---------------Math Shop--------------- A 4am crack 2014-09-24 --------------------------------------- "Math Shop" is a 1986 educational game designed and programmed by Cary Hammer; contributing designer: Alice Wyman; distributed by Scholastic, Inc. COPYA fails miserably and immediately. EDD 4 bit copy gives no errors, but the copy just reboots over and over. The original disk boots to ProDOS and might be entirely file-based (based on the pattern of disk activity while the game loads), but the copy never even gets as far as displaying the ProDOS splash screen. In my experience, programs do not spontaneously reboot unless someone tells them to. Turning to my trusty Disk Fixer sector editor, I press "O" to enter the Input/ Output Control, then set "CHECKSUM ENABLED" to "NO" to ignore address field checksums and epilogue bytes). And behold! All tracks and sectors are readable. Based on my limited experience cracking other disks, I would guess that this disk has - Standard prologue bytes before the address and data fields [otherwise my sector editor would give me read errors, even when ignoring checksums] - Non-standard epilogue bytes after the address and data fields [otherwise COPYA would work] - Some secondary protection [otherwise the bit copy created with EDD 4 would work] Given the (relatively) weak structural protection, I used to turn to the DOS 3.3 master disk, patch the RWTS to ignore checksums and epilogue bytes (changing $B942 from "SEC" to "CLC"), and run COPYA. Then, one fine day, and completely by accident, I came across an original disk with a bad sector. I suppose this shouldn't surprise me. These floppies are decades old by now; it's amazing any of them work at all. The point is, I shouldn't be using tools that ignore potentially serious read errors. There are other tools, like Super Demuffin, that can convert a disk like this (with non-standard epilogue bytes) into a standard format. It requires figuring out what the actual epilogue bytes are, but it has the advantage of surfacing a read error if the original disk actually has a read error. So... no more COPYA+B942:18 patch. From now on, it's Super Demuffin or Advanced Demuffin to convert disks to a standard format. My AUTOTRACE program will only automate extraction of the RWTS from a DOS 3.3-shaped bootloader, so let's see if I can use Super Demuffin. Super Demuffin is a cracker's utility built on top of Locksmith Fast Disk Copy. It takes a disk that uses non- standard but uniform address and data prologue and epilogue bytes, and it converts it to a standard disk format. I've included a copy on my work disk. First, I'll need to find exactly what those epilogue bytes are. Turning to the Copy ][+ nibble editor: --v-- COPY ][ PLUS BIT COPY PROGRAM 8.4 (C) 1982-9 CENTRAL POINT SOFTWARE, INC. --------------------------------------- TRACK: 01 START: 2A55 LENGTH: 015F 2A30: FF FF FF FF FF FF FF FF VIEW 2A38: FF FF FF FF FF FF FF FF 2A40: FF FF FF FF FF FF FF FF 2A48: FF FF FF FF FF FF FF FF 2A50: FF FF FF FF FF D5 AA 96 <-2A55 ^^^^^^^^ address prologue 2A58: FF FE AA AB AA AA FF FF 2A60: FF FF EB E7 E7 F9 FE FF ^^^^^^^^ address epilogue 2A68: FF FF FF FF D5 AA AD 9B ^^^^^^^^ data prologue 2A70: 97 9B 9A 9B 9A 9B 9A 9B --------------------------------------- A TO ANALYZE DATA ESC TO QUIT ? FOR HELP SCREEN / CHANGE PARMS Q FOR NEXT TRACK SPACE TO RE-READ --^-- (Not shown in the above screenshot, but the data epilogue is also "FF FF EB".) Some quick inspection suggests that all tracks on the disk use the same non- standard address and data epilogue bytes. Now I can plug this information into Super Demuffin. When you first run Super Demuffin, it asks for the parameters of the original disk. In this case, the prologue bytes are the same, but the epilogues are "FF FF EB" instead of "DE AA EB". --v-- SUPER-DEMUFFIN AND FAST COPY Modified by: The Saltine/Coast to Coast Address prologue: D5 AA 96 Address epilogue: FF FF EB DISK ^^^^^ ORIGINAL *change from "DE AA" Data prologue: D5 AA AD Data epilogue: FF FF EB ^^^^^ *change from "DE AA" Ignore write errors while demuffining! D - Edit parameters - Advance to next parm - Exit edit mode R - Restore DOS 3.3 parameters O - Edit Original disk's parameters C - Edit Copy disk's parameters G - Begin demuffin process --^-- Pressing "G" switches to the Locksmith Fast Disk Copy UI. It assumes that both disks are in slot 6, and that drive 1 is the original and drive 2 is the copy. [S6,D1=original disk, side A] [S6,D2=blank disk] --v-- LOCKSMITH 7.0 FAST DISK BACKUP R................................... W*********************************** HEX 00000000000000001111111111111111222 TRK 0123456789ABCDEF0123456789ABCDEF012 0................................... 1................................... 2................................... 3................................... 4................................... 5................................... 6................................... 7................................... 8................................... 9................................... A................................... B................................... C................................... D................................... 12 E................................... F................................... [ ] PRESS [RESET] TO EXIT --^-- (I repeated this procedure with side B, which also gave no errors.) There are two problems with this copy: 1. Depending on how the original disk was written, this copy may or may not be able to read itself. I may need to patch the disk's RWTS to deal with the fact that the disk is now in a standard format. 2. Even if it can read itself, it won't run. The copies I tried to make -- even the bit copies -- just rebooted endlessly, which means there is some code being executed during boot to check if the disk is original. (Hint: it's not.) It's time for a little boot tracing. [S6,D1=original disk, side A] [S5,D1=my work disk] ]PR#5 ... CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 ]BLOAD BOOT0,A$800 ]CALL -151 *801L ; This looks like the standard ProDOS ; boot0 code, which is unsurprising, ; since the original disk loads ProDOS 0801- 38 SEC 0802- B0 03 BCS $0807 0804- 4C 32 A1 JMP $A132 0807- 86 43 STX $43 0809- C9 03 CMP #$03 080B- 08 PHP 080C- 8A TXA 080D- 29 70 AND #$70 080F- 4A LSR 0810- 4A LSR 0811- 4A LSR 0812- 4A LSR 0813- 09 C0 ORA #$C0 0815- 85 49 STA $49 0817- A0 FF LDY #$FF 0819- 84 48 STY $48 081B- 28 PLP 081C- C8 INY 081D- B1 48 LDA ($48),Y 081F- D0 3A BNE $085B 0821- B0 0E BCS $0831 0823- A9 03 LDA #$03 0825- 8D 00 08 STA $0800 0828- E6 3D INC $3D 082A- A5 49 LDA $49 082C- 48 PHA 082D- A9 5B LDA #$5B 082F- 48 PHA 0830- 60 RTS ; this is not standard 0831- 4C 00 09 JMP $0900 Let's see what's lurking at $0900. To do this, I'll need to interrupt the boot process at $0831, after the code is loaded into memory but before it gets executed. *9600