--------------TellStar II--------------
A 4am crack                  2017-03-11
---------------------------------------

Name: TellStar II
Version: (*) see below
Genre: productivity/astronomy
Year: 1982
Credits: Evan M. Scharf
Publisher: Scharf Software Systems
Platform: Apple ][+ or later
Media: single-sided 5.25-inch floppy
OS: DOS 3.3
Previous cracks: none (of this version)

(*) As with many Apple II disks, there
is limited versioning information. Some
other copies of this program display an
explicit version number on the title
page; others at least have a revision
date in a REM statement in the startup
program. My copy, alas, has neither,
which tells me that it is unique but
not whether it is newer or older!

Some kind soul uploaded a manual to a
different version. I can tell you that
this is the "Level II" version of the
program, which offers views of both the
Northern and Southern hemispheres.
("Level I" offers only one hemisphere.)
My copy also allows you to enter dates
up to year 3000. (Early versions only
allowed up to 1999.) It also allows you
to save views to a user-supplied data
disk. (Early versions could only print
them out.)

So, as far as I can tell, this version
has not been preserved, and it is more
advanced than any of the other copies I
could find online.

                   ~

This disk was automatically cracked by
Passport. Here is the transcript:

                 --v--

T00,S00 FOUND DOS 3.3 BOOTLOADER
USING DISK'S OWN RWTS
WRITING TO S5,D2
SWITCHING TO BUILT-IN RWTS
T00,S02,$49: 03 -> 04
T00,S02,$52: 4CB1BEEAEA -> A9D520B8B8
T00,S02,$5F: BB -> B8
T00,S02 RWTS REQUIRES EXTRA NIBBLES AND
TIMING BITS AFTER THE DATA PROLOGUE BY
JUMPING TO $BECA.
T00,S02,$F4: EABD8CC010FBC9ADD0E84CCABE
-> A056BD8CC010FBC9ADD0E7A900
T00,S03,$91: AF -> DE
T00,S03,$35: AF -> DE
T00,S02,$9E: AF -> DE
T00,S08 RWTS REQUIRES A NON-STANDARD
DISK VOLUME NUMBER.
T00,S08,$12: B148 -> A900
CRACK COMPLETE.

                 --^--

More information and source code is
available at
https://archive.org/details/Passport4am

                   ~

The disk that Passport produced works
flawlessly... almost.

Steps to reproduce:

1. Display a star view (any date and
   location)
2. At "L  I  C  <-  ->  O  D  G  S  E"
   prompt, press "G"
3. At "SAVE VIEW S PRINT VIEW P END E"
   prompt, press "S"
4. At "PLACE 'SAVE' DISKETTE IN DRIVE
   PRESS ANY KEY WHEN READY" prompt,
   insert a formatted DOS 3.3 disk and
   press a key
5. At "PLACE 'TELLSTAR' DISKETTE IN
   DRIVE PRESS ANY KEY WHEN READY"
   prompt, reinsert the program disk
   and press a key

                 --v--

I/O ERROR
BREAK IN 0
]

                 --^--

There is an RWTS swapper somewhere. It
"switches" to a standard RWTS so it can
save files on user-supplied data disks.
This has no effect, since we've already
standardized the RWTS with Passport.
But then it tries to switch back to the
protected RWTS so it can read more code
from the program disk, which fails
because the program disk is no longer
protected.

Hmm.

See if you can spot it:

[S5,D1=work disk]

]PR#5
...
]CATALOG,S6,D1

*A 011 TELLSTAR
*I 007 APPLESOFT
*B 050 FPBASIC
*B 017 RUNTIME
*B 029 TELLSTAR I.OBJ
*B 003 CHAR.GEN
*B 006 CHAR.TBL
*B 006 FTL.B
*B 038 TELLSTAR II.OBJ
*B 044 NORTH.TABLE.OBJ
*B 043 SOUTH.TABLE.OBJ
*B 041 MESSIER.TABLE.OBJ
*B 037 CALCULATIONS.OBJ
*B 052 TELLSTAR DISPLAY.OBJ
*B 004 STAR.SHAPES
*B 002 DOS.SWITCH.OBJ
*B 037 TELLSTAR UTIL.OBJ
 T 002 LOCATION
 T 011 STR.DEMO
 B 028 COM.DEMO
 B 006 VAR.DEMO

Yeah, "DOS.SWITCH.OBJ" jumped out at me
too.

