-----------Gertrude's Secrets---------- A 4am crack 2014-03-26 --------------------------------------- Gertrude's Secrets is 1982 educational game distributed by The Learning Company. Booting the original disk sounds like a normal DOS 3.3, complete with track seeking to track 2, then 1, then 0, then swinging to the middle of the disk to read the catalog track. It even displays a BASIC prompt during boot, as if it's loading a HELLO program. However, the disk is uncopyable by any automated method. COPYA fails instantly. EDD4 bit copy gives read errors on track $13 and up (which appear to be entirely unformatted). The copy that EDD4 creates can boot, but it only gets as far as loading DOS and displaying the BASIC prompt before clearing the screen and rebooting. My trusty Copy ][+ 5.5 sector editor can read tracks $00 through $12, though, once I change the RWTS option to "DOS 3.3 patched" (which ignores address field checksums and epilogue bytes). Track $11 does appear to contain a disk catalog. My initial hypothesis: 6-2 nibble encoding scheme; custom RWTS with standard prologue bytes ("D5 AA 96" and "D5 AA AD") but non-standard epilogue bytes; a CALL in the HELLO program that executes a nibble check. I can use COPYA from the DOS 3.3 master disk to copy the data from the original disk to a blank disk with standard epilogue bytes. By booting the DOS 3.3 master disk and changing $B942 from SEC ($38) to CLC ($18), I can create a "no checksum" RWTS that ignores epilogue bytes on read but respects them on write. I will need to make one additional modification. By default, COPYA copies the entire disk, tracks $00 through $22. There is no option in the UI to change this, so I will need to manually BLOAD COPY.OBJ0 and modify it to stop reading and writing after track $12. [S6D1=DOS 3.3 master disk] Load COPYA and its helper program into memory: ]LOAD COPYA ]BLOAD COPY.OBJ0 Stop COPYA from reloading COPY.OBJ0: ]70 Patch COPY.OBJ0 in memory to stop reading (and writing -- two separate patches) after track $12: ]CALL-151 *302:13 *35F:13 Patch DOS to ignore epilogue errors: *B942:18 And go: *3D0G ]RUN [S6D1=Gertrude's Secrets original disk] [S6D2=blank disk] This produces a copy that is readable by unmodified DOS 3.3. The copy can even read itself (since the only thing that's changed is the epilogue bytes that it was ignoring in the first place). But it still displays the same behavior as the copy I made with EDD4: it loads DOS, displays the BASIC prompt, then reboots. However, further investigation reveals something very interesting... [S6D1=DOS 3.3 master disk] [S6D2=Gertrude's Secrets copy] ]PR#6 ]CATALOG,D2 DISK VOLUME 254 A 002 HELLO B 055 SECRET WORLD B 009 SECRETSGOOSE.O B 034 ADV #108 B 005 SECRETFONT B 002 SECRETSRANDOM.O B 015 SECRETSHELLO&TITLER.OBJ0 B 004 SECRETSHELLO.O B 026 SECRETCODE.O B 002 FRESHSTART.O B 055 SECRET WORLD.IIE B 033 SECRETLOGO ]RUN HELLO Lo and behold, the game loads and runs! That means that the last part of my hypothesis was incorrect. Whatever secondary protection causes the copy to reboot is not part of the HELLO program; it's part of the custom DOS. At this point, I can recreate a working copy of the game by initializing another blank disk with DOS 3.3 and copying these files over with a file copier. What about the nibble check? Don't even care. OK, OK, I care a little. But it's easy enough to find. [S5D1=my work disk] [S6D1=non-working copy] ]PR#5 ]CALL -151 *8600