--------------Victory Road-------------
A 4am crack                  2015-03-18
-------------------. updated 2015-09-06
                   |___________________

Name: Victory Road
Genre: arcade
Year: 1988
Authors: Quicksilver Software, Inc.
Publisher: Data East
Media: double-sided 5.25-inch floppy
OS: Quick-DOS
Other versions: Sven & Chow crack

Only side A is bootable, so I'll start
there.

                   ~

               Chapter 0
 In Which Various Automated Tools Fail
          In Interesting Ways


COPYA
  no errors, but copy reboots endlessly

Locksmith Fast Disk Backup
  ditto

EDD 4 bit copy (no sync, no count)
  ditto

Copy ][+ nibble editor
  nothing unusual

Disk Fixer
  T00 -> custom bootloader
  T11 -> DOS 3.3-style disk catalog

Why didn't any of my copies work?
  probably a nibble check in early boot

Next steps:

  1. Boot trace
  2. Find & disable nibble check
  3. There is no step 3 (I hope)

                   ~

               Chapter 1
   In Which Our Adventure Concludes
        Almost Before It Begins


[S6,D1=original disk (side A)]
[S5,D1=my work disk]

]PR#5
CAPTURING BOOT0
...reboots slot 6...
...reboots slot 5...
SAVING BOOT0

]CALL -151
*800<2800.28FFM
*801L

0801-   4C 00 0A    JMP   $0A00

Huh?

*800

0800- 03

Oh, this disk takes advantage of a
little-used feature of the Disk II ROM
routine to load multiple sectors before
jumping to $0801. It's so rare, I've
never even bothered to update my auto-
trace script to check for it. (Note to
self: fix that someday.)

So let's trace this manually.

*9600<C600.C6FFM

96F8-   A0 00       LDY   #$00
96FA-   B9 00 08    LDA   $0800,Y
96FD-   99 00 28    STA   $2800,Y
9700-   B9 00 09    LDA   $0900,Y
9703-   99 00 29    STA   $2900,Y
9706-   B9 00 0A    LDA   $0A00,Y
9709-   99 00 2A    STA   $2A00,Y
970C-   C8          INY
970D-   D0 EB       BNE   $96FA
970F-   AD E8 C0    LDA   $C0E8
9712-   4C 00 C5    JMP   $C500

*BSAVE TRACE,A$9600,L$115
*9600G
...reboots slot 6...
...reboots slot 5...
]BSAVE BOOT0 0800-0AFF,A$2800,L$300
]CALL -151
*800<2800.2AFFM
*A00L

; world's simplest nibble check!
0A00-   EA          NOP
0A01-   EA          NOP

; hard-coded slot (x16)
0A02-   A2 60       LDX   #$60

; death counters
0A04-   A9 56       LDA   #$56
0A06-   85 FD       STA   $FD
0A08-   A9 08       LDA   #$08
0A0A-   C6 FC       DEC   $FC
0A0C-   D0 04       BNE   $0A12
0A0E-   C6 FD       DEC   $FD
0A10-   F0 38       BEQ   $0A4A

; look for "FB" nibble
0A12-   BC 8C C0    LDY   $C08C,X
0A15-   10 FB       BPL   $0A12
0A17-   C0 FB       CPY   #$FB
0A19-   D0 ED       BNE   $0A08
0A1B-   F0 00       BEQ   $0A1D

; kill a few cycles (not pointless,
; because the disk spins independently
; of the CPU, so all of these low-level
; disk reads are highly time-sensitive)
0A1D-   EA          NOP
0A1E-   EA          NOP

; read data latch (note: no BPL loop
; here, we're just reading it once)
0A1F-   BC 8C C0    LDY   $C08C,X

; do a compare to set or clear the
; carry bit (among other things, but
; it's the carry bit we care about)
0A22-   C0 08       CPY   #$08

; rotate the carry into the low bit of
; the accumulator
0A24-   2A          ROL

; if we just rolled a "1" bit out of
; the high bit of the accumulator, take
; this branch
0A25-   B0 0B       BCS   $0A32

; next nibble needs to be $FF
0A27-   BC 8C C0    LDY   $C08C,X
0A2A-   10 FB       BPL   $0A27

; ...otherwise we start over
0A2C-   C0 FF       CPY   #$FF
0A2E-   D0 D8       BNE   $0A08

; loop back to get next nibble
0A30-   F0 EB       BEQ   $0A1D

; execution continues here (from $0A25)
; get another nibble
0A32-   BC 8C C0    LDY   $C08C,X
0A35-   10 FB       BPL   $0A32

; stash it in zero page
0A37-   84 FC       STY   $FC

; if the accumulator is anything but
; %00001010, start over
0A39-   C9 0A       CMP   #$0A
0A3B-   D0 CB       BNE   $0A08

I got lost several times trying to
follow this routine. I think the
easiest way to explain it is to show
the difference between the original
disk and my non-working copy.

Here is the original disk, as seen by
the Copy II+ nibble editor. Nibbles
with extra "0" bits (timing bits) after
them are displayed in inverse on an
original machine, marked here with a
"+" after the nibble.

