|
|
|
IDENTIFICATION SERVEUR : 10.0.97.1 - CLIENT : 54.166.141.12 |
|
| Voir le sujet précédent :: Voir le sujet suivant |
| Auteur |
Message |
toinet
Site Admin
Inscrit le: 15 Juin 2007
Messages: 2928
Localisation: Le Chesnay, France
|
 Posté le: Jeu 23 Juin 2016, 14:31 Sujet du message: Logic builders (Scholastic, 1984) |
 |
|
#883 - Five friendly spiders who make problem solving simple. Ages 7 to adult. Learning opportunities: logic builders reinforces problem-solving and planning skills. It also sharpens memory, attention to detail, and pattern recognition.
Disk format
We have a non-standard 16-sec disk. Locksmith Fast Disk Backup says all sectors cannot be read. It seems we have a change of epilog markers only.
Copy II Plus, the bit editor, shows no extra track but shows that tracks 1 and 2 contain the value 0 for the track, the value is encoded in 4*4 in the sequence D5AA96 VV VV TT TT SS SS CC CC where VV is the volume number, TT the track, SS the sector, CC the checksum.
Some boot trace
We enter our usual
| Code: |
CALL -151
9600<C600.C6FFM
96FB: 20 FDDA 60 (coz we're on a IIgs)
9600G
01
*
|
The analysis of T0/S0 shows a different interleaving table. This is important for copying the tracks. See below for the values. The code uses the controller ROM to load the sectors, so, no big deal, if the controller ROM can do it, our DOS 3.3 RWTS can also. That's a good point for our disk copy.
Sectors are loaded at $900, then at $400 then executed at $473 (see the pushed values #$4 and #$72 in the code). There (it is on T0/SE), we move code to $200 and execute it. The code comes from T0/SF and is another protection check: desync values. It desyncs the head, reads hidden nibbles, if they match, the code returns or reboots if we have a copy.
Let's summarize
We have a change of markers:
- D5AA96 FFFF for the address field
- D5AAAD FFFF for the data field
- T0-TS2 record 0 as the track number (for T0, that's normal, not for tracks 1&2)
- a different interleaving table
- a desync protection check
Let's go then...
How to copy
We have a //gs. We will use its memory and put two RWTS in memory.
At $10/B700, a standard one.
At $20/B700, one that matches the track 0 wherever the head is.
Note that the code in the RWTS that checks if we are on the right track (requested track vs the one read from the disk) is at $BDEF. By default, it compares the read value from the disk with the value in $478. On our modified RWTS, we must tell it that we are in track 0, always, thus the C0 00 EA for CPY #$00 NOP code.
So boot my copy disk and:
| Code: |
// 0. Oops! Forgot the disk copy
Launch Advanced demuffin 1.4
Enter the monitor
B930:18 60 EA
B98B: 18 60 EA
Press control-Y
Format a blank disk in drive 2
Insert Logic builders in drive 1
Copy T3/S0 to T22/SF
// 1. We create our RWTS
Reboot my copy disk
Launch Mobby Disk II (because it has a powerful read/write track feature)
Press Control-E / SPC / SPC to enter the monitor
10/B700<00/B700.BFFFM
20/B700<00/B700.BFFFM
20/
BDEF:C0 00 EA
BFB8: 0 3 5 7 9 B D F 2 4 6 8 A C E 1
// 2. We read the original tracks
Press control-Y
Insert a standard DOS 3.3 disk in drive 1
Read T0/S0
Press Control-E / SPC / SPC to enter the monitor
00/B700<20/B700.BFFFM
Press Control-Y
Insert Logic builders in drive 1
Read T0/S0
Press Control-Down arrow to read the entire track
Insert a standard DOS 3.3 disk in drive 1
Press Control-E / SPC / SPC to enter the monitor
00/B700<10/B700.BFFFM
Press Control-Y
Read T1/S0
Press Control-E / SPC / SPC to enter the monitor
00/B700<20/B700.BFFFM
Press Control-Y
Insert Logic builders in drive 1
Press > to move the buffer to $5000
Read T1/S0
Press Control-Down arrow to read the entire track
Insert a standard DOS 3.3 disk in drive 1
Press Control-E / SPC / SPC to enter the monitor
00/B700<10/B700.BFFFM
Press Control-Y
Read T2/S0
Press Control-E / SPC / SPC to enter the monitor
00/B700<20/B700.BFFFM
Press Control-Y
Insert Logic builders in drive 1
Press > to move the buffer to $6000
Read T2/S0
Press Control-Down arrow to read the entire track
// 3. We save the read tracks
Press Control-E / SPC / SPC to enter the monitor
00/B700<10/B700.BFFFM
Press Control-Y
Type D to switch to Drive 2
You have your copy of Logic builders in drive 2
Write T0/S0 (the buffer is set to $4000 by default)
Now press Control-W three times to write tracks 0, 1 and 2.
