-------------Big Book Maker------------
A 4am crack                  2015-03-08
---------------------------------------

Name: Big Book Maker: Tall Tales &
  American Folk Tales
Genre: educational
Year: 1991
Publisher: Queue, Inc.
Media: two double-sided 5.25-inch disks
OS: ProDOS 1.4
Other versions: none (preserved here
  for the first time)
Similar cracks: The Electric Crayon -
  The Land Is Your Land (no. 251)

                   ~

               Chapter 0
 In Which Various Automated Tools Fail
          In Interesting Ways


COPYA
  Disk 1, side A: immediate read error
  Disk 1, side B: no errors
  Disk 2, side A: no errors
  Disk 2, side B: no errors

(Unsurprisingly, disk 1 side A is the
only side that is bootable. I shall
focus all of my efforts there.)

Locksmith Fast Disk Backup
  can't read any track

EDD 4 bit copy (no sync, no count)
  no errors, but copy only boots as far
  as ProDOS title screen, then gives
  "RELOCATION / CONFIGURATION ERROR"

Copy ][+ nibble editor
  modified address epilogue "AF AB AB"
  odd-numbered tracks (1, 3, 5...) also
    have a modified address prologue
    ("D4 AA 96")
  
Disk Fixer
  ["O" -> "Input/Output Control"]
  set Address Epilogue to "AF AB AB"
  -> even-numbered tracks readable
  set Address Prologue to "D4 AA 96"
  -> odd-numbered tracks also readable
  T00 -> looks like ProDOS

Why didn't COPYA work?
  modified prologue/epilogue bytes

Why didn't Locksmith FDB work?
  modified prologue/epilogue bytes

Why didn't my EDD copy work?
  I don't know. The error is a standard
  ProDOS message, but it could easily
  have been triggered manually after a
  failed nibble check.

Converting the disk to a standard
format will be tricky. Super Demuffin
assumes all tracks share the same
prologue and epilogue bytes, but this
disk's address prologue alternates
between "D5 AA 96" and "D4 AA 96".
Advanced Demuffin requires a DOS 3.3-
shaped RWTS, but this disk uses ProDOS.

Next steps:

  1. Build an RWTS that can read the
     original disk
  2. Convert it to a standard format
     with Advanced Demuffin
  3. Patch the bootloader and/or the
     PRODOS file to be able to read
     a standard format disk
  4. Find the nibble check (or whatever
     is triggering the relocation error
     on the EDD copy) and bypass it

                   ~

               Chapter 1
         Bit Math Is Best Math


[S6,D1=original disk]
[S6,D2=blank disk]
[S5,D1=my work disk]

]PR#5
CAPTURING BOOT0
...reboots slot 6...
...reboots slot 5...
SAVING BOOT0

]BLOAD BOOT0,A$800
]CALL -151

*801L
.
. standard ProDOS bootloader, until...
.
0831-   85 40       STA   $40
0833-   85 48       STA   $48
0835-   A0 63       LDY   #$63
0837-   B1 48       LDA   ($48),Y
0839-   99 94 09    STA   $0994,Y
083C-   C8          INY
083D-   C0 EB       CPY   #$EB
083F-   D0 F6       BNE   $0837
0841-   A2 06       LDX   #$06
0843-   BC 1D 09    LDY   $091D,X
0846-   BD 24 09    LDA   $0924,X
0849-   99 F2 09    STA   $09F2,Y
084C-   BD 2B 09    LDA   $092B,X
084F-   20 48 09    JSR   $0948    <- !
0852-   CA          DEX
0853-   10 EE       BPL   $0843

Standard ProDOS does have this memory
copy loop at $0841..$0854, but it does
not have any JSR in it. Normally, the
instruction at $084F is "STA $0A7F,X",
and $0948 is part of the routine that
displays the "UNABLE TO LOAD PRODOS"
message if something goes wrong during
early boot.

*9600<C600.C6FFM

; ProDOS boot0 is sensitive to the
; value of the accumulator, so don't
; clobber it
96F8-   48          PHA

; set up callback after copy loop
96F9-   A9 4C       LDA   #$4C
96FB-   8D 55 08    STA   $0855
96FE-   A9 0C       LDA   #$0C
9700-   8D 56 08    STA   $0856
9703-   A9 97       LDA   #$97
9705-   8D 57 08    STA   $0857

; restore accumulator
9708-   68          PLA

; start the boot
9709-   4C 01 08    JMP   $0801

; callback is here -- copy the entire
; bootloader to the hi-res graphics
; page so it will survive a reboot
970C-   A2 03       LDX   #$03
970E-   A0 00       LDY   #$00
9710-   B9 00 08    LDA   $0800,Y
9713-   99 00 28    STA   $2800,Y
9716-   C8          INY
9717-   D0 F7       BNE   $9710
9719-   EE 12 97    INC   $9712
971C-   EE 15 97    INC   $9715
971F-   CA          DEX
9720-   D0 EE       BNE   $9710

; turn off the slot 6 drive motor
9722-   AD E8 C0    LDA   $C0E8

; reboot to my work disk
9725-   4C 00 C5    JMP   $C500

*BSAVE TRACE,A$9600,L$128
*9600G
...reboots slot 6...
...reboots slot 5...

