--------------Microzine 2--------------
A 4am crack                  2015-10-25
---------------------------------------

Name: Microzine vol. 1, no. 2
Genre: educational
Year: 1983
Publisher: Scholastic, Inc.
Media: double-sided 5.25-inch floppy
OS: DOS 3.3 with custom bootloader
Previous cracks: none
Similar cracks:
  #464 Microzine 4
  #409 Microzine 5
  #332 Microzine 3
  #331 Jumble Jet

Both sides are bootable to the main
menu. I'll start with side A.

                   ~

               Chapter 0
 In Which Various Automated Tools Fail
          In Interesting Ways


What does the boot look and sound like?
  1. immediate blank screen
  2. several sequential track reads
  3. track seek (maybe to T11?)
  4. HGR-style screen clear
  5. more disk activity (back and forth
     like file access)
  6. title screen

Does it access the disk after boot?
  Yes, repeatedly.

Does it have an option to read, write,
or format user-supplied data disks?
  Yes.

COPYA
  immediate disk read error

Locksmith Fast Disk Backup
  errors on tracks $00-$04, but $05-$22
  copy OK (of course the copy does not
  boot)

EDD 4 bit copy (no sync, no count)
  no read errors, but copy hangs after
    reading one track

Copy ][+ nibble editor
  T00 -> standard prologues, modified
    epilogues (FF FF EB)
  T01 -> corrupted address fields that
    claim to be track $00
  T02..T03 -> not full tracks? looks
    like they have some standard-ish
    sectors, but not 16 per track
    (also corrupted address fields)
  T04..T22 -> standard prologues,
    modified epilogues (FF FF EB),
    standard address fields

                 --v--

   COPY ][ PLUS BIT COPY PROGRAM 8.4
(C) 1982-9 CENTRAL POINT SOFTWARE, INC.
---------------------------------------

TRACK: 01  START: 2735  LENGTH: 185A
       ^^

2710: FF FF FF FF FF FF FF FF   VIEW
2718: FF FF FF FF FF FF FF FF
2720: FF FF FF FF FF FF FF FF
2728: FF FF FF FF FF FF FF FF
2730: FF FF FF FF FF D5 AA 96  <-2735
                     ^^^^^^^^
                 address prologue

2738: AA AA AA AA AA AA AA AA
      ^^^^^ ^^^^^ ^^^^^ ^^^^^
      V000   T00   S00  chksm

2740: FF FF FF FF FC FF FF FF
      ^^^^^^^^
  address epilogue

2748: FF D5 AA AD F2 FA D7 D7
         ^^^^^^^^
      data prologue

2750: A6 BE FE F7 FB EC 97 B9

---------------------------------------

  A  TO ANALYZE DATA  ESC TO QUIT

  ?  FOR HELP SCREEN  /  CHANGE PARMS

  Q  FOR NEXT TRACK   SPACE TO RE-READ

                 --^--

The disk is lying to me. The address
field claims to be track $00, but it's
really track $01. Bad disk! Stop lying!

Disk Fixer
  ["O" -> "Input/Output Control"]
    set Address Epilogue to "FF FF EB"
    set Data Epilogue to "FF FF EB"
  T00 readable
  T01..T04 unreadable (no option to
    ignore the corrupted address field)
  T05..T22 readable
  T11 looks like DOS 3.3 catalog

Copy ][+ sector editor
  ["P" -> "Sector Editor Patcher"]
    set type to "CUSTOM"
    set Address Epilogue to "FF FF"
    set Data Epilogue to "FF FF EB"
  T00 readable

  ["P" -> "Sector Editor Patcher"]
    set CHECK TRACK to "NO"
  T01 readable!
  only parts of T03 and T04 readable:
    T03: S03,04,05,06,07,0A,0B,0C,0D,0E
    T04: S01,02,04,08,09,0C,0F

Why didn't COPYA work?
  modified epilogue bytes on track $00

Why didn't Locksmith FDB work?
  ditto

Why didn't my EDD copy work?
  I don't know. Lots of weirdness going
  on in tracks $01-$04, though.