]BLOAD DOS.SWITCH.OBJ

]PAD
A$4100,L$00DC

]CALL -151

*4100L

4100-   A9 03       LDA   #$03
4102-   8D 49 B8    STA   $B849
4105-   A9 BB       LDA   #$BB
4107-   8D 5F B8    STA   $B85F
410A-   A9 EA       LDA   #$EA
410C-   8D F4 B8    STA   $B8F4
410F-   A9 BD       LDA   #$BD
4111-   8D F5 B8    STA   $B8F5
4114-   A9 8C       LDA   #$8C
4116-   8D F6 B8    STA   $B8F6
4119-   A9 C0       LDA   #$C0
411B-   8D F7 B8    STA   $B8F7
411E-   A9 10       LDA   #$10
4120-   8D F8 B8    STA   $B8F8
4123-   A9 FB       LDA   #$FB
4125-   8D F9 B8    STA   $B8F9
4128-   A9 C9       LDA   #$C9
412A-   8D FA B8    STA   $B8FA
412D-   A9 AD       LDA   #$AD
412F-   8D FB B8    STA   $B8FB
4132-   A9 D0       LDA   #$D0
4134-   8D FC B8    STA   $B8FC
4137-   A9 E8       LDA   #$E8
4139-   8D FD B8    STA   $B8FD
413C-   A9 4C       LDA   #$4C
413E-   8D FE B8    STA   $B8FE
4141-   A9 CA       LDA   #$CA
4143-   8D FF B8    STA   $B8FF
4146-   A9 BE       LDA   #$BE
4148-   8D 00 B9    STA   $B900
414B-   A9 4C       LDA   #$4C
414D-   8D 52 B8    STA   $B852
4150-   A9 B1       LDA   #$B1
4152-   8D 53 B8    STA   $B853
4155-   A9 BE       LDA   #$BE
4157-   8D 54 B8    STA   $B854
415A-   A9 EA       LDA   #$EA
415C-   8D 55 B8    STA   $B855
415F-   8D 56 B8    STA   $B856
4162-   A9 AF       LDA   #$AF
4164-   8D 9E B8    STA   $B89E
4167-   8D 35 B9    STA   $B935
416A-   8D 91 B9    STA   $B991
416D-   60          RTS
416E-   A9 04       LDA   #$04
4170-   8D 49 B8    STA   $B849
4173-   A9 B8       LDA   #$B8
4175-   8D 5F B8    STA   $B85F
4178-   A9 A0       LDA   #$A0
417A-   8D F4 B8    STA   $B8F4
417D-   A9 56       LDA   #$56
417F-   8D F5 B8    STA   $B8F5
4182-   A9 BD       LDA   #$BD
4184-   8D F6 B8    STA   $B8F6
4187-   A9 8C       LDA   #$8C
4189-   8D F7 B8    STA   $B8F7
418C-   A9 C0       LDA   #$C0
418E-   8D F8 B8    STA   $B8F8
4191-   A9 10       LDA   #$10
4193-   8D F9 B8    STA   $B8F9
4196-   A9 FB       LDA   #$FB
4198-   8D FA B8    STA   $B8FA
419B-   A9 C9       LDA   #$C9
419D-   8D FB B8    STA   $B8FB
41A0-   A9 AD       LDA   #$AD
41A2-   8D FC B8    STA   $B8FC
41A5-   A9 D0       LDA   #$D0
41A7-   8D FD B8    STA   $B8FD
41AA-   A9 E7       LDA   #$E7
41AC-   8D FE B8    STA   $B8FE
41AF-   A9 A9       LDA   #$A9
41B1-   8D FF B8    STA   $B8FF
41B4-   A9 00       LDA   #$00
41B6-   8D 00 B9    STA   $B900
41B9-   A9 A9       LDA   #$A9
41BB-   8D 52 B8    STA   $B852
41BE-   A9 D5       LDA   #$D5
41C0-   8D 53 B8    STA   $B853
41C3-   A9 20       LDA   #$20
41C5-   8D 54 B8    STA   $B854
41C8-   A9 B8       LDA   #$B8
41CA-   8D 55 B8    STA   $B855
41CD-   8D 56 B8    STA   $B856
41D0-   A9 DE       LDA   #$DE
41D2-   8D 9E B8    STA   $B89E
41D5-   8D 35 B9    STA   $B935
41D8-   8D 91 B9    STA   $B991
41DB-   60          RTS

Well well well. A set of three shafts
bored into the Earth to obtain water,
but that's not important right now.
What's important is that we have found
the RWTS swapper. The memory locations
it's twiddling line up exactly with the
modifications that Passport made to the
disk. For example, $B849 is stored on
track 0, sector 2. Passport changed the
value on disk from #$03 to #$04. And
here we have a routine at $4100 that
sets it to #$03, and a routine at $416E
that sets it to #$04.

Turning to my trusty Disk Fixer sector
editor, I can follow "DOS.SWITCH.OBJ"
and find this code on track $22. I can
put an "RTS" at each entry point to
neutralize everything.

T22,S0E,$04: A9 -> 60
T22,S0E,$72: A9 -> 60

Quod erat liberandum.

---------------------------------------
A 4am crack                    No. 1058
------------------EOF------------------
