16th April 2010Galaforce 2 - a Kevin Edwards self-decrypting loader which loads in the main game files, decrypts the main game file and executes an RTS - to an execute address purposely pushed onto the stack beforehand.
0400 LDA #15 0402 LDX #0 \*FX15,0 0404 JSR OSbyte \Clear keyboard 0407 SEI \disable interrupts 0408 LDA #0 040A LDX #15 040C STA &02A1,X 040F DEX \Ensure no foreign ROMs 0410 BPL &040C \are present 0412 LDY &FFB6 \and no foreign vectors 0415 DEY \by copying default address 0416 LDA &FFB7 \vectors from OS ROM. 0419 STA &70 041B LDA &FFB8 041E STA &71 0420 LDA (&70),Y 0422 STA &0200,Y 0425 DEY 0426 BPL &0420 0428 JMP &04E2 \continue execution at 4E2 \Kevin advertises himself in this next bit 0428 ** ** ** 50 72 6F 74 65 Prote 0430 63 74 69 6F 6E 20 64 65 ction de 0438 73 69 67 6E 20 26 20 63 sign & C 0440 6F 64 69 6E 67 20 28 63 oding (c 0448 29 20 4B 65 76 69 6E 20 ) Kevin 0450 45 64 77 61 72 64 73 20 Edwards 0458 31 39 38 38 2D 2D 2D 2D 1988---- 0460 2D 2D 2D 2D 2D 2D 2D 2D -------- 0468 2D 2D 2D 2D 2D 2D 2D 2D -------- 0470 2D 2D 2D 2D 2D 2D 2D 2D -------- 0478 2D 2D 2D 2D 2D 2D 2D 2D -------- 0480 2D 2D 2D 2D 2D 2D 2D 2D -------- 0488 2D 2D 2D 2D 2D 2D 2D 2D -------- 0490 2D 2D 2D 2D 2D 2D 2D 2D -------- 0498 2D 2D 2D 2D 2D 2D 2D 2D -------- 04A0 2D 2D 2D 2D 2D 2D 2D 2D -------- 04A8 2D 2D 2D 2D 2D 2D 2D 2D -------- 04B0 2D 2D 2D 2D 2D 2D 2D 2D -------- 04B8 2D 2D 2D 2D 2D 2D 2D 2D -------- 04C0 2D 2D 2D 2D 2D 2D 2D 2D -------- 04C8 2D 2D 2D 2D 2D 2D 2D 2D -------- 04D0 2D 2D 2D 2D 2D 2D 2D 2D -------- 04D8 2D 2D 2D 2D 2D 2D 2D 2D -------- 04E0 2D 2D ** ** ** ** ** ** -- 04E2 SEI \disable interrupts 04E3 LDX #255 04E5 TXS \reset stack pointer 04E6 INX \X=0 04E7 LDA #3 04E9 STA &0258 \*FX200,3 04EC LDA #75 04EE STA &70 04F0 LDA #69 04F2 STA &71 04F4 LDA #86 04F6 STA &72 04F8 LDA #73 04FA STA &73 04FC LDA #78 \Store values used in 04FE STA &74 \decryption 0500 LDA &0500 0503 EOR &70 0505 INC &0511 0508 EOR &72 050A INC &71 050C INC &71 050E EOR &71 0510 EOR #237 0512 EOR &0600,X 0515 LDY &74 0517 STY &051B 051A EOR #236 051C EOR &0601,X 051F EOR &73 0521 STA &0600,X 0524 LDA &73 0526 EOR &74 0528 STA &73 052A CLC 052B ADC #244 052D STA &74 052F EOR &0511 0532 STA &72 0534 LSR A 0535 EOR &74 0537 STA &70 0539 INX 053A BNE &0500 053C LDY #3 \*FX200,3 053E STY &0258 0541 LDA #&4C \&4C is code for JMP 0543 STA &0287 \When break is pressed, if ?&287=&4C 0546 LDA #&87 \we JMP to the address in &288/9 0548 STA &0288 \which is 054B DEY \Y=2 054C STY &0289 \&24C 054F LDA #64 0551 STA &0D00 0554 LDA &FFFA 0557 BNE &05B4 0559 LDA &FFFB 055C CMP #13 055E BNE &05B4 0560 INC &0501 0563 BNE &0500 0565 LDA #0 0567 STA &70 0569 STA &71 056B TAY 056C LDA &71 056E EOR &0600,Y 0571 STA &71 0573 LDX #8 0575 LDA &71 0577 ROL A 0578 BCC &0586 057A LDA &71 057C EOR #8 057E STA &71 0580 LDA &70 0582 EOR #16 0584 STA &70 0586 ROL &70 0588 ROL &71 058A DEX 058B BNE &0575 058D INY 058E CPY #20 0590 BNE &056C 0592 