------Mystery of the Witch's Shoes----- A 4am crack 2015-02-13 --------------------------------------- Name: Mystery of the Witch's Shoes: Sequencing Genre: educational Year: 1986 Publisher: Troll Associates Media: single-sided 5.25-inch floppy OS: David-DOS II.2 (see T00,S08) Other versions: none (preserved here for the first time) Identical cracks: Mrs. Wigglesworth's Secret (no. 223); Case of the Missing Chick (no. 222); Case of the Great Train Robbery (no. 221) ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA disk read error on first pass Locksmith Fast Disk Backup reads every track except $03; copy hangs on boot EDD 4 bit copy (no sync, no count) no errors, but copy boots DOS and exits to prompt Oddly, DOS commands still work at this point, but the files are gibberish. ]CATALOG VOL-*-FREE 254 127 B 005 HELP B 005 HELP2 B 033 MENU.SCREEN B 011 TABLES A 002 HELLO B 033 TROLL B 033 TITLE B 009 MENU B 011 FAO2.OBJ B 005 TABLE(A)2 B 014 TABLE.ALL B 027 TABLE(B)1 B 022 DATA.FUN B 002 LETTERS.USE B 016 FAO.OBJ B 005 TABLE(A)1 B 034 TABLE(C1)1 B 032 TABLE(C2)1 B 002 SCRN1.C B 009 SCRN2.COLD B 022 DATA.M&S B 022 DATA.F&F B 010 SCRN2.C ]LOAD HELLO ]LIST 20826 SYNTAX GOSUB |asy| cFGD Copy ][+ nibble editor T03 appears to be almost entirely sync bytes (all $FF, no data, no sectors per se, no structure at all) Disk Fixer T00,S00 starts off as a DOS 3.3-style bootloader, then goes off into the weeds T01,S01 is entirely blank T00,S08 has a copyright message: DAVID-DOS II.2 COPYRIGHT 1984 DAVID WESTON ...mailing address... T01,S09 -> startup program is blank T11 -> DOS 3.3-style disk catalog can't read T03 under any combination of parameters Why didn't COPYA work? T03 is unreadable because it does not have a standard sector structure Why didn't Locksmith FDB work? probably a nibble check during boot Why didn't my EDD copy work? I have no idea Next steps: 1. Capture bootloader with AUTOTRACE 2. Find nibble check and disable it 3. Figure out what's up with HELLO ~ Chapter 1 In Which We Get Nothing For Free, And Our Adventure Begins In Earnest [S6,D1=original disk] [S5,D1=my work disk] ]PR#5 CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 Hmm, a custom bootloader. Wait, I want to test something first. ]CATALOG,S6,D1 ...works... ]LOAD HELLO ]LIST ...same garbled results as before... OK, this HELLO program is definitely corrupted. Back to boot tracing. ]CALL -151 *800<2800.28FFM *801L ; similar enough to DOS 3.3 boot0 loop ; to re-use the disk controller ROM ; routine to read sectors from track 0 0801- A5 27 LDA $27 0803- C9 09 CMP #$09 0805- D0 17 BNE $081E 0807- A5 2B LDA $2B 0809- 4A LSR 080A- 4A LSR 080B- 4A LSR 080C- 4A LSR 080D- AA TAX 080E- 09 C0 ORA #$C0 0810- 85 3F STA $3F 0812- A9 00 LDA #$00 0814- 9D 78 04 STA $0478,X 0817- 9D F8 04 STA $04F8,X 081A- A9 5C LDA #$5C 081C- 85 3E STA $3E ; $08FF holds the sector count 081E- AE FF 08 LDX $08FF 0821- 30 15 BMI $0838 0823- BD ED 08 LDA $08ED,X 0826- 85 3D STA $3D 0828- CE FF 08 DEC $08FF ; $08FE holds the address (highest page ; first then decremented, unlike normal ; DOS 3.3) 082B- AD FE 08 LDA $08FE 082E- 85 27 STA $27 0830- CE FE 08 DEC $08FE ; call disk controller to read sector ; (loops back to $801 on exit) 0833- A6 2B LDX $2B 0835- 6C 3E 00 JMP ($003E) ; execution continues here (from $0821) ; after sector reads are complete 0838- 20 89 FE JSR $FE89 083B- 8D 0C C0 STA $C00C 083E- 8D 0E C0 STA $C00E 0841- 20 93 FE JSR $FE93 0844- 20 2F FB JSR $FB2F 0847- 20 58 FC JSR $FC58 ; looks like we're printing something ; to the screen, but there's nothing ; there except spaces ($A0) -- maybe ; this bootloader is generic/reusable ; with an option to print a title? 