Log inRegister an accountBrowse CSDbHelp & documentationFacts & StatisticsThe forumsAvailable RSS-feeds on CSDbSupport CSDb Commodore 64 Scene Database
 Welcome to our latest new user ibux ! (Registered 2020-09-25) You are not logged in 
CSDb User Forums

Forums > CSDb Discussions > What's the process for cracking cartridges?
2019-04-25 11:50
Lord Crucifier

Registered: Feb 2004
Posts: 33
What's the process for cracking cartridges?

How was this done in the old days? Convoluted custom hardware soldered together with exotic parts and many wires? Or something boring and straightforward?

I duckduckgo'ed for a bit and couldn't find much info.
2019-04-25 12:09

Registered: Jun 2002
Posts: 1720
We copied the ROMs onto PROMs and the manually drew copies of the board onto OH-film which we then used to produce PCBs, then soldered, flashed the PROMs and inserted into sockets.

So it's not cracking. Just simple replication.
2019-04-25 12:25

Registered: Mar 2009
Posts: 2925
2019-04-25 13:15

Registered: Sep 2003
Posts: 1391
DISCLAIMER: don't try this at home!
You can in most cases hotplug the cartridge after starting your dumping software.

If you dump $8000-$bfff to disc you can then examine what happens after the reset by following the CBM80 vectors. Any banking logic, if any may be deduced from the code there. A visual inspection of the cartridge circuitry will show if banking functionality is plausible.
2019-04-25 14:38

Registered: Apr 2002
Posts: 4608
it was common practice to change system roms in those days so I can imagine a rom hack which asks you wether to dump the cart or start it ? :)
2019-04-26 11:43
Lord Crucifier

Registered: Feb 2004
Posts: 33
Thanks for the replies. I was referring to "cartridge to disk" cracks, and wondered how you got into the ROM data stored on the cartridge in order to crack it. Hedning's link cleared up a lot, thanks!
2019-04-26 12:49

Registered: Jan 2008
Posts: 277
Some custom kernals (Dolphin DOS if I remember correctly) allowed to bypass CBM80 check in memory when certain key has been pressed during startup, thus resulting in starting with BASIC. This allowed to dump from memory to disk. Another solution was to read ROM with EPROM burners and dump it (there were many EPROM burners for c64 including Promenade, Datel and Rex) to disk. Third option was either a custom switch or dedicated hardware product like Cartridge Backer that would disconnect some lines at cartridge port. A variant of it would be port expander allowing selection of lines that should be left open/closed. Not all expanders have such option.

After dumping ROM to disk you have to write loader that would load dumped ROM into memory and run it. If the cartridge did not have any protection and no banking it was basically game over (unless you would pack it to make loading faster and link with intro). Some cartridges have banking capabilities so the loader needs to take that into account and it requires some code modification. Another thing is that some ROMs had anti-dumping protection techniques. Some were software based - like at the beginning of code execution startup code tries to overwrite own memory. This will not work with ROM obviously but will hang system when code is executed from RAM. Others had some additional hardware. If I remember correctly MSSIAH had such thing implemented, thus it not working correctly with some hardware emulators/recreations of C64.
2019-04-26 16:43

Registered: Jan 2002
Posts: 124
I had a swtich that sort of disabled the cart. Allowing the computer to boot with the cart inserted but not active, I could then enable it, load any software based machine code monitor not residing at the $8000 area and then save the content of the cart. Pretty straight forward for the vanilla 8Kb carts...

Pontus "Bacchus" Berg
* FairLight Council *
RefreshSubscribe to this thread:

You need to be logged in to post in the forum.

Search the forum:
Search   for   in  
All times are CET.
Search CSDb
Users Online
Dex-D/Airsomjith Class
Guests online: 137
Top Demos
1 Uncensored  (9.7)
2 Edge of Disgrace  (9.6)
3 Coma Light 13  (9.6)
4 Memento Mori  (9.6)
5 Comaland 100%  (9.6)
6 The Shores of Reflec..  (9.6)
7 Unboxed  (9.6)
8 Lunatico  (9.6)
9 Remains  (9.5)
10 C=Bit 18  (9.5)
Top onefile Demos
1 Dawnfall V1.1  (9.5)
2 Gumbo Revised  (9.5)
3 Smile to the Sky  (9.5)
4 Daah, Those Acid Pil..  (9.5)
5 Bad Boy  (9.5)
6 Crystal Gazer  (9.5)
7 Cuarentenauta  (9.5)
8 Instinct  (9.5)
9 The Tuneful Eight [u..  (9.5)
10 The Night It Snowed  (9.5)
Top Groups
1 PriorArt  (9.4)
2 Booze Design  (9.4)
3 Censor Design  (9.4)
4 Fossil  (9.4)
5 Performers  (9.3)
Top Musicians
1 Rob Hubbard  (9.8)
2 Jeroen Tel  (9.6)
3 LMan  (9.6)
4 Linus  (9.5)
5 Drax  (9.5)

Home - Disclaimer
Copyright © No Name 2001-2020
Page generated in: 0.058 sec.