----------------Decimals--------------- A 4am crack 2014-08-20 --------------------------------------- "Decimals" is a 1982 educational program distributed by Edu-Ware, Inc. The main menu says "Ver 3.0 04-01-82". COPYA fails immediately and miserably. 4 bit copy gives no errors, and the copy works, which suggests that this disk may not use any secondary protection beyond the non-standard disk structure. (I have seem some weaker nibble checks that can be defeated with a strong bit copier, so you never know until you try.) Turning to my trusty Copy ][+ sector editor, I press "P" to get to the Sector Editor Patcher, and select "DOS 3.3 PATCHED". This option ignores checksum bytes and epilogue sequences. As long as the address and data prologue are standard ("D5 AA 96" and "D5 AA AD", respectively), this will allow me to read each sector. And lo and behold, it works! I can read the data from every sector on every track. The Copy ][+ nibble editor also shows standard address and data prologues, but a non-standard address epilogue of "DA AA CF" (instead of "DE AA EB") and a non-standard data epilogue of "DA AA EB" (instead of "DE AA EB"). --v-- COPY ][ PLUS BIT COPY PROGRAM 8.4 (C) 1982-9 CENTRAL POINT SOFTWARE, INC. --------------------------------------- TRACK: 01 START: 2AA1 LENGTH: 015F 2A80: FF FF FF FF FF FF FF FF VIEW 2A88: FF FF FF FF FF FF FF FF 2A90: FF FF 9F E7 F9 FE FF FF 2A98: FF FF FF FF FF FF FF FF 2AA0: FF D5 AA 96 FF FE AA AB <-2AA1 ^^^^^^^^ address prologue 2AA8: AA AA FF FF DA AA CF F3 ^^^^^^^^ non-standard address epilogue 2AB0: FC FF FF FF FF FF FF FF 2AB8: FF D5 AA AD F2 FA D7 D7 ^^^^^^^^ data prologue 2AC0: A6 BE FE F7 FB EC 97 B9 --------------------------------------- A TO ANALYZE DATA ESC TO QUIT ? FOR HELP SCREEN / CHANGE PARMS Q FOR NEXT TRACK SPACE TO RE-READ --^-- Some quick inspection suggests that all tracks on the disk use the same non- standard epilogue sequences. Given the (relatively) weak structural protection, I used to turn to the DOS 3.3 master disk, patch the RWTS to ignore checksums and epilogue bytes (changing $B942 from "SEC" to "CLC"), and run COPYA. Then, one fine day, and completely by accident, I came across an original disk with a bad sector. I suppose this shouldn't surprise me. These floppies are decades old by now; it's amazing any of them work at all. The point is, I shouldn't be using tools that ignore potentially serious read errors. So, no more COPYA+B942:18 patch. From now on, it's Super Demuffin or Advanced Demuffin to convert disks to a standard format. Given that this disk is self-booting, I should be able to use my AUTOTRACE program to extract the RWTS from the original disk, then load that into Advanced Demuffin to convert it to a standard format. [S6,D1=original disk] [S6,D2=blank disk] [S5,D1=my work disk] ]PR#6 ]BRUN ADVANCED DEMUFFIN 1.1 --> EXIT TO MONITOR *F1F:50 ; use slot 5 *800G ; resume --> LOAD NEW RWTS MODULE At $B8, load "RWTS" from drive 1 --> EXIT TO MONITOR *F1F:60 ; use slot 6 *800G ; resume --> FORMAT TARGET DISK ...grind grind grind... --> CONVERT DISK This disk is 16 sectors, and the default options (copy the entire disk, all tracks, all sectors) don't need to be changed. --v-- ADVANCED DEMUFFIN 1.1 - COPYRIGHT 1983 WRITTEN BY THE STACK -CORRUPT COMPUTING =======PRESS ANY KEY TO CONTINUE======= TRK:................................... +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0:................................... SC1:................................... SC2:................................... SC3:................................... SC4:................................... SC5:................................... SC6:................................... SC7:................................... SC8:................................... SC9:................................... SCA:................................... SCB:................................... SCC:................................... SCD:................................... SCE:................................... SCF:................................... ======================================= 16 SC $00,$00 TO $22,$0F BY $01 TO DRV2 --^-- The disk's own RWTS gave no read errors on any track. This is the power and the genius of Advanced Demuffin. Every disk must be able to read itself. So, let it read itself, then capture the data and write it out in a standard format. Depending on how the original RWTS was written, a demuffin'd disk may not be able to read itself. Some developers just patch the RWTS to ignore epilogue bytes, while others patch the RWTS to look for specific non-standard epilogue bytes. Demuffin'd disks in the latter category will grind immediately on boot, since as soon as the RWTS is loaded, all further disk reads will look for the original (non-standard) epilogue bytes and not find them. Booting the demuffin'd copy confirms that this disk is in the latter category: it grinds almost immediately on boot, unable to read itself. For future reference (mostly mine), here's a nice chart of the memory locations for all the prologues and epilogues in a DOS 3.3-shaped RWTS. If the RWTS stores $B700 in T00,S01 (most do), then $B8xx will be in T00,S02; $B9xx in T00,S03; and so on. 0x | read | write ---------------+-------+------- D5 | $B955 | $BC7A prologue AA | $B95F | $BC7F / 96 | $B96A | $BC84 ADDRESS -------+-------+------- \ DE | $B991 | $BCAE epilogue AA | $B99B | $BCB3 EB | | $BCB8 ---------------+-------+------- D5 | $B8E7 | $B853 prologue AA | $B8F1 | $B858 / AD | $B8FC | $B85D DATA ----------+-------+------- \ DE | $B935 | $B89E epilogue AA | $B93F | $B8A3 EB | | $B8A8 ---------------+-------+------- I spent way too much time making that. Anyway, here are the three patches that allow my copy to read itself. T00,S02,$9E change "DA" to "DE" T00,S03,$35 change "DA" to "DE" T00,S03,$91 change "DA" to "DE" (The third byte of the address epilogue is never checked, so the fact that it was non-standard doesn't actually matter.) Success! The disk boots and loads with no complaint. There doesn't appear to be any secondary protection. Quod erat liberandum. --------------------------------------- A 4am crack No. 118 ------------------EOF------------------