084A- A2 0D LDX #$0D 084C- BD B9 08 LDA $08B9,X 084F- 9D 0D 04 STA $040D,X 0852- CA DEX 0853- 10 F7 BPL $084C ; also blank spaces 0855- A2 25 LDX #$25 0857- BD C7 08 LDA $08C7,X 085A- 9D 01 05 STA $0501,X 085D- CA DEX 085E- 10 F7 BPL $0857 ; VTAB 2 0860- A9 02 LDA #$02 0862- 85 25 STA $25 0864- 20 22 FC JSR $FC22 ; set up RWTS parameters (usually done ; at $B700, but inlined here) 0867- A6 2B LDX $2B 0869- 8E E9 B7 STX $B7E9 086C- 8E F7 B7 STX $B7F7 086F- A0 01 LDY #$01 0871- 8C F4 B7 STY $B7F4 0874- 8C EA B7 STY $B7EA 0877- 8C F8 B7 STY $B7F8 087A- A0 02 LDY #$02 087C- 8C EC B7 STY $B7EC 087F- A0 1A LDY #$1A 0881- 8C E1 B7 STY $B7E1 0884- A0 B6 LDY #$B6 0886- 8C F1 B7 STY $B7F1 0889- A0 02 LDY #$02 ; highly suspect 088B- 20 03 BB JSR $BB03 ; reset stack 088E- A2 FF LDX #$FF 0890- 9A TXS 0891- 8E EB B7 STX $B7EB 0894- 8E FB 04 STX $04FB ; start DOS 0897- 4C 84 9D JMP $9D84 Looks like $BB03 (there shouldn't be any code there at all, by the way) is loading the rest of DOS. I bet it's doing a nibble check first, though. *8FE.8FF 08FE- BF 0B OK, we're loading into $B400..$BFFF. Let's capture it. *9600 and hangs until you press something else. That part is skipped for now, but I'm guessing it's called later. Location | Description | Value -------------+------------------+------ $B474 | length of data | $03 $B475/$B476 | starting address | $A502 $B477..$B479 | data The 3 bytes at $B477 end up at $A503, which is the tail end of the RUN entry point. It's just a JMP to the code that was just patched earlier: A503- 4C 36 9E JMP $9E36 Thus, trying to break to the prompt during boot will hang until you press something else. (Even if you did manage to get to the prompt, the RUN flag would ensure you couldn't do anything useful. Defense in depth!) Location | Description | Value -------------+------------------+------ $B47A | length of data | $30 $B47B/$B47C | starting address | $B5FF $B47D..$B4AC | data The $30 bytes at $B47D end up at $B600. The new code looks like this: B600- 60 RTS B601- A0 20 LDY #$20 B603- B9 0F B6 LDA $B60F,Y B606- 99 00 03 STA $0300,Y B609- 88 DEY B60A- 10 F7 BPL $B603 B60C- 4C 00 03 JMP $0300 B60F- A9 BF LDA #$BF B611- 85 01 STA $01 B613- A0 00 LDY #$00 B615- 84 00 STY $00 B617- 91 00 STA ($00),Y B619- C8 INY B61A- D0 FB BNE $B617 B61C- C6 01 DEC $01 B61E- A5 01 LDA $01 B620- C9 08 CMP #$08 B622- B0 F3 BCS $B617 B624- AD 81 C0 LDA $C081 B627- 20 93 FE JSR $FE93 B62A- 20 89 FE JSR $FE89 B62D- 4C 00 E0 JMP $E000 Looks like this is going to be The Badlands routine that wipes main memory and exits. Location | Description | Value -------------+------------------+------ $B4AD | length of data | $01 $B4AE/$B4AF | starting address | $B7C1 $B4B0 | data | $60 This puts an RTS instruction at $B7C2, which would normally set up the RWTS parameters for writing DOS after INIT. Location | Description | Value -------------+------------------+------ $B4B1 | length of data | $03 $B4B2/$B4B3 | starting address | $9E72 $B4B4..$B4B6 | data This modifies DOS's image of the page 3 jump vectors so that will jump to $B601, a.k.a. The Badlands. Location | Description | Value -------------+------------------+------ $B4B7 | length of data | $02 $B4B8/$B4B9 | starting address | $A396 $B4BA..$B4BB | data | 18 60 This patch neutralizes the SAVE handler at $A397 so it does nothing but claims to have succeeded. That's it. The next byte is $00, so the BEQ at $B583 branches and the patch loop exits gracefully via RTS. (There appear to be more patches to decrypt binary files, but this disk does not use them.) The result is a really messed up DOS that is maximally unfriendly to prying eyes and maximally incompatible with any other version of DOS. It decrypts BASIC files on the fly, traps , traps , sets the RUN flag, and disables the SAVE command. It does not, however, hinder copying the disk itself. The only patch I need to bypass the copy protection is at $BB03: 1. push $B5/$19 to the stack 2. set Y register to $04 3. jump to $B7A9 T00,S07,$03 old: "4E 06 BB 71 6E 0A BB 40 27 6E 0F" new: "A9 B5 48 A9 19 48 A0 04 4C A9 B7" Quod erat liberandum. --------------------------------------- A 4am crack No. 224 ------------------EOF------------------