--Who Am I? Birds, Trees, and Flowers-- A 4am crack 2014-07-12 --------------------------------------- "Who Am I? Birds, Trees, and Flowers" is a 1986 educational game developed by Frederick Burggraf and distributed by Focus Media, Inc. The original comes on two double-sided disks and uses all four sides. All four sides are bootable, and each loads DOS, displays a BASIC prompt, then runs a HELLO program of some sort. Disk 1 side A is labeled "Program", while disk 2 side A is labeled "Program Plus Editor". Side A of each disk launches an identical main menu. Side B of each disk loads a HELLO program which simply says "THIS DISK MUST BE BOOTED FROM THE OTHER SIDE." (Actually, I'm wondering if these disks might use Pronto-DOS. DOS 3.3 loads 5 sectors from track 2; Pronto-DOS only loads 1, so the boot sound is different -- a grace note instead of a quarter note before moving the drive head from track 2 to track 1.) COPYA fails miserably and immediately with a disk read error. EDD 4 bit copy gives no read errors, but the copy grinds the disk drive on boot and never gets any further. My trusty Copy ][+ sector editor can read track 0, sectors 0-9 without any trouble. Everything beyond that, even the rest of the sectors on track 0, is unreadable. Ignoring epilogue bytes (press "P" to get to the Sector Editor Patcher, then select "DOS 3.3 PATCHED") makes no difference. Switching to the nibble editor, it appears that all the tracks are in a fairly standard 16-sector format, but the data prologue has been changed from "D5 AA AD" to "D5 AA FF". --v-- COPY ][ PLUS BIT COPY PROGRAM 8.4 (C) 1982-9 CENTRAL POINT SOFTWARE, INC. --------------------------------------- TRACK: 0D START: 233D LENGTH: 015F 2318: FF FF FF FF FF FF FF FF VIEW 2320: FF FF FF FF FF FF FF FF 2328: FF FF FF FF FF FF FC FF 2330: FF FF FF FF FF FF FF FF 2338: FF FF FF FF FF D5 AA 96 <-233D ^^^^^^^^ standard address prologue 2340: FF FE AE AF AA AA FB FB 2348: AB AA CF F3 FC FF FF FF ^^^^^^^^ non-standard address epilogue 2350: FF FF FF D5 AA FF CF CA ^^^^^^^^ non-standard data prologue 2358: D9 D2 D2 D2 D2 D2 D2 D2 --------------------------------------- A TO ANALYZE DATA ESC TO QUIT ? FOR HELP SCREEN / CHANGE PARMS Q FOR NEXT TRACK SPACE TO RE-READ --^-- All tracks appears to use the same prologue and epilogue sequences (except for the first 10 sectors on track 0). The sectors I can read on track 0 appear to be a standard(-ish) DOS 3.3 RWTS. Of course, there are some modifications to accommodate the non-standard prologue and epilogue sequences, but a cursory glance shows no other obvious pitfalls. Of course, it's always the non-obvious pitfalls that bite you, so let's forget I mentioned it. Go go gadget AUTOTRACE! [S6,D1=original disk] [S5,D1=my work disk] ]PR#5 ... CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 CAPTURING BOOT1 ...reboots slot 6... ...reboots slot 5... SAVING BOOT1 SAVING RWTS For those of you just tuning in, my work disk uses a custom program that I affectionately call "AUTOTRACE" to automate the process of boot tracing as far as possible. For some disks, this just captures track 0, sector 0 (saved in a file called "BOOT0") and stops. For other disks that load in the same way that an unprotected DOS 3.3 disk loads, it captures the next stage of the boot process as well (in a file called "BOOT1"). BOOT1 contains sectors 0-9 on track 0, which are loaded into memory at $B600..$BFFF. This generally contains the RWTS routines which the program uses to read the rest of the disk. If the RWTS is fairly normal as well (and my AUTOTRACE program just spot- checks a few memory locations to guess at its "normalcy"), there's a good chance I'll be able to use a tool called Advanced Demuffin (written in 1983 by The Stack) to convert the disk from whatever weird format it uses to store its sector data into a standard disk readable by unprotected DOS 3.3 disks or any other third-party tools. In this case, AUTOTRACE extracts the RWTS routines (generally loaded from track 0, sectors 2-9 into $B800..