--------------Bannercatch-------------- A 4am crack 2015-12-08 --------------------------------------- Name: Bannercatch Genre: educational Year: 1984 Credits: - by Tom Snyder, Steven Fried - music: Tom Snyder, Chris Lutes - graphics: Steven Fried, Peter Reynolds - Apple conversion: Bucko Balaska, Andrew C. Frank - Apple graphics: Ann Phelan, Stu Ross Publisher: Scholastic, Inc. Media: single-sided 5.25-inch floppy OS: Pronto-DOS (although T02,S00 has the string "SCHOLASTIC" where "PRONTO-DOS" should be) Previous cracks: The Artist Identical cracks: #167 Quations #192 Magical Myths #196 Moptown Hotel 1.2 #217 The Perfect Score #301 Alice in Wonderland #321 Gertrude's Puzzles 1.2 #322 Bumble Plot 1.2 #325 Fraction Action #337 The Adventures of Sinbad #363 Moptown Hotel 1.3 #378 Bank Street Storybook #428 Microzine 16 ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA immediate disk read error Locksmith Fast Disk Backup unable to read any track EDD 4 bit copy (no sync, no count) no errors, but copy fills screen with garbage and reboots Copy ][+ nibble editor all tracks use standard prologues (address: D5 AA 96, data: D5 AA AD) but modified epilogues (address: FF FF EB, data: FF FF EB) Disk Fixer ["O" -> "Input/Output Control"] set Address Epilogue to "FF FF EB" set Data Epilogue to "FF FF EB" Success! All tracks readable! T00 -> looks like a DOS 3.3 RWTS T11 -> DOS 3.3 disk catalog T01,S07 -> startup program is "BANNERCATCH 11/08" Why didn't COPYA work? modified epilogue bytes (every track) Why didn't Locksmith FDB work? modified epilogue bytes (every track) Why didn't my EDD copy work? probably a nibble check during boot Next steps: 1. AUTOTRACE to capture RWTS 2. Advanced Demuffin to convert disk to standard format 3. Patch RWTS (if necessary) 4. Find nibble check and bypass it ~ Chapter 1 In Which We Attempt To Use The Original Disk As A Weapon Against Itself [S6,D1=original disk] [S6,D2=blank disk] [S5,D1=my work disk] ]PR#5 CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 /!\ BOOT0 JUMPS TO $08C0 CAPTURING BOOT1 ...reboots slot 6... ...reboots slot 5... SAVING BOOT1 SAVING RWTS /!\ NIBBLE CHECK AT $BB00 ]BRUN ADVANCED DEMUFFIN 1.5 ["5" to switch to slot 5] ["R" to load a new RWTS module] --> At $B8, load "RWTS" from drive 1 ["6" to switch to slot 6] ["C" to convert disk] --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK:................................... +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0:................................... SC1:................................... SC2:................................... SC3:................................... SC4:................................... SC5:................................... SC6:................................... SC7:................................... SC8:................................... SC9:................................... SCA:................................... SCB:................................... SCC:................................... SCD:................................... SCE:................................... SCF:................................... ======================================= 16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- ]PR#5 ]CATALOG,S6,D2 C1983 DSR^C#254 244 FREE A 002 BANNERCATCH 11/08 B 006 BC.CRED1 B 006 BC.CRED2 B 006 BC.CRED3 B 033 BC.FACE B 004 BC.HI B 033 BC.LOGO B 006 BC.LOW B 049 BC.OB1 B 023 BC.OB2 B 033 BC.SCH B 017 DSP0 B 015 DSP1 B 019 DSP2 [S6,D1=demuffin'd copy] ]PR#6 ...fills screen with garbage, reboots endlessly... Let's go find that nibble check. ~ Chapter 2 In Which We Run Into An Old Friend ]PR#5 ]BLOAD BOOT0,A$800 ]CALL -151 *801L . . all normal until... . 084A- 4C C0 08 JMP $08C0 *8C0L 08C0- 8E E9 B7 STX $B7E9 08C3- 6C FD 08 JMP ($08FD) *BLOAD BOOT1,A$2600 *FE89G FE93G ; disconnect DOS *B600<2600.2FFFM ; move RWTS into place *B700L B700- 20 00 BB JSR $BB00 *BB00L BB00- A0 00 LDY #$00 BB02- B9 00 BB LDA $BB00,Y BB05- 99 00 02 STA $0200,Y BB08- 88 DEY BB09- D0 F7 BNE $2B02 BB0B- 60 RTS *20C