---------------Space Math--------------
A 4am crack                  2016-03-09
---------------------------------------

Name: Space Math
Genre: educational
Year: 1983
Publisher: Methods & Solutions
Media: single-sided 5.25-inch floppy
OS: DOS 3.3
Previous cracks: none
Similar cracks:
  #540 Mountain Climbing

                   ~

               Chapter 0
 In Which Various Automated Tools Fail
          In Interesting Ways


COPYA
  immediate disk read error

Locksmith Fast Disk Backup
  unable to read any track

EDD 4 bit copy (no sync, no count)
  works

Copy ][+ nibble editor
  modified data epilogue
  ("BF AA EB" instead of "DE AA EB")

Disk Fixer
  ["O" -> "Input/Output Control"]
    set Data Epilogue to "BF AA EB"
  all tracks readable
  T00 -> looks like a DOS 3.3 RWTS
  T11 -> DOS 3.3 disk catalog
  T01,S09 -> startup program is "HELLO"

Why didn't COPYA work?
  modified epilogue bytes (every track)

Why didn't Locksmith FDB work?
  modified epilogue bytes (every track)

EDD worked. What does that tell us?
  no half or quarter tracks
  almost certainly no nibble check
  (just structural changes to epilogue)

Next steps:

  1. capture RWTS with AUTOTRACE
  2. convert disk to standard format
     with Advanced Demuffin
  3. patch RWTS to read standard format

                   ~

               Chapter 1
In Which We Attempt To Use The Original
    Disk As A Weapon Against Itself


[S6,D1=original disk]
[S6,D2=blank disk]
[S5,D1=my work disk]

]PR#5
CAPTURING BOOT0
...reboots slot 6...
...reboots slot 5...
SAVING BOOT0
CAPTURING BOOT1
...reboots slot 6...
...reboots slot 5...
SAVING BOOT1
SAVING RWTS
SAVING IOB

Ah! My AUTOTRACE script has detected
that this RWTS lives at $3800, so it
created an IOB file for me that calls
it properly. (By default, Advanced
Demuffin assumes the RWTS entry point
is $B800.)

]BRUN ADVANCED DEMUFFIN 1.5

["5" to switch to slot 5]

["R" to load a new RWTS module]
  --> At $38, load "RWTS" from drive 1
          ^^

[press "I" to load a new IOB module]
  --> load "IOB" from drive 1
            ^^^

["6" to switch to slot 6]

["C" to convert disk]

                 --v--

ADVANCED DEMUFFIN 1.5    (C) 1983, 2014
ORIGINAL BY THE STACK    UPDATES BY 4AM
=======PRESS ANY KEY TO CONTINUE=======
TRK:...................................
+.5:
    0123456789ABCDEF0123456789ABCDEF012
SC0:...................................
SC1:...................................
SC2:...................................
SC3:...................................
SC4:...................................
SC5:...................................
SC6:...................................
SC7:...................................
SC8:...................................
SC9:...................................
SCA:...................................
SCB:...................................
SCC:...................................
SCD:...................................
SCE:...................................
SCF:...................................
=======================================
16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2

                 --^--

]PR#5
...
]CATALOG,S6,D2

C1983 DSR^C#254
268 FREE

*A 003 HELLO
*B 035 SM.SETUP.4.1
*B 025 RUNTIME.CG
*B 003 SM.PK
*B 002 SM.UNPACKER 1.2.OBJ0
*B 004 SM.M&SH.4.1
*B 002 SPACE.SHP
 B 068 SPACE MATH.4.1
*B 016 INSTRUCTIONS.4.1
*B 015 MINI INSTRUCTIONS.4.1
*B 066 TEACHER.4.1
 T 002 PARMS

]RUN HELLO
...works...

[S6,D1=demuffin'd copy]

]PR#6
...grinds and crashes...

My demuffin'd copy can not read itself,
because it's still looking for the non-
standard epilogue bytes. This is so
common, I wrote a tool to fix it for me
automatically: "Post-Demuffin Patcher".
(I am not good with names.) I included
the binary on my work disk, but you can
download the source code at
https://archive.org/details/
PostDemuffinPatcher4am

It does a lot more than just fix non-
standard epilogue bytes, but it looks
like that's the only thing this disk
needs. But let's find out!

                   ~

               Chapter 2
 In Which We Remove All Traces Of Copy
Protection Using An Automated Tool That
   I Wrote For Just Such An Occasion


[S6,D1=demuffin'd copy]
[S5,D1=my work disk]

]PR#5
]BRUN PDP

T00,S03,$35 change BF to DE
T00,S02,$9E change BF to DE

Quod erat liberandum.

---------------------------------------
A 4am crack                     No. 643
------------------EOF------------------