--------------Odd One Out--------------
A 4am crack                  2014-04-08
---------------------------------------

Odd One Out is a 1986 educational game
designed by Donna Stanger, programmed
by Paul Elseth & Lon Koenig, and
distributed by Sunburst Communications.

The original disk is uncopyable by
COPYA or Locksmith Fast Disk
Backup. EDD 4 bit copy gives no read
errors, but the copy just grinds a few
times and reboots.

Some manual inspection with the Copy
][+ nibble editor reveals that each
track has a different address and data
prologue:

Track | Address  | Data
------+----------+----------
 $00  | D5 AA 96 | D5 AA AD
 $01  | D5 AA 97 | D5 AA AE
 $02  | D5 AA 9A | D5 AA AF
 $03  | D5 AA 9B | D5 AA B2
 $04  | D5 AA 9D | D5 AA B3

And so on.

Time for boot tracing with AUTOTRACE.

[S5D1=my work disk]
[S6D1=original disk]

]PR#5
...
CAPTURING BOOT0
...boots slot 6...
...boots slot 5...
SAVING BOOT0
CAPTURING BOOT1
...boots slot 6...
...boots slot 5...
SAVING BOOT1
SAVING RWTS

Well, that worked flawlessly. My work
disk first runs AUTOTRACE0, which sets
up a minimal boot trace to capture the
first sector of track 0 and saves it to
the file "BOOT0" (on my work disk, not
the original disk). If the first sector
looks reasonably normal, it runs
AUTOTRACE1, which sets up a more
involved boot trace to capture the rest
of track 0 and save it to the file
"BOOT1". If *that* looks reasonably
normal, it saves the RWTS to a file,
unimaginatively named "RWTS", which can
be loaded with Advanced Demuffin to
copy each track of the original disk to
a duplicate with standard address/data
prologue/epilogue sequences.

Advanced Demuffin will only load RWTS
files from a drive in slot 6, which is
annoying since mine is in slot 5. Note
to self: patch that someday. In the
meantime, I'm swapping floppy disks
like some kind of prehistoric caveman.

[S6,D1=my work disk]

]PR#6
]BRUN ADVANCED DEMUFFIN 1.1

--> LOAD NEW RWTS MODULE
    At $B8, load "RWTS"
    from D1

[S6,D1=original disk]
[S6,D2=blank disk]

--> FORMAT TARGET DISK

...grind grind grind...

--> CONVERT DISK

This disk is 16 sectors, and the
default options (copy the entire disk,
all tracks, all sectors) don't need to
be changed.

ADVANCED DEMUFFIN 1.1  - COPYRIGHT 1983
WRITTEN BY THE STACK -CORRUPT COMPUTING
=======PRESS ANY KEY TO CONTINUE=======
TRK:...................................
+.5:
    0123456789ABCDEF0123456789ABCDEF012
SC0:...................................
SC1:...................................
SC2:...................................
SC3:...................................
SC4:...................................
SC5:...................................
SC6:...................................
SC7:...................................
SC8:...................................
SC9:...................................
SCA:...................................
SCB:...................................
SCC:...................................
SCD:...................................
SCE:...................................
SCF:.................R.................
=======================================
16 SC $00,$00 TO $22,$0F BY $01 TO DRV2

Hmm. The disk's own RWTS can't read one
single sector on track $11? That's
odd. And T11,S0F is usually the first
sector of the VTOC, so this could be
fatal.

Rebooting my work disk, I can see the
disk catalog on the demuffin'd copy,
despite the read error on T11,S0F. I
make a mental note to investigate this
later.

[S5D1=my work disk]
[S6D1=demuffin'd copy]

