------------The Royal Rules------------ A 4am crack 2015-03-16 --------------------------------------- Name: The Royal Rules Genre: educational Year: 1986 Credits: - Designed by Tom O'Brien - Programmed by Raoul Watson Publisher: Sunburst Communications Media: two single-sided 5.25-inch disks OS: ProDOS 1.1.1 Other versions: none (preserved here for the first time) Identical cracks: Now You See It, Now You Don't: Was It There? Was It Missing? (4am crack no. 262) ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA immediate disk read error Locksmith Fast Disk Backup unable to read any track EDD 4 bit copy (no sync, no count) no read errors, but copy loads ProDOS title screen, then reboots Copy ][+ nibble editor T00 has at least a few sectors, but I'm not sure how many T01+ have no visible structure at all --v-- COPY ][ PLUS BIT COPY PROGRAM 8.4 (C) 1982-9 CENTRAL POINT SOFTWARE, INC. --------------------------------------- TRACK: 03 START: 357F LENGTH: 1438 3578: FF AA D5 FE 9A FF FF EF VIEW 3580: F9 CF D3 F3 99 E6 99 E6 3588: 99 E6 99 E6 99 E6 99 E6 3590: 99 E6 99 E6 99 CA AA A9 3598: 9B 9D A6 96 AA D5 FC 99 35A0: E6 99 E6 99 E6 99 E6 99 35A8: E6 99 E6 CA D5 A9 FE DC 35B0: A7 B7 D9 9E CF BD DA 9A 35B8: DB B4 BB A7 CF CF DC A6 --------------------------------------- A TO ANALYZE DATA ESC TO QUIT ? FOR HELP SCREEN / CHANGE PARMS Q FOR NEXT TRACK SPACE TO RE-READ --^-- Disk Fixer ["O" -> "Input/Output Control"] "CHECKSUM ENABLED" -> "NO" T00,S00 readable T00,S0D readable T00,S0E readable nothing else Why didn't COPYA work? not a 16-sector disk (or maybe a wildly non-standard one) Why didn't Locksmith FDB work? ditto Why didn't my EDD copy work? I don't know. Probably a nibble check in the first .SYSTEM file (assuming this is really ProDOS as it claims). Converting the disk to a standard format will be a challenge. Advanced Demuffin requires a DOS 3.3-shaped RWTS, but this disk uses ProDOS (as far as I can tell). Assuming the disk even uses 16 sectors (and Copy ][+ just can't see the structure), I might be able to extract the RWTS from the PRODOS file and build an RWTS to plug into Advanced Demuffin. I've done that successfully before, but it's finicky. DOS 3.3 and ProDOS are very different beasts. Next steps: 1. Boot trace to capture PRODOS file in memory 2. Extract its RWTS routines to build a DOS 3.3-shaped RWTS file 3. Convert the disk to a standard format with Advanced Demuffin 4. Patch the bootloader and/or the PRODOS file to be able to read a standard format disk 5. Find and bypass the nibble check ~ Chapter 1 In Which We Take Our First Steps [S6,D1=original disk] [S5,D1=my work disk] ]PR#5 CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 ]CALL -151 *800<2800.28FFM *801L ; set up $801 with an "RTS" (probably ; so we can JSR $C65C later to read ; sectors) 0801- A9 60 LDA #$60 0803- 