--------FOR Your NEXT Adventure--------
A 4am crack                  2014-04-08
---------------------------------------

FOR Your NEXT Adventure is a 1985
educational game programmed by Robert
C. Rosen and distributed by Sunburst
Communications.

The original disk is uncopyable by
COPYA or Locksmith Fast Disk
Backup. EDD 4 bit copy gives read
errors on tracks $13 and up (but the
tracks do appear to be formatted and
contain data).

Some manual inspection with the Copy
][+ nibble editor reveals that each
track has a different address and data
prologue:

Track | Address  | Data
------+----------+----------
 $00  | D5 AA 96 | D5 AA AD
 $01  | D5 AA 97 | D5 AA AE
 $02  | D5 AA 9A | D5 AA AF
 $03  | D5 AA 9B | D5 AA B2
 $04  | D5 AA 9D | D5 AA B3

And so on.

Time for boot tracing with AUTOTRACE.

[S5D1=my work disk]
[S6D1=original disk]

]PR#5
...
CAPTURING BOOT0
...boots slot 6...
...boots slot 5...
SAVING BOOT0
CAPTURING BOOT1
...boots slot 6...
...boots slot 5...
SAVING BOOT1
SAVING RWTS

Well, that worked flawlessly. My work
disk first runs AUTOTRACE0, which sets
up a minimal boot trace to capture the
first sector of track 0 and saves it to
the file "BOOT0" (on my work disk, not
the original disk). If the first sector
looks reasonably normal, it runs
AUTOTRACE1, which sets up a more
involved boot trace to capture the rest
of track 0 and save it to the file
"BOOT1". If *that* looks reasonably
normal, it saves the RWTS to a file,
unimaginatively named "RWTS", which can
be loaded with Advanced Demuffin to
copy each track of the original disk to
a duplicate with standard address/data
prologue/epilogue sequences.

Advanced Demuffin will only load RWTS
files from a drive in slot 6, which is
annoying since mine is in slot 5. Note
to self: patch that someday. In the
meantime, I'm swapping floppy disks
like some kind of 20th century peasant.

[S6,D1=my work disk]

]PR#6
]BRUN ADVANCED DEMUFFIN 1.1

--> LOAD NEW RWTS MODULE
    At $B8, load "RWTS"
    from D1

[S6,D1=original disk]
[S6,D2=blank disk]

--> FORMAT TARGET DISK

...grind grind grind...

--> CONVERT DISK

This disk is 16 sectors, and the
default options (copy the entire disk,
all tracks, all sectors) don't need to
be changed.

ADVANCED DEMUFFIN 1.1  - COPYRIGHT 1983
WRITTEN BY THE STACK -CORRUPT COMPUTING
=======PRESS ANY KEY TO CONTINUE=======
TRK:...................................
+.5:
    0123456789ABCDEF0123456789ABCDEF012
SC0:...................................
SC1:...................................
SC2:...................................
SC3:...................................
SC4:...................................
SC5:...................................
SC6:...................................
SC7:...................................
SC8:...................................
SC9:...................................
SCA:...................................
SCB:...................................
SCC:...................................
SCD:...................................
SCE:...................................
SCF:...................................
=======================================
16 SC $00,$00 TO $22,$0F BY $01 TO DRV2

Interestingly, the disk's own RWTS gave
no read errors on any track. (EDD 4 bit
copy gave a whole slew of read errors.)
Whatever weird prologue sequences the
original disk is using, it managed to
confuse EDD 4. Impressive, in a twisted
kind of way.

Rebooting my work disk, I can now see
the disk catalog on the demuffin'd
copy.

[S5D1=my work disk]
[S6D1=demuffin'd copy]

]PR#5
...
]CATALOG,S6,D2

C1983 DSR^C#254
047 FREE

 A 003 LOGO
 B 024 CG
 B 003 SMALL
 B 002 STACK
 T 002 SOUNDS
 T 002 NAMES
 T 002 ST
 T 002 ST.17
 T 002 ST.5
 T 002 ST.3
 A 070 MOREROOMS
 T 007 W
 A 063 FLOORS
 T 002 ST.4
 T 002 ST.2
 T 002 ST.1
 A 026 TUNNEL
 T 003 R
 A 071 ROOMS
 A 049 NEW.OLD
 T 002 ST.6
 T 002 ST.7
 A 013 SCREEN
 T 002 ST.18
 T 002 ST.8
 T 002 ST.9
 T 002 ST.10
 T 002 ST.11
 T 002 ST.12
 B 002 DIGITS
 B 002 LETTERS
 B 033 CONGRATS
 T 002 ST.15
 T 002 ST.13
 T 002 ST.14
 T 002 ST.16
 B 033 LOGO.BIN

]RUN LOGO

The game loads and runs without
complaint. All further disk access is
done through standard DOS functions.
(It even runs from drive 2!) There
don't appear to be any nibble checks or
any other form of secondary protection.

Now to make the disk be able to read
itself (remember, it still has the
original RWTS on it)...

Using Copy ][+, I can "copy DOS" from a
freshly initialized DOS 3.3 (or
compatible) disk onto the demuffin'd
copy. I actually chose ProntoDOS for
this purpose, since it's highly
compatible with standard DOS 3.3 but
much faster. (This function of Copy ][+
just sector-copies tracks 0-2 from one
disk to another, but it's easier than
setting that up manually in some other
copy program.)

]PR#6
...
FILE NOT FOUND

Oops, I forgot one last thing: the
HELLO program is actually called LOGO.

]PR#5
...
]CATALOG,S6,D2
...
]RENAME LOGO,HELLO
]PR#6

Quod erat liberandum.

---------------------------------------
A 4am crack                  2014-04-08
-------------------EOF-----------------