--In Search of The Most Amazing Thing-- A 4am crack 2019-11-29 --------------------------------------- Name: In Search of The Most Amazing Thing Version: rev. 0 (*) Genre: educational Year: 1983 Credits: Tom Snyder, Omar H. Khudari Publisher: Spinnaker Software Platform: Apple ][+ or later Media: 5.25-inch disk Sides: 1 OS: DOS 3.3 with custom bootloader and Pronto-DOS after-loader (*) This game was re-released at least twice with productized protections. I believe this one is the first release. ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA immediate disk read error Locksmith Fast Disk Backup unable to read any track EDD 4 bit copy (no sync, no count) no errors, but copy grinds the disk forever like it can't read itself Copy ][+ nibble editor The disk appears to use 16 sectors. I can see a relatively standard sector structure on every track. It seems to use a per-track address prologue (sometimes $AA $D5 $AB, sometimes $BF $AA $D5) and data prologue (sometimes $ED $AA $D5, sometimes $D7 $AA $D5). Disk Fixer attempts to use read sectors with the prologues and epilogues I saw in the nibble editor were unsuccessful. Maybe a non-standard nibble translate table as well? Why didn't COPYA work? modified prologues and epilogues and probably some other stuff Why didn't Locksmith FDB work? ditto Why didn't my EDD copy work? I don't know. Next steps: 1. Trace the boot 2. Capture the RWTS 3. Convert the disk to a standard format 4. Declare victory (*) (*) go to the gym ~ Chapter 1 In Which We Sharpen Our Wits And Our Pencils, And Our Journey Begins Our journey starts, as so many journeys in copy protection start, by copying the drive firmware to lower memory and modifying it. *9600 At $B6, load "OBJ.B600-BFFF" from drive 1 [press "6" to switch to slot 6] [press "C" to convert disk] This disk is 16 sectors, and the default options (copy the entire disk, all tracks, all sectors) don't need to be changed. It probably won't be able to read track 0, but we'll jump off that bridge when we come to it. --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK:R.................................. +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0:R.................................. SC1:................................... SC2:................................... SC3:................................... SC4:................................... SC5:................................... SC6:................................... SC7:................................... SC8:................................... SC9:................................... SCA:................................... SCB:................................... SCC:................................... SCD:................................... SCE:................................... SCF:................................... ======================================= 16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- ]PR#5 ... ]CATALOG,S6,D2 C1983 DSR^C#254 008 FREE A 002 HELLO A 056 GROUND.F19 A 059 FLY.F14 A 055 BCOMP.F19 A 049 ELEV.F19 A 040 TRADE.F22 B 008 CRUNCHED CAREXT B 019 CRUNCHED CARINT B 009 CRUNCHED ELEVPIC B 017 CRUNCHED STORE B 019 CRUNCHED SMOKE B 023 CRUNCHED AUCTION B 008 CRUNCHED TABLE T 015 ADVICE T 012 ITEMS T 004 SONG0 T 004 SONG1 A 022 LOGO.F26 A 037 DEMO.M20 A 003 INITTEMP B 003 UTIL.$0D00 B 002 SHAPE TABLE B 003 X B 006 Y T 004 SONG B 006 HELLO PRONTO-DOS T 002 SAVEGAME0 T 001 SAVEGAME1 ]LOAD HELLO ]LIST 10 D$ = CHR$ (4) 20 TEXT : HOME 30 PRINT 35 PRINT D$;"BRUN HELLO PRONTO- DOS" 40 REM IN ORDER TO USE OUR AL TERNATE MEMORY SCHEME, THE F OLLOWING THREE POKES ARE NEC ESSARY 46 POKE 103,49: REM $31 48 POKE 104,64: REM $40 50 POKE 16432,0 55 PRINT D$"RUN INITTEMP" ]RUN It briefly flashes an error message: CAN'T EXECUTE PRONTO-DOS DOS NOT AT NORMAL 48K LOCATION. ...but then it continues booting until it crashes at the "demo or play game" screen. However, if I reboot with the DOS 3.3 System Master disk, then re-insert my demuffined copy and re-run HELLO, it does work. This tells me that there is no secondary protection that relies on the original bootloader. Once we loaded the custom RWTS, it loaded a standard DOS (then modified itself in-memory to become Pronto-DOS), and the game itself doesn't care how it got there. That's great news, because it means I can replace tracks 0-2 with a standard DOS 3.3 that runs the HELLO program, and the entire game should just work. [Copy ][+ 8.4] --> COPY --> DOS --> from slot 6, drive 2 --> to slot 6, drive 1 [S6,D1=demuffin'd copy] [S6,D2=newly formatted DOS 3.3 disk] ...read read read... ...write write write... ]PR#6 ...game boots and loads, and it is glorious, except for one minor detail... ~ Chapter 7 In Which We Sweat The Details There is one minor detail, one small "finishing touch," that would make this crack house into a crack home. --v-- T00,S00 ----------- DISASSEMBLY MODE ---------- 0001:A5 27 LDA $27 0003:C9 09 CMP #$09 0005:D0 18 BNE $001F 0007:A5 2B LDA $2B 0009:4A LSR 000A:4A LSR 000B:4A LSR 000C:4A LSR 000D:09 C0 ORA #$C0 000F:85 3F STA $3F 0011:A9 5C LDA #$5C 0013:85 3E STA $3E 0015:18 CLC 0016:AD FE 08 LDA $08FE 0019:6D FF 08 ADC $08FF 001C:20 B3 08 JSR $08B3 <-- ... 00B3:8D FE 08 STA $08FE ; clear the screen and print ; "SPINNAKER" 00B6:20 2F FB JSR $FB2F 00B9:20 58 FC JSR $FC58 00BC:A2 09 LDX #$09 00BE:BD E9 08 LDA $08E9,X 00C1:9D 0E 04 STA $040E,X 00C4:CA DEX 00C5:10 F7 BPL $00BE 00C7:60 RTS --^-- ]PR#6 ...game boots and loads and prints "SPINNAKER" during boot just like the original, and it is glorious... Quod erat liberandum. --------------------------------------- A 4am crack No. 2128 ------------------EOF------------------