-------Reference Micro Mysteries------- ------------Textbook Skills------------ A 4am crack 2014-07-14 --------------------------------------- "Reference Micro Mysteries: Textbook Skills" is a 1986 educational game developed by Frederick Burggraf and distributed by Focus Media, Inc. [The copy protection is identical to "Who Am I? Birds, Trees, and Flowers," also distributed by Focus Media. This write-up is therefore quite similar to that one, with a few corrections.] The original comes on a double-sided disk. Each side boots, loads DOS, displays a BASIC prompt, then runs a HELLO program of some sort. Each side has different content, and they appear to be entirely self-contained and independent of the other. COPYA fails miserably and immediately with a disk read error. EDD 4 bit copy gives no read errors, but the copy grinds the disk drive on boot and never gets any further. My trusty Copy ][+ sector editor can read track 0, sectors 0-9 without any trouble. Everything beyond that, even the rest of the sectors on track 0, is unreadable. Ignoring epilogue bytes (press "P" to get to the Sector Editor Patcher, then select "DOS 3.3 PATCHED") makes no difference. Switching to the nibble editor, it appears that all the tracks are in a fairly standard 16-sector format, but the data prologue has been changed from "D5 AA AD" to "D5 AA FF". --v-- COPY ][ PLUS BIT COPY PROGRAM 8.4 (C) 1982-9 CENTRAL POINT SOFTWARE, INC. ---------------------------------------- TRACK: 01 START: 1E35 LENGTH: 015F 1E10: FF FF FF FF FF FF FF FF VIEW 1E18: FF FF FF FF FF FF FF FF 1E20: FF FF FF FF FF FF E7 F9 1E28: FE FF FF FF FF FF FF FF 1E30: FF FF FF FF FF D5 AA 96 <-1E35 ^^^^^^^^ standard address prologue 1E38: FF FE AA AB AA AA FF FF 1E40: AB AA CF F3 FC FF FF FF ^^^^^^^^ non-standard address epilogue 1E48: FF FF FF D5 AA FF CF CA ^^^^^^^^ non-standard data prologue 1E50: DF BE BA BA A9 AF BF BD ---------------------------------------- A TO ANALYZE DATA ESC TO QUIT ? FOR HELP SCREEN / CHANGE PARMS Q FOR NEXT TRACK SPACE TO RE-READ --^-- All tracks appears to use the same prologue and epilogue sequences (except for the first 10 sectors on track 0). The sectors I can read on track 0 appear to be a standard(-ish) DOS 3.3 RWTS. Of course, there are some modifications to accommodate the non-standard prologue and epilogue sequences, but a cursory glance shows no other obvious pitfalls. Of course, it's always the non-obvious pitfalls that bite you, so let's forget I mentioned it. Go go gadget AUTOTRACE! [S6,D1=original disk] [S5,D1=my work disk] ]PR#5 ... CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 CAPTURING BOOT1 ...reboots slot 6... ...reboots slot 5... SAVING BOOT1 SAVING RWTS For those of you just tuning in, my work disk uses a custom program that I affectionately call "AUTOTRACE" to automate the process of boot tracing as far as possible. For some disks, this just captures track 0, sector 0 (saved in a file called "BOOT0") and stops. For other disks that load in the same way that an unprotected DOS 3.3 disk loads, it captures the next stage of the boot process as well (in a file called "BOOT1"). BOOT1 contains sectors 0-9 on track 0, which are loaded into memory at $B600..$BFFF. This generally contains the RWTS routines which the program uses to read the rest of the disk. If the RWTS is fairly normal as well (and my AUTOTRACE program just spot- checks a few memory locations to guess at its "normalcy"), there's a good chance I'll be able to use a tool called Advanced Demuffin (written in 1983 by The Stack) to convert the disk from whatever weird format it uses to store its sector data into a standard disk readable by unprotected DOS 3.3 disks or any other third-party tools. In this case, AUTOTRACE extracts the RWTS routines (generally loaded from track 0, sectors 2-9 into $B800..