8D 01 08 STA $0801 ; save slot (x16) 0806- 86 43 STX $43 0808- 86 2B STX $2B ; munge slot into $C6 form and store it 080A- 8A TXA 080B- 4A LSR 080C- 4A LSR 080D- 4A LSR 080E- 4A LSR 080F- 09 C0 ORA #$C0 0811- 8D 38 08 STA $0838 ; set reset vector 0814- A0 CE LDY #$CE 0816- A9 08 LDA #$08 0818- 8C F2 03 STY $03F2 081B- 8D F3 03 STA $03F3 081E- A9 AD LDA #$AD 0820- 8D F4 03 STA $03F4 0823- A9 00 LDA #$00 0825- 85 09 STA $09 0827- 85 03 STA $03 ; increment physical sector number 0829- E6 3D INC $3D ; read a sector 082B- 20 36 08 JSR $0836 ; decrement sector count 082E- CE 39 08 DEC $0839 ; loop back to read more sectors 0831- D0 F6 BNE $0829 ; or continue down below 0833- 4C 40 08 JMP $0840 0836- 4C 5C C6 JMP $C65C 0839- [02] 083A- ["PRODOS"] ; execution continues here after all ; sectors are read 0840- A9 02 LDA #$02 0842- 85 02 STA $02 0844- A9 0C LDA #$0C 0846- 85 27 STA $27 ; don't know what this does yet 0848- 20 34 09 JSR $0934 This is where I need to interrupt the boot, to see what ends up at $900 (and $A00) from initial sector read loop. *9600 COPY --> FILE --> from SLOT 7, DRIVE 1 --> to SLOT 5, DRIVE 1 --> BASIC.SYSTEM OK, now I have a clean copy of the ProDOS BASIC.SYSTEM file on my DOS 3.3- based work disk. I'll get back to that. ]PR#5 ]BLOAD BOOT1.PRODOS,A$2000 ]CALL -151 *2000L . . nothing unusual, until... . ; set up to read block 2 into $0C00 ; (this is the ProDOS disk catalog) 218F- A2 00 LDX #$00 2191- 86 14 STX $14 2193- A0 02 LDY #$02 2195- A9 0C LDA #$0C 2197- 85 15 STA $15 2199- 8D 07 22 STA $2207 219C- 8C 08 22 STY $2208 219F- 8E 09 22 STX $2209 ; raw disk read (MLI $80) 21A2- 20 00 BF JSR $BF00 21A5- [80 04 22] ; on failure, jump to The Badlands 21A8- D0 19 BNE $21C3 ; check if we've read all the blocks of ; the disk catalog into memory 21AA- A0 03 LDY #$03 21AC- B1 14 LDA ($14),Y 21AE- AA TAX 21AF- 88 DEY 21B0- 11 14 ORA ($14),Y 21B2- F0 0C BEQ $21C0 21B4- B1 14 LDA ($14),Y 21B6- A8 TAY 21B7- A5 15 LDA $15 21B9- 18 CLC 21BA- 69 02 ADC #$02 21BC- C9 14 CMP #$14 21BE- 90 D7 BCC $2197 ; success path continues at $5800 21C0- 4C 00 58 JMP $5800 ; failure path ends up here 21C3- 4C 00 57 JMP $5700 *5700L ; relocate this to $0800 5700- A2 80 LDX #$80 5702- BD 0E 57 LDA $570E,X 5705- 9D 00 08 STA $0800,X 5708- CA DEX 5709- 10 F7 BPL $5702 ; and jump there 570B- 4C 00 08 JMP $0800 ; wipe all memory 570E- 2C 89 C0 BIT $C089 5711- 2C 89 C0 BIT $C089 5714- A2 1F LDX #$1F 5716- A0 00 LDY #$00 5718- 99 00 09 STA $0900,Y 571B- 99 00 20 STA $2000,Y 571E- 99 00 40 STA $4000,Y 5721- 99 00 60 STA $6000,Y 5724- 99 00 80 STA $8000,Y 5727- 99 00 A0 STA $A000,Y 572A- 99 00 D0 STA $D000,Y ; and make a sound while doing it 572D- AD 30 C0 LDA $C030 5730- 88 DEY 5731- D0 E5 BNE $5718 5733- EE 0C 08 INC $080C 5736- EE 0F 08 INC $080F 5739- EE 12 08 INC $0812 573C- EE 15 08 INC $0815 573F- EE 