-------Case of the Missing Chick------- A 4am crack 2015-02-13 --------------------------------------- Name: Case of the Missing Chick: Finding The Main Idea Genre: educational Year: 1986 Publisher: Troll Associates Media: single-sided 5.25-inch floppy OS: David-DOS II.2 (see T00,S08) Other versions: none (preserved here for the first time) Identical cracks: Case of the Great Train Robbery (4am crack no. 221) ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA disk read error on first pass Locksmith Fast Disk Backup reads every track except $03; copy hangs on boot EDD 4 bit copy (no sync, no count) no errors, but copy boots DOS and exits to prompt Oddly, DOS commands still work at this point, but the files are gibberish. ]CATALOG VOL-*-FREE 254 104 B 005 HELP A 002 HELLO B 026 PC2 B 006 O B 021 SH2 B 002 PG2 B 005 T1 B 005 T2 B 005 T2A B 002 M B 005 O3 B 004 AN1 B 012 O4 B 060 A B 033 TITLE B 014 TABLE.ALL B 005 T2B B 033 MENU.SCREEN B 007 H1 B 005 O2 B 021 SH1 B 005 T3A B 005 T3B B 003 PLN B 004 MTBL B 004 MDRW B 011 P B 033 TROLL B 005 T4A B 005 T4B B 003 AN2 B 007 H3 B 008 H4 B 008 H2 B 008 U ]LOAD HELLO ]LIST 20817 SYNTAX GOSUB |asy`C@AC Copy ][+ nibble editor T03 appears to be almost entirely sync bytes (all $FF, no data, no sectors per se, no structure at all) Disk Fixer T00,S00 starts off as a DOS 3.3-style bootloader, then goes off into the weeds T01,S01 is entirely blank T00,S08 has a copyright message: DAVID-DOS II.2 COPYRIGHT 1984 DAVID WESTON ...mailing address... T01,S09 -> startup program is blank T11 -> DOS 3.3-style disk catalog can't read T03 under any combination of parameters Why didn't COPYA work? T03 is unreadable because it does not have a standard sector structure Why didn't Locksmith FDB work? probably a nibble check during boot Why didn't my EDD copy work? I have no idea Next steps: 1. Capture bootloader with AUTOTRACE 2. Find nibble check and disable it 3. Figure out what's up with HELLO ~ Chapter 1 In Which We Get Nothing For Free, And Our Adventure Begins In Earnest [S6,D1=original disk] [S5,D1=my work disk] ]PR#5 CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 Hmm, a custom bootloader. Wait, I want to test something first. ]CATALOG,S6,D1 ...works... ]LOAD HELLO ]LIST ...same garbled results as before... OK, this HELLO program is definitely corrupted. Back to boot tracing. ]CALL -151 *800<2800.28FFM *801L ; similar enough to DOS 3.3 boot0 loop ; to re-use the disk controller ROM ; routine to read sectors from track 0 0801- A5 27 LDA $27 0803- C9 09 CMP #$09 0805- D0 17 BNE $081E 0807- A5 2B LDA $2B 0809- 4A LSR 080A- 4A LSR 080B- 4A LSR 080C- 4A LSR 080D- AA TAX 080E- 09 C0 ORA #$C0 0810- 85 3F STA $3F 0812- A9 00 LDA #$00 0814- 9D 78 04 STA $0478,X 0817- 9D F8 04 STA $04F8,X 081A- A9 5C LDA #$5C 081C- 85 3E STA $3E ; $08FF holds the sector count 081E- AE FF 08 LDX $08FF 0821- 30 15 BMI $0838 0823- BD ED 08 LDA $08ED,X 0826- 85 3D STA $3D 0828- CE FF 08 DEC $08FF ; $08FE holds the address (highest page ; first then decremented, unlike normal ; DOS 3.3) 082B- AD FE 08 LDA $08FE 082E- 85 27 STA $27 0830- CE FE 08 DEC $08FE ; call disk controller to read sector ; (loops back to $801 on exit) 0833- A6 2B LDX $2B 0835- 6C 3E 00 JMP ($003E) ; execution continues here (from $0821) ; after sector reads are complete 0838- 20 89 FE JSR $FE89 083B- 8D 0C C0 STA $C00C 083E- 8D 0E C0 STA $C00E 0841- 20 93 FE JSR $FE93 0844- 20 2F FB JSR $FB2F 0847- 20 58 FC JSR $FC58 ; looks like we're printing something ; to the screen, but there's nothing ; there except spaces ($A0) -- maybe ; this bootloader is generic/reusable ; with an option to print a title? 