----Multiplying & Dividing Fractions---
A 4am crack                  2015-09-18
---------------------------------------

Name: Success with Math: Multiplying &
  Dividing Fractions
Genre: educational
Year: 1984
Authors: Microcomputer Workshops
Publisher: Mindscape, Inc.
Media: single-sided 5.25-inch floppy
OS: DOS 3.3
Previous cracks: none
Similar cracks:
  Division Made Easy (crack no. 443)

                   ~

               Chapter 0
 In Which Various Automated Tools Fail
          In Interesting Ways


COPYA
  immediate disk read error, but it
  gets an "I'm Someone Special" sticker
  and a participation trophy

Locksmith Fast Disk Backup
  unable to read any track

EDD 4 bit copy (no sync, no count)
  no errors, but copy does not work;
  it loads DOS from T00-T02, but before
  displaying the DOS prompt, the drive
  swings to a high track and hangs with
  the drive motor on

Copy ][+ nibble editor
  modified address epilogue ("DE *",
    not consistent)

Disk Fixer
  ["O" -> "Input/Output Control"]
    set CHECKSUM ENABLED = "NO"
  Success! All tracks readable!
  T00 -> looks like a DOS 3.3 RWTS
  T11 -> DOS 3.3 disk catalog
  T01,S09 -> startup program is "HELLO"

Why didn't COPYA work?
  modified epilogue bytes (every track)

Why didn't Locksmith FDB work?
  modified epilogue bytes (every track)

Why didn't my EDD copy work?
  probably a nibble check during boot

Next steps:

  1. capture RWTS with AUTOTRACE
  2. convert disk to standard format
     with Advanced Demuffin
  3. find nibble check and bypass it

                   ~

               Chapter 1
In Which We Attempt To Use The Original
    Disk As A Weapon Against Itself


[S6,D1=original disk]
[S5,D1=my work disk]

]PR#5
...
CAPTURING BOOT0
...reboots slot 6...
...reboots slot 5...
SAVING BOOT0
CAPTURING BOOT1
...reboots slot 6...
...reboots slot 5...
SAVING BOOT1
SAVING RWTS

[S6,D1=original disk]
[S6,D2=blank disk]
[S5,D1=my work disk]

]PR#5
...

]BRUN ADVANCED DEMUFFIN 1.5

[press "5" to switch to slot 5]

[press "R" to load a new RWTS module]
  --> At $B8, load "RWTS" from drive 1

[press "6" to switch to slot 6]

[press "C" to convert disk]

                 --v--

ADVANCED DEMUFFIN 1.5    (C) 1983, 2014
ORIGINAL BY THE STACK    UPDATES BY 4AM
=======PRESS ANY KEY TO CONTINUE=======
TRK:...................................
+.5:
    0123456789ABCDEF0123456789ABCDEF012
SC0:...................................
SC1:...................................
SC2:...................................
SC3:...................................
SC4:...................................
SC5:...................................
SC6:...................................
SC7:...................................
SC8:...................................
SC9:...................................
SCA:...................................
SCB:...................................
SCC:...................................
SCD:...................................
SCE:...................................
SCF:...................................
=======================================
16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2

                 --^--

The disk's own RWTS gave no read errors
on any track. This is the power and the
genius of Advanced Demuffin. Every disk
must be able to read itself. So, let it
read itself, then capture the data and
write it out in a standard format.

[S6,D1=demuffin'd copy]

]PR#6
...loads DOS from T00-T02, but before
   displaying the DOS prompt, the drive
   swings to a high track and hangs...

(This is the same behavior I saw with
my failed EDD copy.)

Let's go find that nibble check.

                   ~

               Chapter 2
    In Which We Attempt To Go Find
           That Nibble Check


]BLOAD BOOT1,A$2600
]CALL -151

*B600<2600.2EFMM
*B700L
.
. all normal until...
.
B747-   4C 00 B4    JMP   $B400

Hmm. That usually jumps to $9D84 to
cold start DOS. I don't have $B400 in
memory yet, but I really need to know
what's there.

