----------The World of Insects--------- A 4am crack 2014-07-13 --------------------------------------- "The World of Insects" is a 1985 educational game by David Cooper, programmed by Michael Gill, edited by Joe London, and distributed by Focus Media, Inc. [The copy protection is identical to "Who Am I? Birds, Trees, and Flowers," also distributed by Focus Media. This write-up is therefore quite similar to that one, with a few corrections.] COPYA fails miserably and immediately with a disk read error. EDD 4 bit copy gives no read errors, but the copy grinds the disk drive on boot and never gets any further. The original loads DOS, displays a BASIC prompt, then runs a HELLO program of some sort, but the copy doesn't even make it to the BASIC prompt. My trusty Copy ][+ sector editor can read track 0, sectors 0-9 without any trouble. Everything beyond that, even the rest of the sectors on track 0, is unreadable. Ignoring epilogue bytes (press "P" to get to the Sector Editor Patcher, then select "DOS 3.3 PATCHED") makes no difference. Switching to the nibble editor, it appears that all the tracks are in a fairly standard 16-sector format, but the data prologue has been changed from "D5 AA AD" to "D5 AA FF". --v-- COPY ][ PLUS BIT COPY PROGRAM 8.4 (C) 1982-9 CENTRAL POINT SOFTWARE, INC. ---------------------------------------- TRACK: 01 START: 1C7D LENGTH: 015F 1C58: FF FF FF FF FF FF FF FF VIEW 1C60: FF FF FF FF FF FF FF FF 1C68: FF FF FF FF FF FF FC FF 1C70: FF FF FF FF FF FF FF FF 1C78: FF FF FF FF FF D5 AA 96 <-1C7D ^^^^^^^^ standard address prologue 1C80: FF FE AA AB AA AA FF FF 1C88: AB AA CF F3 FC FF FF FF ^^^^^^^^ non-standard address epilogue 1C90: FF FF FF D5 AA FF CF CA ^^^^^^^^ non-standard data prologue 1C98: DF BE B5 F5 E9 AF BF BD ---------------------------------------- A TO ANALYZE DATA ESC TO QUIT ? FOR HELP SCREEN / CHANGE PARMS Q FOR NEXT TRACK SPACE TO RE-READ --^-- All tracks appear to use the same prologue and epilogue sequences (except for the first 10 sectors on track 0). The sectors I can read on track 0 appear to be a standard(-ish) DOS 3.3 RWTS. Of course, there are some modifications to accommodate the non-standard prologue and epilogue sequences, but a cursory glance shows no other obvious pitfalls. Of course, it's always the non-obvious pitfalls that bite you, so let's forget I mentioned it. Go go gadget AUTOTRACE! [S6,D1=original disk] [S5,D1=my work disk] ]PR#5 ... CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 CAPTURING BOOT1 ...reboots slot 6... ...reboots slot 5... SAVING BOOT1 SAVING RWTS For those of you just tuning in, my work disk uses a custom program that I affectionately call "AUTOTRACE" to automate the process of boot tracing as far as possible. For some disks, this just captures track 0, sector 0 (saved in a file called "BOOT0") and stops. For other disks that load in the same way that an unprotected DOS 3.3 disk loads, it captures the next stage of the boot process as well (in a file called "BOOT1"). BOOT1 contains sectors 0-9 on track 0, which are loaded into memory at $B600..$BFFF. This generally contains the RWTS routines which the program uses to read the rest of the disk. If the RWTS is fairly normal as well (and my AUTOTRACE program just spot- checks a few memory locations to guess at its "normalcy"), there's a good chance I'll be able to use a tool called Advanced Demuffin (written in 1983 by The Stack) to convert the disk from whatever weird format it uses to store its sector data into a standard disk readable by unprotected DOS 3.3 disks or any other third-party tools. In this case, AUTOTRACE extracts the RWTS routines (generally loaded from track 0, sectors 2-9 into $B800..