you if u do

[crabfists]

I got ReSource 6.06 from Codetapper's site. (Thanks Codetapper by the way)

http://www.codetapper.com/

[crabfists]

Know what you mean about the custom chip flags. That is invaluable. Must be a way of setting IDA up to do that... I might have a fiddle around if I get a chance.

I'm getting the hang of ReSource now and quite liking it. Incidentally, I tried running it in Picasso96 mode in WinUAE so I could take advantage of the higher screen res to fit more text on the screen but all I got was a green screen. Anybody manged to run this in Picasso96 mode?

[BippyM]

Originally Posted by crabfists

Know what you mean about the custom chip flags. That is invaluable. Must be a way of setting IDA up to do that... I might have a fiddle around if I get a chance.

I'm getting the hang of ReSource now and quite liking it. Incidentally, I tried running it in Picasso96 mode in WinUAE so I could take advantage of the higher screen res to fit more text on the screen but all I got was a green screen. Anybody manged to run this in Picasso96 mode?

Attched is a pic of my tooltypes (Can't be bothered to copy them)

hope it helps

[zenox98]

Thanks bibbym. I had the same issue as crabfists, and it's the 'SYSRENDER=ON' that was needed. Cheers

[BippyM]

no worries and it's BippyM

[crabfists]

Thanks BippyM. Haven't tried ReSource in hi-res yet but I will do when I get a chance.

On the subject of disassembling games I came across this guy's site yesterday:

http://www.tomatarium.pwp.blueyonder...lfrontier.html

He's done a cross platform version of Frontier by disassembling the code, pulling out the OS calls and other hardware specific stuff and writing a program to convert 68000 asm to portable C. Interesting approach. The source code to the asm to c converter is there but I haven't looked at it yet.

[Ironclaw]

Originally Posted by bippym

no worries and it's BippyM

Not according to your registered name, which is bippym, no capital letters.

[crabfists]

I'm still hacking away at this game but progress is quite slow at the minute as I try and work through what I think is the rob northen copylock loader in order to get to the game code. To teach me a little bit about removing copy protection and how WHDLoad works I am looking at the WHDLoad slave for the game to see how it patches it. I'm getting my head around how it patches it now but I'm trying to understand how using trap exceptions to jump to patched-in routines work.

Before the slave jumps to the game's code it loads a file from disk into memory, which I presume is the rnc loader (I've spotted trace vector decoder setup code and what I think is encrypted code), and patches a location within that file just loaded with a trap #15 instruction then sets up trap exception vector #15 like this:

 pea    patch_loader_1(pc)       
        move.l    (a7)+,$BC.W            ;; set as trap vector for trap #15

Then it jumps to the code it's just loaded. I've put a breakpoint on the line that executes the trap #15 and I was expecting it would jump directly to the patch_loader_1 routine but it doesn't, instead it jumps to another routine then that routine does an rts and then the patch_loader_1 routine is executed. My question is what is this other routine it jumps to first and why is it being executed on a trap instruction? I thought a trap #15 would jump directly to the routine set as the trap vector routine (eg patch_loader_1).

Also, I don't quite understand what the rnc code is doing (and I don't know if I need to to work it out to get to the game's code). The WHDLoad slave loads the rnc code to location $10000 but then the rnc code copies most of itself into location $50000 and jumps to there. Later on, when on the game title screen, if I look at location $10000 the rnc code does not exist any more. Why does it relocate itself like this? Why doesn't it just load itself directly to location $50000 in the first place?

I'm not really sure I should be getting bogged down in all this stuff. Is there an easy way to get to the game code without worrying about rnc code such as code encryption etc? Do I just need to see what files the patched loader is loading and then disassemble them after they have been decrunched?

Thanks in advance!

[RedskullDC]

Hi Mark_K, et al.

Originally Posted by mark_k

[I have original ReSource 4.x, 5.x and 6.01, 6.06 packages.] From memory, ReSource version 6 came with the same manual as version 5, which was not hugely different from versions 3 & 4. I don't think anyone has scanned the ReSource version 5 manual, but that might be worthwhile to do.
....

Zipped PDF of the Manual for V5/V6 is in the zone now.

Rather large, but nice and clear to read, especially the code examples.

Knock yourselves out!

Incidentally, IDA is very nice for a "one-size-fits-all" dissassembler, but ReSource V6.06 is definitely the go for serious Amiga work.

V6.06 still has several bugs, but nothing too drastic, these 2 immediately spring to mind:

1. Creates .w offsets for some .b type branches when near the +/-127/128 byte offset limits. Especially when branching ahead.

2. Creates incorrect word offsets when code with an offset in the relocation table resolves to an absolute location outside the HUNK that the relocation table belongs to.
(The apple2000 V1.3 emulator is a good example of this).
In reality, this is pretty hacky hand-assembly anyway. Doubt you would ever see a compiler produce such code.

Cheers,
Red

[RedskullDC]

Originally Posted by crabfists

Anybody manged to run this in Picasso96 mode?

Works fine on WinUAE using Picasso96 at any resolution.
Use it at 1680x1050 here

Do get a few screen artifacts on the requesters and menuitems, nothing to worry about however. Doesn't affect the program in any way.

Only works in 8-bit screenmodes though.

Red

[crabfists]

Thanks very much for the ReSource manual RedSkullDC, that's very good of you.

[crabfists]

Sorry to do this... but bumping this to ask if anybody has any hints regarding my questions above in post #29.

[zenox98]

Hi crabfists.

You will probably need to wait for one of the big guns to notice this thread, before you get an answer. I'm still new to Resource myself, so I'm no help

[Toni Wilen]

Then it jumps to the code it's just loaded. I've put a breakpoint on the line that executes the trap #15 and I was expecting it would jump directly to the patch_loader_1 routine but it doesn't, instead it jumps to another routine then that routine does an rts and then the patch_loader_1 routine is executed. My question is what is this other routine it jumps to first and why is it being executed on a trap instruction? I thought a trap #15 would jump directly to the routine set as the trap vector routine (eg patch_loader_1).

VBR moved? Afaik whdload by default moves vbr and "reroutes" exceptions back to VBR at address zero if it was "acceptable" exception. (or re-enables the system and puts dialog if something unexpected happened)

[crabfists]

Thanks zenox98. You're right, I need to wait a bit and be more patient.

ps crapfists? he he

[musashi5150]

Originally Posted by crabfists

ps crapfists? he he

I'm such a kid... that made me spit my coffee all over my keyboard

[Wepl]

Originally Posted by Toni Wilen

VBR moved? Afaik whdload by default moves vbr and "reroutes" exceptions back to VBR at address zero if it was "acceptable" exception. (or re-enables the system and puts dialog if something unexpected happened)

crabfists:
probably yes. it should be identifyable by the pc if you are in the game, slave or whdload.
still dont know which game you are working on....

[RedskullDC]

Hi crabfists,

Originally Posted by crabfists

Sorry to do this... but bumping this to ask if anybody has any hints regarding my questions above in post #29.

Need a bit more info to go on.

Can you save a resource disassem of the code region(s) in question
for us to have a look at?

Red

[zenox98]

Originally Posted by crabfists

Thanks zenox98. You're right, I need to wait a bit and be more patient.

ps crapfists? he he

Sorry about that. I did notice later and changed your name back to how it should be