Brutkey

Foone🏳️‍⚧️🏳️‍⚧️
@foone@digipres.club

so, step 3: The checksums.
I hack out the checksum function so that when it's called, it just writes the "correct" answer into the return value.

I do it at the point where checksum_memory() is implemented, not where it's called, as there's two visible calls to the checksumming function, there may be more. this way it'll always return the right value.

(assuming they always checksum the same part of memory! a fun trick would be doing different chunks of RAM... but not here)


Foone🏳️‍⚧️🏳️‍⚧️
@foone@digipres.club

so I have a hack that works: I don't think I trust it though. I'm going to change it so the right memory gets into RAM at the right places, just to make sure there's no additional side effects.

There's random values in this sector, after all: what if the game is using them to multiple enemy damage or something?

Foone🏳️‍⚧️🏳️‍⚧️
@foone@digipres.club

rather than hack my way into having a disk that'll work when mounted in DOSBox, I'm just going to make it work properly if the files are copied to DOS? I'll stick the information from those sectors into a file, and swap the raw-sector interrupts out for a simple DOS read-file-data routine.

in fact, I might be able to steal one from elsewhere in the EXE

Foone🏳️‍⚧️🏳️‍⚧️
@foone@digipres.club

weird. I can't find any DOS file interrupts. I know this is for DOS 2.x, but it's gotta load files somehow... there's a high score file!

Foone🏳️‍⚧️🏳️‍⚧️
@foone@digipres.club

oh wait I searched on "int 21h". but there's a generic interrupt mechanism here, I just described it. I'm an idiot

Foone🏳️‍⚧️🏳️‍⚧️
@foone@digipres.club

btw, the game (Rogue, if I didn't mention that before) is written in C, and uses Lattice C 2.00.

Ghidra mostly decompiles it properly. The function arguments sometimes confuse it: Lattice seems to add some padding between arguments sometimes? I'm not sure why exactly.

Foone🏳️‍⚧️🏳️‍⚧️
@foone@digipres.club

this game is so old it doesn't support directories

QCATOPR :donor:
@timjclevenger@infosec.exchange

@foone@digipres.club The only version I have (and had back then) is cracked so it's interesting to hear how they got there.