' +JJJJ ?\>m0M='+l> /+l  H d@hLҦ L~ L  ﵪ*i BB䵊嵰`72µ- i ư&( Rp s P  LLʬLoō 鷎귭෍ᷩ췩緈JJJJx Lȿ L8ᷭ緍췩 緍i 8 `巬 췌`x (`(8`I`B` ``>J>J>VU)?`8'x0|&HhHh VY)'&Y)xꪽ)' `Hh`V0^*^*>&` aI꽌ɪVɭ&Y&&Y& 꽌ɪ\8`&&꽌ɪɖ'*&%&,E'зЮ꽌ɪФ`+*xS&x'8*3Ixix&& 8  '  & x)*++`NG8`0($ p,&" ۿ ۿڿL흍ٿ vLQ  !"#$%&'()*+,-./0123456789:;<=>?  ( 9 +"  "*  (9"1 ( ,.(0# 2  /#0/#0 *?'#07#00/0/'#07#0:"4<*55/**5/*%5/)1/)1/)1/)'#0/#0*5/*75/**5/*:5//#0/#0'#07#0:::*::'#07#0).).*#!.*'!.8)(#/-)(#/-,,eb)++$ h( ,!!"@h !D)"E` @ $ C ` DQ &J80^݌Hh ü ü݌ ռ ռ ռA ļD ļ? ļAEDE?HJ>h Լ ռ ռ ռ`HJ>݌h Hh݌`HH ᥠ L\HIHHHHhHH݌hHhHh݌H6 VDP (FD Z $0x8x D- ܸDD# H8`?F Vk *f???0xF Hh D#-FFF8` D ܸx D - ܸx8`-0ݩ?ʥD FFF`   LDcpq` [` ~  L IH  /JJJJ"L뷩 ᷩ췩 ɛ LDLSAVBPILOCUNLOCIBPIBPIBPPRBPIBLISCALBPIBUZZOFӜsqu`".Q`pNФbptťܥm2<(-Py0\|e<6e< ~ vL~ JJJJj귍hI  aUL@ kU8  L  ^R(jQ0l^l\  OÌȌ`W ԧ H h@ [_ /QSIRb_L`LLLL`ª`LQL߼YLeLXLeLee ўQ0 L&RE;BY; Ꝥ$`( R \ZLl8 ўR HH\`\Z[YS6`LxQɿu3'RͲʎRʎ]]]ɍuL͟ɍ}RLRɍg^H8 ^hZLɍR LͲɊRR% QLܤͲ Z@ -^ ş\[Z QY\[Z8`l6Lş_Ȍb_Ͳ] )Y h( ֭ͲLɍ [LLĦ__ ^ 9 LҦ3 9 a   0LjLY u< (_9 ˭ɠuɠK_9 ?LˆʎõĵL õ ĵµ aµ`` L̦µ_bJLuLz`  ȟ QlXJ̥KlV  ȟ QlV eօ3L׭Lܫ &RL &QL d L4 We)n `@-eff L f`L . tQLѤ LҦL` OPu d L Ne)noon 8ɍ` ^f\õL ^NR  RΩLҦ\L \ şL_ NLjHv 3h`0h8` [L NС õ`A@` ŵL]Lõ`  \ 濭0 ş  Q ^\lZl^\8  ş Lȟ`fhjõĵ@OAP`u@`@&`QR`F Ls  @DAF@u`8` %@ @A@`@`@A`Mµ ) LЦ`8@AWc@8@-@HAȑ@hHȑ@ȑ@hHȑ@Ȋ@ch8&ȑ@Hȑ@Ah@LHȑ@ȑ@ htphso`hMhL`9V8U897T6S67`INILOASAVRUCHAIDELETLOCUNLOCCLOSREAEXEWRITPOSITIOOPEAPPENRENAMCATALOMONOMOPRINMAXFILEFINBSAVBLOABRUVERIF!pppp p p p p`" t""#x"p0p@p@@@p@!y q q p@ ,\Z[PRR3\ɄSɊ"RQJ(0Fw6. ^-%p 㩠RP.Q I* P\L˵B̵C8pB߮Z\ @ յյ\BIR Z-^ Jp\IZLLӜv  Ϡ@跻~!Wo*9~~~~ɬƬ~_ j ʪHɪH`Lc (L ܫ㵮赎 ɱ^_ J LsL Q(`贩紎 DǴҵԵƴѵӵµȴ 7 ַ :ŵƴѵǴҵȴµ納贍﵎ٵ്ᵭⳍڵL^ѵ-I `  4 ò-յ!  8صٵ紭ﵝ 7L (0+BC  7L HH`LgL{0 HH` õL H hBL BH [ h`Lo õ ڬL B ڬ LH hB@ յյ [L (ȴ) ȴ 7L L ( L (ȴL{ƴѵ洩ƴǴҵ 7 ^* B0 HȱBh ӵԵ 8 L8 ݲ` ܫ  / / şFD B / / ]ƴS0Jȴ ȴ)  紅D贅F B ƴ  / 0L Ν `ND8HFFhDh N ş`, ŵBѵ`, ѵB8`  XI볩쳢8 DH E𳈈췍Ȍ X0 · JLǵBȵC`,յp` 䯩 R-յյ`յ0` K R-յյ`ɵʵӵԵ` 4 K ( ѵҵLBȱBL8` DBHBH : ַ޵BȭߵBhhӵԵ RBܵmڵ޵ȱBݵm۵ߵ` 䯩LR˵̵ֵ׵`LzĪLR E( 8` R` ELRŪƪ`췌 յյI뷭鷭귭ⵍ㵍跬ª 뷰` Lf ݵܵߵ޵ ^`8ܵ i B8` 4L ֵȱB׵ ܯ䵍൭嵍 ` DȑB׵Bֵ  ַ յյ`` ᥠ hh`ĵµ`ڿ8.ڿ.ۿ`êL`õĵBCõĵ`µµ`L õBĵCصص Qƴ0"Bƴ 󮜳` 0۰ϬBƴ8`i#`ЗLw!0>ﵭ` m ﳐ 7i볍 8 ЉLw`H h ݲL~ `浍국䵍뵩嵠Jm赍嵊mjnnn浈ۭm浍浭m䵍䵩m嵍`"L ŵ8ŵH x(`F d£àĠz# u` @@A` @A@  B C BBCLCLfBL ީLhh`LLN7ɿLݍҭ -A@@i@@@i@AAݣ@ݢΩDDLeA@@lL /?@Hɷ@#@h@!ɵ@ɥͰi+hɝi@@/8e@@DAA͈@̈DDL܇@BA݅C@BAC濽տ`xxlt]iVȿQkKRE;BY;LꍁlL<ԍL WLHr7s8 LH HLݍ ,,(`l8 LH e UL׉ LH LH,, sL,,, t鍁` H `Le HL H LL H QL H Llש B\ȹ'ȹ' (LRANGWRITE PROEND DATFILE NOT FOUNVOLUMI/O ERDISK FULLOCKESYNTANO BUFFETYPE MISMATCTOO LARGNOT DIREC q`QrU`)`\N|Lي80ʭ) $% B橠 B  ` L߭ɍ_LةحW`8& 9ʩ8`WL () ~ۭ N N L,H whLZ؍^؍_`$,,L`hhhL٭0 ,0L,Ƀɛɍ8ɠnɻɺ: n(8l mnحuIn Lw8n {۠u  {ۥgh,,0۬ۍ،؍La8 L߭ u ب H بh,8m l بNۘHج,8۰h Z wةͼH h بLZ8Ѕυ Z0 Z LڭٍَٺHץ9ɾIn0 hH )? @(I7n׽Nשn I-- h+( ,,0 ,Hّ(ho Lލ ׭,0 )?( Ɉoɀ@MםH Ihh0 Lڊʰڍ,עLڍhhیڬ<۠x )ڠ8۬ڰ(HH `ȹ0,Ȍ ɍ  ɠ )?, @, LB LƠ LLւ&LݩLL#B B!P`L [F]ind --> [A]SCII --> "CONFIG" --v-- -------------- DISK EDIT -------------- TRACK a ProDOS filename. *1030.1031 1030- 3F 10 *FC58G N 400<103F.104FM LBASIC.SYSTEMJJJJ It's loading BASIC.SYSTEM into $2000 and executing it. That means that MEMORY.CONFIG must be executed before BASIC.SYSTEM; it must be loaded by the PRODOS file direct01E- B9 3F 10 LDA $103F,Y 1021- 99 81 02 STA $0281,Y 1024- 88 DEY 1025- D0 F7 BNE $101E 1027- AD 10 C0 LDA $C010 102A- 4C 00 20 JMP $2000 