Leatherneck Copy Protection

[mlynn1974]

Leatherneck by Microdeal: A game I had almost forgotten about until I saw it in my local Antique Shop.
Insanely difficult. 4 player with the Microdeal Joystick Adapter.
Not quite as good as Commando or Ikari Warriors but excellent music by David Whittaker.

There are 2 versions already cracked:
1. Automation 22 (Fake or not?).
This doesn't seem to work correctly. Player 4 is always active and Player 1 cannot proceed
2. Klapauzius's excellent single packed, trained, hard disk compatible version.

So I thought can I copy this to a standard .ST disk image from the Pasti Image? What would I find?

The disk is single sided, 54 tracks, 9 sectors and cannot simply be copied by FastCopy 3.
Track 0 Sector 9 stores the high scores.

To crack this game and copy it to a standard format disk:
1. Make MSA disk image from PASTI disk image
2. Copy MSA to standard disk image (.ST)
3. Copy files from .ST disk image removing hidden attribute to destination disk using KK Commander
Destination disk: 80 tracks, 9 sectors, single sided.

4. Read sector 0, track 9 to memory using T0S9RD.S (GETBPB, RWABS)
5. Save track using "Save Binary" in MonST e.g. S C:\A.DAT,$4e000,$4e000+$1FF
6. Write back to destination disk using T0S9WR.S (GETBPB, RWABS)

If the disk is not correctly cracked it seeks for sector 9 across all tracks on the disk making a horrid noise.
Steem Debug pointed to an infinite loop here:

Code: Select all

L00C1: MOVE.L    #$70000,2096(A5)
      BSR       L00D8 
      MOVE.W    #$4D,2094(A5) 
      BSR       L00CF 
      BSR       L00CE 
      BSR       L00D1 
      CMPI.W    #$FFFF,D0 
      BEQ.S     L00C1 
      BSR       L00C7 
      BSR       L00CF 
      BSR       L00C6 
      BSR       L00D1 
      LEA       $70000,A0 
      MOVE.W    #$A1,D0 
      MOVE.W    #$C8,D1 
      CLR.L     D2
L00C2:CMP.B     (A0)+,D0
      BEQ       L00C4 
      DBF       D1,L00C2
L00C3:CMPI.W    #8,D2 
      BCC.S     L00C5 
      BRA.S     L00C1 
L00C4:ADDI.W    #1,D2 
      DBF       D1,L00C2
      BRA.S     L00C3 
L00C5:RTS 

And lots of activity here:

Code: Select all

L00C8:BSR.S     L00CA 
      MOVE.W    D0,$FFFF8604.W
      BRA.S     L00CA 
L00C9:BSR.S     L00CA 
      MOVE.W    $FFFF8604.W,D0
L00CA:MOVE      SR,-(A7)
      MOVE.W    D7,-(A7)
      MOVEQ     #$20,D7 
L00CB:DBF       D7,L00CB
      MOVE.W    (A7)+,D7
      MOVE      (A7)+,SR
      RTS 

In other parts of the code it mucks around with $ff8606 - FIFO access to the DMA controller.
Writing $80 there "connects" $FF8604 to the FDC status register.

1. Disassemble L.PRG using Easy Rider 4.
2. Copy loop expects $ffff to be found. Return from L00C1 early. Return value not stored anywhere or used.
3. Reassemble L.PRG using Devpac 2.
4. Copy L.PRG to standard disk.

Test: It works!

[Mug UK]

Nice work.