Lesson #2

Print "enter your name"
Input a$
Print "hello",a$

1. It output "enter your name"
2. Then it checks the keyboard to see if any key has been pressed. If a key has been pressed that letter is stored in a predefined place in memory (a$). It will keep checking the keyboard until return has been pressed, that indicates the end of the string. when return has been pressed it puts a "0" at the end of the string (a$) in memory.
3. Then it outputs "hello" and reads the letters (a$) stored in memory. It will read the memory until it reached a zero which indicates the end of the string. Then it will output the letters to the screen after hello.

0000 = 0*2^0+0*2^1+0*2^2+0*0^3+0*2^4=0
0001 = 1*2^0 = 1*1=1
0010 = 1*2^1 = 1*2=2
0100 = 1*2^2 = 1*4=4
1000 = 1*2^3 = 1*80011 = 1*2^0+1*2^1 =1*1+1*2 = 3
1010 = 1*2^1+1*2^3 1*2+1*8=10

MSB					LSB
 15					0
|----------------------------------------|
|	       A X			 | AX is 16 bit register, AL and AH 
|	AH	|	AL		 | is 8 bit registers. Same goes for
|----------------------------------------| BX BH Bl, CX CH CL, DX DH DL.
|	       B X			 |
|	BH	|	BL		 | These registers are called common 
|----------------------------------------| registers, I call them that.
|	       C X			 |
|	CH	|	CL		 |
|----------------------------------------|
|	       D X			 |
|	DH	|	DL		 |
|----------------------------------------|
|		SI			 | SI and DI are string registers
|________________________________________| used for copying and comparing
|		DI			 | strings ie password protections
|________________________________________|
|		SP			 |
|________________________________________| SP and BP are stack registers
|		BP			 | I'll get to the stack later
|________________________________________|
|		CS			 | CS, DS, ES and SS are SEGMENT
|________________________________________| registers.
|		DS			 | 
|________________________________________| 
|		ES			 | 
|________________________________________|
|		SS			 | 
|________________________________________|

|----------------------------------------|
|		IP			 | Instruction Pointer
|________________________________________|
|					 |
|	O D I T S Z  A  P  C   		 |Flags
------------------------------------------

		
	          segment	     Offset (IP)
			 \         /
			  013F:0012

CS	Code segment this is the segment that keeps the actual code
DS	Data segment this is the segment that holds variabled and strings etc
ES	is the same as DS and is used when ie comparing to strings
SS	is the stack segment.

MOV	Move ie MOV AX,0011 Loads AX with 0011
MOVSB 	Moves a byte of string source is put in DS:SI destination adress is
 	put in 	ES:DI.
MOVSW	Same as above but moves a whole word instead of a byte
DEC	decreases a register with 1 ie if AX is 0004 the DEC AX will decrease
 	ax so AX will be 0003. (common for decreasing the life varaiable in
         games)
INC	Increases a register with 1
CALL	call a subroutin (a small part of code in a program)
CLD	clears the D flag
CMP     Compare ie CMP AL,61 checks if AL is 61 (the letter 'a' in ascii)
CMPSB   compare a byte in two strings. Source string is put in DS:SI and 	destination adress is put in ES:DI.
CMPSW	Same as above but compares a word instead of a byte.
DIV	Divide ie DIV AX,0012 divides ax with 0012
MUL	Multiply 
INT   	Interrupt executes an interrupt ie int 21 executes interrupt 21
PUSH	Pushes a value to the stack
POP 	Returns a value from the stack
NOP	No operation doesn't do anything
REP     Repeats instruction until CX=0
REPE	Repeat while equal ie REPE CMPSB comapres each byte in a string as 	long as they are equal.
REPZ	Repeat while zero flag i 0 (off)
RET	Return from subroutine
SCASB	Scan a string for a specific byte that is put in AL. The adress 	of the string to be scanned is put in ES:DI
STOSB	Stores the byte in AL at ES:DI, DI is automatically increased.
STOSW	The same as above but it stores a word instead of a byte.
TEST	A logical comparsion with flag settings. You can see it as a cmp for 	now. 
XOR	Exlusive OR. See below:

	1001
	1100
result	0101	conclusion, XOR allows only on of two sums to be 1 if the 		result is gona be 1. XOR 1,1 will give 0. XOR 0,0 will give 0
		XOR 1,0 will give 1. This instruction is used to zero a 		register ie XOR AX,AX. Lets say AX=1001