What file are we opening and reading? $102F + 1 will be a pointer toSR $BF00 1009- [C8 2F 10] ; ProDOS MLI call: read file 100C- 20 00 BF JSR $BF00 100F- [CA 35 10] ; ProDOS MLI call: close file 1012- 20 00 BF JSR $BF00 1015- [CC 3D 10] 1018- AC 3F 10 LDY $103F 101B- 8C 80 02 STY $0280 1t gets moved to $1000). ]PR#7 ]PREFIX /MARSH.SQ ]BLOAD MEMORY.CONFIG,A$2000,TSYS ]CALL -151 *2033:4C 59 FF *2028G *1000L ; ProDOS MLI call: close file 1000- 20 00 BF JSR $BF00 1003- [CC 2D 10] ; ProDOS MLI call: open file 1006- 20 00 BF J to "4C 28 20" ]PR#6 ...works... Quod erat liberandum. ~ Epilogue How does MEMORY.CONFIG get called? This bugged me for a long time. The answer came to me after I listed the legitimate code at $2242 (thand a precisely organized track $23 (and failing). On the assumption that this was the nibble check, I made the following edit to skip over the copy protection and go directly to the legitimate-looking code at $2028. T1F,S09,$00 change "20 D1 21" A- B9 42 22 LDA $2242,Y 202D- 99 00 10 STA $1000,Y 2030- C8 INY 2031- D0 F7 BNE $202A 2033- 4C 00 10 JMP $1000 My copy never made it this far. It was stuck in an infinite loop in the $2036 subroutine, trying to fi ; move drive head back to track 0 201D- A9 23 LDA #$23 201F- 85 00 STA $00 2021- A9 00 LDA #$00 2023- 85 01 STA $01 2025- 20 E4 21 JSR $21E4 ; move some code and jump to it 2028- A0 00 LDY #$00 2021- D0 F3 BNE $20E6 20F3- C0 5D CPY #$5D 20F5- D0 CE BNE $20C5 ; success path falls through to here 20F7- A0 00 LDY #$00 20F9- EA NOP 20FA- 60 RTS Backing up and continuing at $201D... *201DL 0E2- D0 E1 BNE $20C5 ; look for $D5 in a specific place 20E4- A0 00 LDY #$00 20E6- C8 INY 20E7- BD 8E C0 LDA $C08E,X 20EA- BD 8C C0 LDA $C08C,X 20ED- 10 FB BPL $20EA 20EF- C9 D5 CMP #$D5 20Fplace 20D1- A0 00 LDY #$00 20D3- C8 INY 20D4- BD 8E C0 LDA $C08E,X 20D7- BD 8C C0 LDA $C08C,X 20DA- 10 FB BPL $20D7 20DC- C9 A5 CMP #$A5 20DE- D0 F3 BNE $20D3 20E0- C0 2D CPY #$2D 2C3- D0 BB BNE $2080 20C5- 20 74 21 JSR $2174 20C8- A5 2D LDA $2D 20CA- C9 0F CMP #$0F 20CC- D0 F7 BNE $20C5 ; read an actual sector worth of data 20CE- 20 FB 20 JSR $20FB ; look for $A5 in a specific #$0A 20B2- 20 68 21 JSR $2168 20B5- A9 04 LDA #$04 20B7- C5 04 CMP $04 20B9- D0 04 BNE $20BF 20BB- E6 04 INC $04 20BD- D0 B8 BNE $2077 20BF- A9 0F LDA #$0F 20C1- C5 04 CMP $04 20 #$D5 20A8- D0 F3 BNE $209D 20AA- C0 10 CPY #$10 ; if not found in correct location, try ; again from the top 20AC- D0 C5 BNE $2073 ; do this for several other sectors 20AE- E6 04 INC $04 20B0- A9 0A LDA 0 F7 BNE $2092 ; skip an exact number of nibbles and ; look for $D5 209B- A0 00 LDY #$00 209D- C8 INY 209E- BD 8E C0 LDA $C08E,X 20A1- BD 8C C0 LDA $C08C,X 20A4- 10 FB BPL $20A1 20A6- C9 D5 CMP 2089- BD 8C C0 LDA $C08C,X 208C- 10 FB BPL $2089 208E- C9 EB CMP #$EB 2090- D0 EE BNE $2080 ; skip to sync byte 2092- BD 8C C0 LDA $C08C,X 2095- 10 FB BPL $2092 2097- C9 FF CMP #$FF 2099- D $2174 207A- A5 2D LDA $2D 207C- C5 04 CMP $04 207E- D0 F7 BNE $2077 ; skip to address epilogue 2080- BD 8C C0 LDA $C08C,X 2083- 10 FB BPL $2080 2085- C9 AA CMP #$AA 2087- D0 F7 BNE $2080 this for all sectors 206B- E6 04 INC $04 206D- A9 10 LDA #$10 206F- C5 04 CMP $04 2071- D0 D0 BNE $2043 ; start over on sector 0 2073- A9 00 LDA #$00 2075- 85 04 STA $04 2077- 20 74 21 JSR - BD 8C C0 LDA $C08C,X 2061- 10 FB BPL $205E 2063- C9 D5 CMP #$D5 2065- D0 F3 BNE $205A 2067- C0 07 CPY #$07 ; if not found in correct location, try ; again from the top 2069- D0 D8 BNE $2043 ; do LDA $C08C,X 2052- 10 FB BPL $204F 2054- C9 FF CMP #$FF 2056- D0 F4 BNE $204C ; skip an exact number of nibbles and ; look for $D5 2058- A0 00 LDY #$00 205A- C8 INY 205B- BD 8E C0 LDA $C08E,X 205Eeld 2043- 20 74 21 JSR $2174 ; is found sector = 0? 