----------------Mud Pies--------------- A 4am crack 2015-12-18 --------------------------------------- Name: Mud Pies Genre: educational Year: 1985 Publisher: Troll Associates Media: single-sided 5.25-inch floppy OS: David-DOS II.2 (see T00,S08) Previous cracks: none Similar cracks: #517 Montana Reading Program #472 Sum Ducks #442 The Changing Earth #411 The Otters' Adventure #396 Nuclear Reactions #224 Mystery of the Witch's Shoes #223 Mrs. Wigglesworth's Secret #222 Case of the Missing Chick #221 Case of the Great Train Robbery ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA disk read error on first pass Locksmith Fast Disk Backup reads every track except $03; copy hangs on boot EDD 4 bit copy (no sync, no count) no errors, but copy boots DOS and exits to prompt Copy ][+ nibble editor T03 appears to be almost entirely sync bytes (all $FF, no data, no sectors per se, no structure at all) Disk Fixer T00,S00 starts off as a DOS 3.3-style bootloader, then goes off into the weeds T01,S01 is entirely blank T00,S08 has a copyright message: DAVID-DOS II.2 COPYRIGHT 1984 DAVID WESTON ...mailing address... T01,S09 -> startup program is blank T11 -> DOS 3.3-style disk catalog can't read T03 under any combination of parameters Why didn't COPYA work? T03 is unreadable because it does not have a standard sector structure Why didn't Locksmith FDB work? probably a nibble check during boot Why didn't my EDD copy work? I have no idea Next steps: 1. Capture bootloader with AUTOTRACE 2. Find nibble check and disable it 3. Declare victory(*) (*) Take a nap. ~ Chapter 1 In Which We Get Nothing For Free, And Our Adventure Begins In Earnest [S6,D1=original disk] [S5,D1=my work disk] ]PR#5 CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 Hmm, a custom bootloader. ]CATALOG,S6,D1 C1983 DSR^C#254 036 FREE B 005 HELP.GUMBO B 005 HELP B 033 HIRES A 003 MENU A 006 HELLO B 007 NONT B 004 ADDRESS B 002 TOTB B 003 CH2 B 009 T1 B 002 S B 030 P B 002 M B 026 CH B 059 A B 002 P1 B 033 SCREEN B 002 P2 B 004 THREE1 B 003 PHRASE B 002 PG1 B 018 ONE.ALL B 060 T2 B 004 TWO1 B 004 TWO2 B 002 TWO3 B 006 THREE2 B 002 THREE3 B 002 THREE4 B 002 P3 B 002 PG2 B 003 VTABLES//$6000 B 011 BLOCK.10X11 A 044 PACK33 B 009 FORK1234.USE B 005 SMILEALL.USE B 034 PIC.MUD B 003 RAPOBJ.4B/$12BD B 002 FORK2OBJ/$142C ]LOAD HELLO ...computer hangs... Wait, what? How can simply loading a program crash my machine? ]PR#5 ]HGR ]BLOAD SCREEN,A$2000,S6,D1 ...displays one of the screens from the game... So binary files appear OK, but even attempting to LOAD the HELLO program fails miserably. Back to boot tracing. ]CALL -151 *800<2800.28FFM *801L ; similar enough to DOS 3.3 boot0 loop ; to re-use the disk controller ROM ; routine to read sectors from track 0 0801- A5 27 LDA $27 0803- C9 09 CMP #$09 0805- D0 17 BNE $081E 0807- A5 2B LDA $2B 0809- 4A LSR 080A- 4A LSR 080B- 4A LSR 080C- 4A LSR 080D- AA TAX 080E- 09 C0 ORA #$C0 0810- 85 3F STA $3F 0812- A9 00 LDA #$00 0814- 9D 78 04 STA $0478,X 0817- 9D F8 04 STA $04F8,X 081A- A9 5C LDA #$5C 081C- 85 3E STA $3E ; $08FF holds the sector count 081E- AE FF 08 LDX $08FF 0821- 30 15 BMI $0838 0823- BD ED 08 LDA $08ED,X 0826- 85 3D STA $3D 0828- CE FF 08 DEC $08FF ; $08FE holds the address (highest page ; first then decremented, unlike normal ; DOS 3.3) 082B- AD FE 08 LDA $08FE 082E- 85 27 STA $27 0830- CE FE 08 DEC $08FE ; call disk controller to read sector ; (loops back to $801 on exit) 0833- A6 2B LDX $2B 0835- 6C 3E 00 JMP ($003E) ; execution continues here (from $0821) ; after sector reads are complete 0838- 20 89 FE JSR $FE89 083B- 8D 0C C0 STA $C00C 083E- 8D 0E C0 STA $C00E 0841- 20 93 FE JSR $FE93 0844- 20 2F FB JSR $FB2F 0847- 20 58 FC JSR $FC58 ; looks like we're printing something ; to the screen, but there's nothing ; there except spaces ($A0) -- maybe ; this bootloader is generic/reusable ; with an option to print a title? 