---------Mystery Double Feature-------- A 4am crack 2016-11-09 --------------------------------------- Name: Mystery Double Feature Genre: adventure Year: 1984 Publisher: Scholastic, Inc. Platform: Apple ][+ or later Media: double-sided 5.25-inch floppy OS: custom Previous cracks: none Similar cracks: #894 Number Stumper #840 Jumpman #595 Addition Magician #476 Microzine 2 Only side A is bootable. Side B just says "Take the disk out and turn it over. Press RETURN when ready." I'm ready. ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA immediate disk read error Locksmith Fast Disk Backup unable to read any track EDD 4 bit copy (no sync, no count) read error on T22 copy displays a graphical title page then hangs with the drive motor on Copy ][+ nibble editor T00 -> standard prologues, modified epilogues (FF FF FF) T01,02 -> not full tracks? looks like they have some standard-ish sectors, but not 16 per track (also corrupted address fields) T03 -> corrupted address fields that claim to be track $00 T04-T20 -> uncorrupted address fields but still non-standard epilogues T21-T22 unformatted (hi-res disk scan confirms this) When I say "corrupted address fields," this is what that looks like: --v-- COPY ][ PLUS BIT COPY PROGRAM 8.4 (C) 1982-9 CENTRAL POINT SOFTWARE, INC. --------------------------------------- TRACK: 03 START: 21DC LENGTH: 189D ^^ 21B8: FF FF FF FF FF FF FF FF VIEW 21C0: FF FF FF FF FF FF FF FF 21C8: FF FF FF FF FF FF FF FF 21D0: FF FF FF FF FF FF FF FF 21D8: FF FF FF FF FF D5 AA 96 <-21DD ^^^^^^^^ address prologue 21E0: AA AA AA AA AA AA AA AA ^^^^^ ^^^^^ ^^^^^ ^^^^^ V000 T00 S00 chksm 21E8: FF FF FF FF FF CF F3 FC ^^^^^^^^ address epilogue 21F0: FF FF D5 AA AD 9B DB B9 ^^^^^^^^ data prologue 21F8: B9 DB F2 DE B9 AE B3 BA --------------------------------------- A TO ANALYZE DATA ESC TO QUIT ? FOR HELP SCREEN / CHANGE PARMS Q FOR NEXT TRACK SPACE TO RE-READ --^-- The disk is lying to me. The address field claims to be track $00, but it's really track $03. Bad disk! Stop lying! Disk Fixer ["O" -> "Input/Output Control"] set Address Epilogue to "FF FF FF" set Data Epilogue to "FF FF FF" T00 readable, disk volume is 000 (!) T01-T03 unreadable (no option to ignore the corrupted address field) T04-T20 readable, disk volume is 254 T21+ unreadable (unformatted) Copy ][+ sector editor ["P" -> "Sector Editor Patcher"] set type to "CUSTOM" set Address Epilogue to "FF FF" set Data Epilogue to "FF FF FF" T00 readable T04-T20 readable ["P" -> "Sector Editor Patcher"] set CHECK TRACK to "NO" only parts of T01 and T02 readable: T01: S03,04,05,06,07,0A,0B,0C,0D,0E T02: S01,02,08,09,0F T03 readable! T04-T20 readable! Why didn't COPYA work? modified epilogue bytes on track $00 (it never even got to the fun part) Why didn't Locksmith FDB work? ditto Why didn't my EDD copy work? I've seen similar disks, where the first N tracks have intentionally corrupted address fields. (N varies from disk to disk.) There's a custom loader that loads the data from those corrupted tracks, then transfers control to a standard RWTS for the rest of the program. Somewhere in the corrupted tracks, it will load data from consecutive half tracks. (These are devilishly difficult to copy, and I didn't even try.) That's just an educated guess; I could be surprised. Hey, I can actually validate that guess in the Copy ][+ nibble editor, which can read half tracks. --v-- COPY ][ PLUS BIT COPY PROGRAM 8.4 (C) 1982-9 CENTRAL POINT SOFTWARE, INC. --------------------------------------- TRACK: 01.50 START: 3700 LENGTH: 198E ^^^^^ 3BD0: FF FF FF FF FF FF FF FF VIEW 3BD8: FF FF FF FF FF FF FF FF 3BE0: FF FF FF FF FF FF FF FF 3BE8: FF FF C9 FF FF FF FF FF 3BF0: FF FF FF FF FF D5 AA 96 <-3BF5 ^^^^^^^^ address prologue 3BF8: AA AA AA AA AF AB AF AB ^^^^^ ^^^^^ ^^^^^ ^^^^^ V000 T00 S0B chksm 3C00: FF FF FF 9F E7 F9 FE FF ^^^^^^^^ address eplogue 3C08: D5 AA AD A7 B4 BD CD ED ^^^^^^^^ data prologue 3C10: ED 9B ED F2 E9 DF B6 AB --------------------------------------- A TO ANALYZE DATA ESC TO QUIT ? FOR HELP SCREEN / CHANGE PARMS Q FOR NEXT TRACK SPACE TO RE-READ --^-- Jackpot! (Note that it's still claiming to be track $00, though, just like the other whole tracks above and below it.) Next steps: 1. Trace the boot 2. ??? ~ Chapter 1 In Which We Brag About Our Humble Beginnings I have two floppy drives, one in slot 6 and the other in slot 5. My "work disk" (in slot 5) runs Diversi-DOS 64K, which is compatible with Apple DOS 3.3 but relocates most of DOS to the language card on boot. This frees up most of main memory (only using a single page at $BF00..$BFFF), which is useful for loading large files or examining code that lives in areas typically reserved for DOS. [S6,D1=original disk] [S5,D1=my work disk] The floppy drive firmware code at $C600 is responsible for aligning the drive head and reading sector 0 of track 0 into main memory at $0800. Because the drive can be connected to any slot, the firmware code can't assume it's loaded at $C600. If the floppy drive card were removed from slot 6 and reinstalled in slot 5, the firmware code would load at $C500 instead. To accommodate this, the firmware does some fancy stack manipulation to detect where it is in memory (which is a neat trick, since the 6502 program counter is not generally accessible). However, due to space constraints, the detection code only cares about the lower 4 bits of the high byte of its own address. Stay with me, this is all about to come together and go boom. $C600 (or $C500, or anywhere in $Cx00) is read-only memory. I can't change it, which means I can't stop it from transferring control to the boot sector of the disk once it's in memory. BUT! The disk firmware code works unmodified at any address. Any address that ends with $x600 will boot slot 6, including $B600, $A600, $9600, &c. ; copy drive firmware to $9600 *9600