Has anyone extracted Stampede 1 and 2 intros?

This is where you post all your requests for demos, intros, pubtros etc...

Moderators: Mug UK, lotek_style, Moderator Team

Post Reply
mlynn1974
Captain Atari
Captain Atari
Posts: 443
Joined: Mon Mar 03, 2008 10:33 pm
Contact:

Has anyone extracted Stampede 1 and 2 intros?

Post by mlynn1974 »

4-7 have been extracted and 3 is easy to get, but why not 1 and 2?
4-7 are available here:
https://demozoo.org/sceners/49333/

Mug UK ripped all the Quartet music and someone else converted them to mods which is great.
I know they're not great demos but it might be nice to make a compilation with all those intros on it on a standard .ST disk image.

Issue 2 is the same as issue 1 except it has a little loader picture.

I don't know if the little animation when you press space is a SEQ file. It certainly uses the standard Quartet Replay routine. I don't know if the FAT on the disk has been played around with to hide the animation, 4V, SET or single demo file. The track counter in Steem SSE jumps about all over the place when it is loading. It just doesn't load a few dozen tracks sequentially and then run.

With the Issue 1 STX using Steem Debugger I worked back in memory to where it was loaded (loads of zeroes before it). I put a breakpoint at that address, reset and reloaded it. When it hit the breakpoint I dumped 150k to disk. There are some funny looking debug symbols at the end :P but maybe I dumped too little memory. I then wrote a little loader to load that block and relocate it to that address. The loader goes into supervisor mode, sets physbase and logbase to $78000, relocates it and jumps to it. On my first attempt I got 2 bombs :(
Still got, still working: Atari 4Mb STe, 520STFM (x2), 2.5Mb STF, Atari 2600JR, Flashback 8 Gold.
Hardware: Cumana CSA 354, Ultimate Ripper, Blitz Turbo, Synchro Express II (US and UK Versions).
User avatar
Mug UK
Administrator
Administrator
Posts: 11597
Joined: Thu Apr 29, 2004 7:16 pm
Location: Stockport (UK)
Contact:

Re: Has anyone extracted Stampede 1 and 2 intros?

Post by Mug UK »

All of the first disks were protected by Rob Northern. Maybe the intros have been wrapped using his protection too?

Try using Dec0de by Orion/Replicants on the .PRG files? https://github.com/orionfuzion/dec0de (there's an ST as well as PC tool)
My main site: http://www.mug-uk.co.uk - slowly digging up the bits from my past (and re-working a few): Atari ST, Sega 8-bit (game hacks) and NDS (Music ripping guide).

I develop a free Word (for Windows) add-in that's available for Word 2007 upwards. It's a fix-it toolbox that will allow power Word users to fix document errors. You can find it at: http://www.mikestoolbox.co.uk
mlynn1974
Captain Atari
Captain Atari
Posts: 443
Joined: Mon Mar 03, 2008 10:33 pm
Contact:

Re: Has anyone extracted Stampede 1 and 2 intros?

Post by mlynn1974 »

Dec0de doesn't find anything it can remove in INTRO.STU at least. Some of the things on the disk are packed with LSD! packer.
All of the first disks were protected by Rob Northern. Maybe the intros have been wrapped using his protection too?
It would seem so:
Here is an extract of the Steem Debug log. This is very useful.

PASTI: Read sector(s). track: 53 (53), side: 0, sector: 8
Break: Hit breakpoint at address $00B3E4
>>> Stop Emulation <<<
>>> Start Emulation <<<
PASTI: Read sector(s). track: 0 (0), side: 0, sector: 12
PASTI: Read sector(s). track: 0 (0), side: 0, sector: 11
E09498: BIOS 4 Rwabs(rwflag=0000,buffer=000056D0,number=0001,recno=0007,dev=0000), read/write disk sector
PASTI: Read sector(s). track: 0 (0), side: 0, sector: 8

So I enabled a breakpoint at the start of the program. When we continue past the breakpoint it tries to read sectors 11 and 12 of track 0, side 0.
I don't know why it would do that. Only track 79, sector 6 contains a CRC error and I thought that would be the copy protection track but this code doesn't even read track 79.
Still got, still working: Atari 4Mb STe, 520STFM (x2), 2.5Mb STF, Atari 2600JR, Flashback 8 Gold.
Hardware: Cumana CSA 354, Ultimate Ripper, Blitz Turbo, Synchro Express II (US and UK Versions).
mlynn1974
Captain Atari
Captain Atari
Posts: 443
Joined: Mon Mar 03, 2008 10:33 pm
Contact:

Re: Has anyone extracted Stampede 1 and 2 intros?

Post by mlynn1974 »

I have basically rewritten the intro using the graphics extracted using the Ultimate Ripper and the massive 5 frame animation using Steem Debugger. I use the Quartet Replayer by Rob Oct 1990.

Each frame on the animation is 128 pixels high and is displayed for 8 frames. I have only tested it on Steem in 512k, 1Mb, 2Mb and 4Mb configurations. The original intro is double buffered ($70000, $78000) but my rewrite is not double buffered.