Next steps:

  1. Trace the boot
  2. ???

                   ~

               Chapter 1
         Boot Trace and Chill


[S6,D1=original disk]
[S5,D1=my work disk]

]PR#5
CAPTURING BOOT0
...reboots slot 6...
...reboots slot 5...
SAVING BOOT0

]CALL -151

*800<2800.28FFM

*801L

; set reset vector
0801-   8A          TXA
0802-   4A          LSR
0803-   4A          LSR
0804-   4A          LSR
0805-   4A          LSR
0806-   09 C0       ORA   #$C0
0808-   85 3F       STA   $3F
080A-   8D F3 03    STA   $03F3
080D-   49 A5       EOR   #$A5
080F-   8D F4 03    STA   $03F4
0812-   A9 00       LDA   #$00
0814-   8D F2 03    STA   $03F2

; hmm
0817-   A9 04       LDA   #$04
0819-   48          PHA

; machine initialization (memory banks,
; TEXT, IN#0, PR#0, &c.)
081A-   8D 81 C0    STA   $C081
081D-   20 2F FB    JSR   $FB2F
0820-   8D 52 C0    STA   $C052
0823-   20 89 FE    JSR   $FE89
0826-   20 93 FE    JSR   $FE93

; clear hi-res screen 1
0829-   A2 20       LDX   #$20
082B-   A0 00       LDY   #$00
082D-   84 06       STY   $06
082F-   A9 20       LDA   #$20
0831-   85 07       STA   $07
0833-   98          TYA
0834-   91 06       STA   ($06),Y
0836-   C8          INY
0837-   D0 FB       BNE   $0834
0839-   E6 07       INC   $07
083B-   CA          DEX
083C-   D0 F6       BNE   $0834

; switch to hi-res screen 1 (blank)
083E-   8D 57 C0    STA   $C057
0841-   8D 50 C0    STA   $C050
0844-   8D 54 C0    STA   $C054
0847-   8D 52 C0    STA   $C052

; set up ($3E) vector to point to the
; sector read routine in the disk
; controller ROM
084A-   A9 5C       LDA   #$5C
084C-   85 3E       STA   $3E

; the disk controller ROM always exits
; via $0801, so set that to an RTS so
; we can JSR and not have to set up a
; loop
084E-   A9 60       LDA   #$60
0850-   8D 01 08    STA   $0801

; hmm
0853-   A9 72       LDA   #$72
0855-   48          PHA

OK, we've now pushed $04/$72 on the
stack. That's probably important.

; multi-sector read
; Y = start logical sector ($01)
; X = end logical sector ($03)
; A = start address high byte ($1D)
0856-   A0 00       LDY   #$00
0858-   84 FC       STY   $FC
085A-   C8          INY
085B-   A9 9D       LDA   #$1D
085D-   A2 05       LDX   #$03

; multi-sector read routine
085F-   20 6C 08    JSR   $086C

; another sector read, 3 more sectors
; ($04..$06) into $9D00..$9DFF
0862-   A9 9D       LDA   #$9D
0864-   A2 06       LDX   #$06
0866-   20 6C 08    JSR   $086C

; another sector read, this time just
; one sector, into $0400 (X is already
; less than Y on entry, so loop will
; exit after one read)
0869-   A9 04       LDA   #$04
086B-   AA          TAX

; falls through to multi-sector read
; entry point (was also called earlier
; from $085F and $0866)
086C-   85 27       STA   $27
086E-   E8          INX
086F-   86 49       STX   $49
0871-   84 F9       STY   $F9

; map logical into physical sector and
; store it in zero page where the disk
; controller ROM will look for it
0873-   B9 8A 08    LDA   $088A,Y
0876-   85 3D       STA   $3D

; read sector via disk controller ROM
0878-   20 85 08    JSR   $0885

; loop until done
087B-   A4 F9       LDY   $F9
087D-   C8          INY
087E-   C4 49       CPY   $49
0880-   90 EF       BCC   $0871
0882-   A5 27       LDA   $27
0884-   60          RTS

0885-   A6 2B       LDX   $2B
0887-   6C 3E 00    JMP   ($003E)


088A-  [00 03 05 07 09 0B 0D 0F]
0892-  [02 04 06 08 0A 0C 0E 01]

That's it. Flexible but compact.

It's a weird combination of reads,
though. 3 pages at $1D00. 3 pages at
$9D00. 1 page at $0400 (part of the
text page, but it's hidden during boot
because we cleared the entire hi-res
graphics page and showed that instead).

Of course, we manually pushed $04/$72
on the stack earlier, so once we fall
through to the sector read routine and
it hits the RTS at $088F, it will
"return" to $0472 + 1 = $0473.

Let's interrupt the boot before it gets
there.

