Transat (No man's land, 1984)

[toinet]

A French software from 1984, written by Jean-Marc Sornin. Come aboard, we're expecting you... Oops! Cross the Atlantic ocean from La Rochelle to Halifax. An old software written in Applesoft.

I have to admit that I have been unable to crack the software at the end of the 80's. Whatever I tried, it failed! I was close to stop working on that software until I tried the basic direct reading of the diskette through the RWTS...


PROTECTION TYPE
On a standard DOS 3.3 diskette:
- markers have been changed (D5 AA 96, F2 AA, AA/D5 D5/AA AD, F2 AA)
- data field routine changes depending on the track
- DOS 3.3 commands have been renamed or deactivated


BOOT TRACE
- 9600<C600.C6FFM
- 96FB: 4C 59 FF
- 9600G
Ah! we have a standard DOS 3.3 boot0 at $0800
- 96FB: A9 4C 8D 4A 08 A9 59 8D 4B 08 A9 FF 8D 4C 08 4C 01 08
- 9600G
Bingo, we have a RWTS from $B600 to $BFFF.

The RWTS entry point at $BD00 redirects to $BEC2. Then, depending on the track the head is over, the markers (DE or F2) and data read routine are changed then execution is given to $BD04.

At $BF24, we get the same inits found at $BEC2 but with no data read routine changes or whatever. That may interest us in a near future...

The data read routine at $BF75 reads the first markers from the drive (D5 AA AD or AA D5 AD), then it reads extra nibbles and finally read the standard 342 nibbles. Quite weird!


DISK COPY
As I have been unable to use Advanced Demuffin or similar products, I have written a short program at $0300 that performed track-per-track reads using the program RWTS and moves to my IIgs memory.

As the program is trivial, I will not detail it (read one track, copy to memory, loop until track $23)

As the RWTS is sort-of a standard one, I presume the code of the RWTS checks that its parameter table must be in $B7xx so that other disk copiers with their own table are unable to copy the disk. I see no other explanation.


PROTECTION REMOVAL
Now that the disk is copied, we must invalidate the call to the protection (the one that changes the data read routine and so on...), if you remember well:
- whenever you call $BD00, a JMP is performed at $BEC2
- at $BF24, we have a code equivalent to $BEC2 with no change in the data read routine.
=> Why don't we change the JMP $BEC2 with JMP $BF24 and try?

- Launch my favorite disk editor
- Read T0/S7
- At offsets $01/$02, change C2 BE with $24 BF
- Save and test...


Oh, my backup copy works well...

Toinet

nb. the CATALOG command has been renamed DIR...

[toinet]

Tiens, tiens, en lisant la partie consacr�e au cracking & hacking du site, je suis tomb� sur la rubrique EDD IV et ses extra-bits.

La routine de lecture de Transat semble utiliser la m�me m�thode, j'y ai trouv� les m�mes

[Deckard]

[JPL]