]PR#5
...
]CATALOG,S6,D1

C1983 DSR^C#254
012 FREE

*A 004 LOGO
*B 002 RESTORE.OBJ
*A 018 MENU
*B 013 SUNBURST LOGO TABLE
*A 046 ALIEN
 T 002 ALIEN FILE
*B 002 CLEAREOL-SM.OBJ
*B 002 CLEAR
*T 003 MANSION ROOMS
 T 002 D-SAURUS FILE
*A 022 TEACHER OPTION
*A 038 DIGITOSAURUS
 T 002 HI SCORE MULTIPLICATION
 T 002 HI SCORE ADDITION
*B 003 CMS4.OBJ
*B 011 IMAGES1
*B 002 BLINKER1.OBJ
*A 032 MANSION
*B 003 NUMBERS
*B 007 BARRIER1
*B 002 QUICKSOUND
*B 002 XOR
*B 003 ALIEN IMAGES2
 T 002 HI SCORE SUBTRACTION
*B 007 POINTERS
 T 002 HI SCORE DIVISION
*B 017 MASTER-SM-MOD
*B 033 GROUP5
*B 033 PIC.MANSION2
*B 031 GROUP4
*B 031 GROUP2
*B 033 PIC.OUTDOORS
*B 031 GROUP1
*B 033 GROUP3
*B 008 MONSTER

]RUN LOGO

The game loads and runs without
complaint. All further disk access is
done through standard DOS functions.
There don't appear to be any nibble
checks or any other form of secondary
protection.

Now to make the disk be able to read
itself (remember, it still has the
original RWTS on it)...

Using Copy ][+, I can "copy DOS" from a
freshly initialized DOS 3.3 (or
compatible) disk onto the demuffin'd
copy. I actually chose ProntoDOS for
this purpose, since it's highly
compatible with standard DOS 3.3 but
much faster. (This function of Copy ][+
just sector-copies tracks 0-2 from one
disk to another, but it's easier than
setting that up manually in some other
copy program.)

]PR#6
...
FILE NOT FOUND

Oops, I forgot one last thing: the
HELLO program is actually called LOGO.

]PR#5
...
]CATALOG,S6,D1
...
]RENAME LOGO,HELLO
]PR#6

Quod erat liberandum.

POSTSCRIPT: because you thought I'd
forgotten about that unreadable sector
on track $11.

Normally under DOS 3.3, track $11
contains the VTOC. T11,S00 points to
T11,S0F, which contains metadata (name,
type, and a pointer to the track/sector
list that contains pointers to the
actual file data) about the first few
files that you see when you type
CATALOG. T11,S0F normally points to
T11,S0E, which holds the same sort of
information on the next few files, and
so on.

But on the original disk, T11,S00
points to T11,S0D instead, as shown in
this annotated screen capture from my
trusty Copy ][+ sector editor:

SECTOR EDITOR                     DISK A

00- A0 11 0D 03 00 00 FE 00   QMC@@~@
       ^  ^
track--+  +--sector

08- 00 00 00 00 00 00 00 00  @@@@@@@@
10- 00 00 00 00 00 00 00 00  @@@@@@@@
18- 00 00 00 00 00 00 00 00  @@@@@@@@
20- 00 00 00 00 00 00 00 7A  @@@@@@@:
28- 00 00 00 00 00 00 00 00  @@@@@@@@
30- 07 FF 00 00 23 10 00 01  G_@@#P@A
38- 00 00 00 00 00 00 00 00  @@@@@@@@
40- 00 00 00 00 00 00 00 00  @@@@@@@@
48- 00 00 00 00 00 00 00 00  @@@@@@@@
50- 00 00 00 00 00 00 00 00  @@@@@@@@
58- 00 00 00 00 00 00 00 00  @@@@@@@@
60- 00 00 00 00 00 00 00 00  @@@@@@@@
68- 00 00 00 00 00 00 00 00  @@@@@@@@
70- 00 00 00 00 00 00 00 00  @@@@@@@@
78- 00 00 00 00 00 00 00 00  @@@@@@@@
80- 00 00 00 00 00 00 00 00  @@@@@@@@


TRACK $11, SECTOR $0    DOS 3.3


For whatever reason, the original copy
protection developer -- AFTER they
changed the prologue sequences on every
single track to nonstandard values --
decided that they weren't quite done,
so they made a sector that even their
own custom RWTS couldn't read. And they
chose the sector that normally kicks
off the disk catalog, just
because... I'm not sure, exactly. Once
I ran the disk through Advanced
Demuffin, I had no problem cataloging
the disk from my work disk (which boots
Diversi-DOS). Maybe some other disk
utilities are confused by a VTOC that
starts on T11,S0D instead of T11,S0F.

---------------------------------------
A 4am crack                  2014-04-08
-------------------EOF-----------------