                   ~

               Chapter 2
 In Which Things Get Brilliantly Weird


*9600<C600.C6FFM

; set up callback by changing the two
; bytes that are pushed to the stack
96F8-   A9 97       LDA   #$97
96FA-   8D 18 08    STA   $0818
96FD-   A9 04       LDA   #$04
96FF-   8D 54 08    STA   $0854

; start the boot
9702-   4C 01 08    JMP   $0801

; callback is here --
; copy $0400 up to higher memory so it
; survives a reboot
9705-   A0 00       LDY   #$00
9707-   B9 00 04    LDA   $0400,Y
970A-   99 00 24    STA   $2400,Y
970D-   C8          INY
970E-   D0 F7       BNE   $9707

; turn off slot 6 drive motor
9710-   AD E8 C0    LDA   $C0E8

; reboot to my work disk
9713-   4C 00 C5    JMP   $C500

*BSAVE TRACE,A$9600,L$116

*BRUN TRACE
...reboots slot 6...
...reboots slot 5...

]BSAVE BOOT1 0400-04FF,A$2400,L$100
]CALL -151

The entry point was $0473, so let's
start there. I'll have to leave the
code at $2400. Relative branches will
look correct, but absolute addresses
in $04xx will be +$2000.

*2473L

; not sure what $4A is for yet
2473-   46 4A       LSR   $4A

2475-   20 C3 04    JSR   $04C3

*24C3L

24C3-   A9 A0       LDA   #$A0
24C5-   4C 0B 04    JMP   $040B

*240BL

240B-   20 0E 04    JSR   $040E

*240EL

240E-   20 33 04    JSR   $0433

*2433L

; call the following line (then fall
; through and do it again)
2433-   20 36 04    JSR   $0436

; save A and Y
2436-   48          PHA
2437-   98          TYA
2438-   48          PHA

; low-level disk stuff (see below)
2439-   A5 FC       LDA   $FC
243B-   85 FD       STA   $FD
243D-   E6 FC       INC   $FC
243F-   A5 FC       LDA   $FC
2441-   29 03       AND   #$03
2443-   0A          ASL
2444-   05 2B       ORA   $2B
2446-   A8          TAY
2447-   B9 81 C0    LDA   $C081,Y

; wait loop
244A-   A9 30       LDA   #$30
244C-   20 A8 FC    JSR   $FCA8

; more low-level disk stuff
244F-   A5 FD       LDA   $FD
2451-   29 03       AND   #$03
2453-   0A          ASL
2454-   05 2B       ORA   $2B
2456-   A8          TAY
2457-   B9 80 C0    LDA   $C080,Y

; more waiting
245A-   A9 30       LDA   #$30
245C-   20 A8 FC    JSR   $FCA8

; restore A and Y on the way out
245F-   68          PLA
2460-   A8          TAY
2461-   68          PLA
2462-   60          RTS

This is a very clever and compact way
to advance the drive head to the next
track. Normally DOS 3.3 keeps track of
this and has a (much more complicated)
routine to move the head back and forth
as needed. But this loader only needs
to move it forward, so the entire
process collapses to this:

1. Set up the Y register to be a slot
   number (x16) plus the appropriate
   phase (0-3, depending on which track
   the drive head is on)

2. LDA $C081,Y to turn on the
   appropriate stepper motor

3. Wait exactly the right amount of
   time (as measured in CPU cycles)

4. LDA $C080,Y to turn off the
   appropriate stepper motor

5. Wait the right amount of time again

...which is exactly what this routine
at $0436 is doing. But that only gets
us halfway there -- literally, it only
moves the drive head by half a track.
But! Since $0433 "falls through" to
$0436, it ends up doing this twice. Two
half tracks equal one whole track, so
calling the routine at $0433 will move
the drive head to the next whole track.

(By the way, this is why it initialized
zero page $FC to $00 at $0858. That's
the "current" track where the drive
head is at boot; it gets updated when
the drive head advances.)

Everything I know about low-level disk
stepping, I learned from this excellent
Usenet post:
macgui.com/usenet/?group=1&id=31160

Continuing...

