Read and rhyme IIgs (Unicorn, 1988)

[toinet]

#822 - This is a early eduware from Unicorn, kindly sent by 4am. Thanks to a great user interface with four different games, children will learn how to find rhyming words.

Protection type
The two disks can be copied but when the first is booted, a yellow-background pic displays: BAD DISK. It seems there are hidden bits or a track length somewhere.

How to copy
Use ZZCopy or Photonix II to copy both sides. Then, store them in a dry and safe place.

Let's follow the code
This is a SYS16 application, named RHYME.SYS16. It is a compiled program with three segments: CODE, GLOBALS, and ARRAYS. That is clear. Paths are hardcoded. In segment 3, there is a table of pointers to file names at $1EB. And there is one file named FSBAD. OK, that seems clear. That file is loaded if the protection fails.
Going back to the CODE segment, we find that parameter $F4 stores the index of the filename before ASL ASL it (or x4 because long is 32 bits) and getting the pointer from the above table.
Now, we'll look for the use of $F4. We find numerous calls (because parameters are sent through the stack and the direct page is set at the beginning of each call to the first parameter in the stack).
The one that interests us is at $174F. There is one parameter pushed onto the stack, then a call to $8614, then the result is stored at $F4 and a comparison is performed. If the result is zero, then the routine at $20FD is called, otherwise it goes to $1758 and calls $1BEE.
At $20FD, we find that the code loads the FSBAD file and performs an infinite loop (BRA to self, or 80 FE).
OK, we have found the check, the protection check address.
At $8614, after some analysis, we find the usual track length check. It returns with a 0 if this is a copy or #$FF if we have the original.
Hooray, we have it. We will now replace the JSL with a LDAL and that will be sufficient because the check is 0 or non-zero. Putting a LDAL will return a non zero value (not FF but non-zero) and that is sufficient. We know we will never have a zero value at $8614 otherwise it would be seen as a BRK opcode and the call would crash the program.

How to crack
Launch Block.Warden and...

[toinet]

And some code

[toinet]

And the Block.Warden view