---Alfred's Basic Band Computer Tutor--
A 4am crack                  2015-06-15
---------------------------------------

Name: Alfred's Basic Band Computer
  Tutor
Version: "VER 5/6/85" (in disk catalog)
Genre: educational
Year: 1985
Authors: Sandy Feldstein, John O'Reilly
Publisher: Alfred Publishing Company
Media: two single-sided 5.25-inch disks
OS: DOS 3.3
Other versions: none (preserved here
  for the first time)
Identical cracks: Alfred's Basic Piano
  Theory Software (crack no. 102)

Disk 2 is a "preview" disk that has
a limited selection of lessons. Disk 1
is the full enchilada. I'll start with
disk 1.

                   ~

               Chapter 0
 In Which Various Automated Tools Fail
          In Interesting Ways


COPYA
  immediate disk read error

Locksmith Fast Disk Backup
  unable to read any track

EDD 4 bit copy (no sync, no count)
  works

Copy ][+ nibble editor
  all tracks use standard prologues
  (address: D5 AA 96, data: D5 AA AD)
  but modified epilogues
  (address: DE AD EB, data: DE AD EB)

Disk Fixer
  ["O" -> "Input/Output Control"]
    set Address Epilogue to "DE AD EB"
    set Data Epilogue to "DE AD EB"
  Success! All tracks readable!
  T00 -> looks like a DOS 3.3 RWTS
  T11 -> DOS 3.3 disk catalog
  T01,S09 -> startup program is "HELLO"

Why didn't COPYA work?
  modified epilogue bytes (every track)

Why didn't Locksmith FDB work?
  modified epilogue bytes (every track)

EDD worked. What does that tell us?
  no half or quarter tracks
  almost certainly no nibble check
  (just structural changes to epilogue)

Next steps:

  1. capture RWTS with AUTOTRACE
  2. convert disk to standard format
     with Advanced Demuffin
  3. find nibble check and bypass it

                   ~

               Chapter 1
In Which We Attempt To Use The Original
    Disk As A Weapon Against Itself


[S6,D1=original disk]
[S6,D2=blank disk]
[S5,D1=my work disk]

]PR#5
CAPTURING BOOT0
...reboots slot 6...
...reboots slot 5...
SAVING BOOT0
CAPTURING BOOT1
...reboots slot 6...
...reboots slot 5...
SAVING BOOT1
SAVING RWTS

]BRUN ADVANCED DEMUFFIN 1.5

["5" to switch to slot 5]

["R" to load a new RWTS module]
  --> At $B8, load "RWTS" from drive 1

["6" to switch to slot 6]

["C" to convert disk]

                 --v--

ADVANCED DEMUFFIN 1.5    (C) 1983, 2014
ORIGINAL BY THE STACK    UPDATES BY 4AM
=======PRESS ANY KEY TO CONTINUE=======
TRK:...................................
+.5:
    0123456789ABCDEF0123456789ABCDEF012
SC0:...................................
SC1:...................................
SC2:...................................
SC3:...................................
SC4:...................................
SC5:...................................
SC6:...................................
SC7:...................................
SC8:...................................
SC9:...................................
SCA:...................................
SCB:...................................
SCC:...................................
SCD:...................................
SCE:...................................
SCF:...................................
=======================================
16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2

                 --^--

]PR#5
...
]CATALOG,S6,D2

C1983 DSR^C#254
004 FREE

*A 008 HELLO
 T 002 DATA
 B 052 CEB
*A 020 PRACTICE
 B 005 SOUND.OBJ0
 B 002 SOUND.OBJ1
*A 033 STARTUP
*A 024 MISC
*A 019 MUSTHEORY
*A 037 TUNES
*A 018 ACCIDENTAL
*A 030 SLURS
*A 030 CLAP
*A 031 VALUES
*A 017 COUNT
*A 038 MELODY
*A 026 UNIT1
*A 046 ALONE
*A 034 RHYWRITE
*A 018 ARTY0
*A 002 VER 5/6/85

]RUN HELLO
...works...

[S6,D1=demuffin'd copy]

]PR#6
...grinds...

My copy can't read itself yet. This is
not unusual.

                   ~

               Chapter 2
 In Which We Remove All Traces Of Copy
Protection Using An Automated Tool That
   I Wrote For Just Such An Occasion


[S6,D1=demuffin'd copy]
[S5,D1=my work disk]

]PR#5
...
]BRUN PDP

; just RWTS fixes
T00,S03,$9B change AD to AA
T00,S03,$3F change AD to AA
T00,S06,$B3 change AD to AA
T00,S02,$A3 change AD to AA

]PR#6
...works...

Disk 2 has identical protection.

Quod erat liberandum.

---------------------------------------
A 4am crack                     No. 346
------------------EOF------------------