2411-   A2 0F       LDX   #$0F
2413-   A0 00       LDY   #$00

; store A in zero page $27, used by the
; disk controller ROM routine as the
; target page to store sectors read
; from disk
2415-   85 27       STA   $27

; X is the final sector to read
2417-   E8          INX
2418-   86 49       STX   $49

; Y is the current sector to read
; (starting with whatever was passed in
; and incrementing until it equals the
; value passed in the X register)
241A-   84 F9       STY   $F9
241C-   98          TYA

; But wait, there's more! Based on the
; high bit of zero page $4A, Y is
; either a logical sector (the map of
; logical->physical sectors is at
; $0263) or a physical sector
241D-   24 4A       BIT   $4A
241F-   30 03       BMI   $2424
2421-   B9 63 04    LDA   $0463,Y

; store physical sector in $3D (again,
; used by the disk controller ROM)
2424-   85 3D       STA   $3D

; read sector by jumping to ($003E),
; which points to $Cx5C (e.g. $C65C if
; booting from slot 6) and exit via
; $0801, which is an RTS by now, so
; this just continues to the next line
2426-   20 00 04    JSR   $0400

; increment sector index
2429-   A4 F9       LDY   $F9
242B-   C8          INY

; are there more sectors to read?
242C-   C4 49       CPY   $49

; yes, branch back and repeat
242E-   90 EA       BCC   $241A

; no, exit with last page (+1) in A
; (disk controller ROM increments this
; after storing sector data, so on exit
; this will be the first page that was
; NOT filled with data in this loop)
2430-   A5 27       LDA   $27
2432-   60          RTS

To sum up:

These two lines of code...

||  24C3-   A9 A0       LDA   #$A0   ||
||  24C5-   4C 0B 04    JMP   $040B  ||

advanced the drive head from track $00
to track $01, read the entire track
into $A000..$AFFF (despite the fact
that every sector's address field was
corrupted and claimed to be track $00),
then fall through from $040B to $040E
and do it all over again, but moving to
track $02 and reading into $B000..$BFFF
instead.

Beautiful.

                   ~

               Chapter 3
         Every Byte Is Sacred,
         Every Byte Is Great,
         If A Byte Gets Wasted,
         Woz Gets Quite Irate


Continuing from $0478...

2478-   20 00 BB    JSR   $BB00

*9600<C600.C6FFM

; set up callback #1 by changing the
; bytes that are pushed to the stack
96F8-   A9 97       LDA   #$97
96FA-   8D 13 08    STA   $0813
96FD-   A9 04       LDA   #$04
96FF-   8D 54 08    STA   $0854

; start the boot
9702-   4C 01 08    JMP   $0801

; callback #1 is here --
; set up callback #2 before calling
; mystery routine at $BB00
9705-   A9 4C       LDA   #$4C
9707-   8D 78 04    STA   $0478
970A-   A9 17       LDA   #$17
970C-   8D 79 04    STA   $0479
970F-   A9 97       LDA   #$97
9711-   8D 7A 04    STA   $047A

; continue the boot
9714-   4C 73 04    JMP   $0473

; callback #2 is here --
; turn off drive motor and break
9717-   AD E8 C0    LDA   $C0E8
971A-   4C 59 FF    JMP   $FF59

*BSAVE TRACE2,A$9600,L$11D
*9600G
...reboots slot 6...
<beep>

*BB00L

; this checks whether Applesoft is in
; ROM and displays an error message if
; it's not
BB00-   AD 81 C0    LDA   $C081
BB03-   AD B3 FB    LDA   $FBB3
BB06-   C9 06       CMP   #$06
BB08-   D0 03       BNE   $BB0D
BB0A-   A9 03       LDA   #$03
BB0C-   60          RTS
BB0D-   AD 83 C0    LDA   $C083
BB10-   AD 83 C0    LDA   $C083
BB13-   8D 00 E0    STA   $E000
BB16-   CD 00 E0    CMP   $E000
BB19-   D0 19       BNE   $BB34
BB1B-   2A          ROL
BB1C-   8D 00 E0    STA   $E000
BB1F-   CD 00 E0    CMP   $E000
BB22-   D0 10       BNE   $BB34
.
. &c.
.

Unrelated to copy protection. But while
I'm here, I should save these two
tracks worth of data, because they
appear to be most of a full copy of DOS
3.3.

*2000<A000.BFFFM
*C500G
...
]BSAVE BOOT2 A000-BFFF,A$2000,L$2000

Now then. Continuing where we left off.

