BS1 intro

[mai]

I have a Disk with a bootloading intro and i am not able to rip this intro.
Can someone check zoned disk please.

[mark_k]

The bootblock code looks like this:

	dl	('DOS'<<8)
	dl	$33164C37
	dl	880

	MOVEM.L	D0-D7/A0-A6,-(SP)
	MOVEA.L	(4).L,A6
	MOVE.W	#CMD_READ,(IO_COMMAND,A1)
	MOVE.L	#$10000,(IO_DATA,A1)
	MOVE.L	#$16A00,(IO_LENGTH,A1)
	MOVE.L	#$76800,(IO_OFFSET,A1)
	JSR	(_LVODoIO,A6)
	LEA	($10000).L,A0
	MOVE.L	#$16A00,D0
NotLoop	NOT.B	(A0)+
	DBRA	D0,NotLoop

	JMP	($10008).L

	dcb.l	$EC,0

That loads the $16A00 bytes at trackdisk offset $76800 to address $10000. Then there's a broken decoding loop where it NOTs the first $6A01 bytes, leaving the last $FFFF bytes un-decoded. But I don't think the rest of the data was encoded in the first place. Then it jumps to $10008, i.e. offset 8 in the just-loaded code.

The decoded data is attached if anyone else wants to take a look. I'm guessing you could probably turn that into an executable pretty easily using an absolute-position cruncher.

The decoded data looks to be crunched, hence the black & white display before the intro starts. I'll take a look and see if I can decrunch that data.

[StingRay]

It's ByteKiller crunched. And I'm in the process of converting the intro to standard executable (no absolute address cruncher required for this).

[StingRay]

Standard AmigaDOS executable of the intro attached. It's a quick hack, no fixes etc. applied so intro needs OCS! Might do a proper fix later.

[demolition]

Just out of curiosity, which tools do you use to analyze the image and disassemble the code?

And does any good tools exist for Windows?

[StingRay]

ReSource for disassembling, AsmPro for the rest. For Windows you can try IDA Pro for disassembling, it supports Amiga/68k files.

[mark_k]

Here's the decrunched demo data. Load to $20000, JSR to $20008.

Edit: the outer wrapper code points D0 to the demo scrolltext (plain ASCII) before calling $20008.

[mai]

Originally Posted by StingRay

Standard AmigaDOS executable of the intro attached. It's a quick hack, no fixes etc. applied so intro needs OCS! Might do a proper fix later.

So it seems not possible to extract executable file without modifications/programming?

[StingRay]

This was no executable file! This was loaded as binary, decrypted and started. To make it run as a stand-alone AmigaDOS executable, it needs to be located at the same address and it also needs a hunk header.

[demolition]

Originally Posted by StingRay

ReSource for disassembling, AsmPro for the rest. For Windows you can try IDA Pro for disassembling, it supports Amiga/68k files.

Thanks, I've tried ReSource (5.0) but couldn't figure out how to use it properly, for example make proper labels. Guess I should spend some more time with it.

AsmPro looks alright, so I will give that a go as well. The main reason why I would prefer Windows is because it's so much easier to copy and paste stuff around.

[mark_k]

Reading the ReSource manual will really help. The manual is on Fish disk 232. While that document is for an earlier version of ReSource, it is mostly applicable to later versions too.

[StingRay]

You can find the manual and the last version of ReSource (6.06) on my site: ReSource+manual.

[mai]

I wanted the intro rather for preservation(submitting to Bitworld).
What to do in such unusual case, any suggestion?

[StingRay]

My executable is the original version, the only difference is that it can be run from AmigaDOS. I also deliberately did not decrunch it as during the decrunching the credits are shown.

I've patched lots of intros like this for Bitworld. In this case you should wait for me doing a proper version though as I didn't disable the code which trackloads the game code after leaving the intro with LMB.

[demolition]

Originally Posted by StingRay

You can find the manual and the last version of ReSource (6.06) on my site: ReSource+manual.

Thanks, that looks like what I was looking for.

[mark_k]

The funny thing is, (as far as I can tell) the code which trackloads another 1KB of data after the intro is completely broken. It's lucky the machine doesn't crash.

It loads 1KB of data from offset $76400 to the address pointed to by A4. A4 contains whatever value was in there when the bootblock code was originally called.

It then loads the bootblock (i.e. 1KB from offset 0) to address $FC00 but doesn't do anything with it. Then it decodes (NOTs) the code it loaded to (A4) and jumps to offset 12.

The data at offset $76400 is probably supposed to be the disk's original bootblock, so the intro is supposed to chain-load that. But at least on this disk, it isn't. The data at offset $76400 looks to be a fragment of demo code. Maybe there's an uncorrupted/unmodified version of this disk somewhere???

[StingRay]

The code is not broken (except for 1 word that's trashed in the decrypter due to dbf and not adapting the loop counter), a4 = bootblock address (OS 1.x only IIRC). There is nothing corrupted, at least not in the boot code. Also, it IS the original bootblock that is loaded, a bog standard DOS bootblock.

[mark_k]

Whoops yeah, something must have gone wrong when I tried to decode that data the first time. And the reason the code loads the actual disk bootblock to a dummy address will be to get the heads to seek back to track 0.

[mai]

Originally Posted by StingRay

I've patched lots of intros like this for Bitworld. In this case you should wait for me doing a proper version though as I didn't disable the code which trackloads the game code after leaving the intro with LMB.

Thanks so far, Please dont forget to create a proper version, if i investigated correctly, then this intro is missing in Bitworld.