-----The Great American States Race---- A 4am crack 2016-03-23 --------------------------------------- Name: The Great American States Race Genre: educational Year: 1987 Publisher: Heartsoft, Inc. Media: single-sided 5.25-inch floppy OS: Diversi-DOS (T02,S02 has the string "C1982 DSR" backwards) Previous cracks: none Similar cracks: #580 Tommy the Time Telling Turtle #578 The Coin Changer #575 Milt's Math Drills: Addition and Subtraction ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA immediate disk read error Locksmith Fast Disk Backup unable to read any track EDD 4 bit copy (no sync, no count) works Copy ][+ nibble editor modified address epilogues ("AA AA EB" instead of "DE AA EB") Disk Fixer ["O" -> "Input/Output Control"] set Address Epilogue to "AA AA EB" all tracks readable T00 -> looks like a DOS 3.3 RWTS T11 -> DOS 3.3 disk catalog T01,S09 -> startup program is "HELLO" Why didn't COPYA work? modified epilogue bytes (every track) Why didn't Locksmith FDB work? modified epilogue bytes (every track) EDD worked. What does that tell us? no half or quarter tracks almost certainly no nibble check (just structural changes to epilogue) Next steps: 1. capture RWTS with AUTOTRACE 2. convert disk to standard format with Advanced Demuffin 3. patch RWTS to read standard format ~ Chapter 1 In Which We Attempt To Use The Original Disk As A Weapon Against Itself [S6,D1=original disk] [S6,D2=blank disk] [S5,D1=my work disk] ]PR#5 CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 CAPTURING BOOT1 ...reboots slot 6... ...reboots slot 5... SAVING BOOT1 SAVING RWTS ]BRUN ADVANCED DEMUFFIN 1.5 ["5" to switch to slot 5] ["R" to load a new RWTS module] --> At $B8, load "RWTS" from drive 1 ["6" to switch to slot 6] ["C" to convert disk] --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK:................................... +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0:................................... SC1:................................... SC2:................................... SC3:................................... SC4:................................... SC5:................................... SC6:................................... SC7:................................... SC8:................................... SC9:................................... SCA:................................... SCB:................................... SCC:................................... SCD:................................... SCE:................................... SCF:................................... ======================================= 16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- ]PR#5 ... ]CATALOG,S6,D2 C1983 DSR^C#254 126 FREE A 002 HELLO A 026 PROGRAM A 004 HELLO2 B 004 HEARTSOFT.CPRS B 003 Alaska.CPRS B 003 Missouri.CPRS B 003 Louisiana.CPRS B 003 Alabama.CPRS B 003 Arizona.CPRS B 003 California.CPRS B 003 Colorado.CPRS B 003 Oklahoma.CPRS B 003 Connecticut.CPRS B 003 Arkansas.CPRS B 003 Delaware.CPRS B 003 Florida.CPRS B 003 Georgia.CPRS B 003 Hawaii.CPRS B 003 Idaho.CPRS B 003 Texas.CPRS B 003 Kansas.CPRS B 003 Illinois.CPRS B 003 Iowa.CPRS B 003 Indiana.CPRS B 003 Kentucky.CPRS B 003 Maine.CPRS B 004 Maryland.CPRS B 004 Michigan.CPRS B 003 Minnesota.CPRS B 003 Mississippi.CPRS B 003 Montana.CPRS B 004 Massachusetts.CPRS B 003 Nebraska.CPRS B 003 Nevada.CPRS B 003 New Hampshire.CPRS B 003 New Jersey.CPRS B 003 New Mexico.CPRS B 003 New York.CPRS B 003 North Carolina.CPRS B 003 North Dakota.CPRS B 003 Oregon.CPRS B 003 Pennsylvania.CPRS B 004 Rhode Island.CPRS B 003 South Carolina.CPRS B 003 South Dakota.CPRS B 003 Tennessee.CPRS B 003 Utah.CPRS B 003 Vermont.CPRS B 003 Virginia.CPRS B 003 Washington.CPRS B 003 West Virginia.CPRS B 003 Ohio.CPRS B 003 Wisconsin.CPRS A 003 STATE WRITER B 003 Wyoming.CPRS T 021 STATES B 010 UTILITY-4.FULL B 034 STATES 1 B 005 BOXES.LNK B 010 HRCG A 003 STATE CORRECTOR B 003 OVERLAY2.CPRS A 002 TEST A 002 TEST2 B 016 GASR.LNK B 002 ST.CPRS B 010 MISSION.CPRS B 005 SR.TITLE.CPRS B 002 THE GREAT.CPRS B 002 STATES RACE.CPRS B 004 GASR.CPRS B 011 AMERICA.CPRS B 005 OVERLAY1.CPRS B 014 GASR2.LNK T 002 TOP TEN B 002 BEST.CPRS B 004 B.A.T..CPRS B 002 MUSIC.MUS B 002 GASR.MUS B 002 GASR2.MUS B 002 GASR.MLNK Ooh, interesting. It's not every day you see lowercase filenames in a disk catalog. ]RUN HELLO ...works... [S6,D1=demuffin'd copy] ]PR#6 ...grinds... My copy can't read itself yet. This is not unusual. ~ Chapter 2 In Which We Remove All Traces Of Copy Protection Using An Automated Tool That I Wrote For Just Such An Occasion [S6,D1=demuffin'd copy] [S5,D1=my work disk] ]PR#5 ]BRUN PDP T00,S03,$91 change AA to DE T00,S06,$AE change AA to DE ]PR#6 ...works... Quod erat liberandum. --------------------------------------- A 4am crack No. 652 ------------------EOF------------------