----------Electric Chalkboard----------
A 4am crack                  2016-03-29
---------------------------------------

Name: Electric Chalkboard
Genre: educational
Year: 1986
Publisher: Heartsoft, Inc.
Media: single-sided 5.25-inch floppy
OS: Diversi-DOS (T02,S02 has the string
  "C1982 DSR" backwards)
Previous cracks: none
Similar cracks:
  #652 The Great American States Race
  #580 Tommy the Time Telling Turtle
  #578 The Coin Changer
  #575 Milt's Math Drills: Addition and
       Subtraction

                   ~

               Chapter 0
 In Which Various Automated Tools Fail
          In Interesting Ways


COPYA
  immediate disk read error

Locksmith Fast Disk Backup
  unable to read any track

EDD 4 bit copy (no sync, no count)
  works

Copy ][+ nibble editor
  modified address epilogues
  ("AA AA EB" instead of "DE AA EB")

Disk Fixer
  ["O" -> "Input/Output Control"]
    set Address Epilogue to "AA AA EB"
  all tracks readable
  T00 -> looks like a DOS 3.3 RWTS
  T11 -> DOS 3.3 disk catalog
  T01,S09 -> startup program is "HELLO"

Why didn't COPYA work?
  modified epilogue bytes (every track)

Why didn't Locksmith FDB work?
  modified epilogue bytes (every track)

EDD worked. What does that tell us?
  no half or quarter tracks
  almost certainly no nibble check
  (just structural changes to epilogue)

Next steps:

  1. capture RWTS with AUTOTRACE
  2. convert disk to standard format
     with Advanced Demuffin
  3. patch RWTS to read standard format

                   ~

               Chapter 1
In Which We Attempt To Use The Original
    Disk As A Weapon Against Itself


[S6,D1=original disk]
[S6,D2=blank disk]
[S5,D1=my work disk]

]PR#5
CAPTURING BOOT0
...reboots slot 6...
...reboots slot 5...
SAVING BOOT0
CAPTURING BOOT1
...reboots slot 6...
...reboots slot 5...
SAVING BOOT1
SAVING RWTS

]BRUN ADVANCED DEMUFFIN 1.5

["5" to switch to slot 5]

["R" to load a new RWTS module]
  --> At $B8, load "RWTS" from drive 1

["6" to switch to slot 6]

["C" to convert disk]

                 --v--

ADVANCED DEMUFFIN 1.5    (C) 1983, 2014
ORIGINAL BY THE STACK    UPDATES BY 4AM
=======PRESS ANY KEY TO CONTINUE=======
TRK:...................................
+.5:
    0123456789ABCDEF0123456789ABCDEF012
SC0:...................................
SC1:...................................
SC2:...................................
SC3:...................................
SC4:...................................
SC5:...................................
SC6:...................................
SC7:...................................
SC8:...................................
SC9:...................................
SCA:...................................
SCB:...................................
SCC:...................................
SCD:...................................
SCE:...................................
SCF:...................................
=======================================
16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2

                 --^--

]PR#5
...
]CATALOG,S6,D2

C1983 DSR^C#254
003 FREE

*A 002 HELLO
 B 034 HEARTSOFT
 B 010 HEAVYCG.ASC
 B 033 PI.CHALKBOARD
 B 032 SHAPES
 B 032 SHAPES
 B 034 COLORBOARD
 B 034 PI.FRONT
 T 003 SHAPES.POSITION
 B 034 PI.FRAME
 B 033 FRAME
 B 002 CHALKBOARD.MUSIC
 A 024 PROGRAM.CHALKBOARD
 B 033 CHALKBOARD
 A 024 PROGRAM.1
 B 002 TESTSHAPE
 B 034 PI.TITLEFRAME
 A 003 HELLO2
 A 002 HELLO-PART2
 A 019 PROGRAM
 B 010 HRCG
 B 010 UTILITY-4.FULL
 B 004 HEARTSOFT.CPRS
 B 017 TITLE.CPRS
 B 005 PART2.CPRS
 B 002 PART3.CPRS
 B 005 BOARD.LNK
 B 002 PCN5.MLNK
 B 014 CHALKBOARD.CPRS

Yes, two files named "SHAPES". I don't
know what the difference is. Nor do I
know how you get duplicate filenames
without hex editing. (A sector editor
shows no control characters in either
file.)

Anyway...

]RUN HELLO
...works...

[S6,D1=demuffin'd copy]

]PR#6
...grinds...

My copy can't read itself yet. This is
not unusual.

                   ~

               Chapter 2
 In Which We Remove All Traces Of Copy
Protection Using An Automated Tool That
   I Wrote For Just Such An Occasion


[S6,D1=demuffin'd copy]
[S5,D1=my work disk]

]PR#5
]BRUN PDP

T00,S03,$91 change AA to DE
T00,S06,$AE change AA to DE

]PR#6
...works...

Quod erat liberandum.

---------------------------------------
A 4am crack                     No. 654
------------------EOF------------------