2046- A5 2D LDA $2D 2048- C5 04 CMP $04 ; no, loop until we find it 204A- D0 F7 BNE $2043 ; skip to sync byte 204C- BD 8E C0 LDA $C08E,X 204F- BD 8C C0 2036- A9 00 LDA #$00 2038- 85 04 STA $04 203A- AE 30 BF LDX $BF30 ; turn on drive motor again, just for ; good measure I guess 203D- BD 89 C0 LDA $C089,X 2040- BD 8E C0 LDA $C08E,X ; looks for the next address fi STA $00 2013- A9 23 LDA #$23 2015- 85 01 STA $01 ; this subroutine moves the drive head ; from the track given in $00 to the ; track given in $01 2017- 20 E4 21 JSR $21E4 ; here we go 201A- 20 36 20 JSR $2036 *2036L RTS *2003L ; grab slot+drive again 2003- AE 30 BF LDX $BF30 ; turn on drive motor manually 2006- BD 8A C0 LDA $C08A,X 2009- BD 89 C0 LDA $C089,X 200C- BD 8E C0 LDA $C08E,X 200F- A9 00 LDA #$00 2011- 85 00 t+drive of last-used device 21D1- AD 30 BF LDA $BF30 21D4- 8D DF 21 STA $21DF ; call ProDOS MLI with command $80 ; ("read block") -- this is like a low- ; level sector read 21D7- 20 00 BF JSR $BF00 21DA- [80 DE 21] 21DD- 60 FIG file. It's a SYS file, which means it's probably loaded at $2000. Then again, everything on this disk is just slightly off. ]PR#7 ]PREFIX /MARSH.SQ ]BLOAD MEMORY.CONFIG,A$2000,TSYS ]CALL -151 *2000L 2000- 20 D1 21 JSR $21D1 *21D1L ; grab sloRODOS file, but I looked and it's part of the RWTS. So this is expected and legitimate, not the start of a nibble check. - T1F,S09 - two additional matches, both highly suspicious. Copy II Plus disk map says T1F,S09 is part of the MEMORY.CONr with the slot number (x16) and an "LDA $C089,X" instruction to turn on the drive motor. And I got lucky: I found four matches. - T00,S0E - part of the ProDOS bootloader (expected) - T04,S0C - Copy II Plus disk map says this is part of the Pthe entire PRODOS file, I turned to my trusty Disk Fixer sector editor and searched for the hex sequence "BD 89 C0". Although there are many variations of copy protection, a surprising number of disks use a nibble check that starts by loading the X registehangs with the drive motor on... It's looking more and more likely that the nibble check is inside the PRODOS file itself. ~ Chapter 3 In Which Things Are Not Always As They Appear Instead of tracing mory. I guess this copy of BASIC.SYSTEM has also been modified to load the HELLO program at a non- standard location, and the HELLO program itself detects when the location is unexpectedly... standard. ]PR#7 ]PREFIX /MARSH.SQ ]-PRODOS ...loads ProDOS and that, as a last resort. ]PR#7 ]PREFIX /MARSH.SQ ]-BASIC.SYSTEM ...program loads and runs without mentioning "Debug Mode"... Hmm. On line 10, PEEK(104) is looking at zero page $68, which is the starting address of the current Applesoft BASIC program in meed directly (the "Debug Mode" indicator). I briefly considered copying the files to a freshly formatted ProDOS disk and letting it run in debug mode, but that wouldn't