------------Alphabet Circus------------ A 4am crack 2015-05-26 --------------------------------------- Name: Alphabet Circus Genre: educational Year: 1984 Authors: Neosoft Publisher: Developmental Learning Materials (DLM) Media: single-sided 5.25-inch floppy OS: Pronto-DOS (T02,S00 contains the string "PRONTO-DOS" backwards) Other versions: none (preserved here for the first time) Similar cracks: Alien Addition (crack no. 277) ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA disk read error on first pass Locksmith Fast Disk Backup can't read anything past track $02 EDD 4 bit copy (no sync, no count) no errors during copying copy loads a few tracks then grinds and crashes Copy ][+ nibble editor T03+ -> modified address and data prologue ("D7 AA 96" / "D7 AA AD") and modified epilogues ("DF AA EB") Disk Fixer T00 -> looks like a DOS 3.3 RWTS T00-T02 -> looks like a full DOS T01,S07 -> startup program is "HELLO" ["O" -> "Input/Output Control"] set Address Prologue to "D7 AA 96" set Address Epilogue to "DF AA EB" set Data Prologue to "D7 AA AD" set Data Epilogue to "DF AA EB" T03+ readable! T11 -> DOS 3.3 disk catalog Why didn't COPYA work? modified prologue bytes (T03+) Why didn't Locksmith FDB work? ditto Why didn't my EDD copy work? probably a nibble check during boot Next steps: 1. capture RWTS with AUTOTRACE 2. convert disk to standard format with Advanced Demuffin 3. find nibble check and bypass it ~ Chapter 1 In Which Automated Tools Get Us Nowhere [S6,D1=original disk] [S6,D2=blank disk] [S5,D1=my work disk] ]PR#5 ... CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 CAPTURING BOOT1 ...reboots slot 6... ...reboots slot 5... SAVING BOOT1 SAVING RWTS ]BRUN ADVANCED DEMUFFIN 1.5 ["5" to switch to slot 5] ["R" to load a new RWTS module] --> At $B8, load "RWTS" from drive 1 ["6" to switch to slot 6] ["C" to convert disk] --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC1:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC2:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC3:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC4:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC5:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC6:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC7:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC8:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC9:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCA:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCB:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCC:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCD:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCE:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCF:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR ======================================= 16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- Well then. That was... not entirely successful. Not entirely unsuccessful, I suppose. But I need to dig deeper. ~ Chapter 2 In Which We Find Something Curious And Our Adventure Begins In Earnest ]PR#5 ... ]CALL -151 *9600 At $B8, load "RWTS 3+" from D1 ["6" to switch to slot 6] ["C" to convert disk] ["Y" to change default values] --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM ======================================= INPUT ALL VALUES IN HEX SECTORS PER TRACK? (13/16) 16 START TRACK: $03 <-- change this START SECTOR: $00 END TRACK: $22 END SECTOR: $0F INCREMENT: 1 MAX # OF RETRIES: 0 COPY FROM DRIVE 1 TO DRIVE: 2 ======================================= 16SC $03,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- And here we go... --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK: ................................ +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0: ................................ SC1: ................................ SC2: ................................ SC3: ................................ SC4: ................................ SC5: ................................ SC6: ................................ SC7: ................................ SC8: ................................ SC9: ................................ SCA: ................................ SCB: ................................ SCC: ................................ SCD: ................................ SCE: ................................ SCF: ................................ ======================================= 16SC $03,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- ]PR#5 ... ]CATALOG,S6,D2 C1983 DSR^C#254 028 FREE A 002 HELLO B 010 GRAPHICS B 006 PA B 033 PAGE1.1 B 006 PB B 006 PS B 006 PT B 006 PU B 006 PV B 006 PW B 006 PX B 006 PC B 006 PD B 006 PE B 006 PF B 033 PAGE1B B 006 PG B 006 PH B 006 PI B 006 PJ B 006 PK B 006 PL B 006 PM B 006 PN B 006 PO B 006 PP B 006 PQ B 006 PR B 006 PZ B 006 PY B 063 PIC.PLETRING B 019 PIC.PJUG *B 006 PIC.HAT/SEAL A 013 GAME.HELLO A 019 GAME.MARQUEE A 017 GAME.LOST A 022 GAME.WHO A 020 GAME.MEET A 020 GAME.SECRET A 016 GAME.JUGGLER A 015 GAME.SCOREBOARD B 003 SOUND TEST B 033 CIRCUS SELECT ]RUN HELLO ...works... [S6,D1=non-working copy] [S6,D2=newly formatted Pronto-DOS disk] [Copy ][+] --> COPY --> DOS --> from slot 6, drive 2 --> to slot 6, drive 1 ...read read read... ...write write write... Quod erat liberandum. --------------------------------------- A 4am crack No. 317 ------------------EOF------------------