--------------Microzine 1-------------- A 4am crack 2015-11-20 --------------------------------------- Name: Microzine vol. 1, issue 1 Genre: educational Year: 1983 Credits: Dan Klassen (producer and editor) David G. Olmon (lead programmer) Tom Hansen, Karen Klassen, and Don Wagner (software designers) Al Borchers and Gary Johnson (programmers) Ame C. Flynn and Michael Callery (computer graphic design) Lorene Lavora and Steve Sullivan (computer illustration) Family Computer Center (testing) Deborah Kovacs (creative director) Stephen Gass (project manager) Jeffrey Siegel (software editor) Bob Neumann, Megan Stine, and H. William Stine (contributing software editors) Publisher: Scholastic, Inc. Media: double-sided 5.25-inch floppy OS: DOS 3.3 Previous cracks: none Both sides are bootable. I'll start with side A. _________________________________ { } { "Unless someone like you } { cares a whole awful lot, } { nothing's going to get better. } { It's not." } { } { The Lorax } {_________________________________} ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA reads a few tracks then exits with a read error Locksmith Fast Disk Backup unable to read T03-T22 EDD 4 bit copy (no sync, no count) no errors, but the copy loads DOS and just grinds and exits with an I/O error Copy ][+ nibble editor modified address prologue (D5 AA 97) plus some extra weirdness -- looks like an extra $FF nibble after the address prologue --v-- COPY ][ PLUS BIT COPY PROGRAM 8.4 (C) 1982-9 CENTRAL POINT SOFTWARE, INC. --------------------------------------- TRACK: 03 START: 3721 LENGTH: 015F 3700: EB D7 9F DE AA EB FF FF VIEW ^^^^^^^^ data epilogue 3708: FF FF FF FF FF FF FF FF 3710: FF FF FF FF FF FF FF FF 3718: FF FF FF FF FF D5 AA 97 ^^^^^^^^ address prologue 3720: FF AA AA AB AB AA AB AB <-3721 ^^ ^^^^^ ^^^^^ ^^^^^ ^^ ?? vol=0 trk=3 sec=1 check... 3728: AA DE AA EB FF FF FF FF ^^ ^^^^^^^^ ...sum address epilogue 3730: FF FF FF FF FF D5 AA AD ^^^^^^^^ data prologue 3738: 96 AD FB B4 96 E6 E6 DC 3740: F6 F5 FE 9E F5 CB B6 CD --------------------------------------- A TO ANALYZE DATA ESC TO QUIT ? FOR HELP SCREEN / CHANGE PARMS Q FOR NEXT TRACK SPACE TO RE-READ --^-- All higher tracks also have that extra $FF nibble after the address prologue. It's 100% consistent, not a fluke. Disk Fixer no way to tell it to ignore the extra $FF nibble, so sector editing is impossible Why didn't COPYA work? modified address prologue (T03+) Why didn't Locksmith FDB work? modified address prologue (T03+) Why didn't my EDD copy work? I don't know. A bit copier wouldn't care about an extra $FF nibble, and examining my non-working copy in a nibble editor, it's being preserved. There's either a runtime protection check during boot, or the RWTS is sensitive to timing bits somewhere, or I don't even know. Next steps: 1. AUTOTRACE to capture the RWTS 2. Advanced Demuffin to convert the disk to a standard format 3. Patch the RWTS (or replace it) 4. Look for runtime protection checks ~ Chapter 1 In Which We Attempt To Use The Original Disk As A Weapon Against Itself And It Doesn't Work [S6,D1=original disk] [S6,D2=blank disk] [S5,D1=my work disk] ]PR#5 CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 CAPTURING BOOT1 ...reboots slot 6... ...reboots slot 5... SAVING BOOT1 SAVING RWTS ]BRUN ADVANCED DEMUFFIN 1.5 ["5" to switch to slot 5] ["R" to load a new RWTS module] --> At $B8, load "RWTS" from drive 1 ["6" to switch to slot 6] ["C" to convert