answer any questions about how the disk is actually protected. But I'm not above doing int... It appears that BASIC.SYSTEM has been hacked up to auto-run HELLO instead of STARTUP. (I ran all the other BASIC files, and HELLO is definitely the startup program.) But running HELLO manually does not give the same results as when the disk is bootO" 20 GOSUB 60000 90 GOTO 10000 99 REM CLEAR 100 & CLEAR 4: & PRINT H$,140 ,0,2,CS,2: & LEN J,H$: IF J > 0 THEN J = J + 20 102 HC = 5 + INT ( RND (1) * 3) BREAK ]RUN ...program prints "Debug Mode" but runs without complaLO ]LIST 0 ONERR GOTO 63000 5 REM HELLO 09/27/89 10 IF PEEK (104) < 88 THEN HOME : VTAB 12: HTAB 14: PRINT "D ebug Mode.": POKE 230,32: POKE 104,88: POKE 88 * 256,0: POKE 2067,96: PRINT CHR$ (4)"RUN HELL-89 MEMORY.CONFIG SYS 3 16-DEC-88 BLOCKS FREE: 26 BLOCKS USED: 254 ]PREFIX /MARSH.SQ ]LOAD STARTUP FILE TYPE MISMATCH Oh. Well, right. The catalog did say that STARTUP was a BIN file. Hmm. ]BLOAD STARTUP ]LIST ] No luck. ]LOAD HEL 8 30-OCT-89 PAC.O14 BIN 5 22-AUG-89 PAC.O15 BIN 5 22-AUG-89 PAC.O16 BIN 4 22-AUG-89 PAC1.27.TBL BIN 1 22-AUG-89 PAC1.27 BIN 81 22-AUG-89 PAC.INTRO BIN 5 27-SEP.PP0 BIN 5 5-JUL-89 HELLO BAS 9 27-SEP-89 MENU BAS 7 27-SEP-89 INFO BAS 10 29-SEP-89 MAIN BAS 15 16-OCT-89 LEARN1 BAS 6 27-SEP-89 LEARN2 BAS 5-JUL-89 UNPACK4 BIN 1 22-AUG-89 BS.CHAR BIN 4 5-JUL-89 GWINDOW BIN 1 5-JUL-89 ESC.WDW BIN 5 5-JUL-89 ANA BIN 3 21-AUG-89 SQ.FNT BIN 3 21-AUG-89 PACly Off [S7,D1=my ProDOS hard drive] ]PR#7 ]CAT,S6,D1 /MARSH.SQ NAME TYPE BLOCKS MODIFIED PRODOS SYS 32 14-JUN-89 BASIC.SYSTEM SYS 21 17-JUN-89 STARTUP BIN 7 5-JUL-89 DBS25 BIN 6 ] PRESS [RESET] TO EXIT. --^-- [S6,D1=demuffin'd copy] ]PR#6 ...boots to ProDOS and hangs... (same as EDD bit copy) ~ Chapter 2 In Which We Enter A Parallel Universe Where Everything Is Just Slight9 A...................................A B...................................B C...................................C D...................................D 12E...................................E F...................................F [ ................3 4...................................4 5...................................5 6...................................6 7...................................7 8...................................8 9...................................*********************************** HEX00000000000000001111111111111111222 TRK0123456789ABCDEF0123456789ABCDEF012 0...................................0 1...................................1 2...................................2 3...................arameters O - Edit Original disk's parameters C - Edit Copy disk's parameters G - Begin demuffin process --^-- ["G" to begin] --v-- LOCKSMITH 7.0 FAST DISK BACKUP R................................... WORIGINAL *change this -----------++ Data prologue: D5 AA AD Data epilogue: DE AA EB Ignore write errors while demuffining! D - Edit parameters - Advance to next parm - Exit edit mode R - Restore DOS 3.3 psk. [S6,D1=original disk, side A] [S6,D1=blank disk] --v-- SUPER-DEMUFFIN AND FAST COPY Modified by: The Saltine/Coast to Coast Address prologue: D5 AA 96 Address epilogue: DE DE EB DISK ^^ OS file to read standard format (if necessary) 3. find nibble check and bypass it ~ Chapter 1 In Which We Convert The Disk To A Standard Format I've included a