|
Eh... you're done. That could have be automatized but that's for fun!
Normalize the disk
Boot my copy disk
Launch Disk Fixer and perform the following changes:
| Code: |
T0/S0/8E // normalize interleaving table
00 03 05 07 09 0B 0D 0F 02 04 06 08 0A 0C 0E 01
00 0D 0B 09 07 05 03 01 0E 0C 0A 08 06 04 02 0F
T0/SE/63 // normalize interleaving table
00 03 05 07 09 0B 0D 0F 02 04 06 08 0A 0C 0E 01
00 0D 0B 09 07 05 03 01 0E 0C 0A 08 06 04 02 0F
T0/SE/34: 36 -> D0 // change move arm address
T0/SE/9B: 20 -> 2C // skip desync check
T0/SE/D0: E6 41 20 36 04 60 // new move arm routine
We must increment $41, used in the controller ROM
to check the track we are on.
T2/SC/AE: FF -> DE // normalize marker
T2/SC/B3: FF -> AA // normaler marker
|
You're done.
The disk image is available at http://www.brutaldeluxe.fr/crack/
Reboot and... enjoy,
LoGo
6/2016
Dernière édition par toinet le Jeu 23 Juin 2016, 14:57; édité 2 fois |
|
| Revenir en haut de page |
|
 |
toinet
Site Admin
Inscrit le: 15 Juin 2007
Messages: 2928
Localisation: Le Chesnay, France
|
| Posté le: Jeu 23 Juin 2016, 14:32 Sujet du message: |
|
|
The loading code at $400
| Code: |
0400:A6 2B LDX $2B ; read sector from ROM
0402:6C 3E 00 JMP ($003E)
0405:20 0E 04 JSR $040E ; read track
0408:20 0E 04 JSR $040E ; read track
040B:20 0E 04 JSR $040E ; read track
040E:20 33 04 JSR $0433 ; move arm
0411:A2 0F LDX #$0F
0413:A0 00 LDY #$00
0415:85 27 STA $27
0417:E8 INX
0418:86 49 STX $49
041A:84 F9 STY $F9
041C:98 TYA
041D:24 4A BIT $4A
041F:30 03 BMI $0424
0421:B9 63 04 LDA $0463,Y
0424:85 3D STA $3D
0426:20 00 04 JSR $0400
0429:A4 F9 LDY $F9
042B:C8 INY
042C:C4 49 CPY $49
042E:90 EA BCC $041A
0430:A5 27 LDA $27
0432:60 RTS
0433:20 D0 04 JSR $04D0 ; was JSR $436 to move 1/2 track
0436:48 PHA ; run twice means move 1 track
0437:98 TYA
0438:48 PHA
0439:A5 FC LDA $FC
043B:85 FD STA $FD
043D:E6 FC INC $FC
043F:A5 FC LDA $FC
0441:29 03 AND #$03
0443:0A ASL
0444:05 2B ORA $2B
0446:A8 TAY
0447:B9 81 C0 LDA $C081,Y
044A:A9 30 LDA #$30
044C:20 A8 FC JSR $FCA8
044F:A5 FD LDA $FD
0451:29 03 AND #$03
0453:0A ASL
0454:05 2B ORA $2B
0456:A8 TAY
0457:B9 80 C0 LDA $C080,Y
045A:A9 30 LDA #$30
