------------Buzz Bang Harvey----------- A 4am crack 2019-03-05 --------------------------------------- Name: Buzz Bang Harvey Genre: educational Year: 1984 Authors: Scott Rackey Publisher: Queue, Inc. Platform: Apple ][+ or later Media: 5.25-inch disk Sides: 1 OS: DOS 3.3 Previous cracks: none Similar cracks: #607 German Vocabulary Games ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA disk read error on first pass Locksmith Fast Disk Backup can't read anything past track $02 EDD 4 bit copy (no sync, no count) works Copy ][+ nibble editor T03+ have modified prologues address: "BA AA 96" data: "D5 AA 96" Disk Fixer T00 -> looks like a DOS 3.3 RWTS T00-T02 -> looks like a full DOS T01,S09 -> startup program is "HELLO" T03+ unreadable ["O" -> "Input/Output Control"] set address prologue to "BA AA 96" set data prologue to "D5 AA 96" Success! T03+ readable T11 -> standard DOS 3.3 disk catalog Why didn't COPYA work? modified address and data prologues on track $03+ Why didn't Locksmith FDB work? ditto EDD worked. What does that tell us? no half or quarter tracks almost certainly no nibble check (just structural changes to epilogue) Next steps: 1. capture RWTS with AUTOTRACE 2. convert disk to standard format with Advanced Demuffin 3. patch RWTS to read standard format ~ Chapter 1 In Which We Attempt To Use The Original Disk As A Weapon Against Itself [S6,D1=original disk] [S6,D2=blank disk] [S5,D1=my work disk] ]PR#5 CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 CAPTURING BOOT1 ...reboots slot 6... ...reboots slot 5... SAVING BOOT1 SAVING RWTS ]BRUN ADVANCED DEMUFFIN 1.5 ["5" to switch to slot 5] ["R" to load a new RWTS module] --> At $B8, load "RWTS" from drive 1 ["6" to switch to slot 6] ["C" to convert disk] --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC1:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC2:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC3:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC4:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC5:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC6:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC7:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC8:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC9:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCA:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCB:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCC:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCD:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCE:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCF:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR ======================================= 16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- Drat. I was hoping the RWTS was smart enough to use the proper address and data prologues based on which track is being read. But it looks like it's a one-shot change after DOS is loaded. I need to dig deeper to find out where that change happens. ~ Chapter 2 In Which We Discover A Historical Curiosity ]PR#5 ... ]BLOAD BOOT1,A$3600 ]CALL -151 *B600<3600.3EFFM *B700L . . all normal, until... . B747- 4C 82 A2 JMP $A282 That normally jumps to $9D84 to cold- start DOS, load the startup program, and so on and so forth. But first, we're doing a little something extra at $A282. That is normally part of the RENAME command handler, but I'm going to go out on a limb here and guess that we're not really renaming anything. Let's see what's hiding there instead. *9600 At $B8, load "RWTS 3+" from D1 ["6" to switch to slot 6] ["C" to convert disk] ["Y" to change default values] --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM ======================================= INPUT ALL VALUES IN HEX SECTORS PER TRACK? (13/16) 16 START TRACK: $03 <-- change this START SECTOR: $00 END TRACK: $22 END SECTOR: $0F INCREMENT: 1 MAX # OF RETRIES: 0 COPY FROM DRIVE 1 TO DRIVE: 2 ======================================= 16SC $03,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- And here we go... --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK: ................................ +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0: ................................ SC1: ................................ SC2: ................................ SC3: ................................ SC4: ................................ SC5: ................................ SC6: ................................ SC7: ................................ SC8: ................................ SC9: ................................ SCA: ................................ SCB: ................................ SCC: ................................ SCD: ................................ SCE: ................................ SCF: ................................ ======================================= 16SC $03,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- Bingo. ]PR#5 ... ]CATALOG,S6,D2 C1983 DSR^C#254 215 FREE A 013 HELLO A 023 BUZZ(8-10) B 014 TXT/GEN A 023 BUZZ(8-10)BACK A 023 BUZZ(ALPH) A 012 INRO 2 B 034 INTRO.PIC B 034 TABLE.PIC1 B 002 NOTE B 003 SMILES T 007 QUOTES T 002 SSCORES T 002 SNAMES B 034 HARVY.PIC T 003 NAMES T 002 SCORES A 023 ALPHARV B 002 NOTE.FIN A 023 BUZZ(8-24) B 002 NOTE.Q ]RUN HELLO ...works... (The reason I always do this is to see whether there are any runtime checks for subtle differences in the original DOS. If the program runs after booting from a third-party disk, I can eliminate a whole range of possible secondary protections.) Of course, the disk won't be able to boot past loading DOS, because it will still try to switch the RWTS parameters that no longer need to be switched. Let's fix that. $A200 is loaded from T01,S01. The first part (wiping a small chunk of memory) is harmless enough. I just want to jump directly to $9D84 instead of continuing to $A332. [S6,D1=demuffin'd copy] T01,S01,$96 change "32 A3" to "84 9D" ]PR#6 ...works... Quod erat liberandum. --------------------------------------- A 4am crack No. 1968 ------------------EOF------------------