----------Following Directions--------- -------One And Two Level Commands------ ------Volume 1: Spatial Relations------ A 4am crack 2016-09-27 --------------------------------------- Name: Following Directions - One and Two Level Commands Volume 1: Spatial Directions Genre: educational Year: 1986 Author: Eleanor Semel Ed.D. Publisher: Laureate Learning Systems Platform: Apple ][+ or later (64K) Media: single-sided 5.25-inch floppy OS: custom Previous cracks: none Identical cracks: #851 Early Emerging Rules: Plurals #850 Early Emerging Rules: Negation #849 Creature Magic #848 Concentrate on Words & Concepts II #847 Concentrate on Words & Concepts ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA immediate disk read error Locksmith Fast Disk Backup unable to read any track EDD 4 bit copy (no sync, no count) works Copy ][+ nibble editor T00 -> modified epilogues T01+ -> automated analysis finds no structure, but I think I found it --v-- COPY ][ PLUS BIT COPY PROGRAM 8.4 (C) 1982-9 CENTRAL POINT SOFTWARE, INC. --------------------------------------- TRACK: 01 START: 1800 LENGTH: 3DFF 1BA8: DF DD B3 CD AE 9B B6 B7 VIEW 1BB0: 9F DE AC AF EF D3 96 CE 1BB8: 9D F7 D6 A6 F2 DA D7 FE 1BC0: EE AB F3 A7 97 F4 FF EC 1BC8: FF BF ED BB AF A5 CA 96 ^^^^^^^^ address prologue 1BD0: AE BF AA AB AF AA AB BE ^^^^^ ^^^^^ ^^^^^ ^^^^^ V=$10 T=$01 S=$0A chksm 1BD8: FE FE FF B4 96 AE ED AA ^^^^^^^^ address epilogue 1BE0: FF FB BF FD AE FE CA AD ^^^^^^^^ data prologue? 1BE8: 96 96 96 96 96 B4 C1 CD --------------------------------------- A TO ANALYZE DATA ESC TO QUIT ? FOR HELP SCREEN / CHANGE PARMS Q FOR NEXT TRACK SPACE TO RE-READ --^-- Disk Fixer ["O" -> "Input/Output Control"] set CHECKSUM ENABLED to "NO" T00 readable -> looks like a modified DOS 3.3-ish bootloader ["O" -> "Input/Output Control"] set Address Prologue to "A5 CA 96" set Data Epilogue to "AE FE CA" no luck, T01+ still unreadable (not sure why -- maybe a custom nibble translate table?) Why didn't COPYA work? modified prologues & epilogues Why didn't Locksmith FDB work? ditto EDD worked. What does that tell us? no half or quarter tracks almost certainly no nibble check (just structural changes to prologues and epilogues) The bootloader is just non-standard enough that Passport can't trace it, and the lack of any access to tracks $01-$22 limits my avenues of attack. Next steps: 1. trace the boot to capture the RWTS 2. convert disk to standard format with Advanced Demuffin 3. patch RWTS to read standard format ~ Chapter 1 In Which Two (Drive) Heads Are Better Than One I have two floppy drives, one in slot 6 and the other in slot 5. My "work disk" (in slot 5) runs Diversi-DOS 64K, which is compatible with Apple DOS 3.3 but relocates most of DOS to the language card on boot. This frees up most of main memory (only using a single page at $BF00..$BFFF), which is useful for loading large files or examining code that lives in areas typically reserved for DOS. [S6,D1=original disk] [S5,D1=my work disk] The floppy drive firmware code at $C600 is responsible for aligning the drive head and reading sector 0 of track 0 into main memory at $0800. Because the drive can be connected to any slot, the firmware code can't assume it's loaded at $C600. If the floppy drive card were removed from slot 6 and reinstalled in slot 5, the firmware code would load at $C500 instead. To accommodate this, the firmware does some fancy stack manipulation to detect where it is in memory (which is a neat trick, since the 6502 program counter is not generally accessible). However, due to space constraints, the detection code only cares about the lower 4 bits of the high byte of its own address. $C600 (or $C500, or anywhere in $Cx00) is read-only memory. I can't change it, which means I can't stop it from transferring control to the boot sector of the disk once it's in memory. BUT! The disk firmware code works unmodified at any address. Any address that ends with $x600 will boot slot 6, including $B600, $A600, $9600, &c. ; copy drive firmware to $9600 *9600 $F800 0306- A2 08 LDX #$08 0308- A0 00 LDY #$00 030A- B9 00 28 LDA $2800,Y 030D- 99 00 F8 STA $F800,Y 0310- C8 INY 0311- D0 F7 BNE $030A 0313- EE 0C 03 INC $030C 0316- EE 0F 03 INC $030F ; 8 pages worth 0319- CA DEX 031A- D0 EE BNE $030A ; switch back to ROM 031C- AD 82 C0 LDA $C082 031F- 