Batman The Movie, Amiga, 2 Disk Europe, Ocean
This repo contains my progress of the disassembling of the 2 Disk version of Batman The Movie for the Amiga.
The inspiration for this exercise was discovering the following cracking series run by h0ffman. Links to those resources shown below.
I've been looking for an excuse to do something on the Amiga for ages and this seemed like a nice little hobby exercise to dip in and out of, a reason to re-learn 68000 and a chance to learn something about game programming in the process.
Resources and code used in this project is listed below. If there's anything used which hasn't been credited, please let me know. Also thanks to the TTE Crew member JAYCEE_1980 who supplied a download link for the RNC disk code in the h0ffman twitch stream: Episode #16 Lemmings.
- Batman 2 Disk Europe
- WinUAE - Windows Amiga Emulator
- FS-UAE - Linux Amiga Emulator
- Action Reply MKIII - Emulator ROMS
- VS Code
- Amiga Assembly Extension
- RNC DosIO - Low level disk code
- Shrinkler - file cruncher/decruncher
- Salvador - zxo file cruncher/decruncher
This exercise is not one of speed, but of learning. It looks like this game could be cracked just by patching out the serial number check around $139C in the loader code. The intention is to spend more time disassembling parts of the code that wouldn't normally be disassembled to crack the game. I'll be following the steps below, like all plans likely to change.
- Disassemble the boot loader. Code Folder
- Disassemble the game loader. Code Folder
- Disassemble the Rob Northen Disk Protection. Code Folder
- Ripping the files from the disk. Files Folder
- Unpack the ripped files. Files Folder
- Re-pack the files for reuse. Files Folder
- Create a Cracked Version of the Disk. - Amiga DOS disk with custom loader (rnc dosio)
- Dos Crack V2
- DosCrackZX0.adf - In Progress (semi functional some loading corruption, game/timer speed up, level 2 onwards)
- Dos Crack V1 -
- DosCrackShrinkler.adf - In Progress (game/timer speed up, level 2 onwards)
- Load time is far too slow, need to change packer
- Disassemble the Game Panel
- Disassemble the Title Screen.
- In Progress (next)
- Disassemble the Platform Levels.
- Disassemble the Batmobile/Batwing Levels.
- Disassemble the BatCave Level.
2024-06-05 - Have disassembled the code to the game 'panel' file. I can now re-assemble the file and have tested it on the test .adf disk image here DosCrackShrinkler_Rebuild.adf
2024-06-03 - First draft of the 'panel' program has been disassembled and can be reassembled in vscode. Some tidying up and splitting out into gfx includes required. Move on to the Title Screen next. Might gain a bit more insight into the VBL interrupts and timings there.
2024-05-30 - Been disassembling the 'Panel' executable that is loaded to $7Cf7C in memory. It contains the gfx and code that manages the game status panel including keeping track of the player lives, energy, level count down timer. Looking for hints for why the 'cracked' version of the game speeds up on level 2 and beyond. Can see that a level 3 vertical blank interrupt calls the 'update' routine every frame. At the moment it appear that this routine is being called more frequently in my version of the re-complied ADF images for level 2 and beyond. Will keep searching... probably wont find out why until I disassemble the level code and see exectly where the level 3 interrupt is raised in the game code (apart from by the vbl).
2024-05-24 - Created a zx0 version of the disk, it's not working perfoectly yet, I think the compressed files are larger, causing corruption/memory overwriting on loading. Also the game timer is speeding up when loading level 2 and above, 1 minute is taking about 50 seconds. It looks like the level 3 interrupt is being called 60 times a second(ish) instead of 50 times a second. The music and game is also running noticably faster. When returning to the title screen, the music is playing faster. Once this is sorted the game should be working on A500 and I can move on to disassembling other parts of the game.
2024-05-24 - Obtained source and built 'salvador' zx0 packer/unpacker tool and link to the depacker source code from git hub (see links above). Have packed ripped files with tool and added files to source control.
2024-05-23 - Created an Amiga DOS disk that can be played and completed, very slow loading times due to decompression (which needs to be fixed). Its a learning exercise and I'm learning loads. I think the clock timer is running too fast (also the music on the title screen), so I think the game timers aren't set quite right at the moment. Also affects game play of levels 2 & 4 which are very tight on the time limits. This needs to be looked at and fixed.
2024-05-22 - Been testing the game and have completed the cracked version. It showed the game-over screen instead of the completion screen. Also had an intermittent crash on level 5. I've updated the new loader, so that it sets the original copy protection serial into the exception vectors. May also need to insert other copy protection data into memory, will test when I have the time.
2024-05-21 - Noticed that Level 5 is crashing/corrupt when navigating through the level. Will have to double check the ripped data for this level, also see if there are any copy protection checksums happening during the level to cause the issue. (Also, you can get infinite energy by patching 3 NOPs into location $7fA76 when playing the game, using action replay, WIN UAE debugger, etc)
2024-05-21 - Created first verison of a single disk crack. The ADF can be found here packedfiles.adf. The load time is far too slow due to the packer used (shrinkler). Need to find a packer with a faster decruncher which still has a decent pack ratio.
2024-05-20 - Successfully created a test crack disk that boots the title screen and first level of the game from an Amiga DOS disk. TestCrack.adf
2024-05-17 - Created a test disk image testcrack.adf which can load the and start the Title Screen from the Amiga DOS formatted disk. The game will crash if you try to start it as theres no code to load the levels etc. Ive borked the test loader, try running on emulator with plenty of memory, think its got stack corruption at the moment
2024-05-17 - Created simple loader using RNC DosIO to load title screen from the ripped files.
2024-05-17 - Added RNC disk code tools which I intend to use to re-create a loader for the game.
2024-05-15 - Unpacked the ripped files and added them to source control and also as unpacked Amiga DOS format ADF files.
2024-05-14 - Completed quite a few tasks on the main game loader:-
- Completed first draft of documenting the gameloader.s code BATMAN Loader
- Added a set of ripped raw files to the rawrippedfiles source directory Ripped Files
- Disk 1 raw ripped files Disk1 Files
- Disk 2 raw ripped files Disk2 Files
2024-04-26 - Commented lots of the main game loader, still some of the copy protection left to comment BATMAN Loader.
2024-04-09 - Began adding the disassembly of the main game loader, the "BATMAN" file from disk 1.
2024-04-07 - Completed first draft of documenting the bootblock.s code.
2024-04-05 - Almost finished documenting the Bootblock code (which builds in VSCode using the Amiga Assembly plug-in)
2024-03-28 - Uploaded ripped files on ADFs, Ripped files are 'IFF' files that are further processed/decrunched by the loader before relocated into memory. All files appear to have IFF headers apart from the the music file(s), not sure what format these are yet.
2024-03-27 - I have ripped the raw files from both disks, need to upload to the repo.
2024-03-26 - Up to this point I have successfully ripped the game loader, documented it and modified it sufficently to get the game to boot without the copy protection kicking in. I've decoded and disassembled the Rob Northen protection and spent some time understanding how it works. I need to upload these files to this repo.
2024-03-25 - Spent quite a while stepping through and documenting the GameLoader (docs yet to be uploaded), also decoding the copy protection routines (early Rob Northen) trace vector decoder (again, docs to be uploaded)