------------Quest Intro Disk-----------
A 4am crack                  2016-03-01
---------------------------------------

Name: Quest: Primary Voice Software
  Intro Disk
Genre: demo
Year: 1986
Credits:
  Programmed by Daniel D. Neilson
  Artwork by Triska Paul
  Designed by Sandra Bauer M.Ed. and
    Carol Pheeters M.Ed.
Publisher: Prescription Learning
Media: 1 double-sided 5.25-inch disk
OS: Pronto-DOS
Previous cracks: none
Identical cracks:
  #354 Comprehension
  #349 Subtraction
  #348 Addition
  #340 Multiplication

This program is primarily for users of
the Ufonic speech card, but the program
boots (with an error) and continues if
it doesn't detect the card.

Only side A is bootable. Well, I guess
side B is, too, but it immediately says
"THIS SIDE CANNOT BE BOOTED" and waits
for a key, then reboots. Which is to
say, it can be booted, but you probably
didn't mean to boot the side that does
nothing but lie to you. Unless you're
into that sort of thing. I don't judge.

I'll start with side A.

                   ~

               Chapter 0
 In Which Various Automated Tools Fail
          In Interesting Ways


COPYA
  immediate disk read error

Locksmith Fast Disk Backup
  reads everything except T00,S00

EDD 4 bit copy (no sync, no count)
  works

Copy ][+ nibble editor
  T00,S00 uses data epilogue "ED AA EB"
  everything else is normal

Disk Fixer
  ["O" -> "Input/Output Control"]
    set Data Epilogue to "ED AA EB"
  Success! T00,S00 readable!
  looks like DOS 3.3 bootloader
  T01,S07 -> startup program is "HELLO"
  T11 -> standard DOS 3.3 disk catalog

Why didn't COPYA work?
  modified data epilogue on T00,S00

Why didn't Locksmith FDB work?
  ditto

Next steps:

  1. Copy T00,S00 manually with a
     sector editor
  2. Maybe nothing? (EDD bit copy works
     so probably no nibble check)

                   ~

               Chapter 1
 In Which We Find The Least We Can Do


[S6,D1=original disk (side A)]
[S6,D2=partial Locksmith FDB copy]

[Disk Fixer]
  ["O" -> "Input/Output Control"]
    set "CHECKSUM ENABLED" to "NO"
  ["R"ead track $00, sector $00]
  ["C"opy sector to drive 2]

[S6,D1=Locksmith FDB copy]

]PR#6
...works...

The same procedure works for side B.

I almost didn't write this up, but I
just love this protection scheme. They
changed one epilogue byte on the one
sector where it's ignored anyway (since
it's read by the disk controller ROM
routine, which doesn't verify epilogue
bytes). This renders it uncopyable by
COPYA and other sector-based copiers,
and they didn't need to make any
changes to the rest of the disk. It's
literally the least they could do.

Quod erat liberandum.

---------------------------------------
A 4am crack                     No. 626
------------------EOF------------------