045C:20 A8 FC JSR $FCA8
045F:68 PLA
0460:A8 TAY
0461:68 PLA
0462:60 RTS
0463:00 BRK ; the interleaving table
0464:0D 0B 09 ORA $090B
0467:07 @@@
0468:05 03 ORA $03
046A:01 0E ORA ($0E,X)
046C:0C 0A 08 TSB $080A
046F:06 04 ASL $04
0471:02 @@@
0472:0F @@@
0473:46 4A LSR $4A ; the entry point of the code
0475:20 A5 04 JSR $04A5
0478:A6 2B LDX $2B
047A:8E E9 B7 STX $B7E9
047D:20 8E BE JSR $BE8E
0480:A5 FC LDA $FC
0482:99 78 04 STA $0478,Y
0485:4A LSR
0486:8D 78 04 STA $0478
0489:A0 00 LDY #$00 ; move code to $200
048B:B9 00 05 LDA $0500,Y ; this is the desync
048E:99 00 02 STA $0200,Y ; protection check
0491:88 DEY
0492:D0 F7 BNE $048B
0494:A9 B7 LDA #$B7
0496:A0 E8 LDY #$E8
0498:20 B5 B7 JSR $B7B5
049B:2C 00 02 BIT $0200 ; it was JSR to check the desync
049E:A9 B7 LDA #$B7
04A0:48 PHA
04A1:A9 01 LDA #$01
04A3:48 PHA
04A4:60 RTS
04A5:A9 A0 LDA #$A0
04A7:4C 0B 04 JMP $040B
04AA:01 01 ORA ($01,X)
04AC:01 01 ORA ($01,X)
04AE:01 01 ORA ($01,X)
04B0:00 BRK
04B1:01 42 ORA ($42,X)
04B3:42 @@@
04B4:42 @@@
04B5:42 @@@
04B6:42 @@@
04B7:42 @@@
04B8:42 @@@
04B9:42 @@@
04BA:42 @@@
04BB:42 @@@
04BC:01 01 ORA ($01,X)
04BE:01 01 ORA ($01,X)
04C0:01 01 ORA ($01,X)
04C2:01 40 ORA ($40,X)
04C4:40 RTI
04C5:40 RTI
04C6:40 RTI
04C7:40 RTI
04C8:40 RTI
04C9:00 BRK
04CA:00 BRK
04CB:00 BRK
04CC:00 BRK
04CD:00 BRK
04CE:00 BRK
04CF:00 BRK
// Our new code to increment $41 and tell
// the controller ROM on which track we are
04D0:E6 41 INC $41
04D2:20 36 04 JSR $0436
04D5:60 RTS
04D6:00 BRK
04D7:00 BRK
|
|
|
| Revenir en haut de page |
|
|
toinet
Site Admin
Inscrit le: 15 Juin 2007
Messages: 2928
Localisation: Le Chesnay, France
|
| Posté le: Jeu 23 Juin 2016, 14:32 Sujet du message: |
|
|
The desync protection check
| Code: |
0200:A9 0A LDA #$0A
0202:85 2A STA $2A
0204:AE E9 B7 LDX $B7E9 ; turn drive on
0207:BD 89 C0 LDA $C089,X
020A:BD 8E C0 LDA $C08E,X
020D:A9 AC LDA #$AC ; our table of desync values
020F:85 48 STA $48 ; is at $02AC
0211:A9 02 LDA #$02
0213:85 49 STA $49
0215:A9 80 LDA #$80 ; number of tries
0217:85 2B STA $2B
0219:C6 2B DEC $2B
021B:F0 5B BEQ $0278
021D:20 44 B9 JSR $B944 ; read
0220:B0 56 BCS $0278
0222:A5 2D LDA $2D ; on sector #$D?