]BLOAD BOOT1 0400-04FF,A$24000
]CALL -151

*247BL

247B-   A5 3F       LDA   $3F
247D-   8D 82 BA    STA   $BA82
2480-   20 9D 04    JSR   $049D

*249DL

; advance the drive head to track $03
249D-   20 33 04    JSR   $0433

; zero page fiddling
24A0-   A9 00       LDA   #$00
24A2-   85 41       STA   $41
24A4-   38          SEC
24A5-   66 4A       ROR   $4A

; call the multi-sector read routine
; again, but this time only read 5
; sectors, into $0E00..$12FF
24A7-   A9 0E       LDA   #$0E
24A9-   A0 01       LDY   #$01
24AB-   A2 05       LDX   #$05
24AD-   20 15 04    JSR   $0415

; move the drive head one phase only,
; to the next HALF track
24B0-   20 36 04    JSR   $0436

[now on track 3.5]

; read more sectors ($06..$0A) from
; track 3.5
24B3-   A2 0A       LDX   #$0A
24B5-   20 15 04    JSR   $0415

; advance another half track
24B8-   20 36 04    JSR   $0436

[now on track 4]

; read more sectors ($0B..$0F) from
; track 4
24BB-   A2 0F       LDX   #$0F
24BD-   20 15 04    JSR   $0415

; fiddle with $4A again
24C0-   46 4A       LSR   $4A
24C2-   60          RTS

So here's the deal with $4A: we
initialized it at $0473 by a blind LSR,
which clears the high bit. This tells
the multi-sector read routine at $0415
to use logical sectors. Then we set the
high bit at $04A4 with SEC + ROR,
indicating we want $0415 to read
physical sectors. Then we read a few
sectors from track 2, a few from track
2.5, and a few from track 3. Then we
reset $4A with another LSR, and we're
back to using logical sectors.

This explains why my EDD bit copy
failed. This disk is storing data on
half tracks. Worse, it's storing data
on *adjacent* half tracks -- a few from
track 3, a few from track 3.5, and a
few from track 4. Due to limitations of
the Disk II drive mechanism, that would
be virtually impossible for a generic
bit copier to reproduce on a blank
floppy disk.

Every part of this code is brilliant.
AND it fits in a single sector in low
memory. AND it's flexible enough to
read from virtually uncopyable disks.

Continuing from $0483...

; now put slot number (x16) into...
; an RWTS parameter table?!?
2483-   A6 2B       LDX   $2B
2485-   8E E9 B7    STX   $B7E9

; set up DOS globals (tracking where
; the drive head is)
2488-   20 8E BE    JSR   $BE8E
248B-   A5 FC       LDA   $FC
248D-   99 78 04    STA   $0478,Y
2490-   4A          LSR
2491-   8D 78 04    STA   $0478

; push $B7/$3A on the stack
2494-   A9 B7       LDA   #$B7
2496-   48          PHA
2497-   A9 3A       LDA   #$3A
2499-   48          PHA

; and exit through HOME (which will
; wipe this loader from memory)
249A-   4C 58 FC    JMP   $FC58

Execution continues at $B73B (because
we just pushed $B7/$3A on the stack).

                   ~

               Chapter 4
       In Which We See The Light
       At The End Of The Tunnel,
       And It's A DOS-shaped RWTS
       Which Is A Weird Thing To
       See In A Tunnel, Honestly


I can interrupt the boot at $0483 to
capture whatever was read from tracks
$03, $03.5, and $04.

*9600<C600.C6FFM

; set up callback #1 after boot0 loads
; boot1 into $0400
96F8-   A9 97       LDA   #$97
96FA-   8D 18 08    STA   $0818
96FD-   A9 04       LDA   #$04
96FF-   8D 54 08    STA   $0854

; start the boot
9702-   4C 01 08    JMP   $0801

; callback #1 is here --
; set up callback #2 after calling the
; spiral track read routine
9705-   A9 4C       LDA   #$4C
9707-   8D 83 04    STA   $0483
970A-   A9 17       LDA   #$17
970C-   8D 84 04    STA   $0484
970F-   A9 97       LDA   #$97
9711-   8D 85 04    STA   $0485

; continue the boot
9714-   4C 73 04    JMP   $0473

; callback #2 is here --
; turn off the drive motor and break
9717-   AD E8 C0    LDA   $C0E8
971A-   4C 59 FF    JMP   $FF59

*BSAVE TRACE3,A$9600,L$11D
*9600G
...reboots slot 6...
<beep>

*2E00<E00.1CFFM
*C500G

]BSAVE BOOT2 0E00-1CFF,A$2E00,L$F00

                   ~

               Chapter 5
       In Which Simplicity Is In
        The Eye Of The Beholder


Using Super Demuffin (with epilogues
"FF FF EB"), I copied track $00 onto a
freshly formatted blank disk. Using
Copy II Plus, I sector copied tracks
$05-$22. Now let's write everything we
captured from the corrupted tracks back
to tracks $01-$03.