LDA &70 \Checksum, match 0594 CMP &06FE \contents of &70/71 0597 BNE &05AD \against &6FE/6FF 0599 LDA &71 059B CMP &06FF 059E BEQ &0600 \If matched, continue at &600 05A0 BNE &05AD \Otherwise loop forever \Kevin says hello 05A0 ** ** 48 69 20 42 54 57 Hi BTW 05A8 20 2E 2E 2E 2E ** ** ** ... \Come to this bit if checksums don't match 05AD LDA #200 05AF LDX #3 05B1 JSR OSbyte \*FX200,3 05B4 STA &0600,Y \Clear memory 05B7 INY 05B8 JMP &05B4 \Loop forever \Next bit is padding, as you can see from the \repeated PAD word 05B8 ** ** ** 20 28 63 29 20 (c) 05C0 4B 65 76 69 6E 20 45 64 Kevin Ed 05C8 77 61 72 64 73 20 31 39 wards 19 05D0 38 38 20 20 20 20 20 50 88 P 05D8 41 44 50 41 44 50 41 44 ADPADPAD 05E0 50 41 44 50 41 44 50 41 PADPADPA 05E8 44 50 41 44 50 41 44 50 DPADPADP 05F0 41 44 50 41 44 50 41 44 ADPADPAD 05F8 50 41 44 50 41 44 50 41 PADPADPA 0600 LDX #239 \Set stack pointer 0602 TXS \to 239 0603 LDA #&57 \execution point 0605 PHA \of game minus 1 0606 LDA #&FF \ie &5800 0608 PHA 0609 LDA #209 060B PHA 060C LDA #99 060E PHA 060F LDX #53 \Check that there are no foreign 0611 LDA &0200,X \vectors by loading their hi bytes. 0614 BPL &05B4 \If they are <&80 (+ve) then 0616 DEX \user has fiddled so jump to 0617 DEX \loop-forever routine. 0618 BPL &0611 061A LDA #0 061C TAY 061D STA &0600,Y \Clear memory up to current point 0620 INY \&600-628 0621 CPY #29 0623 BNE &061D 0625 CLI 0626 LDA #140 \*TAPE 0628 LDX #12 062A JSR OSbyte 062D LDX #&BC \*command at &6BC 062F LDY #&06 \*L.GAME? 900 0631 JSR OScli 0634 LDX #&CC \*command at &6CC 0636 LDY #&06 \*L.GAME2?? E00 0638 JSR OScli 063B LDA #15 063D LDX #0 \*FX15,0 063F JSR OSbyte \clear kbd 0642 SEI \disable interrupts 0643 LDA #3 0645 STA &0258 \*FX200,3 0648 LDA &0287 064B CMP #76 \If contents of &287 064D BEQ &0652 \are <> 76 jump to 064F JMP &05B4 \loop-forever routine 0652 LDY #0 0654 LDX #78 0656 PLA \Value put on stack at &60C 0657 STA &70 \?&70=99 0659 STA &71 \?&71=99 065B PLA 065C STA &72 \?&72=209 065E LDA &0E00,Y \Decode game code 0661 EOR &70 0663 DEC &71 0665 EOR &71 0667 EOR &72 0669 STA &0E00,Y 066C INC &72 066E LDA &72 0670 SEC 0671 SBC #95 0673 EOR &71 0675 STA &72 0677 EOR &70 0679 STA &70 067B EOR #228 067D STA &71 067F EOR &72 0681 INY 0682 BNE &065E 0684 INC &0660 0687 INC &066B 068A DEX 068B BNE &065E 068D STX &0287 0690 CLI \reneable interrupts 0691 RTS \return to address on stack ie &5800. \More PADding 0690 ** ** 50 84 44 50 41 81 PADPAD 0698 50 41 44 95 41 44 50 84 PADPADPA 06A0 44 50 41 44 50 41 44 50 DPADPADP 06A8 41 44 50 41 44 50 41 44 ADPADPAD 06B0 50 41 44 95 41 44 50 84 PADPADPA 06B8 44 50 41 81 4C 4F 41 81 DPADLOAD 06C0 20 47 61 6D 65 83 7F 20 Game.. 06C8 39 30 30 0D 4C 4F 41 44 900.LOAD 06D0 20 47 61 A8 65 32 84 BA Game2.. 06D8 20 45 30 F5 0D 50 72 AA E0..Pro 06E0 74 65 63 74 69 6F 6E 20 tection 06E8 28 63 29 20 4B 65 76 69 (c) Kevi 06F0 6E 20 45 A1 77 61 72 A1 n Edward 06F8 73 20 31 FC 38 38 34 74 s 19884t
Mr Spock 1 Feb 2005