084A- A2 0D LDX #$0D 084C- BD B9 08 LDA $08B9,X 084F- 9D 0D 04 STA $040D,X 0852- CA DEX 0853- 10 F7 BPL $084C ; also blank spaces 0855- A2 25 LDX #$25 0857- BD C7 08 LDA $08C7,X 085A- 9D 01 05 STA $0501,X 085D- CA DEX 085E- 10 F7 BPL $0857 ; VTAB 2 0860- A9 02 LDA #$02 0862- 85 25 STA $25 0864- 20 22 FC JSR $FC22 ; set up RWTS parameters (usually done ; at $B700, but inlined here) 0867- A6 2B LDX $2B 0869- 8E E9 B7 STX $B7E9 086C- 8E F7 B7 STX $B7F7 086F- A0 01 LDY #$01 0871- 8C F4 B7 STY $B7F4 0874- 8C EA B7 STY $B7EA 0877- 8C F8 B7 STY $B7F8 087A- A0 02 LDY #$02 087C- 8C EC B7 STY $B7EC 087F- A0 1A LDY #$1A 0881- 8C E1 B7 STY $B7E1 0884- A0 B6 LDY #$B6 0886- 8C F1 B7 STY $B7F1 0889- A0 02 LDY #$02 ; highly suspect 088B- 20 03 BB JSR $BB03 ; reset stack 088E- A2 FF LDX #$FF 0890- 9A TXS 0891- 8E EB B7 STX $B7EB 0894- 8E FB 04 STX $04FB ; start DOS 0897- 4C 84 9D JMP $9D84 Looks like $BB03 (there shouldn't be any code there at all, by the way) is loading the rest of DOS. I bet it's doing a nibble check first, though. *8FE.8FF 08FE- BF 0B OK, we're loading into $B400..$BFFF. Let's capture it. *9600 and hangs until you press something else. That part is skipped for now, but I'm guessing it's called later. Location | Description | Value -------------+------------------+------ $B474 | length of data | $03 $B475/$B476 | starting address | $A502 $B477..$B479 | data The 3 bytes at $B477 end up at $A503, which is the tail end of the RUN entry point. It's just a JMP to the code that was just patched earlier: A503- 4C 36 9E JMP $9E36 Thus, trying to break to the prompt during boot will hang until you press something else. (Even if you did manage to get to the prompt, the RUN flag would ensure you couldn't do anything useful. Defense in depth!) Location | Description | Value -------------+------------------+------ $B47A | length of data | $30 $B47B/$B47C | starting address | $B5FF $B47D..$B4AC | data The $30 bytes at $B47D end up at $B600. The new code looks like this: B600- 60 RTS B601- A0 20 LDY #$20 B603- B9 0F B6 LDA $B60F,Y B606- 99 00 03 STA $0300,Y B609- 88 DEY B60A- 10 F7 BPL $B603 B60C- 4C 00 03 JMP $0300 B60F- A9 BF LDA #$BF B611- 85 01 STA $01 B613- A0 00 LDY #$00 B615- 84 00 STY $00 B617- 91 00 STA ($00),Y B619- C8 INY B61A- D0 FB BNE $B617 B61C- C6 01 DEC $01 B61E- A5 01 LDA $01 B620- C9 08 CMP #$08 B622- B0 F3 BCS $B617 B624- AD 81 C0 LDA $C081 B627- 20 93 FE JSR $FE93 B62A- 20 89 FE JSR $FE89 B62D- 4C 00 E0 JMP $E000 Looks like this is going to be The Badlands routine that wipes main memory and exits. Location | Description | Value -------------+------------------+------ $B4AD | length of data | $01 $B4AE/$B4AF | starting address | $B7C1 $B4B0 | data | $60 This puts an RTS instruction at $B7C2, which would normally set up the RWTS parameters for writing DOS after INIT. Location | Description | Value -------------+------------------+------ $B4B1 | length of data | $03 $B4B2/$B4B3 | starting address | $9E72 $B4B4..$B4B6 | data This modifies DOS's image of the page 3 jump vectors so that will jump to $B601, a.k.a. The Badlands. Location | Description | Value -------------+------------------+------ $B4B7 | length of data | $02 $B4B8/$B4B9 | starting address | $A396 $B4BA..$B4BB | data | 18 60 This patch neutralizes the SAVE handler at $A397 so it does nothing but claims to have succeeded. That's it. The next byte is $00, so the BEQ at $B583 branches and the patch loop exits gracefully via RTS. (There appear to be more patches to decrypt binary files, but this disk does not use them.) The result is a really messed up DOS that is maximally unfriendly to prying eyes and maximally incompatible with any other version of DOS. It decrypts BASIC files on the fly, traps , traps , sets the RUN flag, and disables the SAVE command. It does not, however, hinder copying the disk itself. The only patch I need to bypass the copy protection is at $BB03: 1. push $B5/$19 to the stack 2. set Y register to $04 3. jump to $B7A9 T00,S07,$03 old: "4E 06 BB 71 6E 0A BB 40 27 6E 0F" new: "A9 B5 48 A9 19 48 A0 04 4C A9 B7" Quod erat liberandum. --------------------------------------- A 4am crack No. 222 ------------------EOF------------------