18 08 INC $0818 5742- EE 1B 08 INC $081B 5745- EE 1E 08 INC $081E 5748- CA DEX 5749- 10 CD BPL $5718 574B- 8D F2 03 STA $03F2 574E- 8D F3 03 STA $03F3 5751- 2C 8A C0 BIT $C08A ; and reboot 5754- 6C FC FF JMP ($FFFC) Well, let's try not to end up there! If we read the catalog successfully, execution continues at $5800. *5800L 5800- A2 4B LDX #$4B 5802- 86 02 STX $02 5804- 2C 81 C0 BIT $C081 5807- 2C 81 C0 BIT $C081 580A- A9 D1 LDA #$D1 580C- 8D 04 D1 STA $D104 ; set reset vector 580F- A2 F6 LDX #$F6 5811- A0 BF LDY #$BF 5813- A9 1A LDA #$1A 5815- 8E F2 03 STX $03F2 5818- 8C F3 03 STY $03F3 581B- 8D F4 03 STA $03F4 ; reset drive heads 581E- A5 43 LDA $43 5820- 29 70 AND #$70 5822- 85 3E STA $3E 5824- AA TAX 5825- BD 80 C0 LDA $C080,X 5828- BD 82 C0 LDA $C082,X 582B- BD 84 C0 LDA $C084,X 582E- BD 86 C0 LDA $C086,X ; then turn on drive motor manually ; (suspicious) 5831- BD 89 C0 LDA $C089,X 5834- 24 43 BIT $43 5836- 10 01 BPL $5839 5838- E8 INX 5839- BD 8A C0 LDA $C08A,X ; wait loop ($58A5 is just an RTS) 583C- A9 00 LDA #$00 583E- AA TAX 583F- A8 TAY 5840- 20 A5 58 JSR $58A5 5843- 88 DEY 5844- D0 FA BNE $5840 5846- CA DEX 5847- D0 F7 BNE $5840 ; an address pointer maybe? 5849- 85 44 STA $44 584B- A9 14 LDA #$14 584D- 85 45 STA $45 ; read/write access to RAM bank 1 584F- 2C 8B C0 BIT $C08B 5852- 2C 8B C0 BIT $C08B ; don't know what this does yet 5855- 20 03 D0 JSR $D003 5858- A2 03 LDX #$03 585A- 86 00 STX $00 585C- 86 01 STX $01 585E- A2 15 LDX #$15 5860- 86 03 STX $03 5862- C6 03 DEC $03 5864- 30 12 BMI $5878 ; nor this 5866- 20 0C D0 JSR $D00C 5869- B0 F7 BCS $5862 586B- C0 06 CPY #$06 586D- D0 F3 BNE $5862 ; nor any of this 586F- 20 0F D0 JSR $D00F 5872- 90 19 BCC $588D 5874- C6 01 DEC $01 5876- 10 E6 BPL $585E 5878- A6 02 LDX $02 587A- 30 26 BMI $58A2 587C- A0 12 LDY #$12 587E- BD A6 58 LDA $58A6,X 5881- 99 96 D3 STA $D396,Y 5884- CA DEX 5885- 88 DEY 5886- 10 F6 BPL $587E 5888- 86 02 STX $02 588A- 4C 58 58 JMP $5858 588D- C6 00 DEC $00 588F- 10 CD BPL $585E 5891- A5 01 LDA $01 5893- C9 03 CMP #$03 5895- D0 E1 BNE $5878 ; success path falls through to here ; (I think) 5897- A6 3E LDX $3E ; turn off drive motor 5899- BD 88 C0 LDA $C088,X ; switch to ROM 589C- 2C 8A C0 BIT $C08A ; continue with "stage 2" loader (to ; launch .SYSTEM file, probably) 589F- 4C 00 08 JMP $0800 ; failure path ends up here 58A2- 4C F6 BF JMP $BFF6 *BFF6L BFF6- 2C 80 C0 BIT $C080 BFF9- 4C 00 D1 JMP $D100 I'm guessing that $D100 ends up executing the code that started out at $5700, a.k.a. The Badlands. By the time execution reaches $589F (the success path), ProDOS has done everything it needs to do by relocating itself into the language card, and it's time to find the first .SYSTEM file and load it. But it needs to load the file at $2000, so ProDOS moves its "stage 2" code to $800 to avoid memory conflicts. Oh, and it's