-------------Nouns/Pronouns------------
A 4am crack                  2015-06-01
---------------------------------------

Name: Nouns/Pronouns
Version: 02.14.86
Genre: educational
Year: 1986
Publisher: Hartley Courseware, Inc.
Media: two single-sided 5.25-inch disks
OS: Diversi-DOS (T02,S02 has the string
  "C1983 DSR" backwards)
Identical cracks: Reading for Meaning
  Level 2 (4am crack no. 154), other
  Hartley Courseware titles

Both disks are bootable and appear to
be independent of each other.

                   ~

               Chapter 0
 In Which Various Automated Tools Fail
          In Interesting Ways


COPYA
  immediate disk read error

Locksmith Fast Disk Backup
  unable to read any track

EDD 4 bit copy (no sync, no count)
  works

Copy ][+ nibble editor
  modified address and data epilogues
  ("DA AA EB" instead of "DE AA EB")

Disk Fixer
  ["O" -> "Input/Output Control"]
    set Address Epilogue to "DA AA EB"
    set Data Epilogue to "DA AA EB"
  all tracks readable
  T00 -> looks like a DOS 3.3 RWTS
  T11 -> DOS 3.3 disk catalog
  T01,S09 -> startup program is "HELLO"

Why didn't COPYA work?
  modified epilogue bytes (every track)

Why didn't Locksmith FDB work?
  modified epilogue bytes (every track)

EDD worked. What does that tell us?
  no half or quarter tracks
  just structural protection, no nibble
    check

Next steps:

  1. capture RWTS with AUTOTRACE
  2. convert disk to standard format
     with Advanced Demuffin
  3. patch RWTS to read standard format

                   ~

               Chapter 1
In Which We Attempt To Use The Original
    Disk As A Weapon Against Itself


[S6,D1=original disk]
[S6,D2=blank disk]
[S5,D1=my work disk]

]PR#5
CAPTURING BOOT0
...reboots slot 6...
...reboots slot 5...
SAVING BOOT0
CAPTURING BOOT1
...reboots slot 6...
...reboots slot 5...
SAVING BOOT1
SAVING RWTS

]BRUN ADVANCED DEMUFFIN 1.5

["5" to switch to slot 5]

["R" to load a new RWTS module]
  --> At $B8, load "RWTS" from drive 1

["6" to switch to slot 6]

["C" to convert disk]

                 --v--

ADVANCED DEMUFFIN 1.5    (C) 1983, 2014
ORIGINAL BY THE STACK    UPDATES BY 4AM
=======PRESS ANY KEY TO CONTINUE=======
TRK:...................................
+.5:
    0123456789ABCDEF0123456789ABCDEF012
SC0:...................................
SC1:...................................
SC2:...................................
SC3:...................................
SC4:...................................
SC5:...................................
SC6:...................................
SC7:...................................
SC8:...................................
SC9:...................................
SCA:...................................
SCB:...................................
SCC:...................................
SCD:...................................
SCE:...................................
SCF:...................................
=======================================
16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2

                 --^--

]PR#5
]CATALOG,S6,D2

C1983 DSR^C#254
098 FREE

*A 003 HELLO
*A 014 CREDITS
*A 044 SK3
*A 046 CREATE LESSON
*A 029 STU PLAN
*A 016 PWL
*B 002 IR
*B 004 HRBX
*B 003 GARBAG
*B 003 SMILES
*B 009 LGCHRS
*B 007 SMALL CHARS
 T 061 STU.FILE
*T 002 LESSONS.FILE
*T 001

           COPYRIGHT (C) 1985
*T 001   HARTLEY COURSEWARE INC.
*T 001     ALL RIGHTS RESERVED

 T 017 ID3
 T 018 ID4
 T 020 ID5
 T 017 PL3
 T 018 PL4
 T 014 PL5
 T 015 PS3
 T 015 PS4
 T 018 PS5

]RUN HELLO
...works...

[S6,D1=demuffin'd copy]

]PR#6
...grinds...

My copy can't read itself yet. This is
not unusual.

                   ~

               Chapter 2
 In Which We Remove All Traces Of Copy
Protection Using An Automated Tool That
   I Wrote For Just Such An Occasion
      And Then It Crashes Anyway


[S6,D1=demuffin'd copy]
[S5,D1=my work disk]

]PR#5
]BRUN PDP

T00,S03,$91 change DA to DE
T00,S03,$35 change DA to DE
T00,S02,$9E change DA to DE

]PR#6
...crashes at $9D86...

Wait, what?

After minutes of furious investigation,
I hit upon the source of the problem:
the disk volume number. The original
disk uses disk volume 001, but the
process of converting it with Advanced
Demuffin gives me a (non-working) copy
with disk volume 254. (This is encoded
in every sector's address field.)

Why is this a problem?  Well, besides
appearing in every sector's address
field, the volume number is stored in
four different places when a disk is
initialized:

1. $B7EB (T00,S01,$EB), in the RWTS
   parameter table used by boot1 to
   load DOS from tracks 0-2 ["Beneath
   Apple DOS", p. 8-35]

2. $B7F6 (T00,S01,$F6), also in the
   RWTS parameter table, as the "last
   found" disk volume

3. $AA66 (T01,S09,$66), in the parsed
   keyword table used by DOS to load
   the startup program (and every other
   file loaded after that) [ibid.,
   p. 8-21]

4. $B3C1 (T11,S00,$06), in the VTOC
   header [ibid., p. 8-32]

My (non-working) copy has a $01 in each
of those locations. Since this doesn't
match the actual disk volume number in
the address fields, every sector read
fails and DOS never loads. (Why did it
work when I booted from my work disk?
Because that loaded DOS from a separate
disk that was already disk volume 254,
thus matching up with the actual disk
volume number in my non-working copy's
address fields.)

Using my trusty Disk Fixer sector
editor, I changed each of the
aforementioned locations to $FE.

T00,S01,$EB change 01 to FE
T00,S01,$F6 change 01 to FE
T01,S09,$66 change 01 to FE
T11,S06,$06 change 01 to FE

Success! My copy finally boots and runs
on its own. There doesn't appear to be
any further copy protection.

(Note to self: add this to a future
version of Post-Demuffin Patcher.)

Disk 2 has identical protection.

Quod erat liberandum.

---------------------------------------
A 4am crack                     No. 323
------------------EOF------------------