------------Snooper Troops 2----------- A 4am crack 2015-03-25 --------------------------------------- Name: Snooper Troops and the case of The Disappearing Dolphin Genre: adventure Year: 1982 Author: Tom Snyder / Computer Learning Connection, Inc. Publisher: Spinnaker Software Media: single-sided 5.25-inch floppy OS: DOS 3.3 Other versions: none (preserved here for the first time) Similar cracks: Frogger (no. 231); Troll's Tale (no. 109) Asimov has a disk image labeled "snooper_troops_ii", but it's really Snooper Troops 1 (Granite Point Ghost). As far as I can tell, this is a first- time preservation. ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA immediate disk read error Locksmith Fast Disk Backup unable to read any track EDD 4 bit copy (no sync, no count) read error on T09 but copy works anyway Copy ][+ nibble editor T00-T02 -> modified address epilogue (ED AA EB) T03-T22 -> modified address prologue (BB AA 96) T09 -> unformatted? mostly sync bytes Disk Fixer ["O" -> "Input/Output Control"] set Address Epilogue to "ED AA EB" T00-T02 -> looks like DOS 3.3 T01,S09 -> startup program is HELLO ["O" -> "Input/Output Control"] set Address Epilogue to "DE AA EB" set Address Prologue to "BB AA 96" T11 -> looks like disk catalog Why didn't COPYA work? modified epilogues / prologues Why didn't Locksmith FDB work? ditto Next steps: 1. capture RWTS with AUTOTRACE 2. convert disk to standard format with Advanced Demuffin 3. patch RWTS to read standard format (if necessary) ~ Chapter 1 In Which Things Don't Always Go According To Plan [S6,D1=original disk] [S5,D1=my work disk] ]PR#5 CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 CAPTURING BOOT1 ...reboots slot 6... ...reboots slot 5... SAVING BOOT1 SAVING RWTS ]BRUN ADVANCED DEMUFFIN 1.5 [press "5" to switch to slot 5] [press "R" to load a new RWTS module] --> At $B8, load "RWTS" from drive 1 [press "6" to switch to slot 6] [press "C" to convert disk] --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC1:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC2:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC3:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC4:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC5:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC6:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC7:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC8:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC9:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCA:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCB:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCC:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCD:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCE:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCF:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR ======================================= 16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- Let's back up. ]PR#5 ]BLOAD BOOT1,A$2600 ]CALL -151 *FE89G FE93G ; disconnect DOS *B600<2600.2FFFM ; move RWTS into place *B700L . . nothing unusual at all . B747- 4C 84 9D JMP $9D84 It makes sense that I haven't found anything unusual yet. Evidence so far suggests that the RWTS on disk can read tracks 0-2 (which is where it's loading DOS), then it switches to a different RWTS that can read the rest of the disk. So whatever this disk is doing to modify its RWTS or load a new one, it's going to do it after loading DOS. And I need to find out where. But that means I need to trace the boot even further. *C500G ; because I have no DOS ... ]CALL -151 *9600 At $B8, load "RWTS 3+" from D1 [press "6" to switch to slot 6] [press "C" to convert disk] [press "Y" to change default values] --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM ======================================= INPUT ALL VALUES IN HEX SECTORS PER TRACK? (13/16) 16 START TRACK: $03 <-- change this START SECTOR: $00 END TRACK: $22 END SECTOR: $0F INCREMENT: 1 MAX # OF RETRIES: 0 COPY FROM DRIVE 1 TO DRIVE: 2 ======================================= 16SC $03,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- Now press RETURN to start the copy... --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK: ......R......................... +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0: ......R......................... SC1: ......R......................... SC2: ......R......................... SC3: ......R......................... SC4: ......R......................... SC5: ......R......................... SC6: ......R......................... SC7: ......R......................... SC8: ......R......................... SC9: ......R......................... SCA: ......R......................... SCB: ......R......................... SCC: ......R......................... SCD: ......R......................... SCE: ......R......................... SCF: ......R......................... ======================================= 16SC $03,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- Now what?!? Oh wait, I remember EDD had problems on track $09 as well. And the nibble check did an RWTS seek to track $09. I can't read it because there's nothing to read. ]PR#5 ... ]CATALOG,S6,D2 C1983 DSR^C#254 038 FREE T 006 SECTOR T 010 WALLS A 064 X B 019 CRUNCHED PIC2 A 003 HELLO B 023 CRUNCHED PIC12 B 034 HOUSE9 B 006 CHARAC TABLE T 046 AQUAINT T 007 CONFESS T 009 MRX T 009 SPECIAL B 016 CRUNCHED PIC10 T 011 QU B 016 CRUNCHED PIC11 B 003 HRG B 019 CRUNCHED PIC3 B 020 CRUNCHED PIC4 B 020 CRUNCHED PIC5 B 021 CRUNCHED PIC1 A 004 INTRO INIT B 002 FORD1 B 003 UTIL.$0800 B 015 CRUNCHED PIC9 B 017 CRUNCHED PIC6 T 002 AGENT 1 B 018 CRUNCHED PIC7 T 002 AGENT 2 B 017 CRUNCHED PIC8 ]RUN HELLO ...works... Now to make the disk be able to read itself, and skip the copy protection routine at $B4BB. T00,S03,$91 change "ED" to "DE" T00,S0C,$84 change "4C BB B4" to "AD E9 B7" Quod erat liberandum. --------------------------------------- A 4am crack No. 278 ------------------EOF------------------