modified the RWTS in memory a number of times. How many? I'm not sure yet. I need to interrupt the boot to see what evil lurks at $D003, $D00C, and $D00F. *9600 *LOGO.BIN BIN 13 ENTER BAS 38 *MENU BAS 34 *GUARD4 BIN 8 *FIRST BAS 32 STATUS BIN 1 *STARTUP BAS 1 *WIMPLE BIN 5 *LOGO BAS 5 *GUARD1 BIN 8 *BOX2 BIN 3 FCOPY BIN 1 *UTIL BAS 13 *SECOND BAS 37 *FORM BIN 6 *GUARD3 BIN 8 *GUARD2 BIN 8 BLOCKS FREE: 1 BLOCKS USED: 279 The custom floppy device driver is in memory, and I have unfettered access to the disk through a clean version of BASIC.SYSTEM. ]PREFIX /KINGS.QUEENS ]LOAD STARTUP ]LIST 1 FOR I = 235 TO 238: POKE I,45 : NEXT I: POKE 254,0: POKE 4 879,0 2 POKE 104,64: POKE 16384,0: PRINT CHR$ (4)"RUN LOGO" Un. Fettered. Access. But how do I copy all these files to a standard disk? I could do it one at a time -- LOAD and BLOAD work, so I could simply load each file into memory and reboot and save it. But wait. ProDOS has separate device drivers for floppies and hard drives. Maybe... [S7,D1=ProDOS hard drive, "A4AMCRACK"] ]PREFIX /A4AMCRACK ]CAT /A4AMCRACK NAME TYPE BLOCKS MODIFIED *PRODOS SYS 35 6-AUG-03 RAM.DRV.SYSTEM SYS 4 29-NOV-10 PROSEL.SYSTEM SYS 1 1-APR-88 APPLICATIONS DIR 2 18-DEC-14 BASIC.SYSTEM SYS 21 6-DEC-91 COMMANDS DIR 1 20-MAR-14 DOC DIR 1 20-MAR-14 DOS3.3 DIR 1 20-MAR-14 ARCHIVE DIR 1 8-FEB-15 MERLIN DIR 2 1-OCT-14 INCOMING DIR 1 30-SEP-14 PROSEL BIN 13 17-OCT-14 UTIL DIR 6 20-MAR-14 BLOCKS FREE:60603 BLOCKS USED: 4932 Not only do I have unfettered access to the floppy disk, I have my entire hard drive of utilities at my disposal. ]-/A4AMCRACK/APPLICATIONS/COPYIIPLUS8.4 /UTIL.SYSTEM ...launches Copy ][+... --> CREATE SUBDIRECTORY --> SLOT 7, DRIVE 1 --> SUBDIRECTORY NAME: KINGS.QUEENS --> COPY --> FILES --> from SLOT 6, DRIVE 1 --> to SLOT 7, DRIVE 1, KINGS.QUEENS --> all files It works. Copy ][+ uses the version of ProDOS in memory, including the custom floppy disk driver. As far as Copy ][+ is concerned, there's nothing unusual about this disk or its files. Hooray for abstractions! Now that I have all the files off the original disk, I can safely put it away and never touch it again. (Whew. Good riddance.) [S6,D1=blank disk] ]PR#7 Using Copy ][+ again, I simply recreate the original disk with a clean copy of the PRODOS file. (I have a directory of PRODOS files of different versions for just such an occasion, because that's not weird at all.) [Copy ][+ 8.4] --> FORMAT DISK --> PRODOS --> SLOT 6, DRIVE 1 --> VOLUME NAME: KINGS.QUEENS --> COPY --> FILES --> from SLOT 7, DRIVE 1 --> to SLOT 6, DRIVE 1 --> ARCHIVES/PRODOS1.1.1/PRODOS --> COPY --> FILES --> from SLOT 7, DRIVE 1, KINGS.QUEENS --> to SLOT 6, DRIVE 1 --> all files except PRODOS ]PR#6 ...works... Quod erat liberandum. --------------------------------------- A 4am crack No. 267 ------------------EOF------------------