                 --v--

   COPY ][ PLUS BIT COPY PROGRAM 8.4
(C) 1982-9 CENTRAL POINT SOFTWARE, INC.
---------------------------------------

TRACK:     START: 1B1E  LENGTH: 17C1

1C70: 9F EB E5 FC D7 D7 D7 EE   VIEW
1C78: FA E6 E6 FF FE F2 ED FD
1C80: FF EF ED BA BB DD AF E6
1C88: B7 A7 CB B7 DE AA EB FF
1C90: FF FF FF FB+FF FF+FF FF+
1C98: FD FF+FF+FF+FF+FF+FF+FF+
1CA0: FF+FF+D5 AA 96 AA AB AA
1CA8: AA AA AB AA AA DE AA EB+
1CB0: FF+FF+FF+FF+FF+FF D5 AA
---------------------------------------

  A  TO ANALYZE DATA  ESC TO QUIT

  ?  FOR HELP SCREEN  /  CHANGE PARMS

  Q  FOR NEXT TRACK   SPACE TO RE-READ

                 --^--

It's easy to understand why a simple
sector copy failed. The sequence that
this code is looking for starts at
offset $1C93, which is between the end
of one sector and the beginning of the
next. (The data epilogue is at $1C8C;
the next address prologue is at $1CA2.)
Sector copiers discard everything
between those delimiters and rebuild
the track with a default pattern of
sync bytes. That pattern doesn't
include an $FB nibble, so the nibble
check fails.

But the EDD bit copy also failed. Here
is the original disk's pattern at
offset $1C93:

  - $FB + timing bit
  - $FF
  - $FF + timing bit
  - $FF
  - $FF + timing bit

And here is what the same part of the
track looks like on my failed EDD copy:

                 --v--

   COPY ][ PLUS BIT COPY PROGRAM 8.4
(C) 1982-9 CENTRAL POINT SOFTWARE, INC.
---------------------------------------

TRACK:     START: 1B1E  LENGTH: 17C1

1C70: 9F EB E5 FC D7 D7 D7 EE   VIEW
1C78: FA E6 E6 FF FE F2 ED FD
1C80: FF EF ED BA BB DD AF E6
1C88: B7 A7 CB B7 DE AA EB FF
1C90: FF FF FF FB+FF FF FF+FF+
1C98: FD FF+FF+FF+FF+FF+FF+FF+
1CA0: FF+FF+D5 AA 96 AA AB AA
1CA8: AA AA AB AA AA DE AA EB+
1CB0: FF+FF+FF+FF+FF+FF D5 AA
---------------------------------------

  A  TO ANALYZE DATA  ESC TO QUIT

  ?  FOR HELP SCREEN  /  CHANGE PARMS

  Q  FOR NEXT TRACK   SPACE TO RE-READ

                 --^--

A subtle difference! The sequence at
offset $1C93 now looks like this:

  - $FB + timing bit
  - $FF
  - $FF
  - $FF + timing bit
  - $FF + timing bit

This code is looking for $FF bytes with
an alternating pattern of timing bit,
no timing bit, timing bit, no timing
bit. It doesn't find that on the bit
copy, so it knows it's not running on
an original disk.

Continuing the code listing...

; get a nibble
0A3D-   BD 8C C0    LDA   $C08C,X
0A40-   10 FB       BPL   $0A3D

; more bit twiddling
0A42-   38          SEC
0A43-   2A          ROL

; AND it with the previously stashed
; nibble
0A44-   25 FC       AND   $FC
0A46-   49 FF       EOR   #$FF

; success path branches over the next
; instruction...
0A48-   F0 03       BEQ   $0A4D

; ...which reboots
0A4A-   4C 00 C6    JMP   $C600

; success path continues here -- set up
; zero page as if none of this ever
; happened
0A4D-   A9 60       LDA   #$60
0A4F-   85 2B       STA   $2B
0A51-   A9 09       LDA   #$09
0A53-   85 27       STA   $27

; restore the code that was supposed to
; be in T00,S00 in the first place
0A55-   A9 01       LDA   #$01
0A57-   8D 00 08    STA   $0800
0A5A-   A9 A5       LDA   #$A5
0A5C-   8D 01 08    STA   $0801
0A5F-   A9 27       LDA   #$27
0A61-   8D 02 08    STA   $0802
0A64-   A9 C9       LDA   #$C9
0A66-   8D 03 08    STA   $0803
0A69-   A9 09       LDA   #$09
0A6B-   8D 04 08    STA   $0804

; and jump back there to start the boot
; for real
0A6E-   4C 01 08    JMP   $0801

To bypass this, I can edit T00,S00 to
put those 5 bytes into $0800..$0804.

T00,S00,$00 change "03 4C 00 0A EA"
                to "01 A5 27 C9 09"

Side B is also COPYA-able and does not
appear to have any further protection.

Quod erat liberandum.

                   ~

               Changelog


2015-09-06

- Vastly improved explanation of the
  actual protection routine. Thanks to
  qkumba for pointing out that my
  original explanation was inaccurate.

2015-03-18

- initial release

---------------------------------------
A 4am crack                     No. 269
------------------EOF------------------