		XOR	1001
			1001
		Result  0000			


JZ	Jump if zero
JNZ	Jump if not zero
JE	Jump if equal
JMP	Jump anyway

Function		AH#	IN DATA
Output to screen	02	DL=chars

MOV	AH,02	; Put the service number in AH
MOV	DL,41	; ASCII number for 'A' in hex
INT	21	; Execute interrupt

--------------------
DOSSEG			; WE ARE USING DOS SEGMENT
.MODEL SMALL		; DEFINES HOW MUCH MEMORY OUR PROGRAM NEEDS
.STACK 100h		; RESERVES 100h BYTES FOR THE STACK
.DATA			; UNDER THIS WE WILL PUT OUR VARIABLES
HELLOMESSAGE	DB 'HELLO WORLD',13,10
.CODE			; THIS IS WHERE OUR PROGRAM STARTS
MOV	AX,@DATA	; PUT THE ADRESS TO THE DATA IN AX
MOV	DS,AX		; AND THEN MOVE IT TO DS
MOV	AH,9		; DOS OUTPUT FUNCTION
MOV 	DX, OFFSET HELLOMESSAGE	; PUT THE OFFSET TO HELLOMESSAGE IN 					; DX	

INT 21			; PRINT THE MESSAGE ON THE SCREEN
MOV AH,4C		; INT 21 FUNCTION TO QUIT AND EXIT TO DOS
INT 21			; AND EXECUTE IT
END			; END THE PROGRAM

Input from keyboard	
with echo to screen	01	AL contains the chars after the int has been
                                executed
Output to screen	02	DL=chars
Show string		09	DS:DX shall point to the string DS should
                                point to the segment adress and DX to the
                                offset adress
Create file		3C	CX=attributes DS:DX pointer to ascii string
                                (name of the file). Returns AX=filehandle or
                                return code
Open file		3D	AL=access and sharing modes DS:DX > Ascii
                                string. Returns AX=filehandle
Read file		3F	BX=filehandle, DS:DX > Ascii string. Returns
                                AX=read bytes or return code
Write to file		40	BX=filehandle, CX=# of bytes to write, DS:DX
                                > ascii string. Returns AX=bytes written or
                                return code


Filehandle:

0 = In device normally the keyboard
1 = Output device uaslly the screen
2 = Error message usually screen
3 = serial, COM 1
4 = paralell LPT1

----------------------
dosseg
.model small
.stack	200h
.data
password db 'fender','$'	; The strings and data we will use
login    db 100  dup (0)
rig     db 'correct','$'
.code
mov     ax,@data
mov     ds,ax
mov     ah,3fh			; Read function from service 21
mov     bx,0			; File handle 0 = keyboard
mov     cx,3			; just check the 3 first letter
mov     dx,offset login		; Offset adress in DX
int 21h
and     ax,ax			; See if anything was typed
jz      fin			; No? so end
mov	cx,ax			; Move read bytes in CX

mov     ax,seg login		; Put segment adress in AX
mov     es,ax			; So we can put it in ES
mov	ax,seg password		; Same here but another strings segment
mov	ds,ax			; And we store it in DS
mov	di,offset login		; Do the same for offset adress for
mov	si,offset password	; Both strings
repe cmpsb   password,login	; Compare them
Je      equals			; Equal the go to Equal

fin:				; End program function
mov     ah,4ch
int 21h


equals:				; Subroutine for strings equal
mov     dx,offset rig
mov     ah,9
int 21h
ret
end

Now I suggest you either buy a book on this subject or search the net for some more information about assembly language. Remeber that experimenting is important.

It's extremly important that you dont use SOFTICE 2.8. Alright have you
installed it. Then load it into your config.sys. When dos has loaded press ctrl-D
and you're in. Great isn't it. What is it?

Softice is a debugger that can be used to see what a program is doing.
For example if load one of the programs that we wrote in the assembly tutorial
you will see the code as it executes. That's why we use a debugger to make
cheats and cracks. The only thing that is difficult is to FIND the code we
are seeking. If we wanna change the # of lives in a game we have to find
exactly where the lives are stored. Once we find that place we can add that value.
This is what we'll do at the end of this lesson.

OK here is what you should see in softice.

The registers at the top. The Data window and the Code window.
At the bottom you enter your commands. Read the Whole softice manual before
proceeding.
Read it? Great!

