--------------Microzine 15------------- A 4am crack 2015-08-28 -------------------. updated 2015-09-06 |___________________ Name: Microzine 15 Genre: educational Year: 1986 Publisher: Scholastic, Inc. Media: one double-sided 5.25-inch disk OS: Pronto-DOS (although T02,S00 has the string "SCHOLASTIC" where "PRONTO-DOS" should be) Previous cracks: none Similar cracks: Microzine 19 (crack no. 390) ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA no errors, but copy loads DOS, swings to a high-numbered track, and reboots Locksmith Fast Disk Backup ditto EDD 4 bit copy (no sync, no count) ditto In my experience, computers do not spontaneously reboot unless someone tells them to. Disk Fixer T00 -> looks like DOS 3.3 RWTS T00-T02 -> looks like full DOS 3.3 T01,S07 -> startup program is "PACK1.OBJ" Why didn't any of my copies work? probably a nibble check in the startup program Next steps: 1. Load and trace the startup program 2. Find and disable the nibble check 3. There is no step 3 (I hope) ~ Chapter 1 In Which We Play Push-Me-Pull-You [S6,D1=non-working Locksmith FDB copy] ]PR#6 [ at DOS prompt] ]FP ]CATALOG SCHOLASTIC V254 B 010 ALICE.SPC B 009 CIT.SPC B 002 CIT2.SPC B 002 CLEAR.OBJ A 007 CREDITS B 004 DOL.SPC B 011 END.SPC B 010 FROG.SPC B 011 HALLO.SPC A 005 HELLO B 004 INIT.OBJ B 006 JEFF.SPC B 002 JEFF2.SPC B 012 LITTLE APEX A 006 LOAD PIC B 010 MARS.SPC A 004 MICROZINE SIDE 1 T 002 MZ.PARAMETER FILE B 008 MZINE1.PAC B 008 MZINE2.PAC B 011 NORTON.SPC A 071 OVAL B 009 OVAL.SPC B 002 PACK.OBJ B 002 PACK1.OBJ B 014 PICDRAWH B 012 PRES.SPC B 009 PROBE.SPC B 010 ROBOT.SPC T 002 SIDE B 009 SNOOD.SPC B 002 SOUND.OBJ B 002 ST.ROSETTE B 002 ST.TIME A 023 TABLE OF CONTENTS B 004 TPINDEX T 151 TWISTAPLOT FILE A 023 UTILITIES B 004 UTILITIES.SPC B 006 VOTE.SPC B 010 VPS.SPC ]BLOAD PACK1.OBJ ]CALL-151 *AA72.AA73 AA72- 00 90 *9000L ; get address of RWTS parameter table 9000- 20 E3 03 JSR $03E3 9003- 85 FB STA $FB 9005- 84 FA STY $FA ; pushing bytes to the stack out of ; nowhere is a little suspicious 9007- A9 C5 LDA #$C5 9009- 48 PHA ; copy some local values into the RWTS ; parameter table 900A- A9 00 LDA #$00 900C- 85 FC STA $FC 900E- A2 03 LDX #$03 9010- BC 49 90 LDY $9049,X 9013- 91 FA STA ($FA),Y 9015- CA DEX 9016- 10 F8 BPL $9010 9018- 8A TXA ; more stack fiddling 9019- 48 PHA At this point, we've pushed two bytes on the stack -- $C5 and $FF. In other words, an RTS right now would pop those values off the stack, add 1, and "return" to... $C600. Which reboots. There is absolutely no reason for legitimate code to do this. There is, however, one very good reason for illegitimate code to do this: because it wants to reboot but doesn't want lazy hackers searching for the hex sequence "4C 00 C6" and finding this routine within seconds. 901A- 20 3C 90 JSR $903C *903CL ; call the RWTS (most likely just to ; move the drive head to the proper ; position for an impending nibble ; check) 903C- 20 E3 03 JSR $03E3 903F- 20 D9 03 JSR $03D9 9042- A9 00 LDA #$00 9044- 85 48 STA $48 ; if that fails, off to The Badlands 9046- B0 5E BCS $90A6 9048- 60 RTS Caller was $901A, so resuming at $901D: *901DL ; get the slot number (x16) from the ; RWTS parameter table and put it in X 901D- A0 01 LDY #$01 901F- B1 FA LDA ($FA),Y 9021- AA TAX ; don't know what this does yet 9022- 20 59 90 JSR $9059 *9059L ; turning on the drive motor manually ; is always suspicious 9059- BD 89 C0 LDA $C089,X ; set up a Death Counter 905C- A9 56 LDA #$56 905E- 85 FD STA $FD 9060- A9 08 LDA #$08 9062- C6 FC DEC $FC 9064- D0 04 BNE $906A ; If the Death Counter hits zero, that ; would be bad. Which part of "Death ; Counter" sounded good to you, anyway? 