--------Geometry Alive! Circles-------- A 4am crack 2015-11-06 --------------------------------------- Name: Geometry Alive! Circles Genre: educational Year: 1984 Authors: Jason A. Dylan, Activity Records, Inc. Publisher: Educational Activities, Inc. Media: single-sided 5.25-inch floppy OS: DOS 3.3 Previous cracks: none Identical cracks: #449 SAT Score Improvement System: Quantitative Comparisons ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA immediate disk read error Locksmith Fast Disk Backup unable to read any track EDD 4 bit copy (no sync, no count) works Copy ][+ nibble editor modified data epilogue ("BF AA EB" instead of "DE AA EB") Disk Fixer ["O" -> "Input/Output Control"] set Data Epilogue to "BF AA EB" all tracks readable T00 -> looks like a DOS 3.3 RWTS T11 -> DOS 3.3 disk catalog T01,S09 -> startup program is "LOADER" Why didn't COPYA work? modified epilogue bytes (every track) Why didn't Locksmith FDB work? modified epilogue bytes (every track) EDD worked. What does that tell us? no half or quarter tracks almost certainly no nibble check (just structural changes to epilogue) Next steps: 1. capture RWTS with AUTOTRACE 2. convert disk to standard format with Advanced Demuffin 3. patch RWTS to read standard format ~ Chapter 1 In Which We Attempt To Use The Original Disk As A Weapon Against Itself [S6,D1=original disk] [S6,D2=blank disk] [S5,D1=my work disk] ]PR#5 CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 CAPTURING BOOT1 ...reboots slot 6... ...reboots slot 5... SAVING BOOT1 SAVING RWTS ]BRUN ADVANCED DEMUFFIN 1.5 ["5" to switch to slot 5] ["R" to load a new RWTS module] --> At $B8, load "RWTS" from drive 1 ["6" to switch to slot 6] ["C" to convert disk] --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK:................................... +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0:................................... SC1:................................... SC2:................................... SC3:................................... SC4:................................... SC5:................................... SC6:................................... SC7:................................... SC8:................................... SC9:................................... SCA:................................... SCB:................................... SCC:................................... SCD:................................... SCE:................................... SCF:................................... ======================================= 16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- ]PR#5 ... ]CATALOG,S6,D2 C1983 DSR^C#254 069 FREE T 007 STUDFIL B 004 BASE2 A 004 LOGO A 026 CIRCLES1A B 002 SOUND B 005 TABLE B 002 PRNT B 004 PLOT.BIN A 003 LOADER A 006 EA MENU A 039 CIRCLES4A A 032 CIRCLES3A A 008 CIRCLES5A A 024 CIRCLES3B B 034 TITLE PAGE A 023 CIRCLES2A A 024 CIRCLES1C A 028 MGMT A 022 CIRCLES1D A 004 FILER A 023 CIRCLES2B A 024 CIRCLES2C A 024 CIRCLES2D A 021 CIRCLES2E B 034 CIRCLE ]RUN LOADER ...works... [S6,D1=demuffin'd copy] ]PR#6 ...grinds... My copy can't read itself yet. This is not unusual. ~ Chapter 2 In Which We Remove All Traces Of Copy Protection Using An Automated Tool That I Wrote For Just Such An Occasion [S6,D1=demuffin'd copy] [S5,D1=my work disk] ]PR#5 ]BRUN PDP T00,S03,$35 change BF to DE T00,S02,$9E change BF to DE Quod erat liberandum. ~ Epilogue Entering a first name of "SCORES" will take you to an administrative screen to show student records. Entering a first name of "PURGE" will allow you to purge student records. There is no administrative password. I purged all student records on the disk using the "PURGE" function, but it turns out this does not zero out the entire text file, so personal student information is still visible with a sector editor. I overwrote all sectors of the file by hand. --------------------------------------- A 4am crack No. 489 ------------------EOF------------------