The intro compressed with Pack Ice v2.4 is only 45398 bytes long.
Uncompressed: 182406 bytes.

I will try to do Intro 2 when I have more time. It is just another picture before the intro music starts.
You do not have the required permissions to view the files attached to this post.
Still got, still working: Atari 4Mb STe, 520STFM (x2), 2.5Mb STF, Atari 2600JR, Flashback 8 Gold.
Hardware: Cumana CSA 354, Ultimate Ripper, Blitz Turbo, Synchro Express II (US and UK Versions).
mOa
Obsessive compulsive Atari behavior
Obsessive compulsive Atari behavior
Posts: 147
Joined: Sun May 12, 2002 11:53 pm

Re: Has anyone extracted Stampede 1 and 2 intros?

Post by mOa »

Nice work!
Thank you
You do not have the required permissions to view the files attached to this post.
mlynn1974
Captain Atari
Captain Atari
Posts: 443
Joined: Mon Mar 03, 2008 10:33 pm
Contact:

Re: Has anyone extracted Stampede 1 and 2 intros?

Post by mlynn1974 »

mOa wrote: Mon Jan 25, 2021 10:41 am Nice work!
:cheers:
And here is INTRO2.PRG
"Graphics by Rob Northen Computing" - I've never seen that before. :lol:

INTRO2.PRG compressed with Pack Ice v2.4 is 56896 bytes long.
Uncompressed: 214644 bytes.

INTRO3.PRG is protected with Copylock Protection System series 2 (1989) by Rob Northen (variant a) and can be decoded with dec0de, but it still tries to read some tracks from the original disk so there is more work to isolate that one.
You do not have the required permissions to view the files attached to this post.
Still got, still working: Atari 4Mb STe, 520STFM (x2), 2.5Mb STF, Atari 2600JR, Flashback 8 Gold.
Hardware: Cumana CSA 354, Ultimate Ripper, Blitz Turbo, Synchro Express II (US and UK Versions).
mlynn1974
Captain Atari
Captain Atari
Posts: 443
Joined: Mon Mar 03, 2008 10:33 pm
Contact:

Re: Has anyone extracted Stampede 1 and 2 intros?

Post by mlynn1974 »

I'm having difficulty with INTRO3.PRG

Medway Boys GC3 says:
Magic no = 3C61D378
Sorry but this is an external Rob Northen

Dec0de says it is "Copylock Protection System series 2 (1989) by Rob Northen (variant a)"
Vectors anti-hijacking: No
Key disk usage: yes
Serial number: $9fbceacc
Serial usage: Program dec0ding
Enc0ded program type: Gemdos
It decodes it but it then it seems to be protected by an internal. It still needs the original disk is in drive A: with the original track 0, sector 6.

I can only see some information on this type of protection:
Alien from Pompey Pirates said, "so it's a bit of a bitch. I have yet to find a 100% surefire way of cracking this protection- every time I encounter it, I have to spend an hour or so on it, mucking about with various little progettes I have." :
http://846231.online.fr/impactatari/texts/crack_pp.htm

Zippy mentions using a keyboard vector to interrupt it and then dump memory before it is relocated:
https://onlinelasopa542.weebly.com/all- ... zippy.html

Using a PASTI Breakpoint in Steem Debugger for track 0, sector 6 gets me a bit further but the Program Counter is in some DMA transfer code and when you trace it back the code is in an Interrupt Service Routine. I can't see clearly when the code is decoded and before it relocates. Then would then have to dump that and somehow make it executable. If anyone can advise me on how to do that I'd be very grateful.
Still got, still working: Atari 4Mb STe, 520STFM (x2), 2.5Mb STF, Atari 2600JR, Flashback 8 Gold.
Hardware: Cumana CSA 354, Ultimate Ripper, Blitz Turbo, Synchro Express II (US and UK Versions).
Zippy
Captain Atari
Captain Atari
Posts: 246
Joined: Sun Feb 01, 2004 1:58 am

Re: Has anyone extracted Stampede 1 and 2 intros?

Post by Zippy »

Did you try with the gamecracker for the RN internal *after* using Dec0de to remove the external? That might work, but you'd need the dec0ded version saved back to the original disk with the protection still working for the gamecracker to work on it.

Either that or just remove the internal manually with the usual MOVE.L #KEY,DO then BRA.S to end of the internal code.

And what the hell is that link above? :D The proper version is at https://codetapper.com/atari-st/st-interviews/zippy/

The source code for my RN external cracker is there too, or it's probably been posted on here somewhere before. I used to use the dump cartridge but I guess you could use the STEEM debugger in the same way, to dump RAM after the freeze.
mlynn1974
Captain Atari
Captain Atari
Posts: 443
Joined: Mon Mar 03, 2008 10:33 pm
Contact:

Re: Has anyone extracted Stampede 1 and 2 intros?

