--------The Fourth R - Reasoning------- A 4am crack 2017-02-01 --------------------------------------- Name: The Fourth R - Reasoning Genre: educational Year: 1984 Publisher: MCE Platform: Apple ][+ or later Media: single-sided 5.25-inch floppy OS: DOS 3.3 Previous cracks: none (of this version) Asimov has a later version; see http://www.hackzapple.com/ phpBB2/viewtopic.php?t=929 for qkumba's write-up of that one ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA immediate disk read error Locksmith Fast Disk Backup unable to read anything other than track $00 EDD 4 bit copy (no sync, no count) no read errors, but copy reboots endlessly Copy ][+ nibble editor Every track (other than track $00) uses a different address prologue. Track $01 is "D5 AA 97", Track $02 is "D5 AA 9A", Track $03 is "D5 AA 9B", Track $11 is "D5 AA B5", &c. Disk Fixer Track $00 looks like a DOS 3.3-shaped bootloader and RWTS ["O" -> "Input/Output Control"] set Address Prologue to "D5 AA B5" Track $11 readable! I can even press "D" to get a directory and select a file (which fails to read because it is stored on a different track with a different prologue, but OK) --v-- ------------ DIRECTORY MODE ----------- $13:$0F HELLO $14:$0F MCE INTRO $15:$0F LE1.SA $16:$0F LE2.SA $17:$0F LE3.SA $18:$0F LE4.SA $19:$0F SW16/MAIN/HRCG $1A:$0F LE1.GT $1B:$0F APSOFT/MAIN INTERFACE $1C:$0F LE2.GT $1D:$0F LE3.GT $1E:$0F LE4.GT $1F:$0F BADWS $20:$0F SOUND TAB/CHRSETA -----------------DOS3.3---------------- --^-- Why didn't COPYA work? modified address prologue on T01+ Why didn't Locksmith FDB work? ditto Why didn't my EDD copy work? I don't know. Probably a runtime protection check in early boot. Disks do not simply reboot unless someone tells them to. Next steps: 1. Trace the boot to capture the RWTS 2. Use Advanced Demuffin to convert the disk to a standard format 3. Find and disable the protection check 4. Declare victory (*) (*) Go to the gym ~ Chapter 1 In Which We Brag About Our Humble Beginnings I have two floppy drives, one in slot 6 and the other in slot 5. My "work disk" (in slot 5) runs Diversi-DOS 64K, which is compatible with Apple DOS 3.3 but relocates most of DOS to the language card on boot. This frees up most of main memory (only using a single page at $BF00..$BFFF), which is useful for loading large files or examining code that lives in areas typically reserved for DOS. [S6,D1=original disk] [S5,D1=my work disk] The floppy drive firmware code at $C600 is responsible for aligning the drive head and reading sector 0 of track 0 into main memory at $0800. Because the drive can be connected to any slot, the firmware code can't assume it's loaded at $C600. If the floppy drive card were removed from slot 6 and reinstalled in slot 5, the firmware code would load at $C500 instead. To accommodate this, the firmware does some fancy stack manipulation to detect where it is in memory (which is a neat trick, since the 6502 program counter is not generally accessible). However, due to space constraints, the detection code only cares about the lower 4 bits of the high byte of its own address. $C600 (or $C500, or anywhere in $Cx00) is read-only memory. I can't change it, which means I can't stop it from transferring control to the boot sector of the disk once it's in memory. BUT! The disk firmware code works unmodified at any address. Any address that ends with $x600 will boot slot 6, including $B600, $A600, $9600, &c. ; copy drive firmware to $9600 *9600S6,D2 --^-- [S6,D1=original disk] [S6,D2=blank disk] And here we go... --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK: .................................. +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0: .................................. SC1: .................................. SC2: .................................. SC3: .................................. SC4: .................................. SC5: .................................. SC6: .................................. SC7: .................................. SC8: .................................. SC9: .................................. SCA: .................................. SCB: .................................. SCC: .................................. SCD: .................................. SCE: .................................. SCF: .................................. ======================================= 16SC $01,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- Track 0 is unprotected, so I used Copy II Plus manual sector copy to copy it. (Not shown; it's under "bit copy" if you're looking for it. Just start and end on track 0.) ~ Chapter 6 In Which We Move Fast And Break Things, But Mostly Just Break Things Now I have a completely broken copy that won't boot because it won't pass its every-track-is-synchronized-with- every-other-track protection check. Turning to my trusty Disk Fixer sector editor, I can bypass the protection check by jumping directly to $B700 (instead of $BB00) after installing the RWTS patcher. T00,S00,$C9: BB -> B7 Now my copy can't read itself because it's altering its RWTS on every track. Let's fix that too. The RWTS patcher ends up at $A971, but it's stored on T00,S00. T00,S00,$CF: 8D -> 2C T00,S00,$D2: 8D -> 2C The result: --v-- T00,S00 ----------- DISASSEMBLY MODE ---------- 00BC:A0 33 LDY #$33 00BE:B9 CA B6 LDA $B6CA,Y 00C1:99 71 A9 STA $A971,Y 00C4:88 DEY 00C5:10 F7 BPL $00BE ; bypass protection check at $BB00 00C7:4C 00 B7 JMP $B700 00CA:48 PHA 00CB:A8 TAY 00CC:B9 81 A9 LDA $A981,Y ; these function as NOPs 00CF:2C 84 BC BIT $BC84 00D2:2C 6A B9 BIT $B96A 00D5:A0 01 LDY #$01 00D7:4C 5D BE JMP $BE5D --^-- ]PR#6 ...boots, loads part of DOS, then starts grinding and crashes... A90A- A=86 X=00 Y=1B P=31 S=F8 * I've missed something. ~ Chapter 7 In Which We Muddle Through Listening closely to my not-quite- working copy, it appears that it's loading part of DOS, then giving up. Which is weird, because I would expect an RWTS to work 100% or not at all. A quick memory test confirms this. ]PR#6 ...boots, crashes... A90A- A=86 X=00 Y=1B P=31 S=F8 ; fill memory with an unusual byte *800:FD N 801<800.BFFEM *C600G ...boots, crashes... A90A- A=22 X=00 Y=1B P=31 S=F8 Poking through the monitor confirms that - $0800..$08FF contains the boot sector (expected) - $0900..$9AFF contains $FD (i.e. is unchanged, which is expected) - $9A00..$A0FF contain the relevant portions of DOS (expected) - $A900..$B5FF contain the relevant portions of DOS (expected) - $B600..$BFFF contains the RWTS (expected) In fact, only a few pages are missing: $A100..$A8FF. In memory, they are all still the $FD byte that I set before rebooting. On disk, these pages are stored on track 1, sector 0-7. Maybe Advanced Demuffin corrupted these? No, that doesn't make any sense. They would end up as nonsense (or zero) -- not a range of $FD bytes. (This is actually why I always set memory to an unusual byte, to distinguish in cases like this where I don't quite know what's going on.) Turning to my trusty Disk Fixer sector editor, I can confirm that all of those sectors are intact on disk. They're just not being loaded, which obviously causes DOS to crash eventually. (Try wiping out 20% of *your* operating system and see how far *you* get.) . . . . Time passes. It is getting dark. You . are likely to be eaten by a grue. . . . OK. DOS loads from the top down. That is, it loads $B500 from T02,S04, then $B400 from T02,S03, &c. Eventually it seeks backwards to track 1, then track 0, then goes and loads the startup program and so on. When it reads T01,S07 into $A900, that works. In fact, it's the last sector that works... for a while. Then it fails for the rest of track 1. BUT BUT BUT then it succeeds again once it gets to track 0 (reading into $9A00..$A0FF). Which makes no sense whatsoever. Oh my God. Of course. We installed an RWTS patcher at $A971. We neutralized it by patching the code on T00,S00, but then... our patched routine got overwritten by the actual contents of T01,S08. --v-- T01,S08 ----------- DISASSEMBLY MODE ---------- 0071:48 PHA 0072:A8 TAY 0073:B9 81 A9 LDA $A981,Y 0076:8D 84 BC STA $BC84 0079:8D 6A B9 STA $B96A 007C:A0 01 LDY #$01 007E:4C 5D BE JMP $BE5D --^-- Words can not express how annoyed I am. T01,S08,$76: 8D -> 2C T01,S08,$79: 8D -> 2C ]PR#6 ...works, and it is annoying I mean glorious but also really, really annoying... Quod erat liberandum. ~ Acknowledgments Many thanks to Michael Whalen, Paul Hagstrom, Jorma Honkanen, and Peter Ferrie for their feedback on drafts of this write-up and the accompanying video. --------------------------------------- A 4am crack No. 1000 ------------------EOF------------------