------------The Boars' Store-----------
A 4am crack                  2015-07-15
---------------------------------------

Name: The Boars' Store
Genre: educational
Year: 1987
Publisher: Random House, Inc.
Media: double-sided 5.25-inch floppy
OS: ProDOS 1.1.1
Previous cracks: none (Asimov has an
  uncracked .nib)

Only side A is bootable, so I'll start
there.

                   ~

               Chapter 0
 In Which Various Automated Tools Fail
          In Interesting Ways


COPYA
  immediate disk read error

Locksmith Fast Disk Backup
  unable to read any track

EDD 4 bit copy (no sync, no count)
  works

Copy ][+ nibble editor
  all tracks use standard prologues
  but modified data epilogue
  ("EB AA EB" instead of "DE AA EB")

Disk Fixer
  ["O" -> "Input/Output Control"]
    set Data Epilogue to "EB AA EB"
  Success! All tracks readable!
  T00 -> looks like ProDOS bootloader
    and disk catalog

Why didn't COPYA work?
  modified epilogue bytes (every track)

Why didn't Locksmith FDB work?
  modified epilogue bytes (every track)

EDD worked. What does that tell us?
  no half or quarter tracks
  almost certainly no nibble check
  just structural changes to epilogue

Next steps:

  1. Super Demuffin
  2. Patch RWTS if necessary
  3. There is no step 3 (I hope)

                   ~

               Chapter 1
          In Which We Choose
      The Right Tool For The Job


I'm going to use Super Demuffin here
(instead of my usual go-to conversion
tool, Advanced Demuffin). The disk is
ProDOS-based, so my AUTOTRACE script
on my work disk won't capture the RWTS.
But luckily, the RWTS modifications are
minor -- custom epilogue bytes, same on
every track -- so Super Demuffin will
work just fine.

When you first run Super Demuffin, it
asks for the parameters of the original
disk. In this case, the prologue bytes
are the same, but the epilogues are "EB
AA EB" instead of "DE AA EB".

                 --v--

      SUPER-DEMUFFIN AND FAST COPY
Modified by: The Saltine/Coast to Coast


   Address prologue: D5 AA 96

   Address epilogue: DE AA EB    DISK
                               ORIGINAL

      Data prologue: D5 AA AD

      Data epilogue: EB AA EB
                     ^^
             *change from "DE"


 Ignore write errors while demuffining!


  D - Edit parameters
      <SPACE> - Advance to next parm
      <RETURN> - Exit edit mode
  R - Restore DOS 3.3 parameters
  O - Edit Original disk's parameters
  C - Edit Copy disk's parameters
  G - Begin demuffin process

                 --^--

Pressing "G" switches to the Locksmith
Fast Disk Copy UI. It assumes that both
disks are in slot 6, and that drive 1
is the original and drive 2 is the
copy.

[S6,D1=original disk]
[S6,D2=blank disk]

                 --v--

     LOCKSMITH 7.0  FAST DISK BACKUP


   R...................................
   W***********************************
HEX 00000000000000001111111111111111222
TRK 0123456789ABCDEF0123456789ABCDEF012
   0...................................
   1...................................
   2...................................
   3...................................
   4...................................
   5...................................
   6...................................
   7...................................
   8...................................
   9...................................
   A...................................
   B...................................
   C...................................
   D...................................
12 E...................................
   F...................................
[               ] PRESS [RESET] TO EXIT

                 --^--

[S7,D1=ProDOS hard drive]

]PR#7
...
]CAT,S6,D1

/BS

 NAME           TYPE  BLOCKS  MODIFIED

 PRODOS          SYS      30  14-MAY-87
 PICS            DIR       1  14-MAY-87
 ANM.SUBS        BIN       5  14-MAY-87
 BOARS.SYSTEM    SYS       5  14-MAY-87
 MISC.SUBS       BIN       8  14-MAY-87
 OPENING         BIN       7  14-MAY-87
 CHSET           BIN       3  14-MAY-87

BLOCKS FREE:  167     BLOCKS USED:  113

]PREFIX /BS
]-BOARS.SYSTEM
...works...

                   ~

               Chapter 2
    In Which Our Adventure Comes To
  A Sudden But Satisfying Conclusion


Depending on how the original disk was
written, this copy may or may not be
able to read itself. I may need to
patch the disk's RWTS to deal with the
fact that the disk is now in a standard
format.

[S6,D1=demuffin'd copy]

]PR#6
...boots ProDOS then says "relocation /
  configuration error" and hangs...

Yup, let's go find the RWTS.

[Disk Fixer]
  ["F"ind]
    ["H"ex]
      ["C9 EB"] ("CMP #$EB")

Found it on track $04, part of the
PRODOS file (as expected).

T04,S0B,$C8 change EB to DE

Side B is similarly protected (modified
data epilogue), but no post-demuffin
patches are necessary because the only
RWTS is on side A.

Quod erat liberandum.

---------------------------------------
A 4am crack                     No. 371
------------------EOF------------------