9066- C6 FD DEC $FD 9068- F0 3C BEQ $90A6 ; look for a specific nibble ($FB) 906A- BC 8C C0 LDY $C08C,X 906D- 10 FB BPL $906A 906F- C0 FB CPY #$FB 9071- D0 ED BNE $9060 9073- F0 00 BEQ $9075 ; kill a few cycles (not pointless, ; because the disk spins independently ; of the CPU, so all of these low-level ; disk reads are highly time-sensitive) 9075- EA NOP 9076- EA NOP ; read data latch (note: no BPL loop ; here, we're just reading it once) 9077- BC 8C C0 LDY $C08C,X ; do a compare to set or clear the ; carry bit (among other things, but ; it's the carry bit we care about) 907A- C0 08 CPY #$08 ; rotate the carry into the low bit of ; the accumulator 907C- 2A ROL ; if we just rolled a "1" bit out of ; the high bit of the accumulator, take ; this branch 907D- B0 0B BCS $908A ; next nibble needs to be $FF 907F- BC 8C C0 LDY $C08C,X 9082- 10 FB BPL $907F ; ...otherwise we start over 9084- C0 FF CPY #$FF 9086- D0 D8 BNE $9060 ; loop back to get next nibble 9088- F0 EB BEQ $9075 ; execution continues here (from $907D) ; get another nibble 908A- BC 8C C0 LDY $C08C,X 908D- 10 FB BPL $908A ; stash it in zero page 908F- 84 FC STY $FC ; if the accumulator is anything but ; %00001010, start over 9091- C9 0A CMP #$0A 9093- D0 CB BNE $9060 I got lost several times trying to follow this routine. I think the easiest way to explain it is to show the difference between the original disk and my non-working copy. Here is the original disk, as seen by the Copy II+ nibble editor. Nibbles with extra "0" bits (timing bits) after them are displayed in inverse on an original machine, marked here with a "+" after the nibble. --v-- COPY ][ PLUS BIT COPY PROGRAM 8.4 (C) 1982-9 CENTRAL POINT SOFTWARE, INC. --------------------------------------- TRACK: START: 1B1E LENGTH: 17C1 1C70: 9F EB E5 FC D7 D7 D7 EE VIEW 1C78: FA E6 E6 FF FE F2 ED FD 1C80: FF EF ED BA BB DD AF E6 1C88: B7 A7 CB B7 DE AA EB FF 1C90: FF FF FF FB+FF FF+FF FF+ 1C98: FD FF+FF+FF+FF+FF+FF+FF+ 1CA0: FF+FF+D5 AA 96 AA AB AA 1CA8: AA AA AB AA AA DE AA EB+ 1CB0: FF+FF+FF+FF+FF+FF D5 AA --------------------------------------- A TO ANALYZE DATA ESC TO QUIT ? FOR HELP SCREEN / CHANGE PARMS Q FOR NEXT TRACK SPACE TO RE-READ --^-- It's easy to understand why a simple sector copy failed. The sequence that this code is looking for starts at offset $1C93, which is between the end of one sector and the beginning of the next. (The data epilogue is at $1C8C; the next address prologue is at $1CA2.) Sector copiers discard everything between those delimiters and rebuild the track with a default pattern of sync bytes. That pattern doesn't include an $FB nibble, so the nibble check fails. But the EDD bit copy also failed. Here is the original disk's pattern at offset $1C93: - $FB + timing bit - $FF - $FF + timing bit - $FF - $FF + timing bit And here is what the same part of the track looks like on my failed EDD copy: --v-- COPY ][ PLUS BIT COPY PROGRAM 8.4 (C) 1982-9 CENTRAL POINT SOFTWARE, INC. --------------------------------------- TRACK: START: 1B1E LENGTH: 17C1 1C70: 9F EB E5 FC D7 D7 D7 EE VIEW 1C78: FA E6 E6 FF FE F2 ED FD 1C80: FF EF ED BA BB DD AF E6 1C88: B7 A7 CB B7 DE AA EB FF 1C90: FF FF FF FB+FF FF FF+FF+ 1C98: FD FF+FF+FF+FF+FF+FF+FF+ 1CA0: FF+FF+D5 AA 96 AA AB AA 1CA8: AA AA AB AA AA DE AA EB+ 1CB0: FF+FF+FF+FF+FF+FF D5 AA --------------------------------------- A TO ANALYZE DATA ESC TO QUIT ? FOR HELP SCREEN / CHANGE PARMS Q FOR NEXT TRACK SPACE