]BSAVE BOOT1 0800-0AFF,A$2800,L$300
]BLOAD BOOT1 0800-0AFF,A$800
]CALL -151

*93FL

; this is the start of the routine that
; normally displays the "UNABLE TO LOAD
; PRODOS" message, but it's been
; shortened to just call $FF2D (beeps
; and prints "ERR") instead
093F-   20 58 FC    JSR   $FC58
0942-   20 2D FF    JSR   $FF2D
0945-   4C 45 09    JMP   $0945

; this is the subroutine called from
; the copy loop at $084F, and the first
; instruction here is the one that was
; clobbered by the call to this
; subroutine
0948-   9D 7F 0A    STA   $0A7F,X
094B-   BD 5C 09    LDA   $095C,X
094E-   9D F7 09    STA   $09F7,X
0951-   BD 63 09    LDA   $0963,X
0954-   9D FE 09    STA   $09FE,X
0957-   A9 AA       LDA   #$AA
0959-   85 31       STA   $31
095B-   60          RTS

ProDOS normally boots by copying part
of the drive controller ROM routine (at
$C65C or wherever, depending on the
boot slot) into RAM and massaging it to
create a working RWTS. This is how it
can fit an entire bootloader in three
pages -- the hard part of reading the
disk is already taken care of.

But on this disk, there is some extra
massaging. For example, this snippet
gets dropped into the middle of the
RWTS code:

095C-   4A          LSR
095D-   C9 6A       CMP   #$6A
095F-   D0 F3       BNE   $0954

And this one:

0961-   BD 8C C0    LDA   $C08C,X
0964-   10 FB       BPL   $0961
0966-   C9 AA       CMP   #$AA
0968-   D0 EA       BNE   $0954

The upshot is that the final RWTS is
different than the drive controller ROM
routine. After all the memory massaging
is complete, this is the part of the
constructed RWTS that checks for the
address and data prologue:

*9EFL

09EF-   88          DEY
09F0-   F0 F5       BEQ   $09E7

; prologue nibble #1
09F2-   BD 8C C0    LDA   $C08C,X
09F5-   10 FB       BPL   $09F2
09F7-   4A          LSR            |dif
09F8-   C9 6A       CMP   #$6A     |fer
09FA-   D0 F3       BNE   $09EF    |ent

; #2
09FC-   BD 8C C0    LDA   $C08C,X
09FF-   10 FB       BPL   $09FC
0A01-   C9 AA       CMP   #$AA
0A03-   D0 EA       BNE   $09EF

; #3
0A05-   BD 8C C0    LDA   $C08C,X
0A08-   10 FB       BPL   $0A05
0A0A-   C9 96       CMP   #$96
0A0C-   F0 09       BEQ   $0A17

The code to find prologue nibble #1
explains how this disk can read its
odd-numbered tracks (with non-standard
address prologue "D4 AA 96").

Normal address prologue byte 1 is $D5.
In binary: $D5 = 1101 0101
After LSR:       0110 1010 = $6A

Odd-numbered tracks use $D4 instead.
In binary: $D4 = 1101 0100
After LSR:       0110 1010 = $6A

So this code will match either prologue
and work on both odd and even tracks.
Clever!

Now let's trace further to capture the
entire PRODOS file. The bootloader uses
its funky RWTS to find and load the
PRODOS file at $2000, then jumps there
at $08FC:

*8FCL

08FC-   4C 00 20    JMP   $2000

After that, the bootloader's RWTS is
never used again. The PRODOS file has
a full RWTS to read (and write) the
rest of the disk.

*9600<C600.C6FFM

; ProDOS boot0 is sensitive to the
; value of the accumulator, so don't
; clobber it
96F8-   48          PHA

; set up callback to my own routine
; instead of executing PRODOS file
96F9-   A9 07       LDA   #$07
96FB-   8D FD 08    STA   $08FD
96FE-   A9 97       LDA   #$97
9700-   8D FE 08    STA   $08FE

; restore accumulator
9703-   68          PLA

; start the boot
9704-   4C 01 08    JMP   $0801

; callback is here -- just turn off the
; slot 6 drive motor and reboot to my
; work disk
9707-   AD E8 C0    LDA   $C0E8
970A-   4C 00 C5    JMP   $C500

*BSAVE TRACE.PRODOS,A$9600,L$10D

The only thing I don't know is exactly
how big the PRODOS file is. Different
versions are different sizes, and of
course many protected disks add their
own special code. So I'm going to clear
main memory with a special pattern so I
can see which pages are overwritten
after PRODOS is loaded.

