The BIT instruction "AND's" memory location $01 with the value
in the accumulator (#$10 = check bit 4). If the dongle is plugged
in, both bits will match up (both 1's), and the branch instruction
will be bypassed and the program will break into the monitor at
$0339.
Running the program again with the dongle plugged in will AND a
1 bit with the dongle 0 bit, causing the branch to be executed.
The program will break into the monitor at $033A. This is just one
method in which ACCESS checks their protection. We can "break"
their protection checks by replacing LDA #$10 with LDA #$00. This
way, the BIT instruction will always result in setting the zero
flag, which emulates the dongle!
Here are some other code forms for checking the dongle:
LDA #$10
BIT $00 (memory location zero, bit 4 holds an image of $0001)
BEQ dongle in
Solution: replace LDA #$10 with LDA #$00.
LDA $01
AND #$10
BEQ dongle in
Solution: replace AND #$10 with AND #$00.
LDA #$40
LSR
LSR
TAX
AND $FFF1,X
BEQ dongle in
Solution: replace LDA #$40 with LDA #$00.
LDA $0001
ASL
TAX
ASL
ASL
ASL
BCS dongle out
Solution: replace BCS with two "NOP"'s.
There are many other ways to check memory location $0001 for the
K.J. REVEALED TRILOGY PAGE [76] (C)1990 K.J.P.B.
<<previous page -
next page>>