copy of Super Demuffin on my work di) Why didn't Locksmith FDB work? modified epilogue bytes (every track) Why didn't my EDD copy work? probably a nibble check in the first SYSTEM file Next steps: 1. convert disk to standard format with Super Demuffin 2. patch RWTS in PRODL L(8L2C)pJJJJ IH(ȱH:=IH[H`@HcH  $ +   I/H`JLNGȄBȄF aK  haaFF  mJm# KKJ UJ )J ۈ) ;J3ȱJFȱJGJKaȄM  aaNNJFLGJ  e editor modified address epilogue "DE DE EB" Disk Fixer ["O" -> "Input/Output Control"] set Address Epilogue to "DE DE EB" Success! All tracks readable! T00 -> looks like ProDOS Why didn't COPYA work? modified epilogue bytes (every trackTools Fail In Interesting Ways COPYA immediate disk read error Locksmith Fast Disk Backup unable to read any track EDD 4 bit copy (no sync, no count) no read errors, but copy loads ProDOS then hangs with drive motor on Copy ][+ nibblstrations, Donna L. Osness Ed.D. (consultant) Publisher: Marshware Media: single-sided 5.25-inch floppy OS: ProDOS 1.8 Other versions: none (preserved here for the first time) ~ Chapter 0 In Which Various Automated ------Squeegee Learns About Drugs------ A 4am crack 2015-01-25 --------------------------------------- Name: Squeegee Learns About Drugs Genre: educational Year: 1989 Authors: EduSystems Incorporated (programming), Morse Software Illu                           ƭ󍭠卍䠣±䠣󍠠󍍱䠣Š󍭠󍍱卍ǍͬԠƠҠΠΠȠōŠҠŠŠҠҠӍΠŠŮ䠣µ󍍱Ԡ􍠠čϠŠӠƠ٬ӠҠҠŠčԮΠϠԠ̠ōӠҠԠӠŠōҠ٠ͬӠҠҍ٬ҠΠΠΠƍԬԠҠŬ󺍍宍ŠŠӠĠӠӢԠ٠Ơ٠ĬӍҠĬǠԠԠԠ嬠嬠謠嬍嬠嬠﬍󮍍㩠퍍䬠嬠堢墩䩍箠󍍭󩍠箠㬠󍍠Р󠱰䠱宠ԍ宠嬠卍Ӡ箠̭ͭ占ᠨ󩍠箠캠󬍠퍍󺍍堨󩍠箠ᠲ堨󩍠箠䍠􍍭堨󩍠箠Яӯ묠򠮲宠Ӡ󮍍堠련᩠Р뮍ԠӮР嬠뮍Рԩ뮠䮍嬠ήР묠ȠΠ̠ˮР𮍍Р宠ӬӠӠӮΠЬ讍䮠占ᬍӬ򍭠򍭠䡍報􍠠󍠠ɠ򍠠󡍍占􍠠뮢Р򍠠Ӡ᭭򭭭렠򢠨Рɠ              iiHh`.!2! 2!`D![!w!HH`- ` `L'.!  `L .!  (`,H h ȑȑȑȑi  88`.!J m3!4!7!6!i5!.! %! 5!5!6!` ō O@ǭ$8`ihheHH08$`H ԰hH  hH hi  hheHH  ȱ  0P`,,-hh  P4HIH[H` Ű OL H & :  &x0 P+ Ұ° OxLkm &)] &)O &)A)n & &L °L O*&G &L ´H OI' & L'ʊm-0,8-'ʊL= µ O&J &l ōK O^1 &L P &H@A &`+ = 'H ° O鷥X & J &鷩xH+3' & h+ (` ñ O鷥'  &L ´  O7RJ &LD &xH+1' & h+ ( ñč" O%J@( &ȑ L  ̱ōd ON &l= &`& M &L  аÍ N O4* &JJJJx  ·9 OB & 4 &鷢P  Oޥ: &. &  & Ų׍ O: &. &  & ų׍ O: &. &  & Ŵ׍ O/ &i@9ȥLI ų׍ O:R &.T & S &Ր б׍S Oե:W &.Y & X & в׍X O:\ &.^ & ] & г׍] O: &. &  &ސ űנ & в׍ O: &. & ռ  & г׍ O: &. & ռ  &ސ ű׍ Oޥ: &. & ռ  & Ų׍ O: &. & ռ  & & гҍ O?/ &ɰ.6 & 5 &ސ űҍ5 Oޥ?9 &ɰ.@ &\8 ? & Ųҍ? O:y &.{ & ռ z &Ր б׍z Oե:~ &. & ռ ҍ Oޥ? &ɰ. &Ф  & Ųҍ O? &I. &  &Ր бҍ Oե@ &ɰ/ &V  & вҍ O> &ɰ- & ?O &ɰ.V & U &Ր бҍU Oե@Y &ɰ/` & _ & вҍ_ O>d &ɰ-k & j & гҍj O? &ɰ. &Ю  &ސ  OЩi O ü ü O1 &݌ЩL ư O꽌ɪgH &Hh LꩰLY & =^ & / ±I OR O _ O; &꽌ɭLʾ#  OVɭ1 &8L2C)pJJJJ IH(ȱH:=IH[H` &`L i=L\Ʃ8m@ &аa &Ui, &H*J)j4]hiHx+i &L  &i< ԍ@ O'+l> /+8 &鷎귭෍ᷩ췩緈JJJJx8 &77777777777JJJJx@ &HIHHHHhHH݌hHI  H  JJJJ  U  I  M  ,Ɉɋɕ1Ɋ-ɍ$8 X /(`8pLiɀLJ &' +JJJJ ?\>m0M=L` LsL- LLC   / X  4   ʊ >!?! ,L)- ` @  ҠȠΠ̠ˠA    $            =ʼn_ &xBbעBO1K1bBaXF?F@`HXFYF$eF% "h D` ժުժު>B?2@5 K5.@B"9<KI!#LԲ2rB r@5>M rl$ r茉0̃baRw!b/=oavwR';axorVwBCEbec'.BCov000?"2>!mImI3axovwR';mArϏB'/=bצJbצfJfBarwBO1K1b4o?Bbf0B%%_u&=.;& !:<)= z}}) }|<ɂ} }=զy }|z 2z }|zi`hhw[ɂTqPYL< Wyi  f Q)? (}Zs p}Yɂ^_ p^_L =<<<=`x / Xi i$8i (i)iH/?2 fk 2i )?0('((QQ?)JJJJJJ?@ H)h H)h @Ң6<=7BC>?HHL,<=<' .< <ȄB<C!=8? , /LĩŠӠ̠ō ɱ %O P Vɲ KO P F ĠȠƠ̺ h> # &C BB >O ?P   ! `yy`8` # &6` . 1Vv` L` L ````<= 8<<=< <=8<<==Ȱ<}<=}=(8 0й(` d d''H hL:)`#jjm jkik0 ΁ ` [((L_JJ_) _)ȩ_)Ȅ` ` [I1((΁ `HJJJ h) e)i)` J%H$HH  (<)=<ɠi@ (   hh$h [L?H$ [hL x` `FG8`0($ p,&"m 귈x c` d`  6s LdQ X !  > Es .'PWSPsn  : m _ -ɛ!jW@kX Lɛ L Nm >, BL^ ( fWjXk  "` 0:9` @ 6Lu BL'Hȅb -h  +bLJ*b)bJH8  h Fbb*V&b'8*1Ibib&& 8  ' & &  Lb)*++`bjj#F8 8    bnLjcJx2`LLB8 [<=<(ȱ L  (֠ҠŠn st A L 3L "ŠȠΠΠ®ؠˠ!#JJJJ )  ݩjЅk ݩj؅kL@mljש׭`j j )j`8`h K< K=< b``a`` ` Y >` h ɮȹɵɷɲɷ`LjЅk hL h T?؅k h@ h T3 үΠԠġLH_)Ji=_J(jI<<h<`8 ɚ L#ɛL (ɠ`ɛ,LYɚ, ` ɛLYɚ ɕ(ɍ ` Ɉ0 ` H HL? ˠ_ LHJJ h)L%Puj8]hk^i` 0 `j   )` @`, ` E c V M jWSN kXT ? ( sn  : X Y LLHh Hh`%H$H  $h$hL[ LX $#xӠŠϠ!L! ]m ]^i^` $$$$`,,, ԠŠ` ` (!Ӡ"!Ϡԍ`stwuv`,rs0t rrLjntrrtst ErHIht H mh`H nj轊mh` >Ps  sPt  t` źP  Lw %H$H  $#L   ! Ԡst Ƞ  Lhr ԠLe Ԡ w ! $h$h%L"  (' ɠ @( (ΠԠ  s  s t  t  [  l `ܱj`M jN kƠ,snLjcb_ -`n  :ȅb_ -` mS  (ԠȠŠ Ԡ JJJJ Š   l `  # (Ǻ("ӠȠΠӠ(ΠŠԠˮ! `_ m/ _. _`8` ˭Ժ!$$ s HJJ$ h- ĺ!$$ s HJJ$ h. - . , ú!$$ s HJJ"$ h/ `j kk8`jj`ejjkik`jk0j`8`jkUjVk8`j`jk$kp귭 , jhhl LZ 2м```  Q` "(   ` ! ` L  ɛLYɚ Llhi>hi?>l ȥqȱ>H>Hqȱ>ȱ> e $ zlq` - _ `0 NOL,)`HH$()? @(hh``LBLB LB H轳 轳 h k kj аNjHjCk ` ` 轳 k͂ #} ͂ j̓ j̓ jō췭k Ok l  K  аL_췍 k뷍"!Ҡ"!Ҡàq ք]ÍT6 ; L ;L BL  B L @ ;f L ; L ;L 6 1 @ L L L 6 1 @ -L  B 1 zL ; @ L @ PL @ ;L @ 6L 췩뷩 , L 췩аѭL  !͠Ժ h訾 H H B / Xhh  LL佂L  !Ԡκ "!ҠԠˠ"!Ҡl"!ˠ"!Š"!"̭!Ԡ^"!Ԡl"!,f0L!Ʃq     ɢ$d v]ΫD Ժt   ճ G c$ T k  f$ BL! BL BLl  K 鷩귭n >   "!Я^"!Ԡl"!Ҡ "!ˠ^"!Ġ͠l"! "!Ԡ^"!Ġl"!Π"!Ԡ^"!٠l"!Ӡ"!Ӡ"!ӳ^"!ˠ Q ) 0       `֩'   z,  :l L 2 Q  ժުժժުHIӠ٠پ ժު ժǍ΍߿ϟժުժު &;:נˠŠנԁgŠԠˠtԠӠˠΠŠ`  W! W! W!  WӠˠĠȠׁԠˠ` ԯ XU3O Q _KJԠY S)( ϾYG KJtE ŠΠ3O c ͮΠ3K 1 Fsz ǮMKJNKJOKJ E~z   KJ~z sz  > ʊHiʊH`?\>m0M='+l> /+l  H d@hLҦ L~ L  ﵪ*i BB䵊嵰`72µ- i ư&( Rp s P  LLʬLoō                          z#     ԰ ͠ˠ>ϠŠ ĠΠĠΠӠҠΠA Р РӠ0((8448)160ı()(8449)26ı<*(8450)185ıN5(8451)0ıb6(8452)183ıu7(8453)73ı<KEY(8454):UTO-DECRYPTION 2014-09-09 CMD(256) CHECKSUM(257) CMD128CHECKSUM37100: SAVE BOOT0' DA $C08C,X" AT $B94F?)(9039)189ı=(9040)140ıQ(9041)192ım "JSR $XX00" AT $BDB9(10169)32ı(10170)0ıRWTS1 CHECK FOR SIMPLE DECRYPTION LOOP AT $B700 (KEY<>0 ON EXIT IF FOUND)KEYNS A NORMAL-SHAPED RWTS7 (RWTS=1 ON EXIT IF FOUND)BRWTS0f "STY $48; STA $49" AT $BD00?z(9984)132ı(9985)72ı(9986)133ı(9987)73ı "SEC; RTS" AT $B942?(9026)56ı(9027)96ı "L 1000: DECRYPTED BOOT1 WAS CAPTURED, NOW SAVE ITX"SAVING BOOT1 DECRYPTED"(4)"BSAVE BOOT1 DECRYPTED,A$2000,L$A00"RWTS0:1200RWTS2501000 RESET FLAGS256,255:257,255 CHECK IF BOOT1 CONTAI472l(X)76(X)108690>v(X1)0(X1)253690](X2)183(X2)8690u"DECRYPTING BOOT1"(4)"BLOAD AUTOTRACE"XX947238767,X38772,X138777,X238649,90:38650,151:38400:XX1:X972862090(X1)248590,(X2)145590A&(X3)248590_0"/!\ BOOT1 IS ENCRYPTED"h:600~NXX1:X9728520W1000X TRY TO AUTO-DECRYPT BOOT1Y (SCAN FOR JMP ($08FD) OR JMP $B700)Z (IF FOUND, PATCH IT AND REBOOT)bX9X) X9472 (X)1894905(X1)137490J(X2)192490k"/!\ NIBBLE CHECK AT $BB00"t500XX1:X97284201000 ENCRYPTED BOOT1? (SCAN FOR EOR ($F8),Y; STA ($F8),Y IN $BB00 RANGE)X9472(X)815768796:X:I,X:I&797,(10171)58""SAVING IOB"X'(4)"BSAVE IOB,A$300,L$1E"b+1000, 74,141,34,15,140,35,15,142,39,15,169,1,141,32,15,141,42,15,169,48,141,241,28,169,15,160,30,76,0 NIBBLE CHECK AT $BB00? (SCAN FOR LDA $C089,# (4)"BSAVE BOOT1,A$2000,L$A00"4 RWTS0:1200D RWTS0400W "SAVING RWTS"z (4)"BSAVE RWTS,A$2200,L$800"  $BDBB HOLDS HIGH BYTE OF START OF RWTS  (USUALLY $B8) (10171)184400  NON-STANDARD RWTS START LOCATIONI:( BOOT1 WAS CAPTURED, NOW SAVE IT< "SAVING BOOT1"` (4)"BSAVE BOOT1,A$2000,L$A00"{ KEY0:1300:KEY0220 "/!