-----Learn About Words In Reading 2----
A 4am crack                  2015-05-14
---------------------------------------

Name: Learn About Words In Reading 2
Genre: educational
Year: 1983
Publisher: American Educational
  Computer, Inc.
Media: double-sided 5.25-inch floppy
Other cracks: none (preserved here for
  the first time)
Similar cracks: Garfield, Eat Your
  Words (4am crack no. 188)

Each side is bootable and appears to be
independent from the other. I'll start
with side A.

                   ~

               Chapter 0
 In Which Various Automated Tools Fail
          In Interesting Ways


COPYA
  immediate disk read error

Locksmith Fast Disk Backup
  unable to read any track

EDD 4 bit copy (no sync, no count)
  works

Copy ][+ nibble editor
  all tracks use standard prologues
  (address: D5 AA 96, data: D5 AA AD)
  but modified data epilogue
  (BF AA EB instead of DE AA EB)

Disk Fixer
  ["O" -> "Input/Output Control"]
    set Data Epilogue to "BF AA EB"
  Success! All tracks readable!
  T00 -> looks like a DOS 3.3 RWTS
  T11 -> DOS 3.3 disk catalog
  T01,S09 -> startup program is "HELLO"

Why didn't COPYA work?
  modified epilogue bytes (every track)

Why didn't Locksmith FDB work?
  modified epilogue bytes (every track)

EDD worked. What does that tell us?
  probably just structural protection
  (modified epilogue), no nibble check

Next steps:

  1. capture RWTS with AUTOTRACE
  2. convert disk to standard format
     with Advanced Demuffin
  3. patch RWTS to read standard format

                   ~

               Chapter 1
In Which We Attempt To Use The Original
    Disk As A Weapon Against Itself


[S6,D1=original disk]
[S6,D2=blank disk]
[S5,D1=my work disk]

]PR#5
CAPTURING BOOT0
...reboots slot 6...
...reboots slot 5...
SAVING BOOT0
CAPTURING BOOT1
...reboots slot 6...
...reboots slot 5...
SAVING BOOT1
SAVING RWTS

]BRUN ADVANCED DEMUFFIN 1.5

["5" to switch to slot 5]

["R" to load a new RWTS module]
  --> At $B8, load "RWTS" from drive 1

["6" to switch to slot 6]

["C" to convert disk]

                 --v--

ADVANCED DEMUFFIN 1.5    (C) 1983, 2014
ORIGINAL BY THE STACK    UPDATES BY 4AM
=======PRESS ANY KEY TO CONTINUE=======
TRK:...................................
+.5:
    0123456789ABCDEF0123456789ABCDEF012
SC0:...................................
SC1:...................................
SC2:...................................
SC3:...................................
SC4:...................................
SC5:...................................
SC6:...................................
SC7:...................................
SC8:...................................
SC9:...................................
SCA:...................................
SCB:...................................
SCC:...................................
SCD:...................................
SCE:...................................
SCF:...................................
=======================================
16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2

                 --^--

]PR#5
...
]CATALOG,S6,D2

C1983 DSR^C#254
032 FREE

 A 014 HELLOHI1
 A 022 LESSONXX1
 A 002 LESSONXX
 B 005 I.BELL
 A 012 SUBPROGRAM XX/1
 A 014 SUBPROGRAM XX/2
 A 014 SUBPROGRAM XX/3
 A 013 SUBPROGRAM XX/4
 A 014 SUBPROGRAM XX/5
 B 003 I.TRUCK
 B 036 HPICS
 B 034 HEAD-A
 B 004 I.KING
 B 003 I.QUEEN
 B 005 I.CAT
 A 008 REWARDS
 A 012 MAKE A FACE
 B 002 I.CAT-1
 B 002 I.LADDER-1
 B 004 I.HEART
 A 013 SUBPROGRAM XX/13
 A 014 SUBPROGRAM XX/12
 B 002 BTWAS
 B 004 I.FLAG
 B 002 SRF-TIM
 B 034 TITLE
 B 002 SRF-MANDY
 A 002 HELLO
 A 012 HELLOHI
 A 012 SRF DELETER
 B 015 BACP800
 B 030 BSYM-SYMTABS
 B 006 I.SLOGO
 B 004 I.FLOWER
 B 004 I.DUCK
 B 003 I.CAKE-1
 B 002 I.TRUCK-1
 A 014 SUBPROGRAM XX/6
 A 012 SUBPROGRAM XX/7
 A 014 SUBPROGRAM XX/8
 A 013 SUBPROGRAM XX/9
 A 014 SUBPROGRAM XX/10
 A 013 SUBPROGRAM XX/11

]RUN HELLO
...works...

[S6,D1=demuffin'd copy]

]PR#6
...grinds then crashes...

The demuffin'd disk can't read itself.
This is not unusual.

                   ~

               Chapter 2
 In Which We Remove All Traces Of Copy
Protection Using An Automated Tool That
   I Wrote For Just Such An Occasion


[S6,D1=demuffin'd copy]
[S5,D1=my work disk]

]PR#5
]BRUN PDP

; fix epilogue byte checking in RWTS
T00,S03,$35 change BF to DE
T00,S02,$9E change BF to DE

Side B has identical protection.

Quod erat liberandum.

---------------------------------------
A 4am crack                     No. 312
------------------EOF------------------