084A- A2 0D LDX #$0D 084C- BD B9 08 LDA $08B9,X 084F- 9D 0D 04 STA $040D,X 0852- CA DEX 0853- 10 F7 BPL $084C ; also blank spaces 0855- A2 25 LDX #$25 0857- BD C7 08 LDA $08C7,X 085A- 9D 01 05 STA $0501,X 085D- CA DEX 085E- 10 F7 BPL $0857 ; VTAB 2 0860- A9 02 LDA #$02 0862- 85 25 STA $25 0864- 20 22 FC JSR $FC22 ; set up RWTS parameters (usually done ; at $B700, but inlined here) 0867- A6 2B LDX $2B 0869- 8E E9 B7 STX $B7E9 086C- 8E F7 B7 STX $B7F7 086F- A0 01 LDY #$01 0871- 8C F4 B7 STY $B7F4 0874- 8C EA B7 STY $B7EA 0877- 8C F8 B7 STY $B7F8 087A- A0 02 LDY #$02 087C- 8C EC B7 STY $B7EC 087F- A0 1A LDY #$1A 0881- 8C E1 B7 STY $B7E1 0884- A0 B6 LDY #$B6 0886- 8C F1 B7 STY $B7F1 0889- A0 02 LDY #$02 ; highly suspect 088B- 20 03 BB JSR $BB03 ; reset stack 088E- A2 FF LDX #$FF 0890- 9A TXS 0891- 8E EB B7 STX $B7EB 0894- 8E FB 04 STX $04FB ; start DOS 0897- 4C 84 9D JMP $9D84 Looks like $BB03 (there shouldn't be any code there at all, by the way) is loading the rest of DOS. I bet it's doing a nibble check first, though. *8FE.8FF 08FE- BF 0B OK, we're loading into $B400..$BFFF. Let's capture it. *9600 and hangs until you press something else. That part is skipped for now, but I'm guessing it's called later. Location | Description | Value -------------+------------------+------ $B474 | length of data | $03 $B475/$B476 | starting address | $A502 $B477..$B479 | data The 3 bytes at $B477 end up at $A503, which is the tail end of the RUN entry point. It's just a JMP to the code that was just patched earlier: A503- 4C 36 9E JMP $9E36 Thus, trying to break to the prompt during boot will hang until you press something else. (Even if you did manage to get to the prompt, the RUN flag would ensure you couldn't do anything useful. Defense in depth!) Location | Description | Value -------------+------------------+------ $B47A | length of data | $30 $B47B/$B47C | starting address | $B5FF $B47D..$B4AC | data The $30 bytes at $B47D end up at $B600. The new code looks like this: B600- 60 RTS B601- A0 20 LDY #$20 B603- B9 0F B6 LDA $B60F,Y B606- 99 00 03 STA $0300,Y B609- 88 DEY B60A- 10 F7 BPL $B603 B60C- 4C 00 03 JMP $0300 B60F- A9 BF LDA #$BF B611- 85 01 STA $01 B613- A0 00 LDY #$00 B615- 84 00 STY $00 B617- 91 00 STA ($00),Y B619- C8 INY B61A- D0 FB BNE $B617 B61C- C6 01 DEC $01 B61E- A5 01 LDA $01 B620- C9 08 CMP #$08 B622- B0 F3 BCS $B617 B624- AD 81 C0 LDA $C081 B627- 20 93 FE JSR $FE93 B62A- 20 89 FE JSR $FE89 B62D- 4C 00 E0 JMP $E000 Looks like this is going to be The Badlands routine that wipes main memory and exits. Location | Description | Value -------------+------------------+------ $B4AD | length of data | $01 $B4AE/$B4AF | starting address | $B7C1 $B4B0 | data | $60 This puts an RTS instruction at $B7C2, which would normally set up the RWTS parameters for writing DOS after INIT. Location | Description | Value -------------+------------------+------ $B4B1 | length of data | $03 $B4B2/$B4B3 | starting address | $9E72 $B4B4..$B4B6 | data This modifies DOS's image of the page 3 jump vectors so that will jump to $B601, a.k.a. The Badlands. Location | Description | Value -------------+------------------+------ $B4B7 | length of data | $02 $B4B8/$B4B9 | starting address | $A396 $B4BA..$B4BB | data | 18 60 This patch neutralizes the SAVE handler at $A397 so it does nothing but claims to have succeeded. That's it. The next byte is $00, so the BEQ at $B583 branches and the patch loop exits gracefully via RTS. (There appear to be more patches to decrypt binary files, but this disk does not use them.) The result is a really messed up DOS that is maximally unfriendly to prying eyes and maximally incompatible with any other version of DOS. It decrypts BASIC files on the fly, traps , traps , sets the RUN flag, and disables the SAVE command. It does not, however, hinder copying the disk itself. The only patch I need to bypass the copy protection is at $BB03: 1. push $B5/$19 to the stack 2. set Y register to $04 3. jump to $B7A9 T00,S07,$03 old: "4E 06 BB 71 6E 0A BB 40 27 6E 0F" new: "A9 B5 48 A9 19 48 A0 04 4C A9 B7" --v-- T00,S07 ----------- DISASSEMBLY MODE ---------- 0003:A9 B5 LDA #$B5 0005:48 PHA 0006:A9 19 LDA #$19 0008:48 PHA 0009:A0 04 LDY #$04 000B:4C A9 B7 JMP $B7A9 --^-- Quod erat liberandum. --------------------------------------- A 4am crack No. 529 ------------------EOF------------------