$BFFF) and saves *that* into a third file called "RWTS". If anything looks fishy or non- standard, AUTOTRACE just stops, and I have to check the files it saved so far to determine why. But in this case, it ran all the way through, automatically capturing BOOT0, BOOT1, and RWTS files. Now I can use Advanced Demuffin to convert the disk to a standard format. (It uses the disk's own RWTS to read the original, then a standard DOS 3.3- compatible RWTS to write out the data, sector by sector.) Advanced Demuffin will only load RWTS files from a drive in slot 6, which is annoying since mine is in slot 5. Note to self: patch that someday. In the meantime, I'm swapping floppy disks like some kind of 18th century pioneer. [S6,D1=my work disk] ]PR#6 ]BRUN ADVANCED DEMUFFIN 1.1 --> LOAD NEW RWTS MODULE At $B8, load "RWTS" from drive 1 [S6,D1=original disk] [S6,D2=blank disk] --> FORMAT TARGET DISK ...grind grind grind... --> CONVERT DISK This disk is 16 sectors, and the default options (copy the entire disk, all tracks, all sectors) don't need to be changed. --v-- ADVANCED DEMUFFIN 1.1 - COPYRIGHT 1983 WRITTEN BY THE STACK -CORRUPT COMPUTING =======PRESS ANY KEY TO CONTINUE======= TRK:R.................................. +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0:R.................................. SC1:R.................................. SC2:R.................................. SC3:R.................................. SC4:R.................................. SC5:R.................................. SC6:R.................................. SC7:R.................................. SC8:R.................................. SC9:R.................................. SCA:................................... SCB:................................... SCC:................................... SCD:................................... SCE:................................... SCF:................................... ======================================= 16 SC $00,$00 TO $22,$0F BY $01 TO DRV2 --^-- The disk's own RWTS can't read the first 10 sectors of track 0, but that's to be expected -- they were in a different format than the rest of the disk. What I really care about is the rest of the disk, and that part went flawlessly. That's the power and the genius of Advanced Demuffin. Every disk must be able to read itself. So, let it read itself, capture the data, and write it out in a standard format. Of course, my copy won't boot, because it doesn't have any boot code in the first 10 sectors of track 0! But check this out... [S6,D1=my work disk] [S6,D2=demuffin'd copy] ]PR#6 ... ]CATALOG,S6,D2 C1983 DSR^C#254 211 FREE A 003 HELLO B 017 INTROPK A 034 GAME T 002 HELP1TXT T 003 HELP2TXT T 003 HELP3TXT T 003 HELP4TXT T 003 HELP5TXT T 003 HELP6TXT T 002 HELP7TXT T 003 HELP8TXT T 002 HELP9TXT T 003 HELP10TXT T 003 HELP11TXT T 003 HELP12TXT T 003 HELP14TXT A 018 START *B 002 MOVE *B 002 HRU2 T 003 HELP15TXT T 003 HELP17TXT T 002 HELP18TXT T 003 HELP19TXT *B 003 RBOOT *B 005 RLOAD *R 012 HRCG T 003 HELP20TXT *B 002 SWAP T 003 HELP21TXT T 003 HELP22TXT *B 002 SOUND T 003 HELP23TXT T 003 HELP24TXT T 003 HELP25TXT T 003 HELP26TXT T 003 HELP16TXT T 057 ANSWERS T 039 QUESTIONS A 004 MIKE T 003 POINTERS B 011 HELP13PK ]RUN HELLO The game loads and runs without complaint. All further disk access is done through standard DOS functions. (It even runs from drive 2!) There doesn't appear to be any kind of nibble check or other copy protection, beyond the custom DOS. Now to make the disk be able to read itself. Using Copy ][+, I can "copy DOS" from a freshly initialized DOS 3.3 disk to the demuffin'd copy. This function of Copy ][+ just sector-copies tracks 0-2 from one disk to another, but it's easier than setting that up manually in some other copy program. [S6,D1=demuffin'd copy] [S6,D2=newly formatted DOS 3.3 disk] Copy ][+ --> COPY --> DOS --> from slot 6, drive 2 --> to slot 6, drive 1 ...read read read... ...write write write... Quod erat liberandum. --------------------------------------- A 4am crack No. 83 ------------------EOF------------------