-----------Division Made Easy----------
A 4am crack                  2015-09-08
---------------------------------------

Name: Division Made Easy
Genre: educational
Year: 1987
Authors: Janice C. Henke
Media: single-sided 5.25-inch floppy
OS: DOS 3.3
Previous cracks: none

                   ~

               Chapter 0
 In Which Various Automated Tools Fail
          In Interesting Ways


COPYA
  no errors, but copy does not work;
  it loads DOS from T00-T02, but before
  displaying the DOS prompt, the drive
  swings to a high track and hangs with
  the drive motor on

Locksmith Fast Disk Backup
  ditto

EDD 4 bit copy (no sync, no count)
  ditto

Copy ][+ nibble editor
  nothing suspicious

Disk Fixer
  T00 -> looks like DOS 3.3 boot0/boot1
  T00-T02 -> looks like full DOS 3.3
  T01,S09 -> startup program is "HELLO"
  T11 -> DOS 3.3 disk catalog

Why didn't any of my copies work?
  probably a nibble check during late
  boot

Next steps:

  1. Trace the boot
  2. ???

                   ~

               Chapter 1
     In Which Our Automated Tools
      Do Nothing Of Significance


[S6,D1=original disk]
[S5,D1=my work disk]

]PR#5
...
CAPTURING BOOT0
...reboots slot 6...
...reboots slot 5...
SAVING BOOT0
CAPTURING BOOT1
...reboots slot 6...
...reboots slot 5...
SAVING BOOT1
SAVING RWTS

]BLOAD BOOT1,A$2600
]CALL -151

*B600<2600.2EFMM
*B700L
.
. all normal until...
.
B747-   4C 00 B4    JMP   $B400

Hmm. That usually jumps to $9D84 to
cold start DOS. I don't have $B400 in
memory yet, but I really need to know
what's there.

*9600<C600.C6FFM

; set up callback #1 after boot0 loads
; boot1
96F8-   A9 4C       LDA   #$4C
96FA-   8D 4A 08    STA   $084A
96FD-   A9 0A       LDA   #$0A
96FF-   8D 4B 08    STA   $084B
9702-   A9 97       LDA   #$97
9704-   8D 4C 08    STA   $084C

; start the boot
9707-   4C 01 08    JMP   $0801

; callback #1 is here --
; set up callback #2 after boot1 loads
; boot2
970A-   A9 17       LDA   #$17
970C-   8D 48 B7    STA   $B748
970F-   A9 97       LDA   #$97
9711-   8D 49 B7    STA   $B749

; continue the boot
9714-   4C 00 B7    JMP   $B700

; callback #2 is here --
; $B400 (and the rest of DOS) is now in
; memory, so copy it to lower memory so
; it survives a reboot
9717-   A2 23       LDX   #$23
9719-   A0 00       LDY   #$00
971B-   B9 00 9D    LDA   $9D00,Y
971E-   99 00 1D    STA   $1D00,Y
9721-   C8          INY
9722-   D0 F7       BNE   $971B
9724-   EE 1D 97    INC   $971D
9727-   EE 20 97    INC   $9720
972A-   CA          DEX
972B-   D0 EE       BNE   $971B

; reboot to my work disk
972D-   4C 00 C5    JMP   $C500

*BSAVE TRACE,A$9600,L$130
*9600G
...reboots slot 6...
...reboots slot 5...

]BSAVE BOOT2,A$1D00,L$2300
]CALL -151

*9D00<1D00.3EFFM
*B400L

B400-   A0 00       LDY   #$00
B402-   B9 12 B4    LDA   $B412,Y
B405-   49 4C       EOR   #$4C
B407-   99 12 B4    STA   $B412,Y
B40A-   C8          INY
B40B-   C0 FF       CPY   #$FF
B40D-   D0 F3       BNE   $B402
B40F-   EA          NOP
B410-   EA          NOP
B411-   EA          NOP
B412-   E5 6F       SBC   $6F
B414-   C1 A0       CMP   ($A0,X)
B416-   FB          ???
B417-   E5 4C       SBC   $4C
B419-   C9 48       CMP   #$48

Oh look, self-decrypting code. As if
that's not suspicious. Luckily (for me)
there are several NOPs where I can
interrupt it.

*B40F:60
*B400G

Now let's see what was hiding there.

                   ~

               Chapter 2
  In Which We Peek Behind The Curtain


*B412L

; seek to track $23 (yes, $23)
B412-   A9 23       LDA   #$23
B414-   8D EC B7    STA   $B7EC

; $00 = seek command (in $B7F4 -- also
; initializing some zero page and
; setting the disk volume to wildcard
; "any volume")
B417-   A9 00       LDA   #$00
B419-   85 04       STA   $04
B41B-   8D F4 B7    STA   $B7F4
B41E-   8D EB B7    STA   $B7EB

; get address of RWTS parameter table
; and call RWTS (not shown)
B421-   20 EB B4    JSR   $B4EB
B424-   20 F2 B4    JSR   $B4F2
B427-   A9 00       LDA   #$00
B429-   85 48       STA   $48

; turn on drive motor manually
B42B-   BD 89 C0    LDA   $C089,X
B42E-   BD 8E C0    LDA   $C08E,X

; get next address field
B431-   20 44 B9    JSR   $B944

; check sector number
B434-   A5 2D       LDA   $2D

; is it the sector we're looking for?
B436-   C5 04       CMP   $04

; nope, loop back and try again
B438-   D0 F7       BNE   $B431

; reset data latch
B43A-   BD 8E C0    LDA   $C08E,X

; get an $FF nibble
B43D-   BD 8C C0    LDA   $C08C,X
B440-   10 FB       BPL   $B43D
B442-   C9 FF       CMP   #$FF
B444-   D0 F4       BNE   $B43A