*800:FD N 801<800.BEFEM
*BRUN TRACE.PRODOS
...reboots slot 6...
...reboots slot 5...

]CALL -151

[perusing memory, starting at $2000]

It looks like $5E00 is the first page
that still has repeated $FD bytes.

*5E-20
=3E
*BSAVE BOOT1.PRODOS,A$2000,L$3E00

Scanning through memory again, I found
the RWTS code at $5598.

*5598L

; ProDOS only uses the bootloader RWTS
; to load the PRODOS file, which then
; has its own fuller, more robust RWTS.
; This code, which is later relocated
; to $D398 in the language card, checks
; the address prologue.
5598-   A0 FC       LDY   #$FC
559A-   8C 6B D3    STY   $D36B
559D-   C8          INY
559E-   D0 05       BNE   $55A5
55A0-   EE 6B D3    INC   $D36B
55A3-   F0 56       BEQ   $55FB

; find prologue byte #1
; (matches $D4 or $D5)
55A5-   BD 8C C0    LDA   $C08C,X
55A8-   10 FB       BPL   $55A5
55AA-   4A          LSR
55AB-   C9 6A       CMP   #$6A
55AD-   D0 EE       BNE   $559D

; #2
; (zero page $31 was initialized during
; boot to $AA)
55AF-   BD 8C C0    LDA   $C08C,X
55B2-   10 FB       BPL   $55AF
55B4-   C5 31       CMP   $31
55B6-   D0 F2       BNE   $55AA
55B8-   A0 03       LDY   #$03

; #3
55BA-   BD 8C C0    LDA   $C08C,X
55BD-   10 FB       BPL   $55BA
55BF-   C9 96       CMP   #$96
55C1-   D0 E7       BNE   $55AA

No surprises here. This is the same
logic as the bootloader's mini-RWTS.
But look at the address epilogue check,
a few lines further down:

*55E6L

; find epilogue byte #1
55E6-   BD 8C C0    LDA   $C08C,X
55E9-   10 FB       BPL   $55E6
55EB-   C9 DE       CMP   #$DE

; if found $DE, immediately exit with
; a "success" status (clear carry bit)
55ED-   F0 0A       BEQ   $55F9

; if not $DE, do... this thing
55EF-   48          PHA
55F0-   68          PLA
55F1-   BD 8C C0    LDA   $C08C,X

; Note: no BPL loop here! It only reads
; the data latch once.
55F4-   C9 08       CMP   #$08
55F6-   B0 03       BCS   $55FB
55F8-   EA          NOP
55F9-   18          CLC
55FA-   60          RTS
55FB-   38          SEC
55FC-   60          RTS

It's looking for a timing bit after the
first epilogue byte. It doesn't even
care what the first epilogue byte was,
as long as it wasn't $DE.

This RWTS will accept two different
address prologues, "D5 AA 96" or "D4 AA
96". It will also accept two different
address epilogues, "DE" or anything-
other-than-DE-followed-by-a-timing-bit.

My initial investigation with Copy ][+
was incomplete. The address epilogue
bytes are not actually relevant. The
only thing that matters is that the
first byte is followed by a timing bit.
(Looking back at the nibble editor, I
can see that Copy ][+ displayed half of
the byte in inverse, meaning that it is
followed by a timing bit. But I didn't
realize its significance.)

With this information, I can build a
flexible DOS 3.3-shaped RWTS that can
read this disk, complete with its even-
and odd-numbered tracks and its custom
address epilogue check.

                   ~

               Chapter 2
   In Which We Use The Original Disk
      As A Weapon Against Itself


]PR#5
[press "Esc" during boot so Diversi-DOS
 stays in main memory and doesn't
 relocate to the language card]
...
]CALL -151
*1800<B800.BFFFM

OK, I have a copy of a standard DOS 3.3
shaped RWTS.

*BLOAD BOOT1.PRODOS,A$2000

; copy address prologue byte checker #1
; from ProDOS
*194F<55A5.55AEM

; fix one branch (EE -> EF)
*1958:EF

*1944L

1944-   A0 FC       LDY   #$FC
1946-   84 26       STY   $26
1948-   C8          INY
1949-   D0 04       BNE   $194F
194B-   E6 26       INC   $26
194D-   F0 F3       BEQ   $1942
194F-   BD 8C C0    LDA   $C08C,X
1952-   10 FB       BPL   $194F
1954-   4A          LSR
1955-   C9 6A       CMP   #$6A
1957-   D0 EF       BNE   $1948

; copy address epilogue byte checker
*198B<55E6.55FAM

; fix one branch (03 -> 02)
*199C:02

*198BL

198B-   BD 8C C0    LDA   $C08C,X
198E-   10 FB       BPL   $198B
1990-   C9 DE       CMP   #$DE
1992-   F0 0A       BEQ   $199E
1994-   48          PHA
1995-   68          PLA
1996-   BD 8C C0    LDA   $C08C,X
1999-   C9 08       CMP   #$08
199B-   B0 02       BCS   $199F
199D-   EA          NOP
199E-   18          CLC
199F-   60          RTS

Now I have a DOS 3.3-shaped RWTS that
can read this disk.

