--------------Microzine 18------------- A 4am crack 2014-09-15 --------------------------------------- "Microzine" was an educational disk- based magazine published by Scholastic between 1983 and 1992. Issue no. 18 is a double-sided disk that features "History Mystery" and "ScholastiCalc." [The copy protection is identical to several other titles I've seen before, including - "Gertrude's Secrets, "Bumble Games," "Juggles' Rainbow, "Moptown Parade," "Reader Rabbit," and "Wizard of Words" by The Learning Company - "Xevious" by Mindscape - "The Notable Phantom" by DesignWare - "Animal Kingdom" and "Race Car 'Rithmetic" by Unicorn Software - "Pitstop II" by Epyx - Microzine 17 by Scholastic That's six different companies using identical copy protection, presumably sourced from the same vendor. Who was it? I wish I knew. Anyway, this write-up is quite similar to those, with a few updates and corrections.] Side B is unprotected. However, side A is uncopyable by any automated method. COPYA fails miserably and immediately. EDD 4 bit copy gives no read errors, but the copy it creates only gets as far as loading DOS and displaying the BASIC prompt before filling the screen with garbage and rebooting. In my experience, disks do not spontaneously reboot unless someone tells them to. Turning to my trusty Disk Fixer sector editor, I press "O" to get to the Input/Output Control and set "CHECKSUM ENABLED" to "NO". This will ignore the checksum bytes and epilogue sequences. i.e. As long as the address and data prologue are standard ("D5 AA 96" and "D5 AA AD", respectively), this will allow me to read each sector. And lo and behold, it works! I can read the data from every sector on every track. Track $11 does appear to contain a disk catalog, which strongly suggests this program is file-based. Based on my limited experience cracking other disks, I would guess that this disk has - Standard prologue bytes before the address and data fields [otherwise a sector editor would give read errors, even when ignoring checksums] - Non-standard epilogue bytes after the address and data fields [otherwise COPYA would work] - Some secondary protection [otherwise the bit copy created with EDD 4 would work] Given the (relatively) weak structural protection, I used to turn to the DOS 3.3 master disk, patch the RWTS to ignore checksums and epilogue bytes (changing $B942 from "SEC" to "CLC"), and run COPYA. Then, one fine day, and completely by accident, I came across an original disk with a bad sector. I suppose this shouldn't surprise me. These floppies are decades old by now; it's amazing any of them work at all. The point is, I shouldn't be using tools that ignore potentially serious read errors. There are other tools, like Super Demuffin, that can convert a disk like this (with non-standard epilogue bytes) into a standard format. It requires figuring out what the actual epilogue bytes are, but it has the advantage of surfacing a read error if the original disk actually has a read error. So... no more COPYA+B942:18 patch. From now on, it's Super Demuffin or Advanced Demuffin to convert disks to a standard format. Just by looking at the first few sectors, it appears that this disk uses a DOS 3.3-derived RWTS, which means that my AUTOTRACE program should be able to extract the RWTS from the original disk. [S6,D1=original disk, side A] [S5,D1=my work disk] ]PR#5 CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 /!\ BOOT0 JUMPS TO $08C0 CAPTURING BOOT1 ...reboots slot 6... ...reboots slot 5... SAVING BOOT1 SAVING RWTS /!\ NIBBLE CHECK AT $BB00 Well, that worked flawlessly. My work disk first runs AUTOTRACE0, which sets up a minimal boot trace to capture the first sector of track 0 and saves it to the file "BOOT0" (on my work disk, not the original disk). If the first sector looks reasonably normal, it runs AUTOTRACE1, which sets up a more involved boot trace to capture the rest of track 0 and save it to the file "BOOT1". If *that* looks reasonably normal, it saves the RWTS to a file, unimaginatively named "RWTS", which can be loaded with Advanced Demuffin to copy each track of the original disk to a duplicate with standard address/data prologue/epilogue sequences. Along the way, it noticed that boot0 is jumping to $08C0, and that there's a possible nibble check at $BB00. I'll definitely want to look at those later, but first I'm going to use Advanced Demuffin to convert this disk to a standard format. [S6,D1=original disk, side A] [S6,D2=blank disk] [S5,D1=my work disk] ]PR#5 ... ]BRUN ADVANCED DEMUFFIN 1.5 [press "5" to switch to slot 5] [press "R" to load a