$BFFF) and saves *that* into a third file called "RWTS". If anything looks fishy or non- standard, AUTOTRACE just stops, and I have to check the files it saved so far to determine why. But in this case, it ran all the way through, automatically capturing BOOT0, BOOT1, and RWTS files. Now I can use Advanced Demuffin to convert the disk to a standard format. (It uses the disk's own RWTS to read the original, then a standard DOS 3.3- compatible RWTS to write out the data, sector by sector.) Advanced Demuffin will only load RWTS files from a drive in slot 6, which is annoying since mine is in slot 5. Note to self: patch that someday. In the meantime, I'm swapping floppy disks like some kind of 20th century peasant. [S6,D1=my work disk] ]PR#6 ]BRUN ADVANCED DEMUFFIN 1.1 --> LOAD NEW RWTS MODULE At $B8, load "RWTS" from drive 1 [S6,D1=original disk] [S6,D2=blank disk] --> FORMAT TARGET DISK ...grind grind grind... --> CONVERT DISK This disk is 16 sectors, and the default options (copy the entire disk, all tracks, all sectors) don't need to be changed. --v-- ADVANCED DEMUFFIN 1.1 - COPYRIGHT 1983 WRITTEN BY THE STACK -CORRUPT COMPUTING =======PRESS ANY KEY TO CONTINUE======= TRK:R.................................. +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0:R.................................. SC1:R.................................. SC2:R.................................. SC3:R.................................. SC4:R.................................. SC5:R.................................. SC6:R.................................. SC7:R.................................. SC8:R.................................. SC9:R.................................. SCA:................................... SCB:................................... SCC:................................... SCD:................................... SCE:................................... SCF:................................... ======================================= 16 SC $00,$00 TO $22,$0F BY $01 TO DRV2 --^-- The disk's own RWTS can't read the first 10 sectors of track 0, but that's to be expected -- they were in a different format than the rest of the disk. What I really care about is the rest of the disk, and that part went flawlessly. That's the power and the genius of Advanced Demuffin. Every disk must be able to read itself. So, let it read itself, then capture the data and write it out in a standard format. Of course, my copy won't boot, because it doesn't have any boot code in the first 10 sectors of track 0! But check this out... [S6,D1=my work disk] [S6,D2=demuffin'd copy] ]PR#6 ... ]CATALOG,S6,D2 C1983 DSR^C#254 198 FREE A 002 HELLO B 002 CORNER.FRAME.SPC T 002 SIDE T 002 NAME.TXT A 004 HOWDY2 A 005 GETNAME B 015 RULES1.PAC B 019 TITLE.PAC B 018 RULES2.PAC B 021 RULES3.PAC B 020 RULES4.PAC B 017 RULES5.PAC B 012 LOGO.PAC A 005 LOADFLEX A 003 TITLE.BAS B 014 PICDRAWH B 002 RELOCATOR B 013 FLEX TEXT *B 005 ASCII.40 *B 005 ASCII.56 B 006 WHO.MODULE B 002 GMOVER A 003 HOWDY B 005 UNDERLINE.40 A 004 REHOWDY A 002 RETITLE.BAS A 019 FIXER T 002 HONOR.ROLL.DATA A 005 RULES A 051 WHO AM I? T 002 SOUND1 T 002 SOUND2 T 002 SOUND3 T 002 SOUND4 *B 003 LOOKLO B 002 SHOW ]RUN HELLO The game loads and runs without complaint. All further disk access is done through standard DOS functions. (It even runs from drive 2!) There doesn't appear to be any kind of nibble check or other copy protection, beyond the custom DOS. Furthermore, my initial hunch was correct -- the original disk uses a modified version of Pronto-DOS. Looking at T02,S00 in a sector editor reveals the string "PRONTO-DOS" backwards. --v-- SECTOR EDITOR DRIVE 2 78- ED BF EA A9 0A D0 06 AD m?j).P.- 80- C5 B5 18 90 01 38 08 8D E5...8.. 88- C5 B5 A9 00 85 48 20 7E E5)..H ~ 90- AE 28 AE 9B B3 9A 60 11 .(..3.`. 98- 0D 00 00 EE 00 01 00 00 ...n.... A0- 00 00 FF FF 01 0A 64 D4 ......dT A8- C9 C1 C2 D3 D2 C1 C2 D6 IABSRABV B0- A0 D3 CF C4 AD CF D4 CE SOD-OTN B8- CF D2 D0 04 11 0F 03 00 ORP..... C0- 00 FE 00 00 00 00 00 00 .~...... C8- 00 00 00 00 00 00 00 00 ........ D0- 00 00 00 00 00 00 00 00 ........ D8- 00 00 00 00 00 00 00 00 ........ E0- 00 00 7A 00 00 00 00 00 ..z..... E8- 00 00 00 11 01 00 00 23 .......# F0- 10 00 01 00 00 00 00 00 ........ F8- 00 00 00 FF FE 00 00 FF ....~... TRACK $02 SECTOR $00 DOS 3.3 [?]-HELP SCREEN --^-- Now to make the disk be able to read itself. Using Copy ][+, I can "copy DOS" from a freshly initialized Pronto- DOS disk to the demuffin'd copy. This function of Copy ][+ just sector-copies tracks 0-2 from one disk to another, but it's easier than setting that up manually in some other copy program. [S6,D1=demuffin'd copy] [S6,D2=newly formatted Pronto-DOS disk] Copy ][+ --> COPY --> DOS --> from slot 6, drive 2 --> to slot 6, drive 1 ...read read read... ...write write write... Repeating this procedure for the other 3 sides yields a completely clean copy of the entire program. Quod erat liberandum. --------------------------------------- A 4am crack No. 80 ------------------EOF------------------