|
| |
| User rating: | awaiting 8 votes (8 left) |
Credits :
No credits found
Intro used in this crack:
Download :
Look for downloads on external sites:
Pokefinder.org
User Comment
Submitted by iAN CooG on 4 January 2022
I don't know if it's born bad or there are some bad bytes due to bad transfer, but what I noticed is:
1) byte at $a000 is $55, most probably due to a memory dump done after a reset, while the xor pattern tells me that should be a $ac.
9FF0: 9C 9D 9E 9F-A0 A1 A2 A3-A4 A5 A6 A7-A8 A9 AA AB
A000: 55 AD AE AF-B0 B1 B2 B0-B4 B5 B6 B7-B8 B9 BA B5
becomes
9FF0: 9C 9D 9E 9F-A0 A1 A2 A3-A4 A5 A6 A7-A8 A9 AA AB
A000: AC AD AE AF-B0 B1 B2 B0-B4 B5 B6 B7-B8 B9 BA B5
2) it manipulates $01 to bankswitch too many times without stopping interrupts. It's a call for disasters.
AB1F 20 81 FF JSR $FF81
AB22 78 SEI
AB23 A9 EA LDA #$EA
AB25 8D 15 03 STA $0315
AB28 A9 31 LDA #$31
AB2A 8D 14 03 STA $0314
AB2D 58 CLI <- patched with 78 (SEI)
AB2E 60 RTS
3) same after decrypting, it leaves $01=#$35 but doesn't set the vector $fffe/fffe before calling another CLI, and there happens the disaster, IRQ is triggered too soon and crashes by jumping to $ffff.
.C:09f7 A5 01 LDA $01
.C:09f9 09 01 ORA #$01
.C:09fb 29 FD AND #$FD
.C:09fd 85 01 STA $01 ; $01=#$35
.C:09ff 20 D4 09 JSR $09D4 ;<- decryption for the next bytes
.C:0a2c 58 CLI ;<- nah, don't!
.C:0a2d 20 3C 42 JSR $423C
to patch it, and have a SEI ($78) there, the original byte at $0a2c which contains $80 must be patched with $a0 ($58^$80 gives the xor value used in that location $d8, then $78^$d8 is $a0)
The fixed d64 is added only to show that the program can be fixed to work. |
User Comment
Submitted by Celtic on 4 September 2014
| doesnt work for me past the intro. |
|
|
|
 | Search CSDb |
|
| Navigate | |
|
| Detailed Info | |
|
| Fun Stuff | |
· Goofs
· Hidden Parts
· Trivia
|
|
| Forum | |
|
| Support CSDb | |
|
 |  |
|