disk] --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC1:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC2:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC3:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC4:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC5:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC6:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC7:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC8:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC9:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCA:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCB:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCC:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCD:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCE:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCF:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR ======================================= 16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- That was not terribly helpful. Then again, that makes sense. The DOS tracks are unprotected (even COPYA was able to get that far). There must be a routine later in the boot process that changes the RWTS so it can read tracks $03-$22. Let's go find it. ~ Chapter 2 In Which It All Comes Down To A Single CPU Cycle ]PR#5 ... ]CALL -151 *9600 At $A8, load "RWTS A800" from drive 1 ["6" to switch to slot 6] ["C" to convert disk] --> CHANGE DEFAULT VALUES? Y --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM ======================================= INPUT ALL VALUES IN HEX SECTORS PER TRACK? (13/16) 16 START TRACK: $03 <-- change this START SECTOR: $00 END TRACK: $22 END SECTOR: $0F INCREMENT: 1 MAX # OF RETRIES: 0 COPY FROM DRIVE 1 TO DRIVE: 2 ======================================= 16SC $03,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- [S6,D1=original disk] [S6,D2=demuffin'd copy (T00-T02)] Now press RETURN to start the copy... --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK: ................................ +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0: ................................ SC1: ................................ SC2: ................................ SC3: ................................ SC4: ................................ SC5: ................................ SC6: ................................ SC7: ................................ SC8: ................................ SC9: ................................ SCA: ................................ SCB: ................................ SCC: ................................ SCD: ................................ SCE: ................................ SCF: ................................ ======================================= 16SC $03,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- ]PR#5 ]CATALOG,S6,D2 C1983 DSR^C#254 002 FREE B 002 HELLO A 003 MICROZINE PREMIER ISSUE SIDE 1 A 004 HELLO1 A 003 HELLO2 A 015 TABLE OF CONTENTS A 008 CREDITS A 044 TP.1 A 043 TP.2 A 055 TP.3 A 033 TP.4 A 033 TP.5 A 005 PREVIEW A 003 LOAD PIC B 002 LOMEM: B 022 HRCG B 010 PICDRAW B 002 RUNPACK B 002 SOUND.OBJ B 002 ST.TP B 011 MZINE1.PAK B 011 MZINE2.PAK B 019 PREVIEW.PAK B 018 G&S.PAK B 021 TWISTAPLOT.PAK B 017 ASK ME.PAK B 017 TOOLCHEST.PAK B 014 HOW IT WORKS.PAK B 005 BALL.SPC B 004 BED.SPC B 003 BELL.SPC B 003 BW3.SPC B 005 EYES.SPC B 005 GHOST.SPC B 010 HOUSE.SPC B 006 MURRY.SPC B 003 NILVAIL.SPC B 008 TITLE.SPC B 010 WIMPS.SPC B 007 WOODS.SPC T 002 NAME B 002 MICROZINE DATA MESSAGE T 002 SIDE [S6,D1=demuffin'd copy] ]PR#6 ...grinds... Of course, the disk can't read itself because it's still patching the RWTS to read the custom address prologue with four nibbles, two timing bits, and a partridge in a pear tree. I can neuther the routine at $A9F8 by putting an "RTS" there. T01,S08,$F8 change A9 to 60 ]PR#6 ...works... Side B has identical protection. Quod erat liberand one more thing... ~ Chapter 4 In Which We Patch A 32-Year-Old Bug The original disk does not work on an enhanced //e (or //c, or IIgs); it gets as far as displaying the title screen, then crashes after you press a key. (My crack, as it stands, does not work on those machines either. This is not related to the copy protection.) I traced through the startup process on my non-working copy. The startup program is the (binary) HELLO program, which patches some of the late-stage bootloader patches (to prevent hackers from capturing a working DOS in memory) and eventually runs the (BASIC) HELLO1 program. HELLO1 eventually exits via the (BASIC) HELLO2 program. HELLO2 is supposed to exit via the (BASIC) TABLE OF CONTENTS program, but neither the original nor my cracked copy ever make it that far. ]PR#5 ... ]LOAD HELLO2,S6,D1 ]LIST 0 ONERR GOTO 62000 1 HIMEM: 39310 10 REM HELLO2 20 HIMEM: 38400 30 PRINT CHR$ (4)"BLOADPICDRAW " 40 PRINT CHR$ (4)"BRUNLOMEM:": & LOMEM: 16384 50 PRINT CHR$ (4)"BRUNHRCG" 55 CALL 3072: POKE 783,0 70 PRINT CHR$ (4)"RUNTABLE OF CONTENTS,D1" 62000 PRINT CHR$ (12): PRINT CHR$ (4)"PR#0": PRINT CHR$ (4)"I N#0": PRINT CHR$ (4): TEXT : HOME 62010 VTAB 11: HTAB 4: PRINT "T HERE IS A PROBLEM WITH YOUR DISK": PRINT 62020 HTAB 9: PRINT "PRESS ANY KEY TO RESTART" 62030 CALL 39503 Through some trial and error, I narowed it down further to line 50, which executes the binary HRCG program. (I'm 99% sure that "HRCG" stands for "hi-res character generator.") ]BLOAD HRCG ]CALL -151 *BF55.BF56 BF55- 00 0C *C00L 0C00- 4C 06 0C JMP $0C06 *C06L 0C06- 86 1F STX $1F 0C08- A9 00 LDA #$00 0C0A- A0 11 LDY #$11 0C0C- 99 02 03 STA $0302,Y 0C0F- 88 DEY 0C10- 10 FA BPL $0C0C 0C12- A9 DE LDA #$DE 0C14- 8D 14 03 STA $0314 0C17- A9 11 LDA #$11 0C19- 8D 15 03 STA $0315 0C1C- 8D 52 C0 STA $C052 0C1F- A9 10 LDA #$10 0C21- 8D 03 03 STA $0303 0C24- A9 1C LDA #$1C 0C26- 8D 04 03 STA $0304 ; I'm not sure what's the significance ; of $1C00, but on my machine it's $FF, ; so this branch is always taken 0C29- 2C 00 1C BIT $1C00 0C2C- 30 05 BMI $0C33 ;[skipped] ;0C2E- A9 E0 LDA #$E0 ;0C30- 8D 0C 03 STA $030C ; execution continues here (from $0C2C) 0C33- 2C 06 E0 BIT $E006 According to "Open Apple Vol. 1 No. 5" page 42, $E006 is a machine ID byte. $00 = ][+ or unenhanced IIe $C4 = enhanced //e $89 = //c ; A "BIT" instruction sets the Z flag ; as if the value had been ANDed with ; the accumulator. On my enhanced //e, ; $E006 is $C4. The accumulator is $1C ; at this point (set at $0C24), so this ; branch is not taken. 0C36- 10 0E BPL $0C46 0C38- A9 00 LDA #$00 0C3A- 85 4A STA $4A 0C3C- 85 CC STA $CC 0C3E- A9 40 LDA #$40 0C40- 85 4B STA $4B 0C42- 85 CD STA $CD 0C44- D0 13 BNE $0C59 ;[skipped] ;0C46- A5 E6 LDA $E6 ;0C48- C9 20 CMP #$20 ;0C4A- F0 04 BEQ $0C50 ;0C4C- C9 40 CMP #$40 ;0C4E- D0 05 BNE $0C55 ;0C50- 8D 26 03 STA $0326 ;0C53- F0 0C BEQ $0C61 ;0C55- A9 20 LDA #$20 ;0C57- 85 E6 STA $E6 ; execution continues here (from $0C44) 0C59- A9 20 LDA #$20 0C5B- 8D 26 03 STA $0326 0C5E- 20 05 08 JSR $0805 <-- ! And there's the problem: this program is assuming there's something to call at $0805, but there isn't. The HELLO2 BASIC program is still in memory at the usual starting address ($0801), so this is just calling some random Applesoft opcodes and crashing. I don't know if this program was part of some larger library that was only partially loaded, or what happened, but that's where the program crashes on my enhanced //e. Since there's no way to salvage this broken code path, I'm going to patch the BIT instruction at $0C33 so it always branches to $0C46. [Disk Fixer] ["D"irectory mode] select "HRCG" T21,S0E,$37 change "2C06E0" to "EA3010" And the same patch on side B: T10,S0E,$37 change "2C06E0" to "EA3010" Quod erat liberandum. --------------------------------------- A 4am crack No. 500 ------------------EOF------------------