\ BOOT1 IS ENCRYPTED":"DECRYPTING BOOT1" 38826,KEY:38820 (4)"RENAME BOOT1,BOOT1 ENCRYPTED" "SAVING BOOT1"(10314)76(10315)240(10316)182ĺ"/!\ BOOT0 JUMPS TO $B6F0":130y x(10314)108(10315)253(10316)81000 STANDARD BOOT0, SO AUTOTRACE BOOT1 "CAPTURING BOOT1" (4)"BLOAD AUTOTRACE" 38649,22:38650,151:38400 d BOOT0 WAS CAPTURED, NOW SAVE IT* e> i"SAVING BOOT0"b n(4)"BSAVE BOOT0,A$2800,L$100" r(10314)108(10315)254(10316)187ĺ"/!\ BOOT0 JUMPS TO ($BBFE)":130 s(10314)76(10315)0(10316)187ĺ"/!\ BOOT0 JUMPS TO $BB00":130G t CMD129CHECKSUM36200: SAVE BOOT1` CMD130CHECKSUM39700: SAVE AUTO-DECRYPTED BOOT1i 90 ((4)"BLOAD BOOT0,A$9800" 2(4)"CATALOG" <1000 Z FIRST RUN [216,0: CLEAR ONERR ^"CAPTURING BOOT0" _(4)"BRUN AUTOTRACE"$  4AM WORK DISK5 FEATURING AUTOTRACEL RWTS EXTRACTION,` IOB CREATION,~ NIBBLE CHECK DETECTION, RWTS AUTO-DECRYPTION 2014-09-09 CMD(256) CHECKSUM(257) CMD128CHECKSUM37100: SAVE BOOT0'      J"#' *L̠٠ŠˠӠ٠ͱàƠ٠ӶıӶIJӠ٠٠ϠŽԠŠĠӠԠԠĠӠΠŠġӠӢϠԠҬâϠJi# c NO SUCH BINARY FILE EXISTS! L08"'&"#* &` c PLEASE INSERT CORRECT DISK CORRECTLY IN THE CORRECT DRIVE AND PRESS Q ɍLYI`ĠΠéL X c LOAD IOB MODULE- 0'   ;L c PLEASE TYPE THE NAME OF THE FILE TO LOAD FILE: c _ Q Ɉɍ'ɠ  c  c PL c ,D_ Q ɱɲ ) K 4 +. JJ)ȱJ!JHȱJh9! *!B c UNABLE TO FORMAT! PRESS RETURN TO GO BACK TO MENU Q ɍL X c LOAD RWTS MODULE- PAGE TO LOAD AT (MUST BE A 2-DIGIT HEX NUMBER):   L  Ɉ L LL c 0L''J ;'LJh`K H Kh`) ɺi``/`،#'J" * *+E8@' c  Q hh L 0'` X c FORMAT DISK IN DRIVE: _ Q ɱɲ )  c INSERT DISK AND PRESS RETURN Q ɍ* `KJ ɮAJ   Ɉ3 LHJ JhJJ$ c P  ɈJJJJJIJJ*JJ  (KJJJJJJ JJ J`JJ J`JJJJ JJ J` c _ Q ɍɮɈɰǰɺ)H h(`H Q ɸLɱIp76 c 80NJ J G&J (J c Lɛ`,ɛ`hhLh&h'&'&H h'H&H`i G'&)?&`'& )&`LHJh``i GJi&&` GJi& 婮 LG 0к m(  L K Q ɍ  I K 3 06. m( KKL P c  c TRK: +.5: 0123456789ABCDEF0123456789ABCDEF0123SC0: SC1: SC2: SC3: SC4: SC5: SC6: SC7: SC8: SC9: SCA: SCB: SCC:  c SCD: SCE: SCFKn Q ɍ  I K  KK ND SECTOR: $  2* c BACKWARDS COPYING NOT SUPPORTEDL c INCREMENT:  c P c MAX # OF RETRIES: _   c COPY FROM DRIVE 1 TO DRIVE: Q ɱɲ) X) c INSERT DISKS AND PRESS RETURN Q ɍ XLLUȌȌD c CHANGE DEFAULT VALUES Q L X c INPUT ALL VALUES IN HEX SECTORS PER TRACK? (13/16) 1_ Q ɳɶ  c START TRACK:   c START SECTOR: $  c END TRACK:  c Exة67  / X'(P"# - c (C)ONVERT DISK LOAD NEW (R)WTS MODULE LOAD NEW (I)OB MODULE (F)ORMAT TARGET DISK E(X)IT TO MONITOR L?ɍɈɕ  ޢ X / XX LYL         (ILũLJ4KL:5L :=ILũLJlKLLL~L ILŠ!I!*` < $<VDP (ED Z $0x8x D- DLHIHHHHhHH݌hHhHh݌H6 h    `HJ>݌h Hh݌` ﶵBD <=>?>>!`FG8`0($ p,&"h8 흠 BȱBȭۿHۿ ȿL߼  !"#$%&'()*+,-./0123456789:;&Y&&Y& 꽌ɪ\8`&&꽌ɪɖ'*&%&,E'зЮ꽌ɪФ`+*xS&x'8*3Ixix&& 8  '  & x)*++>J>J>VU)?`8'x0|&HhHh    VY)'&Y)xꪽ)'     `Hh`V0^*^*>&` aI꽌ɪVɺ련򠲩報䠲ԠӠĠӠ΢報堲堢ӍǠԠġԺؠƠӿ٠͠ŠϠŠ뺠뺠򺠤򺠤ƍ뺠뺠򺠠Ơ򺠠Ʃ򮍍堭썠ᠢ뮍ԠҺĠ˺ĠҺᠱ뮠堢ӠҠˢ뮩Ԡ˺ᠢ堍ᠢ련Ӡᠢ련Ӡ󠱳򠱶蠱à묠멠堲΢٢󮍍ӠҠ˿ᠱ İŠԠӿ려򠤰려򠤰Ƭ荱Ԡˠ뮠ԠˢήӠ ԠϠҺ堢󮠠ήΠӠ뮍Ġנ źӍӠ뮠ԠԠ˺嬠ӠԠ˺뮠占묠㮍ĠנӠźӠ련Ӡ󮍍à΍󺍍堢쬠嬠뮠堢󢮠򮠠ẢӠ嬠¸¸ӧ¸Ӡ䠤ƮǠӠӍӠӠ뮠堢ĠנӠŢŠύĠԠԠŠԠؠҩ묠Ӣââ䢬庍ˠŭġӠӢϠԠҬâϠō뮠뮍Ң𠭭䮍ע𠭭󺍍Ң䮍ע󮠠卢Ң堢ע뮠堢Ңע򮠠󮠠宍󮠠󮍍宠򠱶򩬠򬠠쮩蠢ˢ󮠠።렠󮠠𮠠嬠퍤󠤰려˺ưưðñòóôõö÷øùºúĺźƺàƠ٠ӶıӶIJ𮍍ŠӠٍ󺍍ĠΠé̠٠ŠˠӠ٠͍卍Ӡ٠٠ϠŢ󠱭󩬠ԠԠˠĠӠ΢Ӡ󠵠뮍䬠ή䠱嬠ԠŠˠĠӠ΢ή련̭î̭à占à䮍蠢̭򠢴¸͢占ŧӠᠢ墠宠ɠɠ䡩̭î占Ӡ󍠠Ӡ󮠠Э٭Рō٠Ǡ˺占򮍍ҠӠ嬠󍠠䍠Ҡ占ӮӠ򍠠嬠栤İӠ占䮍Ӡ嬠栤¸ 􍠠䍠 䬠䍠䮍Ӡ䍠 ƠŠ٠ŠàĠРİӍ 庍Ӡ٠Ʋ򍱴ŠƠؠƲ򍱴íĠƠƲ򍱴ƭĠƠƲ危ƠӠ ̍Ҡ堣렣ĠƠƲ򍱴àƠ٠ؠ報 嬠묠Ӡ 嬠í® Ǡ Ӎ Ӯ ӠӠ ®ᠢŠԠĢ򮍍ŠԠŠԠˠ٠ΠԠŠŠĠӍξӮŠŠōŠƠŠŠϠĢ宠άᠱᠲ󺍍ϠȠ٠Šӡ䮠󍠠ưӠӧӠ宍бӧ堠ӠӠ宠䍠፠􍠠Ƞ宠占ư􍠠宠􍠠Ӯӧ󬍠Ӡ󮍍̠̠Ƞӧ占󮍍̠堲􍠠ȠԠ󍠠󮠠𠳠䍠퍠Ӡ蠲Р堲Рͬ͠占占Ӡ٠Ӎ󺍍嬠Ӡ󮍍۫ɬӠ뮠䍢ϢϢϠ򮍍􍲭󩮠㱢堢Ӡ٠٠ϠŢ덠󠱳󮩍堢󮍍ᠢ宍嬠򠢠ӠҠ˿려򠤰려򠤰î占󠱮려䍠ŧӠ󠰭ԲӰà婮占ήԠˢή󮍍묠ᠢӠ荠ŠŭӬ̤ΠĠנӠŢήӠ¸ᠢ墠蠶̭Р捠婮Ԡݩ󮠠ϢŧӮᠠƱź  ƲŠ ƲŠ Ʋˠ ƲҠ 뮍 堨³堨宍 󺍍占ƱŠ Ӡ󠠠ԱԬìà嬠፠𠳠占堲ɠĬԠ占Ԡ̠ȍЩᠤԠ宍԰占ӮƠፍ٠嬠䍠堳䠲Ӎ󩬠 󍠠󍠠堢䍠̭٠䮠፠򍠠砢ԠϠҢƠ䠠ùᠤ䠤ōƮƵàƸà䬠썠򮠠䬠ù婠䠤Š婠ԍ砤䍠獠穬堲፠䮍ƲԠƵ󍠠Ԡ䍠Ӡ 䮠󍠠ӬӠŠ獠ﮠؠ򍠠 Ơ堲䍠 вٍàгԡӠ􍠠Ġд󠤴¬荠 뮠ŰҠᠤàᠤƠ򠱳䠱򠩍 