Disk layout comparison:

track |     old     |     new
------+-------------+-------------
 $01  |        $A000-$AFFF
 $02  |        $B000-$BFFF
 $03  | $0E00-$12FF | $0E00-$1DFF
$03.5 | $1300-$17FF | --
 $04  | $1800-$1CFF | --

Of course, all the tracks will now have
normal address fields (no more lying
about the track numbers). Also no half
tracks and no spirals. Just, you know,
sectors on a disk.

[S6,D1=demuffin'd copy (T00,T05-T22)]
[S5,D1=my work disk]

]PR#5
...
]CALL -151

*300L

; page count (decremented)
0300-   A9 30       LDA   #$30
0302-   85 FF       STA   $FF

; logical sector (incremented)
0304-   A9 00       LDA   #$00
0306-   85 FE       STA   $FE

; call RWTS to write sector
0308-   A9 03       LDA   #$03
030A-   A0 88       LDY   #$88
030C-   20 D9 03    JSR   $03D9

; increment logical sector, wrap around
; from $0F to $00 and increment track
030F-   E6 FE       INC   $FE
0311-   A4 FE       LDY   $FE
0313-   C0 10       CPY   #$10
0315-   D0 07       BNE   $031E
0317-   A0 00       LDY   #$00
0319-   84 FE       STY   $FE
031B-   EE 8C 03    INC   $038C

; Convert to the interleave order that
; this disk expects
031E-   B9 40 03    LDA   $0340,Y
0321-   8D 8D 03    STA   $038D

; increment page to write
0324-   EE 91 03    INC   $0391
0327-   C6 FF       DEC   $FF

; loop until done with all pages
0329-   D0 DD       BNE   $0308
032B-   60          RTS

; sector interleave table
*340.34F

0340- 00 06 05 04 03 02 01 0F
0348- 0E 0D 0C 0B 0A 09 08 07

; RWTS parameter table, pre-initialized
; with slot 6, drive 1, track $01,
; sector $00, address $2000, and RWTS
; write command ($02)
*388.397

0388- 01 60 01 00 01 00 FB F7
0390- 00 20 00 00 02 00 00 60

*BSAVE MAKE,A$300,L$98
*BLOAD BOOT2 A000-BFFF,A$2000
*BLOAD BOOT2 0E00-1CFF,A$4100
*300G

Now I need to modify the bootloader at
$0473 slightly.

  1. Modify the routine at $049D to
     read all of track $03 instead of
     the crazy spiral stuff.

  2. Modify the routine at $0433 (that
     advances the drive head) so it
     updates zero page $41 with the
     current track.

The sector read routine at $C65C
compares the track listed in the
address field to zero page $41 and
loops forever until it matches. $C600
initializes $41 to 0, and the original
disk never updates $41, but everything
works because the address fields are
corrupted and all claim to be track 0.

So part of it will be simpler, because
we'll no longer be spiraling between
tracks. But part of it will actually
be more complicated because the address
fields are no longer corrupted and we
need to track the track number.

First, a patch to $049D to load a whole
track into $0D00..$1CFF. (Page $0D is
blank but ignored -- the original disk
only loaded $E00..$1CFF.)

T00,S0F,$9D change "20 33 04 A9 00"
                to "A9 0D 4C 0E 04"

----------- DISASSEMBLY MODE ----------
009D:A9 0D          LDA   #$0D
009F:4C 0E 04       JMP   $040E

Second, a new routine at $04A2 (now
unused space) to increment the track
number in zero page.

T00,S0F,$A2 change "85 41 38 66 4A"
                to "E6 41 4C 36 04"

----------- DISASSEMBLY MODE ----------
00A2:E6 41          INC   $41
00A4:4C 36 04       JMP   $0436

Third, a patch to the routine at $0433
to call the patch at $04A2 to increment
the track number in zero page before
advancing the drive arm.

T00,S0F,$34 change "36" to "A2"

----------- DISASSEMBLY MODE ----------
0033:20 A2 04       JSR   $04A2

]PR#6
...works...

Side B has identical protection.

Quod erat liberandum.

---------------------------------------
A 4am crack                     No. 476
------------------EOF------------------