--------------Monkey Math--------------
A 4am crack                  2015-03-06
---------------------------------------

Name: Monkey Math
Genre: educational
Year: 1983
Authors: Dennis Zander, Roger Harnish
Publisher: Artworx
Media: single-sided 5.25-inch floppy
OS: DOS 3.3
Other versions: none (preserved here
  for the first time)

                   ~

               Chapter 0
 In Which Various Automated Tools Fail
          In Interesting Ways


COPYA
  immediate disk read error

Locksmith Fast Disk Backup
  unable to read any track

EDD 4 bit copy (no sync, no count)
  works

Copy ][+ nibble editor
  modified addres epilogue (DF AA EB)
  
Disk Fixer
  ["O" -> "Input/Output Control"]
    set Address Epilogue to "DF AA EB"
  all tracks readable
  T00 -> looks like a DOS 3.3 RWTS
  T11 -> DOS 3.3 disk catalog
  T01,S09 -> startup program is ARTWORX

Why didn't COPYA work?
  modified epilogue bytes (every track)

Why didn't Locksmith FDB work?
  modified epilogue bytes (every track)

Next steps:

  1. capture RWTS with AUTOTRACE
  2. convert disk to standard format
     with Advanced Demuffin
  3. patch RWTS to read standard format

                   ~

               Chapter 1
In Which We Attempt To Use The Original
    Disk As A Weapon Against Itself


[S6,D1=original disk]
[S6,D2=blank disk]
[S5,D1=my work disk]

]PR#5
CAPTURING BOOT0
...reboots slot 6...
...reboots slot 5...
SAVING BOOT0
CAPTURING BOOT1
...reboots slot 6...
...reboots slot 5...
SAVING BOOT1
SAVING RWTS

]BRUN ADVANCED DEMUFFIN 1.5

["5" to switch to slot 5]

["R" to load a new RWTS module]
  --> At $B8, load "RWTS" from drive 1

["6" to switch to slot 6]

["C" to convert disk]

                 --v--

ADVANCED DEMUFFIN 1.5    (C) 1983, 2014
ORIGINAL BY THE STACK    UPDATES BY 4AM
=======PRESS ANY KEY TO CONTINUE=======
TRK:...................................
+.5:
    0123456789ABCDEF0123456789ABCDEF012
SC0:...................................
SC1:...................................
SC2:...................................
SC3:...................................
SC4:...................................
SC5:...................................
SC6:...................................
SC7:...................................
SC8:...................................
SC9:...................................
SCA:...................................
SCB:...................................
SCC:...................................
SCD:...................................
SCE:...................................
SCF:...................................
=======================================
16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2

                 --^--

]PR#5
]CATALOG,S6,D2

C1983 DSR^C#254
340 FREE

 A 003 ARTWORX
 A 051 MATH
 B 034 MALE FACE
 B 034 BLANK
 B 002 WHISTLE
 B 002 SD2
 B 019 GRA
 B 007 BIN
 B 002 WH2
 B 002 ZEE

]RUN ARTWORX
...works...

[S6,D1=demuffin'd copy]

]PR#6
...grinds...

                   ~

               Chapter 2
 In Which We Remove All Traces Of Copy
Protection Using An Automated Tool That
   I Wrote For Just Such An Occasion


[S6,D1=demuffin'd copy]
[S5,D1=my work disk]

]PR#5
]BRUN PDP

T00,S03,$91 change DF to DE

(Just an RWTS fix. There doesn't appear
to be any secondary protection.)

Quod erat liberandum.

---------------------------------------
A 4am crack                     No. 245
------------------EOF------------------