60 RTS *BSAVE RWTS MOVER,A$300,L$20 ; disconnect DOS *FE89G FE93G ; move RWTS to RAM bank *300G ; start Advanced Demuffin *800G From my inspection with a nibble editor and sector editor, I know that track 0 is (mostly) standard. This RWTS is only for tracks $01-$22. Advanced Demuffin can handle that. ["C" to convert disk] ["Y" to change default values] --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM ======================================= INPUT ALL VALUES IN HEX SECTORS PER TRACK? (13/16) 16 START TRACK: $01 <-- change this START SECTOR: $00 <-- change this END TRACK: $22 END SECTOR: $0F INCREMENT: 1 MAX # OF RETRIES: 0 COPY FROM DRIVE 1 TO DRIVE: 2 ======================================= 16SC $01,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- After putting a blank disk in S6,D2, it's time for the big finale: --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK: .................................. +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0: .................................. SC1: .................................. SC2: .................................. SC3: .................................. SC4: .................................. SC5: .................................. SC6: .................................. SC7: .................................. SC8: .................................. SC9: .................................. SCA: .................................. SCB: .................................. SCC: .................................. SCD: .................................. SCE: .................................. SCF: .................................. ======================================= 16SC $01,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- This is the power and the genius of Advanced Demuffin. Every disk must be able to read itself. So, let it read itself, then capture the data and write it out in a standard format. I also copied track 0 by loading up my trusty Disk Fixer sector editor and manually copying each sector from the original disk to this demuffin'd copy. Now I have all tracks converted. Of course, this copy doesn't boot yet, because it still has the original RWTS. And since the RWTS code on track $00 is shifted by two sectors, none of my tools can detect or automatically patch anything. I made these changes by hand like some kind of 20th century teenager. ; RWTS (prologues and epilogues) T00,S04,$53: FE -> D5 T00,S04,$58: CA -> AA T00,S04,$9E: FE -> DE T00,S04,$A3: FE -> AA T00,S04,$E7: FE -> D5 T00,S04,$F1: CA -> AA T00,S05,$35: FE -> DE T00,S05,$3F: FE -> AA T00,S05,$55: A5 -> D5 T00,S05,$5F: CA -> AA T00,S05,$91: FE -> DE T00,S05,$9B: FE -> AA ; nibble translate tables T00,S06,$49: D5 -> D6 T00,S06,$D5: 20 -> D5 T00,S06,$D6: D6 -> 20 ; ignore non-standard disk volume # T00,S0A,$12: B148 -> A900 ]PR#6 ...works... Quod erat liberandum. ~ Epilogue In Which We POKE Along Fun fact(*): this disk actually has a DOS 3.3 disk catalog, but on track $22 instead of $11. (*) not guaranteed, actual fun may vary [S6,D1=DOS 3.3 system master] [S6,D2=working copy (not original)] ]PR#6 ... According to the framed Beagle Bros. "Peeks, Pokes and Pointers" chart that hangs above my desk and reminds me that technical writing should be wondrous, useful, and fun (but not always in that order), $AC01 contains the track number that DOS 3.3 uses for the disk catalog. ]CALL -151 *AC01:22 *3D0G ]CATALOG,D2 DISK VOLUME 254 B 003 HELLO B 008 MCP B 003 BL B 026 INTRO B 046 TI B 022 BIRD B 021 BRD.V B 042 BRD.P B 026 BEAR B 021 BR.V B 067 BR.P B 026 BEAR2 B 026 BR2.V B 004 BR2.VR B 012 PRINT B 013 CALREAD B 002 Q B 002 R B 002 S B 002 T B 002 U B 002 V B 002 W B 002 X Furthermore, it appears that the game itself is written (at least partially) in BASIC, despite the lack of any "A" type files in the disk catalog. To wit: ]BLOAD HELLO ]LIST 0 ONERR GOTO 700 1 HIMEM: 26880: HOME : POKE 230 ,32: HCOLOR= 7: HPLOT 0,0: CALL 62454: POKE - 16302,0: POKE - 16297,0: POKE - 16300,0: POKE - 16304,0 5 POKE 48914,1: CALL 48915: POKE 48914,88: CALL 48915 10 POKE 103,1: POKE 104,69: POKE 105,1: POKE 106,69: POKE 176 64,0: POKE 48914,60: CALL 48 915 700 RUN Not related to the copy protection; I just thought it was interesting. --------------------------------------- A 4am crack No. 852 ------------------EOF------------------