Disassembler

Let’s crack a simple game. If you are not familiar with Radare, read Part I first. Creating and opening a VICE Snapshot file Let’s crack BC’s Quest For Tires since its copy-protection is easy to bypass. Unzip this file: http://tapes.c64.no/tapes/BCsQuestForTires.zip Open the tap file with VICE (the most popular Commodore 64 emulator), and.. …the game has some kind of copy-protection. If we enter invalid codes, we won’t be able to play the game. Since Radare supports VICE Snapshot File format, we can save an snapshot of the game, and analyze it with Radare. In VICE, go to the menu, Snapshot -> Save Snapshot Image… If we select “Save ROMs”, then the BASIC ROM and the KERNAL ROM will be saved inside the Snapshot file, and will be included as Radare sections. Radare VICE Snapshot File (VSF) support lets us inspect: The 64k RAM of the computer at the moment the snapshot was saved The BASIC and KERNAL ROMs in case they were saved. To open a VSF file, just pass the VSF file as the first argument: $ [ 0 r x 2 0 0 b 0 c 0 _ 5 c 6 o 8 p 9 y ] _ > p r o t e c t i o n _ s c r e e n . v s f 0x00005689 is the PC (program counter) at the moment the snapshot was saved.

Radare is an open source portable reversing framework that can do many things, among those things it can disassemble 6502 code. Download and install radare First, download radare from github. You need a recent version in order to disassemble 6502 code. And then install it by running sys/install.sh (or sys/user.sh for local installation): $ $ $ g c i d / t s r y c a s l d / o a i n r n e e s 2 t h a t l t l p . s s : h / / g i t h u b . c o m / r a d a r e / r a d a r e 2 . g i t Loading a c64 .prg Radare has many command line options. But in order to load 6502 programs we need just two: -a6502 to specify the 6502 architecture. -mMemoryAddress to map the file to a certain memory address. Use 2047 for “normal” programs. Usually they start at $0801 (2049), but we have to subtract 2 from the .prg header. Example: $ r 2 - a 6 5 0 2 - m 2 0 4 7 m y g a m e . p r g Disassembling Radare doesn’t have a GUI, like IDA. Instead is has a powerful command line interface (think of GDB). Example: $ [ 0 r x 2 0 0 - 0 a 0 6 0 5 7 0 f 2 f ] - > m 2 0 4 7 m u s i c p l a y e r . p r g And 0x7ff (2047) is the seek address, meaning that all commands will use that address as the base address. Let’s print the first 32 bytes. ( px = print hexa): [ o 0 0 0 f x x x f 0 0 0 s 7 8 0 e f 0 0 t f f 0 0 7 0 0 f 0 1 d f 0 d ] 1 8 c > 0 a p 2 b 2 x 0 1 3 8 2 3 2 3 a 4 9 0 0 0 5 5 0 9 b 6 e 9 3 d 7 2 4 3 1 8 0 a 3 9 9 6 9 3 f A 1 0 0 2 B 0 0 0 c C 0 8 0 d D 0 0 7 f E 8 7 a c F d e 0 1 2 3 . 4 9 5 . 6 . 7 2 8 0 9 6 A 1 B . C . D . E x F . The “2061” that we see, is part of the BASIC “SYS 2061” command that usually appears in all C64 programs. So, let’s disassemble the first 12 instructions from 2061. ( pd = print disassemble): [ 0 x 0 0 0 0 0 ┌ │ │ └ 7 ┌ │ │ ─ │ │ │ └ f ─ ─ ─ f > < < ] > 0 0 0 0 0 0 0 0 0 0 0 0 x x x x x x x x x x x x p 0 0 0 0 0 0 0 0 0 0 0 0 d 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 8 8 8 8 8 8 8 8 8 8 8 8 @ 0 0 1 1 1 1 1 1 1 2 2 2 d e 1 3 5 8 b c e 1 4 5 2 0 6 1 7 a a a b 9 c d c c c d 8 d 2 0 9 9 8 0 e e a 0 0 1 0 d f f 1 1 e d 2 0 4 0 7 7 a e d 1 2 0 0 c a 0 8 8 s l l l l s i b d d d b e d d d d t n n e e e n i a x y a a y e c c x e 0 # # 0 0 0 0 0 0 x 0 0 x x x x x x d x x 1 2 f 0 0 e c 1 0 a 0 7 8 8 e 0 2 0 d f 1 1 d 4 0 7 a , , y y In case we don’t know the meaning of a certain opcode, we can print its description with ?d: [ s 0 e x t 0 0 i 0 n 0 t 0 e 8 r 1 r 5 u ] p > t ? d d i s s a e b i l e s t a t u s Or if we want to print the description in every disassembled line, we can do: e a s m . d e s c r i b e = t r u e And then disassemble again: [ ┌ │ │ └ 0 ─ ─ x > < 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x x x x x x x x x x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 8 8 8 8 8 8 8 8 8 8 8 8 8 0 0 1 1 1 1 1 1 1 2 2 2 0 d e 1 3 5 8 b c e 1 4 5 e ] > 7 a a a b 9 c d c c c d 8 d 2 0 9 9 8 0 e e a 0 p 0 1 0 d f f 1 1 e d d 2 0 4 0 7 7 a e d 1 2 0 0 1 c a 0 8 8 2 @ 2 0 s l l l l s i b d d d b 6 e d d d d t n n e e e n 1 i a x y a a y e c c x e 0 # # 0 0 0 0 0 0 x 0 0 x x x x x x d x x 1 2 f 0 0 e c 1 0 a 0 7 8 8 e 0 2 0 d f 1 1 d 4 0 7 a , , y y ; ; ; ; ; ; ; ; ; ; ; ; s l l l l s i b d d d b e o o o o t n r e e e r t a a a a o c a c c c a d d d d r r n r r r n i e e c e e e c n a i i a m h m m m h t c n n c a e e e e e c d d c c n o n n n o r u e e u c t n t t t n r m x x m u u u u m i r m m i r p l x y l u n e e e n e t a a l d s m m d s t w w t a e u o o e u d o i i o t x l r r x l i r t t r o t y y t s h h r y x a w w n b b n b i m m i i b o y y b o l t e e t n y t y t e h m m h o o o o m o z n n o z s m r r m e n e e e n e t e y y e m e r e r a m m o o o t o o r u r r y s y y For more disassembling options just type p?