$BFFF) and saves *that* into a third file called "RWTS". If anything looks fishy or non- standard, AUTOTRACE just stops, and I have to check the files it saved so far to determine why. But in this case, it ran all the way through, automatically capturing BOOT0, BOOT1, and RWTS files. Now I can use Advanced Demuffin to convert the disk to a standard format. (It uses the disk's own RWTS to read the original, then a standard DOS 3.3- compatible RWTS to write out the data, sector by sector.) Advanced Demuffin will only load RWTS files from a drive in slot 6, which is annoying since mine is in slot 5. Note to self: patch that someday. In the meantime, I'm swapping floppy disks like some kind of 17th century scribe. [S6,D1=my work disk] ]PR#6 ]BRUN ADVANCED DEMUFFIN 1.1 --> LOAD NEW RWTS MODULE At $B8, load "RWTS" from drive 1 [S6,D1=original disk] [S6,D2=blank disk] --> FORMAT TARGET DISK ...grind grind grind... --> CONVERT DISK This disk is 16 sectors, and the default options (copy the entire disk, all tracks, all sectors) don't need to be changed. --v-- ADVANCED DEMUFFIN 1.1 - COPYRIGHT 1983 WRITTEN BY THE STACK -CORRUPT COMPUTING =======PRESS ANY KEY TO CONTINUE======= TRK:R.................................. +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0:R.................................. SC1:R.................................. SC2:R.................................. SC3:R.................................. SC4:R.................................. SC5:R.................................. SC6:R.................................. SC7:R.................................. SC8:R.................................. SC9:R.................................. SCA:................................... SCB:................................... SCC:................................... SCD:................................... SCE:................................... SCF:................................... ======================================= 16 SC $00,$00 TO $22,$0F BY $01 TO DRV2 --^-- The disk's own RWTS can't read the first 10 sectors of track 0, but that's to be expected -- they were in a different format than the rest of the disk. What I really care about is the rest of the disk, and that part went flawlessly. That's the power and the genius of Advanced Demuffin. Every disk must be able to read itself. So, let it read itself, then capture the data and write it out in a standard format. Of course, my copy won't boot, because it doesn't have any boot code in the first 10 sectors of track 0! But check this out... [S6,D1=my work disk] [S6,D2=demuffin'd copy] ]PR#6 ... ]CATALOG,S6,D2 C1983 DSR^C#254 056 FREE *A 002 HELLO *A 006 LOADFLEX *A 003 TITLE.BAS B 022 INTRO1.PAC *A 007 WELCOME B 002 GMOVER B 002 RELOCATOR B 013 FLEX TEXT *B 005 ASCII.40 *B 005 ASCII.56 B 019 INTRO2.PAC B 014 TITLE.PAC B 010 WALLET.GRAPHICS B 012 LOGO.PAC B 019 INTRO3.PAC *A 041 THE BOOKSTORE THEFT A 039 THE WAYWARD WALLET B 018 PHILLIPS.GRAPHICS A 042 THE PHILLIPS FORTUNE B 022 PEARL.GRAPHICS *A 041 THE PILFERED PEARL *A 005 INSTRUCTIONS *A 006 RE.WELCOME B 013 BOOKSTORE.PAC B 007 RMM.SHAPES B 011 PETS.PAC A 038 RACHEL'S DOG B 016 WELCOME.GRAPHICS ]RUN HELLO The game loads and runs without complaint. All further disk access is done through standard DOS functions. (It even runs from drive 2!) There doesn't appear to be any kind of nibble check or other copy protection, beyond the custom DOS. Speaking of custom DOS, the original disk is not using DOS 3.3; it's using Diversi-DOS. I have not seen a whole lot of commercial disks that licensed third-party DOS, but there it is on T00,S0A, clear as day: --v-- SECTOR EDITOR DRIVE 1 00- EE F4 03 A9 9D 8D 0D 9D nt.).... 08- 8D 49 B7 A9 84 8D 48 B7 .I7)..H7 10- 20 84 9D A0 00 B9 32 9B .. .92. 18- 30 0D 09 80 20 ED FD C8 0... m}H 20- D0 F3 EE 17 9B D0 EE AD Psn..Pn- 28- 00 C0 10 FB AD 10 C0 4C .@.{-.@L 30- 84 9D 44 49 56 45 52 53 ..DIVERS 38- 49 2D 44 4F 53 28 54 4D I-DOS(TM 40- 29 0D 42 59 20 42 49 4C ).BY BIL 48- 4C 20 42 41 53 48 41 4D L BASHAM 50- 0D 43 31 39 38 32 20 44 .C1982 D 58- 53 52 0D 0D 54 48 49 53 SR..THIS 60- 20 44 49 53 4B 20 43 4F DISK CO 68- 4E 54 41 49 4E 53 20 41 NTAINS A 70- 20 48 49 47 48 2D 53 50 HIGH-SP 78- 45 45 44 0D 4F 50 45 52 EED.OPER 80- 41 54 49 4E 47 20 53 59 ATING SY TRACK $00 SECTOR $0A DOS 3.3 [?]-HELP SCREEN --^-- Now to make the disk be able to read itself. I don't think I have this exact version of Diversi-DOS, but I do have a later version. [S6,D1=Diversi-DOS master disk] --v-- DIVERSI-DOS(TM) VERSION 4.1-C C1983 DSR, INC / BY BILL BASHAM 1 - INSTRUCTIONS 2 - PUT DIVERSI-DOS ONTO A DISK 3 - RUN A PROTECTED PROGRAM 4 - MAKE COPIES OF THIS DISK 5 - MODIFY BUFFER ROUTINES 6 - BSAVE BUFFER FILE 7 - BSAVE DDMOVER FILE 8 - BSAVE PATCH FILE 9 - EXIT TO BASIC / G - GARB. COLLECT P - PLAY DOGFIGHT / R - RAMDISK ENTER SELECTION (1 TO 9) -> --^-- I press "2" to put Diversi-DOS onto a disk, press "N" to decline the free sector patch, then put the demuffin'd copy into S6,D1 and press RETURN. [The procedure for the other side is identical.] Quod erat liberandum. --------------------------------------- A 4am crack No. 84 ------------------EOF------------------