ӠӬ荠󮍠ᮍ  嬠宠 占à쮍íƠ䠠嬠󮍠嬠 ͠ 宠砢Ġנ Ţ 􍠠䮠򍠠 î占덠ƷŭҠӠ𠲠󍠤ƸР̠򍠤ƸΠҠӍƸɠŠ 䩍íƠ栠㍠ƷРó忍ƷѠΠ荠ƷРij򿍠ƷŠٱƷí󍠤Ʒĭ򍠤ƶҲ٠򍠤ƶβ٠򍠤ƶٍƶִ̠ƶ­ҠԠ󍠤ƶŭ ƷٱҠΠ򿍠Ƶà􍠤ƵŠӴ􍠤Ƶ٠䍠Ƶíִұ٠占Ƶƭα٠ҠӠӠ􍠤ƴ­䍠ƴĭŠ占ƵҠ򍠤ƵàӴ占ƵРˠ􍠤Ƴĭ֠렣󍠤ƴŠƴŠ占ƴŠ􍠤ƴ Ӡ󮠠󺍍Ƴ³٠Ҡ򍠤ƳؠǠ򍠤ƳҠ堣렣Ƴ􍠠獠Ӡ ԬݍƳ³占砤ƱƠ捠宠󠱭򮠠䍠Ҡ Ʋú ƲƺԠ ƳƠĸ ƬĸƲƠƠנԍƲ̠ ƲǠ Ʋ ƲŠ Ʋº䬠捠䠱宠荠嬠䠹䍠样Ӡ󍠠Ӡ􍠠Ӡ 󩮠򮠠宠󠤹Ԡ󠤲󩬠䍠Ʈ°󍠠򮠠ᠤ􍠠ƱΠΠ占򮍠뮍Π䮠퍠報 ﮍĭƠ䩍ưԠԠ占٠󍠠ﮍà֠󠤰򠤰덠፠٠ٮ 嬠٠䮍ﬠ፠宍٠􍠠󠤰 ٠퍠򠰰렰堤ŮŸӠì婍ŹӠ占󠤰፠퍠堰򠰰󍠠󩮠ӠàŠ䠤荠렰󮍠宠報占堨󩬍ӠàᠤŶà䍠ᮍŷààӠӮŴààᬠ占ӮŵӠ䍠ᮍ려ŲӠӠӠ􍠠ᮍųààᬠ占űӠ퍠뮠䍠ᠤ렰嬠Ǻư堢ĠƠùƠ°àĠӬŬȠӠ荠뮠󠱮򠠠Πٍ퍍䠴Ӡݍݍݍðҍ͠򩍤ƸͲƠԍõōĸŠԍĠԍưԱƵҍ占ӮӧǠӠ栤¸٠Ԡİ䍠Ӡ뮍ðĠɯϠ 䍠堤İ􍠠Ӡ占 嬠٠Ԡ􍠠䍠宍İӠӮ䍠Ӡ፠뮠Ӡ 嬠䍠宠􍠠򮠠䍠Ӡ 󮩍ĸŭƠ䬠󩍍ưà􍠠󮠠Щ占󠱭z      󮍍IJĠԠݠ򍠠ƱƩijƠӠݠ謍󠤸뮩ӧ箠򍠠ƹƩ󍠠Ӡ笠捠ӠíƮӠ󍠠쭤Ơ፠Ӡ占Ӡ占Ʃ󍠠ӠӍƲƠ䩍İǠݠӍ CMD129CHECKSUM36200: SAVE BOOT1` CMD130CHECKSUM39700: SAVE AUTO-DECRYPTED BOOT1i 90 ((4)"BLOAD BOOT0,A$9800" 2(4)"CATALOG" <1000 Z FIRST RUN [216,0: CLEAR ONERR ^"CAPTURING BOOT0" _(4)"BRUN AUTOTRACE"$  4AM WORK DISK5 FEATURING AUTOTRACEL RWTS EXTRACTION,` IOB CREATION,~ NIBBLE CHECK DETECTION, RWTS AUTO-DECRYPTION 2014-09-15 CMD(256) CHECKSUM(257) CMD128CHECKSUM37100: SAVE BOOT0'      렯獍卍ƭ􍠠栤İ栤򮍍堢堢Ԣ栢٢箍ӮƠ󩮠􍠠󠱮䬠䍠򮍍堤 堨獠󮍍򮠠占宠󍠠𮩠笠썠䠢̭ɸ堤䠤ԠϠҢ̭٠䠦宠፠婮󠤱ư䠤ƱŠĠ ŮӠӠ􍠠Ӡ蠢ĠנӍŢР 䬠퍠Ӡ렯笠򍍭묠ĠӠϢ¢򩍤ư堢Ģ멍堢򩍤Š堢â􍍭󩍠źàϠƠ٠Ϡ֠àƠ٠ӶıӶIJ 堢멍ķ堢àӺà堢ĢàƠĢ荤ijƠ󠱭荤İӠîƠԺ 堢âĠĢ荤IJĠƱƩ􍠠 SIMPLE DECRYPTION LOOP AT $B700A (KEY<>0 ON EXIT IF FOUND)KKEY0_((8448)160ır)(8449)26ı*(8450)185ı5(8451)0ı6(8452)183ı7(8453)73ı<KEY(8454):$ CMD128CHECKSUM37100: SAVE BOOT0'  "SEC; RTS" AT $B942?-(9026)56ı@(9027)96ı_ "LDA $C08C,X" AT $B94F?s(9039)189ı(9040)140ı(9041)192ı "JSR $XX00" AT $BDB9(10169)32ı(10170)0ıRWTS1  CHECK FORRESET FLAGS'256,255:257,255-a CHECK IF BOOT1 CONTAINS A NORMAL-SHAPED RWTS (RWTS=1 ON EXIT IF FOUND)RWTS0 "STY $48; STA $49" AT $BD00?(9984)132ı(9985)72ı(9986)133ı(9987)73ıX138777,X2438649,90:38650,151:38400:JXX1:X9728620T1000 DECRYPTED BOOT1 WAS CAPTURED, NOW SAVE IT"SAVING BOOT1 DECRYPTED"(4)"BSAVE BOOT1 DECRYPTED,A$2000,L$A00"RWTS0:1200RWTS2501000  OR JMP ($08FD) OR JMP $B700)BZ (IF FOUND, PATCH IT AND REBOOT)MbX9472il(X)76(X)108690v(X1)0(X1)253690(X2)183(X2)8690"DECRYPTING BOOT1"(4)"BLOAD AUTOTRACE"XX947238767,X38772,AN FOR EOR ($F8),Y; STA ($F8),Y IN $BB00 RANGE):X9472L(X)81590a(X1)248590v(X2)145590&(X3)2485900"/!\ BOOT1 IS ENCRYPTED":600NXX1:X9728520W1000X TRY TO AUTO-DECRYPT BOOT1Y (SCAN F169,15,160,30,76,0/ NIBBLE CHECK AT $BB00?L (SCAN FOR LDA $C089,X)WX9472j(X)189490(X1)137490(X2)192490"/!\ NIBBLE CHECK AT $BB00"500XX1:X97284201000 ENCRYPTED BOOT1?/ (SC $B8)(10171)184400B NON-STANDARD RWTS START LOCATION\I768796:X:I,X:Ip797,(10171)5""SAVING IOB"'(4)"BSAVE IOB,A$300,L$1E"+1000, 74,141,34,15,140,35,15,142,39,15,169,1,141,32,15,141,42,15,169,48,141,241,28,26,KEY:388205 (4)"RENAME BOOT1,BOOT1 ENCRYPTED"I "SAVING BOOT1"m (4)"BSAVE BOOT1,A$2000,L$A00"~ RWTS0:1200 RWTS0400 "SAVING RWTS" (4)"BSAVE RWTS,A$2200,L$800"  $BDBB HOLDS HIGH BYTE OF START OF RWTS  (USUALLYAPTURING BOOT1"* (4)"BLOAD AUTOTRACE"L 38649,22:38650,151:38400:r BOOT1 WAS CAPTURED, NOW SAVE IT "SAVING BOOT1" (4)"BSAVE BOOT1,A$2000,L$A00" KEY0:1300:KEY0220 "/!\ BOOT1 IS ENCRYPTED":"DECRYPTING BOOT1" 388(10314)76(10315)240(10316)182ĺ"/!\ BOOT0 JUMPS TO $B6F0":130 u(10314)76(10315)192(10316)8ĺ"/!\ BOOT0 JUMPS TO $08C0":130 x(10314)108(10315)253(10316)81000 STANDARD BOOT0, SO AUTOTRACE BOOT1  "C d BOOT0 WAS CAPTURED, NOW SAVE IT* e> i"SAVING BOOT0"b n(4)"BSAVE BOOT0,A$2800,L$100" r(10314)108(10315)254(10316)187ĺ"/!\ BOOT0 JUMPS TO ($BBFE)":130 s(10314)76(10315)0(10316)187ĺ"/!\ BOOT0 JUMPS TO $BB00":130G t