---------Fay: That Math Woman!---------
A 4am crack                  2021-06-11
---------------------------------------

Name: Fay: That Math Woman!
Genre: educational
Year: 1983
Credits: David Vincent, Paul Melhus
Publisher: Didatech Software
Platform: Apple ][+ or later (32K)
Media: 5.25-inch disk
Sides: 1
OS: DOS 3.3
Previous cracks: none

                   ~

               Chapter 0
 In Which Various Automated Tools Fail
          In Interesting Ways


COPYA
  read error on second pass

Locksmith Fast Disk Backup
  unable to read track 9
  copy boots as far as the text title
  screen, then prints "ILLEGAL DISC"
  and exits to a prompt

EDD 4 bit copy (no sync, no count)
  works

Copy ][+ nibble editor
  track 9 appears to have real sectors
  but uses a non-standard address
  prologue ($AA $95 $96)

                 --v--

   COPY ][ PLUS BIT COPY PROGRAM 8.4
(C) 1982-9 CENTRAL POINT SOFTWARE, INC.
---------------------------------------

TRACK: 09  START: 2C89  LENGTH: 189F

2C68: FF FF FF FF FF FF FF FF   VIEW
2C70: FF FF FF FF FF FF FF FF
2C78: FF FF FF FF FF FF FF FF
2C80: FF FF FF FF FF FF FF FF
2C88: FF AA 95 96 AA AA AE AB  <-2C89
         ^^^^^^^^
     address prologue

2C90: AE AA AA AB DE AA EA B5
                  ^^^^^
            address epilogue

2C98: FF FF FF FF FF D5 AA AD
                     ^^^^^^^^
                  data prologue

2CA0: 96 96 96 96 96 96 96 96
2CA8: 96 96 96 96 96 96 96 96

                 --^--

Disk Fixer
  setting the address prologue to
  $AA $95 $96, I am able to read all 16
  sectors on track 9, which are empty

Why didn't COPYA work?
  track 9 uses non-standard prologue

Why didn't Locksmith FDB work?
  There could be a run-time check that
  alters the RWTS to read track 9. The
  original disk does not grind during
  boot, which suggests that either the
  RWTS is patched to auto-switch the
  prologue on track 9, or a user mode
  program is patching it temporarily.

EDD worked. What does that tell us?
  no half or quarter tracks
  almost certainly no nibble check
  (just the structural changes to the
   address prologue on track 9)

Next steps:

  1. find the bad-sector check
  2. disable it
  3. declare victory (*)

(*) go to the home gym

                   ~

               Chapter 1
 In Which We Check If We Are Too High
      To Deal With This Right Now


The disk uses a standard DOS 3.3 disk
catalog, but all the files are named
with control characters in them, making
it difficult to access them from third-
party tools.

Copy ][+ "RENAME FILES" fixes that.

Relatedly, Copy ][+ says that the boot
program is named "F" (plus a bunch of
control characters), which is weird
because F is a text file. But that is,
technically, something that DOS 3.3
supported, so maybe it's true.

Thus:

[S6,D1=non-working copy]
[S5,D1=my work disk]

]PR#5
...
]CATALOG,S6

C1983 DSR^C#254
432 FREE

*T 002 F
*B 002 A
*B 058 Y
*B 002 T

]TLIST F

BRUN T,A$800,D1
BRUN AQWADATS\^,A$4000,D1
BRUN YGOTT_^^,A$800,D1

It does appear to be true that this
disk boots to a text file full of DOS
commands. Honestly, I had forgotten
this was even possible in two thousand
twenty two in the year of our Lord.

OK.

"T" is a memory check. The program
requires 32K of memory. No, I'm not
kidding. It uses loads DOS 3.3 master
in low memory, which relocates itself
as high as possible ($9D00+ if you have
at least 48K). This "T" program checks
where DOS ended up and prints an
"INSUFFICIENT MEMORY" error if DOS
isn't high enough.

"A" (plus control characters) prints
the text title page and exits.

That leaves "Y", which is executed from
$800.