*9600<C600.C6FFM

; set up callback #1 after boot0 loads
; boot1
96F8-   A9 4C       LDA   #$4C
96FA-   8D 4A 08    STA   $084A
96FD-   A9 0A       LDA   #$0A
96FF-   8D 4B 08    STA   $084B
9702-   A9 97       LDA   #$97
9704-   8D 4C 08    STA   $084C

; start the boot
9707-   4C 01 08    JMP   $0801

; callback #1 is here --
; set up callback #2 after boot1 loads
; boot2
970A-   A9 17       LDA   #$17
970C-   8D 48 B7    STA   $B748
970F-   A9 97       LDA   #$97
9711-   8D 49 B7    STA   $B749

; continue the boot
9714-   4C 00 B7    JMP   $B700

; callback #2 is here --
; $B400 (and the rest of DOS) is now in
; memory, so copy it to lower memory so
; it survives a reboot
9717-   A2 23       LDX   #$23
9719-   A0 00       LDY   #$00
971B-   B9 00 9D    LDA   $9D00,Y
971E-   99 00 1D    STA   $1D00,Y
9721-   C8          INY
9722-   D0 F7       BNE   $971B
9724-   EE 1D 97    INC   $971D
9727-   EE 20 97    INC   $9720
972A-   CA          DEX
972B-   D0 EE       BNE   $971B

; reboot to my work disk
972D-   4C 00 C5    JMP   $C500

*BSAVE TRACE,A$9600,L$130
*9600G
...reboots slot 6...
...reboots slot 5...

]BSAVE BOOT2,A$1D00,L$2300
]CALL -151

*9D00<1D00.3EFFM
*B400L

B400-   A0 00       LDY   #$00
B402-   B9 12 B4    LDA   $B412,Y
B405-   49 4C       EOR   #$4C
B407-   99 12 B4    STA   $B412,Y
B40A-   C8          INY
B40B-   C0 FF       CPY   #$FF
B40D-   D0 F3       BNE   $B402
B40F-   EA          NOP
B410-   EA          NOP
B411-   EA          NOP
B412-   E5 6F       SBC   $6F
B414-   C1 A0       CMP   ($A0,X)
B416-   FB          ???
B417-   E5 4C       SBC   $4C
B419-   C9 48       CMP   #$48

Oh look, self-decrypting code. As if
that's not suspicious. Luckily (for me)
there are several NOPs where I can
interrupt it.

*B40F:60
*B400G

Now let's see what was hiding there.

                   ~

               Chapter 3
  In Which We Peek Behind The Curtain


*B412L

; seek to track $23 (yes, $23)
B412-   A9 23       LDA   #$23
B414-   8D EC B7    STA   $B7EC

; $00 = seek command (in $B7F4 -- also
; initializing some zero page and
; setting the disk volume to wildcard
; "any volume")
B417-   A9 00       LDA   #$00
B419-   85 04       STA   $04
B41B-   8D F4 B7    STA   $B7F4
B41E-   8D EB B7    STA   $B7EB

; get address of RWTS parameter table
; and call RWTS (not shown)
B421-   20 EB B4    JSR   $B4EB
B424-   20 F2 B4    JSR   $B4F2
B427-   A9 00       LDA   #$00
B429-   85 48       STA   $48

; turn on drive motor manually
B42B-   BD 89 C0    LDA   $C089,X
B42E-   BD 8E C0    LDA   $C08E,X

; get next address field
B431-   20 44 B9    JSR   $B944

; check sector number
B434-   A5 2D       LDA   $2D

; is it the sector we're looking for?
B436-   C5 04       CMP   $04

; nope, loop back and try again
B438-   D0 F7       BNE   $B431

; reset data latch
B43A-   BD 8E C0    LDA   $C08E,X

; get an $FF nibble
B43D-   BD 8C C0    LDA   $C08C,X
B440-   10 FB       BPL   $B43D
B442-   C9 FF       CMP   #$FF
B444-   D0 F4       BNE   $B43A

; now count the number of nibbles
; before we get to a $D5 nibble (which
; is the start of the data prologue)
B446-   A0 00       LDY   #$00
B448-   C8          INY
B449-   BD 8E C0    LDA   $C08E,X
B44C-   BD 8C C0    LDA   $C08C,X
B44F-   10 FB       BPL   $B44C
B451-   C9 D5       CMP   #$D5
B453-   D0 F3       BNE   $B448

; if we have the wrong number of
; nibbles between the address epilogue
; and the next data prologue, loop back
; and try again (endlessly)
B455-   C0 07       CPY   #$07
B457-   D0 B9       BNE   $B412

; do the previous nibble count for each
; of the 16 sectors on track $23
B459-   E6 04       INC   $04
B45B-   A9 10       LDA   #$10
B45D-   C5 04       CMP   $04
B45F-   D0 D0       BNE   $B431

; reset sector count
B461-   A9 00       LDA   #$00
B463-   85 04       STA   $04

; reposition on sector $04 again
B465-   20 44 B9    JSR   $B944
B468-   A5 2D       LDA   $2D
B46A-   C5 04       CMP   $04
B46C-   D0 F7       BNE   $B465

