----------Submarine Commander---------- A 4am crack 2018-03-17 --------------------------------------- Name: Submarine Commander Genre: simulation Year: 1983 Credits: Patrick Buckland Publisher: Thorn EMI Video Platform: Apple ][+ or later Media: 5.25-inch disk Sides: 1 OS: Diversi-DOS C1982 Similar cracks: #599 Word Man ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA disk read error on first pass Locksmith Fast Disk Backup can't read T02,S09 or anything after track $02 EDD 4 bit copy (no sync, no count) no errors during copying copy loads a few tracks then grinds and crashes Copy ][+ nibble editor T03 appears unformatted ("HI-RES DISK SCAN" confirms this) T04+ use modified data epilogue (DF AA EB) Disk Fixer T00 -> looks like a DOS 3.3 RWTS T00-T02 -> looks like a full DOS T01,S09 -> startup program is "HELLO" ["O" -> "Input/Output Control"] set Data Epilogue to "DF AA EB" T04+ readable, but slightly garbage (possibly a modified nibble translate table?) Why didn't COPYA work? T03 unformatted, modified epilogue bytes (T04+) Why didn't Locksmith FDB work? ditto Why didn't my EDD copy work? probably a nibble check during boot Why do the sectors look like garbage even after changing the data epilogue? probably some changes to the nibble translate table (possibly tied to the protection check) Next steps: 1. trace the boot to find the protection check and RWTS changes 2. capture the final RWTS and use it to convert the rest of the disk 3. ??? ~ Chapter 1 In Which Automated Tools Get Us Nowhere [S6,D1=original disk] [S6,D2=blank disk] [S5,D1=my work disk] ]PR#5 ... CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 CAPTURING BOOT1 ...reboots slot 6... ...reboots slot 5... SAVING BOOT1 SAVING RWTS ]BRUN ADVANCED DEMUFFIN 1.5 ["5" to switch to slot 5] ["R" to load a new RWTS module] --> At $B8, load "RWTS" from drive 1 ["6" to switch to slot 6] ["C" to convert disk] --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC1:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC2:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC3:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC4:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC5:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC6:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC7:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC8:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC9:..RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCA:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCB:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCC:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCD:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCE:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCF:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR ======================================= 16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- Well then. That was... not entirely successful. Not entirely unsuccessful, I suppose. But I need to dig deeper. ~ Chapter 2 In Which We Find Something Curious And Our Adventure Begins In Earnest ]PR#5 ... ]CALL -151 *9600 At $B8, load "RWTS" from D1 ["6" to switch to slot 6] ["C" to convert disk] ["Y" to change default values] --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM ======================================= INPUT ALL VALUES IN HEX SECTORS PER TRACK? (13/16) 16 START TRACK: $04 <-- change this START SECTOR: $00 END TRACK: $22 END SECTOR: $0F INCREMENT: 1 MAX # OF RETRIES: 0 COPY FROM DRIVE 1 TO DRIVE: 2 ======================================= 16SC $04,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- And here we go... --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK: ............................... +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0: ............................... SC1: ............................... SC2: ............................... SC3: ............................... SC4: ............................... SC5: ............................... SC6: ............................... SC7: ............................... SC8: ............................... SC9: ............................... SCA: ............................... SCB: ............................... SCC: ............................... SCD: ............................... SCE: ............................... SCF: ............................... ======================================= 16SC $04,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- And there was much rejoicing. ]PR#5 ]CATALOG,S6,D2 C1983 DSR^C#254 328 FREE A 002 HELLO B 034 DISP.MAP B 026 SUB.OBJ0 B 034 SUB.OBJ1 B 038 SCRUBS B 034 BANG ]RUN HELLO ...works... The reason I always do this is to see whether there are any runtime checks for subtle differences in the original DOS. If the program runs after booting from a third-party disk, I can eliminate a whole range of possible secondary protections. Not only does the game work after booting from my work disk, it runs from drive 2 without complaint. Now to make the disk be able to read itself (remember, it still has the original RWTS on it)... Going all the way back, the original RWTS is capable of reading a standard disk -- most of the first few tracks were standard, before all the fiddling. I can bypass all the fiddling by making $9E4D jump to $A180 instead of $AE8E. T00,S0D,$4E: 8EAE -> 80A1 ]PR#6 ...works, and it is glorious... Quod erat liberandum. ~ Acknowledgments Thanks to Ian Baronofsky for lending me original disk. --------------------------------------- A 4am crack No. 1722 ------------------EOF------------------