What we will do now is to change the first program that we wrote. The one that
printed 'hello world' on the screen. You should if you have read the manual
you should know all about breakpoints and how you change code in memory etc

here's what we'll do.

1 Load the program into softice 

  LDR Hello.exe

2 Have a look at the code that follows you should recognize it.

3 Put a breakpoint on interrupt 21, write to file or device

  BPINT 21 AH=40

4 Let the program execute, (it will stop when instruction int 21 AH=40 comes
up)

5 Lets see whats in DS:DX

  D DS:DX and look at the data window there is our 'hello world' string.

6  Now lets change that.
   
   E 
   Now your in the data window and you are able to change the string to
   whatever you want. Try and see. When you're done changing the string just
   hit enter and you'll see that the program prints your changed string instead
   of 'hello world' that it was supposed to do. Great huh!


Try to debug other program and change their output, you'll learn alot by doing
that. Cracking is also something that is both funny and educational.

I promised a cheat for a real game didn't I.

Aquanoid is a breakout game which is available free on the net (happy puppy,
download.com etc). We will change the number of lives that the programmer
gave us to something that we think is more suitable :).

Ldr the aqua.exe

Now lets think!
Everytime we miss the ball the lives decreases. We just need to find where the
# of lives is stored. How? Beats me.

	THE END

No just kidding, the summer is affecting me in some strange way. Where were we,
yeah right we are looking for a place in memory that changes everytime we miss
the ball. And it should only change by decreasing or increasing by 1.

Here's what to do.

Snap_save the whole DS block. Snap takes a snapshot of that register so you
can compare it later and see what has been changed. Play the game until the
ball is going off screen (when you just missed it). Switch to Softice and do a
snap_save of DS register:

Snap s ds:0 ds:ffff

Now switch back (ctrl-d) and loose one life. When the you've lost a life switch
back to softice and do a snap_compare:

Snap C

A row of numbers will now display all the changes. Since you had 6 lives from
the start you will have 5 after you died. The lives can change in two ways it
can either start from 0 or 1 and increase until it reaches 5 or 6, or it could
start from 6 and decrease down to 1 or from 5 to 0 which is most likely.
Look for these changes. If you find a place that changes from 6 to 5 write
the adress down. Remeber that after the adress is the old value and after that
is the new value so this is what you are looking for:

xxxx:xxxx 05 04
xxxx:xxxx 06 05


Now theres alot of values changes in every second thats why you wanna snap_save
the DS register just before you die (in the game that is). Hey look there's a
change from 06 to 05. Write that adress down and keep looking. Keep scrolling
through the list, Yeah I know it takes 1-3 minutes but thats alright i think.
This is the funny part where you try to locate the code setting up diffrent traps
that you can think of. In this case we used the command snap_save. In another
case we might use a breakpoint.

As you can see there was only one change from 06 to 05. Remeber when i told you
that the segment adress a program was given was depending on the amount of available
memory and what programs that are loaded (memory config.). Therefor my segment
adresses will not be the same as your segments.
So the adress is:

CS:0004

Lets view that adress while we keep losing lives.

D cs:0004

As you can see it decreases every time we lose a life. Lets change the value
on that adress.

E cs:0004       change it to whatever you fancy ie 11h=17 lives.

Keep on playing the game and notice how many lives you have, nothing
happens the first 11 times you loose, but then it ticks down. Lets find the
decreaser.

BPM CS:0004 W

The W means Write only. The program will stop when something is written at
cs:0004. Loose another life and BANG!! you're in softice again facing the code
that decreases the number of lives. The instruction looks like this:

CS:39A9	FF8C44AC	DEC WORD PTR [SI+AC44],+00

Replace that with a NOP.

A CS:39A9

  CS:39A9 NOP

Play some and you'll see that the number of lives is always the same and is
not decreasing anymore. Great HUH.

OK lets make this cheat a permanent one. See the letters and number before the
instruction (mnemonics) the instructions we changed was:

FF8C44AC	DEC WORD PTR [SI+AC44],+00.

we replaced it with NOP. Lets search using our hex editor the string
FF8C44AC, two hits lets just change the first. Replace the FF 8C with 90 90
(90 is NOP in machine code). Save the file and wow it works we made a cheat.
Feels good doesn't it. Well that's about it for now.  See you in lesson #3.
 
All opinions on my work are welecomed. Please feel free to ask questions at
my E-mail indian_trail@hotmail.com

Indian_Trail