; find tail end of data epilogue
B46E-   BD 8C C0    LDA   $C08C,X
B471-   10 FB       BPL   $B46E
B473-   C9 AA       CMP   #$AA
B475-   D0 F7       BNE   $B46E
B477-   BD 8C C0    LDA   $C08C,X
B47A-   10 FB       BPL   $B477
B47C-   C9 EB       CMP   #$EB
B47E-   D0 EE       BNE   $B46E

; now count the nibbles between the
; data epilogue and the next address
; prologue
B480-   BD 8C C0    LDA   $C08C,X
B483-   10 FB       BPL   $B480
B485-   C9 FF       CMP   #$FF
B487-   D0 F7       BNE   $B480
B489-   A0 00       LDY   #$00
B48B-   C8          INY
B48C-   BD 8E C0    LDA   $C08E,X
B48F-   BD 8C C0    LDA   $C08C,X
B492-   10 FB       BPL   $B48F
B494-   C9 D5       CMP   #$D5
B496-   D0 F3       BNE   $B48B

; if we have the wrong number of
; nibbles between the data epilogue
; and the next address prologue, loop
; back and keep trying (endlessly)
B498-   C0 10       CPY   #$10
B49A-   D0 C5       BNE   $B461

; do that for most of the sectors (but
; not all of them)
B49C-   E6 04       INC   $04
B49E-   A9 0A       LDA   #$0A
B4A0-   20 A8 FC    JSR   $FCA8
B4A3-   A9 04       LDA   #$04
B4A5-   C5 04       CMP   $04
B4A7-   D0 04       BNE   $B4AD
B4A9-   E6 04       INC   $04
B4AB-   D0 B8       BNE   $B465
B4AD-   A9 0F       LDA   #$0F
B4AF-   C5 04       CMP   $04
B4B1-   D0 BB       BNE   $B46E

; find sector $0F
B4B3-   20 44 B9    JSR   $B944
B4B6-   A5 2D       LDA   $2D
B4B8-   C9 0F       CMP   #$0F
B4BA-   D0 F7       BNE   $B4B3

; read sector data
B4BC-   20 DC B8    JSR   $B8DC

; more nibble counting -- looking for
; an $A5 nibble after an exact number
; of other nibbles after the end of the
; data epilogue
B4BF-   A0 00       LDY   #$00
B4C1-   C8          INY
B4C2-   BD 8E C0    LDA   $C08E,X
B4C5-   BD 8C C0    LDA   $C08C,X
B4C8-   10 FB       BPL   $B4C5
B4CA-   C9 A5       CMP   #$A5
B4CC-   D0 F3       BNE   $B4C1
B4CE-   C0 2B       CPY   #$2B
B4D0-   D0 E1       BNE   $B4B3

; and now looking for a $D5 (the start
; of the next prologue) after an exact
; number of other nibbles
B4D2-   A0 00       LDY   #$00
B4D4-   C8          INY
B4D5-   BD 8E C0    LDA   $C08E,X
B4D8-   BD 8C C0    LDA   $C08C,X
B4DB-   10 FB       BPL   $B4D8
B4DD-   C9 D5       CMP   #$D5
B4DF-   D0 F3       BNE   $B4D4
B4E1-   C0 5D       CPY   #$5D
B4E3-   D0 CE       BNE   $B4B3

; whew, made it -- turn off drive motor
B4E5-   BD 88 C0    LDA   $C088,X

; and continue the boot
B4E8-   4C 84 9D    JMP   $9D84

After all that nibble counting, there
are absolutely no side effects. I can
patch boot1 to call $9D84 directly and
bypass the entire copy protection.

T00,S01,$48 change "00 B4" to "84 9D"

]PR#6
...works...

A quick track/sector map confirms that
track $23 is unused by any files on the
disk. It was formatted like a 16-sector
track (based on the pattern of nibbles
we were looking for), but its sole
purpose in life was to be scanned by
the copy protection routine that I've
now bypassed.

Furthermore, this is the reason why the
address epilogue seemed inconsistent:

]PR#5
...
]BLOAD RWTS,A$3800
]CALL -151
*B800<3800.3EFFM
*B98BL

B98B-   BD 8C C0    LDA   $C08C,X
B98E-   10 FB       BPL   $B98B
B990-   C9 DE       CMP   #$DE
B992-   D0 AE       BNE   $B942
B994-   EA          NOP
B995-   BD 8C C0    LDA   $C08C,X
B998-   10 FB       BPL   $B995
B99A-   C9 AA       CMP   #$AA
B99C-   EA          NOP           <-- !
B99D-   EA          NOP           <-- !
B99E-   18          CLC
B99F-   60          RTS

It's not checking the second half of
the address epilogue at all! But since
the first half is standard, no RWTS
patches are required, so I'm just going
to leave it alone.

Quod erat liberandum.

---------------------------------------
A 4am crack                     No. 454
------------------EOF------------------