Post by mlynn1974 »

Thanks for the info Zippy! I tried copying back the Dec0de version back to a copy of the .STX disk image and the ran GC3 on it, but it freezes when reading Track 0 Sector 6.
Either that or just remove the internal manually with the usual MOVE.L #KEY,DO then BRA.S to end of the internal code.
I thought about that but it seems to decrypt the original code one instruction at a time in an Timer C based interrupt service routine. I can't get into that easily.

I tried dumping memory from $2172 (as per the screenshot). You can see the magic key in D0. I though this was the earliest opportunity after it had decrypted the code but I can't seem to relocate the code at that address in my code. I tried dumping 200k from that address. I then packed it with Pack Ice 2.4 then using its depack routine.

My wrapper code would go something like this:
; go supervisor mode
; set screen
lea data(pc),a0
move.l #$2172,a1
bsr depack
jmp $2172
but that doesn't work :(
You do not have the required permissions to view the files attached to this post.
Still got, still working: Atari 4Mb STe, 520STFM (x2), 2.5Mb STF, Atari 2600JR, Flashback 8 Gold.
Hardware: Cumana CSA 354, Ultimate Ripper, Blitz Turbo, Synchro Express II (US and UK Versions).
Zippy
Captain Atari
Captain Atari
Posts: 246
Joined: Sun Feb 01, 2004 1:58 am

Re: Has anyone extracted Stampede 1 and 2 intros?

Post by Zippy »

Yes that looks like a slightly unusual way of checking the RN magic number. Did you try NOP, NOP over the BNE at $2164 and another NOP. NOP over the BNE at $216e?

Is the RN internal check immediately before the stuff there from $215e or has it already run already and it just jumps to $215e for the checks?

Sometimes the depack can corrupt if it goes over itself, you might have to copy the packed data down to the low address first, then unpack it there, then jump to it, but you'd need to copy your patch/depack code out of the way somewhere up high or down low.

Do you have a dec0ded dump of the intro3.prg? And if you copy the decoded intro3.prg over the encrypted version back onto the original disk does it work?
mlynn1974
Captain Atari
Captain Atari
Posts: 443
Joined: Mon Mar 03, 2008 10:33 pm
Contact:

Re: Has anyone extracted Stampede 1 and 2 intros?

Post by mlynn1974 »

Is the RN internal check immediately before the stuff there from $215e or has it already run already and it just jumps to $215e for the checks?
It has already run and it just jumps to $215e for the checks.
Sometimes the depack can corrupt if it goes over itself
I think that's what's happening.
Do you have a dec0ded dump of the intro3.prg? And if you copy the decoded intro3.prg over the encrypted version back onto the original disk does it work?
Yes if it is put on the original disk as INTRO.STU it works. I called it INTRO3D.PRG just for my local copy. It runs from my C: drive as long as the original disk (.stx image) is in the A: drive. It reads Track 0, Sector 6 twice.
You do not have the required permissions to view the files attached to this post.
Still got, still working: Atari 4Mb STe, 520STFM (x2), 2.5Mb STF, Atari 2600JR, Flashback 8 Gold.
Hardware: Cumana CSA 354, Ultimate Ripper, Blitz Turbo, Synchro Express II (US and UK Versions).
Zippy
Captain Atari
Captain Atari
Posts: 246
Joined: Sun Feb 01, 2004 1:58 am

Re: Has anyone extracted Stampede 1 and 2 intros?

Post by Zippy »

Haha, this has more protection than a lot of games did! As well as the RN external it has 2 RN internals + checksums of the internals + checksums of the scroller text + self modifying code. It's also hiding code that's playing around with the reset vector but not 100% sure what that was doing.

Hopefully this is working OK but with the effort they put in there could also be other stuff I didn't find on initial look.

This version is depacked, unencrypted (was a simple logical NOT of the entire code) and then has both RN internals patched + the checksum on the internals patched.
INTROCRK.zip
You do not have the required permissions to view the files attached to this post.
mlynn1974
Captain Atari
Captain Atari
Posts: 443
Joined: Mon Mar 03, 2008 10:33 pm
Contact:

Re: Has anyone extracted Stampede 1 and 2 intros?

Post by mlynn1974 »

:D Fantastic work Zippy! :cheers:
This was a bit out of my league. It works nicely. I think after nearly 30 years it is reasonable to be able to run it without the rest of the magazine and without STX disk format. It must have been compressed a bit if the original was 44k and the cracked version is 90k.

A checksum on the scroller text? I think experience with RN would have helped the author if he was going on to develop games, but it must have cost a lot of time and money to implement this for a few intros for a disk magazine that didn't last very long.

The reset vector change might be because it has to signal to the loader in the auto folder to tell it to load the magazine if the intro has been shown (and then clear the flag).
Still got, still working: Atari 4Mb STe, 520STFM (x2), 2.5Mb STF, Atari 2600JR, Flashback 8 Gold.
Hardware: Cumana CSA 354, Ultimate Ripper, Blitz Turbo, Synchro Express II (US and UK Versions).
Post Reply

Return to “Demos - Requests”