0224:C9 0D CMP #$0D
0226:D0 F1 BNE $0219
0228:A0 00 LDY #$00 ; launch the check then
022A:BD 8C C0 LDA $C08C,X
022D:10 FB BPL $022A
022F:88 DEY
0230:F0 46 BEQ $0278
0232:C9 D5 CMP #$D5 ; first nibble
0234:D0 F4 BNE $022A
0236:A0 00 LDY #$00
0238:BD 8C C0 LDA $C08C,X ; read nibbles
023B:10 FB BPL $0238
023D:88 DEY
023E:F0 38 BEQ $0278
0240:C9 E7 CMP #$E7
0242:D0 F4 BNE $0238
0244:BD 8C C0 LDA $C08C,X
0247:10 FB BPL $0244
0249:C9 E7 CMP #$E7
024B:D0 2B BNE $0278
024D:BD 8C C0 LDA $C08C,X
0250:10 FB BPL $024D
0252:C9 E7 CMP #$E7
0254:D0 22 BNE $0278
0256:BD 8D C0 LDA $C08D,X ; lose time
0259:A0 10 LDY #$10
025B:24 06 BIT $06
025D:BD 8C C0 LDA $C08C,X ; read nibble
0260:10 FB BPL $025D
0262:88 DEY
0263:F0 13 BEQ $0278
0265:C9 EE CMP #$EE
0267:D0 F4 BNE $025D
0269:A0 07 LDY #$07 ; do we have our desync values
026B:BD 8C C0 LDA $C08C,X
026E:10 FB BPL $026B
0270:D1 48 CMP ($48),Y
0272:D0 04 BNE $0278 ; no, next try
0274:88 DEY
0275:10 F4 BPL $026B
0277:60 RTS ; yes, just return...
0278:C6 2A DEC $2A ; next try
027A:D0 99 BNE $0215
027C:A2 22 LDX #$22 ; we're bad
027E:BD 89 02 LDA $0289,X ; copy code
0281:95 00 STA $00,X
0283:CA DEX
0284:10 F8 BPL $027E
0286:4C 00 00 JMP $0000 ; execute it
0289:A0 01 LDY #$01 ; we clear RAM
028B:84 4F STY $4F ; and reboot
028D:88 DEY
028E:84 4E STY $4E
0290:98 TYA
0291:91 4E STA ($4E),Y
0293:88 DEY
0294:D0 FB BNE $0291
0296:E6 4F INC $4F
0298:F0 0C BEQ $02A6
029A:A5 4F LDA $4F
029C:C9 C0 CMP #$C0
029E:D0 F1 BNE $0291
02A0:A9 D0 LDA #$D0
02A2:85 4F STA $4F
02A4:D0 EB BNE $0291
02A6:AD 81 C0 LDA $C081
02A9:6C FC FF JMP ($FFFC)
02AC:FC @@@ ; the desync values
02AD:EE EE FC INC $FCEE
02B0:E7 @@@
02B1:EE FC E7 INC $E7FC
|
|
|
| Revenir en haut de page |
|
|
|
|
Vous ne pouvez pas poster de nouveaux sujets dans ce forum
Vous ne pouvez pas répondre aux sujets dans ce forum
Vous ne pouvez pas éditer vos messages dans ce forum
Vous ne pouvez pas supprimer vos messages dans ce forum
Vous ne pouvez pas voter dans les sondages de ce forum
|
|
FAQ 
Rechercher 
Liste des Membres 
Groupes d'utilisateurs
S'enregistrer
Profil 
Se connecter pour vérifier ses messages privés 
Connexion 
