---------World Geography Trivia--------
A 4am crack                  2015-03-06
---------------------------------------

Name: World Geography Trivia
Genre: educational
Publisher: Micro Learningware
Media: single-sided 5.25-inch floppy
OS: DOS 3.3
Other versions: Asimov has an uncracked
  .nib image

                   ~

               Chapter 0
 In Which Various Automated Tools Fail
          In Interesting Ways


COPYA
  immediate disk read error

Locksmith Fast Disk Backup
  unable to read any track

EDD 4 bit copy (no sync, no count)
  works

Copy ][+ nibble editor
  modified addres and data epilogue
    bytes ("AA AA EB" for each)
  
Disk Fixer
  ["O" -> "Input/Output Control"]
    set Address Epilogue to "AA AA EB"
    set Data Epilogue to "AA AA EB"
  all tracks readable
  T00 -> looks like a DOS 3.3 RWTS
  T11 -> DOS 3.3 disk catalog
  T01,S09 -> startup program is "HELLO"

Why didn't COPYA work?
  modified epilogue bytes (every track)

Why didn't Locksmith FDB work?
  modified epilogue bytes (every track)

Next steps:

  1. capture RWTS with AUTOTRACE
  2. convert disk to standard format
     with Advanced Demuffin
  3. there is no step 3 (I hope)

                   ~

               Chapter 1
In Which We Attempt To Use The Original
    Disk As A Weapon Against Itself


[S6,D1=original disk]
[S6,D2=blank disk]
[S5,D1=my work disk]

]PR#5
CAPTURING BOOT0
...reboots slot 6...
...reboots slot 5...
SAVING BOOT0
CAPTURING BOOT1
...reboots slot 6...
...reboots slot 5...
SAVING BOOT1
SAVING RWTS

]BRUN ADVANCED DEMUFFIN 1.5

["5" to switch to slot 5]

["R" to load a new RWTS module]
  --> At $B8, load "RWTS" from drive 1

["6" to switch to slot 6]

["C" to convert disk]

                 --v--

ADVANCED DEMUFFIN 1.5    (C) 1983, 2014
ORIGINAL BY THE STACK    UPDATES BY 4AM
=======PRESS ANY KEY TO CONTINUE=======
TRK:...................................
+.5:
    0123456789ABCDEF0123456789ABCDEF012
SC0:...................................
SC1:...................................
SC2:...................................
SC3:...................................
SC4:...................................
SC5:...................................
SC6:...................................
SC7:...................................
SC8:...................................
SC9:...................................
SCA:...................................
SCB:...................................
SCC:...................................
SCD:...................................
SCE:...................................
SCF:...................................
=======================================
16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2

                 --^--

]PR#5
]CATALOG,S6,D2

C1983 DSR^C#254
008 FREE

 A 004 HELLO
 T 063 CAT1
 T 058 CAT2
 T 062 CAT3
 T 054 CAT4
 T 063 CAT5
*B 010 FLEX TYPE
*B 005 ASCII.40
*A 030 PROGRAM
*B 034 ML DONE
 A 005 HELLO2
 T 063 CAT6
 T 002 SCORES
*A 031 TIC-TAC
*A 004 MENU

]RUN HELLO
...works...

[S6,D1=demuffin'd copy]

]PR#6
...grinds...

                   ~

               Chapter 2
 In Which We Remove All Traces Of Copy
Protection Using An Automated Tool That
   I Wrote For Just Such An Occasion


[S6,D1=demuffin'd copy]
[S5,D1=my work disk]

]PR#5
]BRUN PDP

T00,S03,$91 change AA to DE
T00,S03,$35 change AA to DE
T00,S06,$AE change AA to DE
T00,S02,$9E change AA to DE

(Just RWTS fixes. There doesn't appear
to be any secondary protection.)

Quod erat liberandum.

---------------------------------------
A 4am crack                     No. 242
------------------EOF------------------