------------Bridge Baron II------------ A 4am crack 2016-01-17 --------------------------------------- Name: Bridge Baron II Genre: games/card Year: 1987 Author: Thomas Throop Publisher: Great Game Products, Inc. Media: single-sided 5.25-inch floppy OS: DOS 3.3 Previous cracks: none Similar cracks: #353 Early Elementary (Compu-Tations) #278 Snooper Troops 2 ~ Chapter 0 In Which Various Automated Tools Fail In Interesting Ways COPYA immediate disk read error Locksmith Fast Disk Backup unable to read any track EDD 4 bit copy (no sync, no count) read error on T0A but copy works Copy ][+ nibble editor T00-T02 -> modified address epilogue (ED AA EB) T03-T22 -> modified address prologue (BB AA 96) T0A -> unformatted? mostly sync bytes Disk Fixer ["O" -> "Input/Output Control"] set Address Epilogue to "ED AA EB" T00-T02 -> looks like DOS 3.3 T01,S09 -> startup program is "BRIDGE BARON 12/4/87" ["O" -> "Input/Output Control"] set Address Epilogue to "DE AA EB" set Address Prologue to "BB AA 96" T11 -> looks like disk catalog Why didn't COPYA work? modified epilogues / prologues Why didn't Locksmith FDB work? ditto Next steps: 1. capture RWTS with AUTOTRACE 2. convert disk to standard format with Advanced Demuffin 3. patch RWTS to read standard format (if necessary) ~ Chapter 1 In Which Things Don't Always Go According To Plan [S6,D1=original disk] [S5,D1=my work disk] ]PR#5 CAPTURING BOOT0 ...reboots slot 6... ...reboots slot 5... SAVING BOOT0 CAPTURING BOOT1 ...reboots slot 6... ...reboots slot 5... SAVING BOOT1 SAVING RWTS ]BRUN ADVANCED DEMUFFIN 1.5 [press "5" to switch to slot 5] [press "R" to load a new RWTS module] --> At $B8, load "RWTS" from drive 1 [press "6" to switch to slot 6] [press "C" to convert disk] --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC1:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC2:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC3:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC4:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC5:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC6:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC7:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC8:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SC9:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCA:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCB:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCC:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCD:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCE:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR SCF:...RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR ======================================= 16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- Let's back up. ]PR#5 ]BLOAD BOOT1,A$2600 ]CALL -151 *FE89G FE93G ; disconnect DOS *B600<2600.2FFFM ; move RWTS into place *B700L . . nothing unusual at all . B747- 4C 84 9D JMP $9D84 It makes sense that I haven't found anything unusual yet. Evidence so far suggests that the RWTS on disk can read tracks 0-2 (which is where it's loading DOS), then it switches to a different RWTS that can read the rest of the disk. So whatever this disk is doing to modify its RWTS or load a new one, it's going to do it after loading DOS. And I need to find out where. But that means I need to trace the boot even further. *C500G ; because I have no DOS ... ]CALL -151 *9600 At $B8, load "RWTS 3+" from D1 [press "6" to switch to slot 6] [press "C" to convert disk] [press "Y" to change default values] --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM ======================================= INPUT ALL VALUES IN HEX SECTORS PER TRACK? (13/16) 16 START TRACK: $03 <-- change this START SECTOR: $00 END TRACK: $22 END SECTOR: $0F INCREMENT: 1 MAX # OF RETRIES: 0 COPY FROM DRIVE 1 TO DRIVE: 2 ======================================= 16SC $03,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- Now press RETURN to start the copy... --v-- ADVANCED DEMUFFIN 1.5 (C) 1983, 2014 ORIGINAL BY THE STACK UPDATES BY 4AM =======PRESS ANY KEY TO CONTINUE======= TRK: .......R........................ +.5: 0123456789ABCDEF0123456789ABCDEF012 SC0: .......R........................ SC1: .......R........................ SC2: .......R........................ SC3: .......R........................ SC4: .......R........................ SC5: .......R........................ SC6: .......R........................ SC7: .......R........................ SC8: .......R........................ SC9: .......R........................ SCA: .......R........................ SCB: .......R........................ SCC: .......R........................ SCD: .......R........................ SCE: .......R........................ SCF: .......R........................ ======================================= 16SC $03,$00-$22,$0F BY1.0 S6,D1->S6,D2 --^-- Now what?!? Oh wait, I remember EDD had problems on track $0A as well. And the nibble check did an RWTS seek to track $0A. I can't read it because there's nothing to read. ]PR#5 ... ]CATALOG,S6,D2 C1983 DSR^C#254 139 FREE B 034 SCREEN A 002 BRIDGE BARON 12/4/87 B 035 B0 B 016 GSL.SYS B 003 BBH B 008 CCG9000 B 077 B2 B 003 BBH128 B 006 BBL B 079 B1A B 078 B1B Now to make the disk be able to read itself, and skip the copy protection routine at $B4BB. ~ Chapter 3 In Which We Remove All Traces Of Copy Protection Using An Automated Tool That I Wrote For Just Such An Occasion [S6,D1=demuffin'd copy] [S5,D1=my work disk] ]PR#5 ... ]BRUN PDP ; fix non-standard epilogue in RWTS T00,S03,$91 change ED to DE ; bypass copy protection T00,S0C,$84 change 4CBBB4 to ADE9B7 ]PR#6 ...works... Quod erat liberandum. --------------------------------------- A 4am crack No. 581 ------------------EOF------------------