TOY SHOP

[.]

Est-ce que quelqu'un a déjà vu une version 16 secteurs de ce logiciel signé Br0derbund?

Sur la seule version en ma possession (héritage The White Man), le boot indique que Numéro 6 est passé par là MAIS la disquette n'est pas copiable au Locksmith fast copy (pas plus que les 2 datas disks).

Normalement certains produits Br0derbund propose de s'autocopier 1 fois par original (il faut appuyer sur ESC au boot). J'imagine que dans ce cas (par facilité), N°6 a fait sauter cette limite en autorisant la copie multiple MAIS ce n'est pas un crack à proprement parlé.

Quelqu'un a mieux?

JM

[toinet]

Je ne connaissais pas ce soft, je suis allé googler un petit peu, le principe de sortir sur papier les formes d'un jouet à assembler.

http://free-game-downloads.mosw.com/abandonware/pc/puzzle_games/games_t/toy_shop_the.html

Ce truc est peut-être sans intérêt sans la boîte, d'où le "crack" minimaliste de n°6.

Mais bon, je me bien l'ajouter sur ma liste au Père Noël

antoine

[.]

En fait ma question est toujours liée à l'interview de Z.
Il disait sur un de ses cracks que le prochain serait Toy Shop.
Pas de chance, j'ai pas!
De plus sur le crack de numéro 6, quand je fais ESC pour aller sur le copieur intégré ça ne semble pas fonctionner
Soit la disquette a des "secteurs" HS soit le copieur est sur la piste $23 (je sais que mon disk II principal n'y arrive pas).

Si tu veux jouer avec les 3 disks de TWM, c'est dispo (attn: ce n'est pas un original mais bien une copie plombée).
J'ai juste booté: ça semble démarrer.
Pour le reste je sais qu'il y a eu 2 infos de cracks sur Computist (détail sur comp.sys.apple2).

Il y a 1 mec qui en vend 1 sur ebay. Mais c'est un spécialiste des tarifs débiles. Ca doit pas être loin des 70 USD en achat immédiat (seule solution proposée). Il a des trucs rares mais à 250 dollars le soft, je préfère encore un restau gastronomique du guide michelin...

JM

[JPL]

[toinet]

Oh, je possède un original de Toy Shop que j'ai acheté il y a quelques mois maintenant.

Une next step : jouer avec (comme Hold-Up, Mandragore, etc.)

Toto

[toinet]

First shot on Toy Shop, (c) 1986, Broderbund...

The package contains three disks (I will not enter into the details of the rest of the package, there are numerous items to create things)

- Master disk:
side 1:
T0: standard
T1-4: non standard
T5-1B: standard
T1C-22: non standard
side 2:
T0-8: non standard
T9-15: standard
T16-22: non standard

- Toy disk 1:
Two non standard sides

- Toy disk 2:
Two non standard sides

It seems there are no extra tracks!
Why would it be a pain? Because it is a Broderbund title... Broderbund was well-known for using a 18-sec disk scheme and we if have to deal with such a protection, finding room would be really difficult!

[toinet]

First, you gather the boot data:
*9600<C600.C6FFM
*96FB:20 FDDA AD C0E8 60 (I use an Apple IIgs)
*9600G
01 (motor stops)

A disassembly of the boot 1 area at $0800 shows that the next boot stage can be interrupted before jumping to $6800

*96FB:A9 59 8D 84A A9 FF 8D 84B 4C 801
*9600G
(beep)
*C0E8

The code in memory is now:
- 1000.10FF
- 6800.6CFF
- 0800.08FF (the boot block)

A disassembly of the $6800 area shows the *usual* 18-sec protection. The commands are the following. They are passed through the stack:
- 00: turn motor on
- 01: turn motor off
- 02: move arm
- 03: read entire 18-sec track
- 04: read 18-sec track sector/sector

Some addresses:
- 6803: read sector data (A5 data D4)
- 687F: main entry point of read track
- 68C2: read header data (D5 9D TT SS CC AA) where TT is the track number, SS the sector and CC the checksum
- 696C: move arm

I will provide the commented disassembly of that 18-sec RWTS later on...