; now count the number of nibbles
; before we get to a $D5 nibble (which
; is the start of the data prologue)
B446-   A0 00       LDY   #$00
B448-   C8          INY
B449-   BD 8E C0    LDA   $C08E,X
B44C-   BD 8C C0    LDA   $C08C,X
B44F-   10 FB       BPL   $B44C
B451-   C9 D5       CMP   #$D5
B453-   D0 F3       BNE   $B448

; if we have the wrong number of
; nibbles between the address epilogue
; and the next data prologue, loop back
; and try again (endlessly)
B455-   C0 07       CPY   #$07
B457-   D0 B9       BNE   $B412

; do the previous nibble count for each
; of the 16 sectors on track $23
B459-   E6 04       INC   $04
B45B-   A9 10       LDA   #$10
B45D-   C5 04       CMP   $04
B45F-   D0 D0       BNE   $B431

; reset sector count
B461-   A9 00       LDA   #$00
B463-   85 04       STA   $04

; reposition on sector $04 again
B465-   20 44 B9    JSR   $B944
B468-   A5 2D       LDA   $2D
B46A-   C5 04       CMP   $04
B46C-   D0 F7       BNE   $B465

; find tail end of data epilogue
B46E-   BD 8C C0    LDA   $C08C,X
B471-   10 FB       BPL   $B46E
B473-   C9 AA       CMP   #$AA
B475-   D0 F7       BNE   $B46E
B477-   BD 8C C0    LDA   $C08C,X
B47A-   10 FB       BPL   $B477
B47C-   C9 EB       CMP   #$EB
B47E-   D0 EE       BNE   $B46E

; now count the nibbles between the
; data epilogue and the next address
; prologue
B480-   BD 8C C0    LDA   $C08C,X
B483-   10 FB       BPL   $B480
B485-   C9 FF       CMP   #$FF
B487-   D0 F7       BNE   $B480
B489-   A0 00       LDY   #$00
B48B-   C8          INY
B48C-   BD 8E C0    LDA   $C08E,X
B48F-   BD 8C C0    LDA   $C08C,X
B492-   10 FB       BPL   $B48F
B494-   C9 D5       CMP   #$D5
B496-   D0 F3       BNE   $B48B

; if we have the wrong number of
; nibbles between the data epilogue
; and the next address prologue, loop
; back and keep trying (endlessly)
B498-   C0 10       CPY   #$10
B49A-   D0 C5       BNE   $B461

; do that for most of the sectors (but
; not all of them)
B49C-   E6 04       INC   $04
B49E-   A9 0A       LDA   #$0A
B4A0-   20 A8 FC    JSR   $FCA8
B4A3-   A9 04       LDA   #$04
B4A5-   C5 04       CMP   $04
B4A7-   D0 04       BNE   $B4AD
B4A9-   E6 04       INC   $04
B4AB-   D0 B8       BNE   $B465
B4AD-   A9 0F       LDA   #$0F
B4AF-   C5 04       CMP   $04
B4B1-   D0 BB       BNE   $B46E

; find sector $0F
B4B3-   20 44 B9    JSR   $B944
B4B6-   A5 2D       LDA   $2D
B4B8-   C9 0F       CMP   #$0F
B4BA-   D0 F7       BNE   $B4B3

; read sector data
B4BC-   20 DC B8    JSR   $B8DC

; more nibble counting -- looking for
; an $A5 nibble after an exact number
; of other nibbles after the end of the
; data epilogue
B4BF-   A0 00       LDY   #$00
B4C1-   C8          INY
B4C2-   BD 8E C0    LDA   $C08E,X
B4C5-   BD 8C C0    LDA   $C08C,X
B4C8-   10 FB       BPL   $B4C5
B4CA-   C9 A5       CMP   #$A5
B4CC-   D0 F3       BNE   $B4C1
B4CE-   C0 2B       CPY   #$2B
B4D0-   D0 E1       BNE   $B4B3

; and now looking for a $D5 (the start
; of the next prologue) after an exact
; number of other nibbles
B4D2-   A0 00       LDY   #$00
B4D4-   C8          INY
B4D5-   BD 8E C0    LDA   $C08E,X
B4D8-   BD 8C C0    LDA   $C08C,X
B4DB-   10 FB       BPL   $B4D8
B4DD-   C9 D5       CMP   #$D5
B4DF-   D0 F3       BNE   $B4D4
B4E1-   C0 5D       CPY   #$5D
B4E3-   D0 CE       BNE   $B4B3

; whew, made it -- turn off drive motor
B4E5-   BD 88 C0    LDA   $C088,X

; and continue the boot
B4E8-   4C 84 9D    JMP   $9D84

After all that nibble counting, there
are absolutely no side effects. I can
patch boot1 to call $9D84 directly and
bypass the entire copy protection.

T00,S01,$48 change "00 B4" to "84 9D"

]PR#6
...works...

A quick track/sector map confirms that
track $23 is unused by any files on the
disk. It was formatted like a 16-sector
track (based on the pattern of nibbles
we were looking for), but its sole
purpose in life was to be scanned by
the copy protection routine that I've
now bypassed.

Quod erat liberandum.

---------------------------------------
A 4am crack                     No. 443
------------------EOF------------------