--------------Swashbuckler-------------
A 4am crack                  2018-10-06
---------------------------------------

Name: Swashbuckler
Genre: action
Year: 1982
Credits: Paul Stephenson
Publisher: Datamost
Platform: Apple ][+ or later
Media: 5.25-inch disk
Sides: 1
OS: DOS 3.3

This disk was automatically cracked by
Passport. Here is the transcript:

                 --v--

Reading from S6,D1
T00,S00 Found DOS 3.3 bootloader
Using disk's own RWTS
Writing to RAM disk
T02,S02 Volume name is DISK VOLUME 254
Writing to S6,D2

The disk was copied successfully, but
Passport did not apply any patches.

Possible reasons:
- The source disk is not copy protected.
- The target disk works without patches.
- The disk uses an unknown protection,
  and Passport can not help any further.

                 --^--

Wait, what?

It turns out this disk is protected,
but the RWTS can also read unprotected
disks.

Here is the RWTS code in question:

                 --v--

T00,S03
----------- DISASSEMBLY MODE ----------
008B:BD 8C C0       LDA   $C08C,X
008E:10 FB          BPL   $008B
0090:85 06          STA   $06
0092:DD 8C C0       CMP   $C08C,X
0095:F0 07          BEQ   $009E
0097:A5 06          LDA   $06
0099:C9 DE          CMP   #$DE
009B:D0 A5          BNE   $0042
009D:EA             NOP
009E:18             CLC
009F:60             RTS

                 --^--

It checks the first epilogue after the
address field, then burns some time by
storing it in zero page $06. Then it
compares the data latch value again --
but no loop -- which will only be true
if the first epilogue nibble has a
timing bit after it.

But! If there is no timing bit, it then
matches the stored nibble value against
the regular epilogue ($DE) and accepts
it. Since that is now the case on the
copy that Passport made, the disk boots
and no patches are required.

Quod erat liberandum.

---------------------------------------
A 4am crack                    No. 1873
------------------EOF------------------