TO RE-READ --^-- A subtle difference! The sequence at offset $1C93 now looks like this: - $FB + timing bit - $FF - $FF - $FF + timing bit - $FF + timing bit This code is looking for $FF bytes with an alternating pattern of timing bit, no timing bit, timing bit, no timing bit. It doesn't find that on the bit copy, so it knows it's not running on an original disk. Continuing the code listing... ; get a nibble 9095- BD 8C C0 LDA $C08C,X 9098- 10 FB BPL $9095 ; more bit twiddling 909A- 38 SEC 909B- 2A ROL ; AND it with the previously stashed ; nibble 909C- 25 FC AND $FC 909E- 49 FF EOR #$FF ; branch to failure path 90A0- D0 04 BNE $90A6 ; success path falls through to here -- ; turn off the drive motor and return ; to the caller 90A2- DD 88 C0 CMP $C088,X 90A5- 60 RTS ; failure path (a.k.a. "The Badlands", ; from which there is no return) 90A6- A8 TAY 90A7- DD 88 C0 CMP $C088,X ; manually pop the return address of ; the immediate caller (which leaves ; the manually pushed $C5FF address on ; the top of the stack to "return" to) 90AA- 68 PLA 90AB- 68 PLA ; destroy all trace of this program in ; memory 90AC- 99 00 90 STA $9000,Y 90AF- C8 INY 90B0- C0 8B CPY #$8B 90B2- D0 F8 BNE $90AC ; "return" to $C5FF+1, i.e. reboot 90B4- 60 RTS That explains the behavior I saw on my non-working copy. ~ Chapter 2 In Which The Best We Can Hope For Is Getting Stuck In An Infinite Loop Meanwhile, the success path returns to the real caller and continues execution at $9025: ; pop the bogus return value ($C5FF) ; off the stack 9025- 68 PLA 9026- 68 PLA ; Route a series of bytes through the ; DOS output vector at ($36). This is ; how binary files "execute" DOS 3.3 ; commands, like PRINT CHR$(4)"..." in ; Applesoft BASIC. This is totally ; legitimate code, cleverly disguised ; as an infinite loop. 9027- A0 00 LDY #$00 9029- 84 FE STY $FE 902B- B9 4D 90 LDA $904D,Y 902E- 09 80 ORA #$80 9030- 20 39 90 JSR $9039 9033- A4 FE LDY $FE 9035- C8 INY 9036- 4C 29 90 JMP $9029 9039- 6C 36 00 JMP ($0036) Let's see what it's printing. *904D. 904D- 04 52 55 9050- 4E 20 48 45 4C 4C 4F 0D 9058- 00 *FC58G N 400<904D.9058M DRUN HELLOM@ (but, like, flashing) Aha! It's not an infinite loop after all. Well, it is, technically, but it won't actually run forever. It's not easy to show in plain text, but the initial "D" and the final "M@" are in inverse. So that string starts with Ctrl-D and ends with Ctrl-M and a null byte. Since DOS is already loaded, printing this through the DOS vector will execute that command, as if you typed it from a prompt yourself. Since that program never returns to the caller, it will break out of the seemingly "infinite" loop. Since there are no side effects to the copy protection routine, I can change this file to simply skip over it and go straight to running the real startup program (at $9027). Turning to my trusty Disk Fixer sector editor, I press "D" to enter directory mode, select "PACK1.OBJ", and I find this code on T02,S01. The first four bytes are the address and length (as with any DOS 3.3 binary file), so the fifth byte is where I need to put an "RTS". T0S,S01,$04 change "20 E3 03" to "4C 27 90" [S6,D1=patched copy] ]PR#6 ...works... Side B is unprotected and unbootable, so that's it, then. Quod erat liberandum. ~ Changelog 2015-09-06 - Vastly improved explanation of the actual protection routine. Thanks to qkumba for pointing out that my original explanation was inaccurate. 2015-08-28 - initial release --------------------------------------- A 4am crack No. 429 ------------------EOF------------------