-------------M-ss-ng-L-nks------------- A 4am crack 2014-05-18 --------------------------------------- "M-ss-ng-L-nks" is a 1984 educational game designed by Carol Chomsky and Judah L. Schwartz; programmed by Harry Chomsky, Judah L. Schwartz, Jon Kaplan, Richard Gersh, and Jonathan Sweedler; and distributed by Sunburst Communications, Inc. [The copy protection is identical to "FOR Your NEXT Adventure," also distributed by Sunburst. This write-up is therefore quite similar to that one, with a few corrections.] The original disk is uncopyable by COPYA or Locksmith Fast Disk Backup. EDD 4 bit copy gives read errors on tracks $13 and up. Oddly, when I look at the original disk with the Copy ][+ nibble editor, those "unreadable" tracks do appear to be formatted and to contain data. Needless to say, the copy does not work. Further inspection in the nibble editor reveals that each track has a different address and data prologue: Track | Address | Data ------+----------+---------- $00 | D5 AA 96 | D5 AA AD (normal) $01 | D5 AA 97 | D5 AA AE $02 | D5 AA 9A | D5 AA AF $03 | D5 AA 9B | D5 AA B2 $04 | D5 AA 9D | D5 AA B3 And so on. Time for boot tracing with AUTOTRACE. [S6D1=original disk] [S5D1=my work disk] ]PR#5 ... CAPTURING BOOT0 ...boots slot 6... ...boots slot 5... SAVING BOOT0 CAPTURING BOOT1 ...boots slot 6... ...boots slot 5... SAVING BOOT1 SAVING RWTS Well, that worked flawlessly. My work disk first runs AUTOTRACE0, which sets up a minimal boot trace to capture the first sector of track 0 and saves it to the file "BOOT0" (on my work disk, not the original disk). If the first sector looks reasonably normal, it runs AUTOTRACE1, which sets up a more involved boot trace to capture the rest of track 0 and save it to the file "BOOT1". If *that* looks reasonably normal, it saves the RWTS to a file, unimaginatively named "RWTS", which can be loaded with Advanced Demuffin to copy each track of the original disk to a duplicate with standard address/data prologue/epilogue sequences. Advanced Demuffin will only load RWTS files from a drive in slot 6, which is annoying since mine is in slot 5. Note to self: patch that someday. In the meantime, I'm swapping floppy disks like some kind of 20th century peasant. [S6,D1=my work disk] ]PR#6 ]BRUN ADVANCED DEMUFFIN 1.1 --> LOAD NEW RWTS MODULE At $B8, load "RWTS" from drive 1 [S6,D1=original disk] [S6,D2=blank disk] --> FORMAT TARGET DISK ...grind grind grind... --> CONVERT DISK This disk is 16 sectors, and the default options (copy the entire disk, all tracks, all sectors) don't need to be changed. ADVANCED DEMUFFIN 1.1 - COPYRIGHT 1983 WRITTEN BY THE STACK -CORRUPT COMPUTING =======PRESS ANY KEY TO CONTINUE======= TRK:................................... +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0:................................... SC1:................................... SC2:................................... SC3:................................... SC4:................................... SC5:................................... SC6:................................... SC7:................................... SC8:................................... SC9:................................... SCA:................................... SCB:................................... SCC:................................... SCD:................................... SCE:................................... SCF:................................... ======================================= 16 SC $00,$00 TO $22,$0F BY $01 TO DRV2 The disk's own RWTS gave no read errors on any track. (EDD 4 bit copy gave a whole slew of read errors.) Whatever weird prologue sequences the original disk is using, it managed to confuse EDD 4. Impressive, in a twisted kind of way. But it shows the power and the genius of Advanced Demuffin. Every disk must be able to read itself. So, let it read itself, then capture the data and write it out in a standard format. Rebooting my work disk, I can now see the catalog on the demuffin'd copy. [S6D1=demuffin'd copy] [S5D1=my work disk] ]PR#5 ... ]CATALOG,S6,D1 C1983 DSR^C#254 245 FREE *A 003 HELLO@ *A 010 OPEN@ *A 010 DIRECT@ *A 053 MISSING LINKS *A 029 TEACH OP@ *A 053 EDITOR@ *A 005 BYE@ *B 024 CHARGEN@ *B 002 INP@.OBJ T 003 DIREC@ *T 005 INTRO@.TXT *T 005 INTRO2@.TXT *T 011 SAMPLE PAS T 002 T@.TXT *B 033 LOGO.BIN *T 003 SAMPLE PAS.PASS Odd filenames, but whatever. ]RUN HELLO@ The game loads and runs without complaint. All further disk access is done through standard DOS functions. There doesn't appear to be any kind of nibble check or other copy protection, beyond the custom RWTS. Now to make the disk be able to read itself (remember, it still has the original RWTS on it)... Using Copy ][+, I can "copy DOS" from a freshly initialized DOS 3.3 disk onto the demuffin'd copy. This function of Copy ][+ just sector-copies tracks 0-2 from one disk to another, but it's easier than setting that up manually in some other copy program. Copy ][+ --> COPY --> DOS --> from slot 6, drive 2 --> to slot 6, drive 1 [S6D1=demuffin'd copy] [S6D2=newly formatted DOS 3.3 disk] ...read read read... ...write write write... And finally, change the boot program to "HELLO@" with the at sign. This feature of Copy ][+ just presents a list interface to choose a file from the catalog, then sector-edits track 1, sector 9 to set the name of the program that DOS runs (instead of "HELLO"). Copy ][+ --> CHANGE BOOT PROGRAM --> on slot 6, drive 1 --> HELLO@ Quod erat liberandum. --------------------------------------- A 4am crack No. 36 ------------------EOF------------------