--Concentrate on Words and Concepts II- A 4am crack 2016-09-26 --------------------------------------- Name: Concentrate on Words and Concepts II Genre: educational Year: 1988 Publisher: Laureate Learning Systems Platform: Apple ][+ or later (64K) Media: single-sided 5.25-inch floppy OS: custom Previous cracks: none Identical cracks: #847 Concentrate on Words & Concepts ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA immediate disk read error, but it gets a participation medal just for showing up Locksmith Fast Disk Backup unable to read any track EDD 4 bit copy (no sync, no count) works Copy ][+ nibble editor T00 -> modified epilogues T01+ -> wacky, automated analysis can find no structure, but I think I figured it out manually --v-- COPY ][ PLUS BIT COPY PROGRAM 8.4 (C) 1982-9 CENTRAL POINT SOFTWARE, INC. --------------------------------------- TRACK: 01 START: 1800 LENGTH: 3DFF 1F70: A6 F7 FE FE FE FE F7 CF VIEW 1F78: 96 CF A6 A6 FE F7 9F AC 1F80: FE FE FF E6 DF DD B3 CD 1F88: AE 9B B6 B7 9F DE AC AF 1F90: FF BF ED BB AF A5 CA 96 ^^^^^^^^ address prologue 1F98: AE BF AA AB AE AB AA BF ^^^^^ ^^^^^ ^^^^^ ^^^^^ V=$10 T=$01 S=$09 chksm 1FA0: FE FE FF B4 96 AE ED AA ^^^^^^^^ address epilogue 1FA8: FF FB BF FD AE FE CA AD ^^^^^^^^ data prologue? 1FB0: E5 D7 F7 DD 9A DD F7 FA --------------------------------------- A TO ANALYZE DATA ESC TO QUIT ? FOR HELP SCREEN / CHANGE PARMS Q FOR NEXT TRACK SPACE TO RE-READ --^-- Disk Fixer ["O" -> "Input/Output Control"] set CHECKSUM ENABLED to "NO" T00 readable -> looks like a modified DOS 3.3-ish bootloader ["O" -> "Input/Output Control"] set Address Prologue to "A5 CA 96" set Data Epilogue to "AE FE CA" no luck, T01+ still unreadable (not sure why -- maybe a custom nibble translate table?) Why didn't COPYA work? modified prologues & epilogues Why didn't Locksmith FDB work? ditto EDD worked. What does that tell us? no half or quarter tracks almost certainly no nibble check (just structural changes to prologues and epilogues) The bootloader is just non-standard enough that Passport can't trace it, and the lack of any access to tracks $01-$22 limits my avenues of attack. Next steps: 1. trace the boot to capture the RWTS 2. convert disk to standard format with Advanced Demuffin 3. patch RWTS to read standard format ~ Chapter 1 In Which We Start At The Beginning Because Where Else Could We Start? I have two floppy drives, one in slot 6 and the other in slot 5. My "work disk" (in slot 5) runs Diversi-DOS 64K, which is compatible with Apple DOS 3.3 but relocates most of DOS to the language card on boot. This frees up most of main memory (only using a single page at $BF00..$BFFF), which is useful for loading large files or examining code that lives in areas typically reserved for DOS. [S6,D1=original disk] [S5,D1=my work disk] The floppy drive firmware code at $C600 is responsible for aligning the drive head and reading sector 0 of track 0 into main memory at $0800. Because the drive can be connected to any slot, the firmware code can't assume it's loaded at $C600. If the floppy drive card were removed from slot 6 and reinstalled in slot 5, the firmware code would load at $C500 instead. To accommodate this, the firmware does some fancy stack manipulation to detect where it is in memory (which is a neat trick, since the 6502 program counter is not generally accessible). However, due to space constraints, the detection code only cares about the lower 4 bits of the high byte of its own address. Stay with me, this is all about to come together and go boom. $C600 (or $C500, or anywhere in $Cx00) is read-only memory. I can't change it, which means I can't stop it from transferring control to the boot sector of the disk once it's in memory. BUT! The disk firmware code works unmodified at any address. Any address that ends with $x600 will boot slot 6, including $B600, $A600, $9600, &c. ; copy drive firmware to $9600 *9600 $F800 0306- A2 08 LDX #$08 0308- A0 00 LDY #$00 030A- B9 00 28 LDA $2800,Y 030D- 99 00 F8 STA $F800,Y 0310- C8 INY 0311- D0 F7 BNE $030A 0313- EE 0C 03 INC $030C 0316- EE 0F 03 INC $030F ; 8 pages worth 0319- CA DEX 031A- D0 EE BNE $030A ; switch back to ROM 031C- AD 82 C0 LDA $C082 031F- 60 RTS *BSAVE RWTS MOVER,A$300,L$20 ; disconnect DOS *FE89G FE93G ; move RWTS to RAM bank *300G ; start Advanced Demuffin *800G From my inspection with a nibble editor and sector editor, I know that track 0 is (mostly) standard. This RWTS is only for tracks $01-$22. Advanced Demuffin can handle that. ["C" to convert disk] ["Y" to change default values] --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM ======================================= INPUT ALL VALUES IN HEX SECTORS PER TRACK? (13/16) 16 START TRACK: $01 <-- change this START SECTOR: $00 <-- change this END TRACK: $22 END SECTOR: $0F INCREMENT: 1 MAX # OF RETRIES: 0 COPY FROM DRIVE 1 TO DRIVE: 2 ======================================= 16SC $01,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- After putting a blank disk in S6,D2, it's time for the big finale: --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK: .................................. +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0: .................................. SC1: .................................. SC2: .................................. SC3: .................................. SC4: .................................. SC5: .................................. SC6: .................................. SC7: .................................. SC8: .................................. SC9: .................................. SCA: .................................. SCB: .................................. SCC: .................................. SCD: .................................. SCE: .................................. SCF: .................................. ======================================= 16SC $01,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- This is the power and the genius of Advanced Demuffin. Every disk must be able to read itself. So, let it read itself, then capture the data and write it out in a standard format. I also copied track 0 by loading up my trusty Disk Fixer sector editor and manually copying each sector from the original disk to this demuffin'd copy. Again, I could have automated that by creating an RWTS with the proper epilogue nibbles, but meh. Automation is a tool, not a religion. Speaking of automation, since the RWTS code on track $00 is shifted by two sectors, none of my automated tools can detect or automatically patch anything. I made these changes by hand like some kind of 13th century handmaiden. ; RWTS (prologues and epilogues) T00,S04,$53: FE -> D5 T00,S04,$58: CA -> AA T00,S04,$9E: FE -> DE T00,S04,$A3: FE -> AA T00,S04,$E7: FE -> D5 T00,S04,$F1: CA -> AA T00,S05,$35: FE -> DE T00,S05,$3F: FE -> AA T00,S05,$55: A5 -> D5 T00,S05,$5F: CA -> AA T00,S05,$91: FE -> DE T00,S05,$9B: FE -> AA ; nibble translate tables T00,S06,$49: D5 -> D6 T00,S06,$D5: 20 -> D5 T00,S06,$D6: D6 -> 20 ; ignore non-standard disk volume # T00,S0A,$12: B148 -> A900 ]PR#6 ...works... Quod erat liberandum. --------------------------------------- A 4am crack No. 848 ------------------EOF------------------