Tower FRA - Thalion

[Leander]

Originally Posted by StingRay

Curiosity got the better of me and I checked my theory by creating a WHDLoad patch. The disk request has been removed and manual protection is disabled too.
Source and binary attached, you can use this as base for your own work if you like.

Really THANKS StingRay, i will take a look to source code, could be a good example for my poor knowledge too (i hope so ).
Slave you made works with data folder uploaded by myself or disk images uploaded by Angus?

[jotd]

talk about doing the same thing twice... I had removed the requester too and was going to explain more how it's done in that particular case, but that assumes a lot of experience in resourcing/debugging anyway. Okay. Scrap it. Try something easier first.

But just configuring/using GenericKick won't get you far. It can be a base to test if the program starts or does something, but in most of the cases (specially with originals) you have to do specific things.

[StingRay]

Originally Posted by Leander

Slave you made works with data folder uploaded by myself or disk images uploaded by Angus?

I have used the disk images provided by Angus for the slave.

[jotd]

the cracked version executable sizes are different. Probably another version, cracked. So need to support 2 versions probably.

BTW I had done the install script too (slave is dummy). Let's not lose that work

TowerFRA_install_script.zip

[Leander]

Originally Posted by jotd

the cracked version executable sizes are different. Probably another version, cracked. So need to support 2 versions probably.

BTW I had done the install script too (slave is dummy). Let's not lose that work

Attachment 67051

Well, at this point I think it's better to rely on the original version, I had used the cracked one because it was AmigaDos and therefore for my limited knowledge it was the only possible solution.
I am a VB6 programmer, I would like to learn to program slaves but I lack the basics so it is not easy for me, however I would like to try.
Thanks for the help and kindness.

[jotd]

problem here is usually not programming but understanding how the game accesses files and if there are any blockers, zap them. This requires the understanding of assembly, and disassembly tools and whatnot. see http://eab.abime.net/showthread.php?...l+ira+tutorial

[Leander]

Originally Posted by jotd

problem here is usually not programming but understanding how the game accesses files and if there are any blockers, zap them. This requires the understanding of assembly, and disassembly tools and whatnot. see http://eab.abime.net/showthread.php?...l+ira+tutorial

Really interesting, i have to study a lot Thanks!

[jotd]

if you disassemble the original "game" executable you'll find that code (I have resourced it a bit so it's clearer below)

	ADDQ.W	#4,A7			;08218: 584f
	MOVE.L	D0,D7			;0821a: 2e00
LAB_054E:
    ; always prompts at least once for data disk
    ; then probably relies on a IDCMP disk inserted message
    ; skipping that allows for game to start
	BSR.W	prompt_for_data_disk		;0821c: 61002b8c    ; => NOP NOP it
	LEA	LAB_04F7(PC),A0		;08220: 41fafce0
	MOVE.L	A0,D1			;08224: 2208
	MOVE.L	#$000003ed,D2		;08226: 243c000003ed
	MOVEA.L	DosBase,A6		;0822c: 2c6c484c
	JSR	(_LVOOpen,A6)	;08230: 4eaeffe2 dos.library (off=-30)
	MOVE.L	D0,11656(A4)		;08234: 29402d88
	BEQ.S	LAB_054E		;08238: 67e2  if file doesn't exist, prompt disk again
	MOVE.L	D0,D1			;0823a: 2200
	MOVEA.L	DosBase,A6		;0823c: 2c6c484c

the numbers on the right are the offsets of the code in the code hunk. There's only one code hunk. Search ";0823a" you'll stumble on that part (without names in clear by your end)

IDK how Sting did that, but I searched for "insert disk" message, put a read memory breakpoint on the message text, that stopped in ROM (graphics lib Text() call), then I went up the callstack and found the program that used it. Went up again, finally found the call to zap.

My installs have a "CHIP_ONLY" setup that installs the program in chip memory, which makes addresses shorter and below $200000 when debugging. I also used an AllocMem (with a tuned size) just before loading the executable so first segment starts exactly at $20000. Much easier to relate memory <=> disassembly by just adding/subbing $20000

here's my slave attempt. I didn't remove the protection yet. You can compare with Stingray's and try to run it and put breakpoints/debug it with WinUAE just to learn. TowerFRAHD.zip

To stop the slave at a given location, I use the "blitz" macro. It fills the screen with colors until you press mouse:

    blitz
    nop
    nop

when you get a "blitz", just break in WinUAE (shift+F12 or end+F12) and go down a few bytes, put breakpoint on nop, resume, click => you're in the slave (the address may change since it relies on dynamic memory allocation in fastmem)

[StingRay]

IDK how Sting did that

I have used ReSource to load the "Game" executable, let Resource convert all indirect A4 references to labels and then simply also searched for the "Insert Disk" text. Then checked the code (still in ReSource) and was convinced that simply disabling the routine would do the trick. Which I then tested by creating the slave. No breakpoints or debuggers used, I only looked at ReSources's output.

[jotd]

I have a more bruteforce/dynamic way of doing that. I didn't really get into ReSource. Just used IRA with my extra resourcing scripts and sometimes IDA for big projects.

The fact that you have to run it on amiga is a deterrent for me, despite the fact that it looks powerful. The interface is terrible compared to modern systems... Choose your weapon. Different styles.

[Leander]

There are two approach, both really interesting but complex for me to understand, like jotd says i have to do my own tries to understand better, so programs i need are WinUAE and IRA (PC tool) /ReSource (Amiga tool), are there some other useful tools to use for this job?