new RWTS module] --> At $B8, load "RWTS" from drive 1 [press "6" to switch to slot 6] [press "C" to convert disk] This disk is 16 sectors, and the default options (copy the entire disk, all tracks, all sectors) don't need to be changed unless something goes horribly wrong. --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK:................................... +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0:................................... SC1:................................... SC2:................................... SC3:................................... SC4:................................... SC5:................................... SC6:................................... SC7:................................... SC8:................................... SC9:................................... SCA:................................... SCB:................................... SCC:................................... SCD:................................... SCE:................................... SCF:................................... ======================================= 16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- The disk's own RWTS gave no read errors on any track. This is the power and the genius of Advanced Demuffin. Every disk must be able to read itself. So, let it read itself, then capture the data and write it out in a standard format. There are two problems with this copy: 1. Depending on how the original disk was written, this copy may or may not be able to read itself. I may need to patch the disk's RWTS to deal with the fact that the disk is now in a standard format. 2. Even if it can read itself, it won't run. The copies I tried to make -- even the bit copies -- just rebooted endlessly, which means there is some code being executed during boot to check if the disk is original. (Hint: it's not.) Just by booting my copy, I can rule out problem #1. The disk seems to read itself just fine. It makes it exactly as far as my failed bit copy -- far enough to figure out that it's not an original disk, fill the screen with garbage, and reboot. But wait... [S6,D1=demuffin'd copy] [S5,D1=my work disk] ]PR#5 ... ]CATALOG,S6,D1 C1983 DSR^C#254 000 FREE A 003 MICROZINE SIDE 1 A 005 HELLO A 027 TABLE OF CONTENTS A 030 INTRO A 063 HIST A 056 HIST2 B 003 TPINDEX B 012 LITTLE APEX B 002 MAP B 014 PICDRAWH B 002 TSHAPES B 002 CLEAR.OBJ B 002 PACK.OBJ B 008 MZINE1.PAC B 008 MZINE2.PAC B 011 INTRO.SPC B 010 TIMES.SPC B 011 ST.ARMOR B 011 ST.FEMALE B 011 ST.HIST1 B 011 ST.HIST2 B 009 ST.HIST3 B 009 ST.HIST4 B 009 ST.HIST5 B 010 ST.HIST6 B 011 ST.HIST7 B 011 ST.HIST8 B 011 ST.MALE B 006 ST.SLUGG B 002 ST.TIME B 002 ST.UPDOWN T 004 INVENTORY T 002 LASTNAME T 006 ROOMS T 002 SIDE T 115 TWISTAPLOT FILE ]RUN HELLO It works! All further disk access is done through DOS functions, and it doesn't seem to mind being booted from a third-party DOS. That's great news, because it narrows down the search field significantly. Whatever is preventing it from booting is confined to the DOS area in tracks 0-2. My AUTOTRACE program warned that there was a nibble check at $BB00. Let's see if that's true. ]PR#5 ... ]BLOAD BOOT0,A$800 ]CALL -151 *801L ... Everything here looks pretty normal (i.e. just like an unprotected DOS 3.3 disk), until it goes to jump to the boot1 code. Usually that happens with an indirect JMP ($08FD), which, in a normal boot0, will end up continuing execution at $B700 which is stored in track 0, sector 1. But in this case, I see: 084A- 4C C0 08 JMP $08C0 *8C0L 08C0- 8E E9 B7 STX $B7E9 08C3- 6C FD 08 JMP ($08FD) Once I load up the boot1 code I captured earlier, it becomes clear why boot0 needed to take a little detour. *BLOAD BOOT1,A$2600 *FE89G FE93G ; disconnect DOS *B600<2600.2FFFM ; move RWTS into place *B700L B700- 20 00 BB JSR $BB00 Aha! I've learned from previous cracks (and from actually reading "Beneath Apple DOS" instead of, you know, just staring at it on my bookshelf) that, in a standard DOS-3.3-derived RWTS, the area from $BB00 to $BC55 is overwritten during every disk read. (It's used as scratch space during denibblization, which is totally a real word that I just made up.) So why is there executable code there? I've captured it already. Let's see. *BB00L BB00- A0 00 LDY #$00 BB02- B9 00 BB LDA $BB00,Y BB05- 99 00 02 STA $0200,Y BB08- 88 DEY BB09- D0 F7 BNE $2B02 BB0B- 60 RTS Well that's definitely suspicious. Relocating yourself into the input buffer at $0200? Seriously, who does that? I'm guessing that the first instruction after this is the entry point, so after relocation, that would be $020C. *20C