                   ~

               Chapter 2
 In Which Our Suspicions Are Confirmed


]BLOAD Y,A$800
]CALL -151

*800L

0800-   4C 5D 21    JMP   $215D

*215DL

215D-   A9 00       LDA   #$00
215F-   85 D7       STA   $D7
2161-   85 EA       STA   $EA
2163-   8D 04 03    STA   $0304
2166-   85 06       STA   $06
2168-   85 07       STA   $07

; more memory stuff (not protection-
; related)
216A-   20 A1 33    JSR   $33A1
216D-   85 EE       STA   $EE
216F-   A9 18       LDA   #$18
2171-   85 23       STA   $23

; set reset vector
2173-   A9 26       LDA   #$26
2175-   8D F2 03    STA   $03F2
2178-   A9 22       LDA   #$22
217A-   8D F3 03    STA   $03F3
217D-   A9 87       LDA   #$87
217F-   8D F4 03    STA   $03F4
2182-   20 4B 31    JSR   $314B

*314BL

314B-   AD D2 03    LDA   $03D2
314E-   30 11       BMI   $3161

; patch RWTS (32K machine)
3150-   A9 AA       LDA   #$AA
3152-   8D 55 89    STA   $8955
3155-   8D 7A 8C    STA   $8C7A
3158-   A9 95       LDA   #$95
315A-   8D 5F 89    STA   $895F
315D-   8D 7F 8C    STA   $8C7F
3160-   60          RTS

; patch RWTS (48K machine)
3161-   A9 AA       LDA   #$AA
3163-   8D 55 B9    STA   $B955
3166-   8D 7A BC    STA   $BC7A
3169-   A9 95       LDA   #$95
316B-   8D 5F B9    STA   $B95F
316E-   8D 7F BC    STA   $BC7F
3171-   60          RTS

Aha! Based on how high DOS is, we are
calculating the addresses within the
RWTS that match the address prologue
nibbles, and changing them to the non-
standard $AA $95 $96 we saw on track 9.
So this is setting up for the read of
the protected track.

Continuing from $2185...

2185-   20 36 32    JSR   $3236
2188-   B0 70       BCS   $21FA

Always a suspicious pattern, especially
after seeing that we've just patched
the RWTS in memory. For completeness, I
confirmed that $21FA prints the error
"ILLEGAL DISC" that I saw earlier.

So we're definitely close.

*3236L

3236-   A0 00       LDY   #$00
3238-   B9 46 32    LDA   $3246,Y
323B-   99 80 03    STA   $0380,Y
323E-   C8          INY
323F-   C0 15       CPY   #$15
3241-   D0 F5       BNE   $3238
3243-   4C 1A 30    JMP   $301A

*301AL

; call the RWTS with the parameters we
; just copied to $0380
301A-   A9 03       LDA   #$03
301C-   A0 80       LDY   #$80
301E-   20 D9 03    JSR   $03D9
3021-   60          RTS

*3243:60

*3236G

*380.

0380- 01 60 01 00 09 00 91 03
                  ^^ ^^
               track/sector

0388- 00 F8 00 00 01 00 00 60
      ^^^^^       ^^
     address   command

0390- 01 00 01 EF D8 1A FF FF

We are reading track 9, sector 0...
into $F800. That's ROM, so nothing
will actually be stored there. But that
answers the question of whether the
program cares about the actual contents
of track 9. It does not. It doesn't
even store the contents; it just checks
if the read succeeded by looking at the
carry flag.

Continuing from $218A...

218A-   20 72 31    JSR   $3172

*3172L

3172-   AD D2 03    LDA   $03D2
3175-   30 0D       BMI   $3184

; restore RWTS (32K machine)
3177-   A9 D5       LDA   #$D5
3179-   8D 55 89    STA   $8955
317C-   8D 7A 8C    STA   $8C7A
317F-   A9 AA       LDA   #$AA
3181-   4C 5A 31    JMP   $315A

; restore RWTS (48K machine)
3184-   A9 D5       LDA   #$D5
3186-   8D 55 B9    STA   $B955
3189-   8D 7A BC    STA   $BC7A
318C-   A9 AA       LDA   #$AA
318E-   4C 6B 31    JMP   $316B

To bypass this protection, I can put
"CLC / RTS" at the start of the routine
at $3236 that tries to read track 9,
fooling the caller into thinking that
the read-with-patched-RWTS always
succeeds.

Turning to my trusty sector editor and
my non-filename-patched-but-still-non-
working-copy, I find the routine on
track $17.

T17,S04,$3A: A000 -> 1860

]PR#6
...boots, and it is glorious...

Quod erat liberandum.

---------------------------------------
A 4am crack                    No. 2864
------------------EOF------------------