Antoine

[toinet]

Let's play with the memory organization of the master disk, side 1:

[qkumba]

T21: F2 F3 F4 F5 F6 F7 F8 F9 FA FB FC FD FE FF <= 4 useless sectors

I have not found any read of track 22 yet.

[qkumba]

T1D-1F loads a DOS 3.3. The VTOC at T11 S00 is fake, and points to T11 S01 with the credits catalog. The real VTOC is at T11 S02 and points to T11 S0F with real files that are BLOADed.

[toinet]

Oh, very nice, Peter.
Agreed on DOS loaded from tracks 1D+, load @ seem similar to the DOS 3.3 memory space.

I should add here the simple track loader I wrote to get all tracks in memory to then write them to files.

Apart from the master disk side 1 where I'm sure everything can be put on a standard 16 sec side, there are two options for full 18-sec sides:
- use two disks (first 16 sectors on drive 1, 2 remaining sectors on drive 2) but I think the program allows the use of two floppies
- dig into the disks and see whether 18 sectors are really used, preventing us from changing to 16-sec.

Time is missing...
antoine

[qkumba]

T22 is not formatted
T00: 08 68 69 6A 6B 6C
the other sectors contain unused data from a previously formatted DOS disk. :-)

The master side B has DOS 3.3 file system, too, along with some 18 sector tracks. I don't know if they are used.
I can't get it to read the data disks, either. If I "load from disk", it expects a DOS 3.3 disk, like the ones that it creates when you save a toy. Is there another menu option to read the 18 sector data disks?

[qkumba]

Funny. We don't need more disks, and we don't need any tricks.
Look at it this way:

sec 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11
trk adr
00 08 68 69 6a 6b 6c
01 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31
02 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f
03 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51
04 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f

1c 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19
1d 1a 1b 1c 1d 1e 1f 9a 9b 9c 9d 9e 9f a0 a1 a2 a3 a4
1e a5 a6 a7 a8 a9 aa ab ac ad ae af b0 b1 b2 b3 b4 b5 b6
1f b7 b8 b9 ba bb bc bd be bf d0 <- this one (d0) is master side A copy protection routine (I'll describe later)
20 e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef f0 f1
21 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff

now let's move some sectors:

00 08 68 69 6a 6b 6c
01 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f
02 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f
03 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f
04 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f

1c 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17
1d 18 19 1a 1b 1c 1d 1e 1f 9a 9b 9c 9d 9e 9f a0 a1
1e a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af b0 b1
1f b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf e0 e1
20 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef f0 f1
21 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff

it fits, no problem.
Master side A copy protection is that track 21 is read 3 times, like this:
read track 21;
phase 3 is turned on then off;
read track again;
phase 0 is turned on then off;
read track again.
Any failure to read will result in a hang.
I don't understand what is intended here, though. Is that track 21.5 or something?

Master side B copy protection is that 8 sectors are read from two randomly-chosen but sequential 18-sector tracks, and the contents are trivially inspected (only 3 bytes compared). This is also done three times. This check can be skipped, the data are not used for anything.

And those data disks? Free disks for saving toys. They have no other purpose, and saving is only DOS 3.3 format, no 18 sector tracks there.

[toinet]

Very good, Peter, you have found room for the extra sectors, now let's rewrite them at the right place.

When you write "data disks are 16-sec sides", do you mean the double-sided Toy disks or others?

The two Toy disks seem to be in 18-sec format, aren't they?
av

[qkumba]

I spoke too soon - the master side B "copy protection" is reading the graphics for the decals and fonts. I didn't try all of the options before I posted. My mistake.
What I thought was a "random" read simply depends on which toy is selected at the time.
Now I see 18-sector reads from T16S00-T22S0B on side B, requiring 22 spare sectors to be found.
Interestingly, prtoy contains the 18-sector read routines, but I don't see it used anywhere. Maybe it's part of the printing process, but I have no printer to confirm.

Regarding the data disks, if you ask Toy Shop to create a data disk for saving, it will format in 16-sector DOS 3.3, and save the images as files.
I still have not found any option that will read the 18-sector data disks.