*BSAVE RWTS LIKE PRODOS,A$1800,L$800

[S6,D1=original disk]
[S6,D2=blank disk]

*BRUN ADVANCED DEMUFFIN 1.5

["5" to switch to slot 5]

["R" to load a new RWTS module]
  --> At $B8, load "RWTS LIKE PRODOS"
      from drive 1

["6" to switch to slot 6]

["C" to convert disk]

                 --v--

ADVANCED DEMUFFIN 1.5    (C) 1983, 2014
ORIGINAL BY THE STACK    UPDATES BY 4AM
=======PRESS ANY KEY TO CONTINUE=======
TRK:...................................
+.5:
    0123456789ABCDEF0123456789ABCDEF012
SC0:...................................
SC1:...................................
SC2:...................................
SC3:...................................
SC4:...................................
SC5:...................................
SC6:...................................
SC7:...................................
SC8:...................................
SC9:...................................
SCA:...................................
SCB:...................................
SCC:...................................
SCD:...................................
SCE:...................................
SCF:...................................
=======================================
16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2

                 --^--

[S7,D1=ProDOS hard drive]

]PR#7
]CAT,S6,D2

/TALL.TALES.PROG

 NAME           TYPE  BLOCKS  MODIFIED

 PRODOS          SYS      32  17-APR-87
 TTALES.SYSTEM   SYS       5  17-SEP-91
 SUPERP.SETUP    BIN       1   9-APR-92
 TOOLBOX         BIN      25   3-APR-92
 SETUP           BIN       9   9-APR-92
 QUIT.IT         BIN       1  17-SEP-91
 DISKBOX         BIN      10   9-APR-92
 TOOLBOX2        BIN       9  13-NOV-91
 DUMP            BIN       5  17-SEP-91
 SYS.STUFF       BIN      49  20-FEB-92
 MAIN            BIN       4   9-APR-92
 BOOK.MAKER      BIN      12   9-APR-92
 UTILITY         BIN       5  21-FEB-92
 OPENING         BIN       8  21-FEB-92
 PRINT           BIN      10   9-APR-92
*BIG             $F2      18   1-AUG-88
*FANCY           $F2       7   3-FEB-89
*SMALL           $F2       4   9-JUL-87
*STANDARD        $F2       9   1-AUG-88
 DISK.INFO       BIN       1  25-APR-91

BLOCKS FREE:   20     BLOCKS USED:  260

                   ~

               Chapter 3
    In Which Our Adventure Comes To
  A Sudden But Satisfying Conclusion


[S6,D1=demuffin'd disk]

]PR#6
...program boots and runs...

Wait, what?

Why did the demuffin'd copy work?
  Advanced Demuffin wrote out the data
  from each sector onto a standard disk
  that uses "D5 AA 96" prologue and "DE
  AA EB" epilogue. The bootloader RWTS
  always matches "D5 AA 96" and doesn't
  care that it never sees a "D4 AA 96",
  and it never checks epilogue bytes at
  all. The RWTS within the PRODOS file
  always matches "D5 AA 96", and its
  epilogue checker always matches "DE"
  and never checks the timing bit. Thus
  no RWTS patches are necessary.

But then why didn't the EDD copy work?
  The bootloader RWTS doesn't check
  epilogue bytes at all, so it was able
  to read the disk and load the PRODOS
  file. Once control is transferred to
  the PRODOS file, it switches to its
  own RWTS to read the disk catalog and
  find the first .SYSTEM file. But its
  own RWTS can't read the disk, because
  EDD preserved the original prologue
  epilogue but not the timing bits.
  The prologue checker (at $D398) finds
  "D5 AA 96" even-numbered tracks) or
  "D4 AA 96" (odd-numbered tracks). But
  the epilogue checker's first compare
  (at $D3EB) didn't match because the
  first epilogue byte was still the
  original value ($AF), and its second
  compare (at $D3F4) didn't match
  because there was no timing bit after
  the first byte. ProDOS can't read the
  disk catalog, so it displays the
  "RELOCATION / CONFIGURATION ERROR"
  and gives up. There was never any
  nibble check; the very structure of
  the disk itself is designed to foil
  bit copiers.
  
Quod erat liberandum.

---------------------------------------
A 4am crack                     No. 255
------------------EOF------------------