💾 Archived View for mirrors.apple2.org.za › active › 4am › images › games › action › Succession%20(4… captured on 2023-01-29 at 06:59:17.
-=-=-=-=-=-=-
---------------Succession--------------
A 4am crack 2015-08-17
---------------------------------------
Name: Succession
Genre: arcade
Year: 1982
Authors: Chris Eisnaugle
Publisher: Piccadilly Software, Inc.
Media: single-sided 5.25-inch floppy
OS: custom with DOS 3.3 bootloader
Previous cracks:
Super Pirates of Minneapolis ("short
version from Black Bag")
~
Chapter 0
In Which Various Automated Tools Fail
In Interesting Ways
COPYA
immediate disk read error, but it
gets a participation medal just for
showing up
Locksmith Fast Disk Backup
unable to read any track
EDD 4 bit copy (no sync, no count)
works
Copy ][+ nibble editor
T00-T08 -> modified address epilogue
("DE D5 EB" instead of "DE AA EB")
T09+ unformatted
Disk Fixer
["O" -> "Input/Output Control"]
set Address Epilogue to "DE D5 EB"
Success! T00-T08 readable
T00 -> looks like a DOS 3.3 RWTS
No sign of the rest of DOS though
No disk catalog on any track
Why didn't COPYA work?
modified address epilogues
Why didn't Locksmith FDB work?
modified address epilogues
EDD worked. What does that tell us?
no half or quarter tracks
probably no nibble check
just structural changes (epilogue)
Next steps:
1. capture RWTS with AUTOTRACE
2. convert disk to standard format
with Advanced Demuffin (tracks
$00-$08 only)
3. patch RWTS (if necessary)
~
Chapter 1
In Which We Attempt To Use The Original
Disk As A Weapon Against Itself
And It Goes As Well As Can Be Expected
[S6,D1=original disk]
[S6,D2=blank disk]
[S5,D1=my work disk]
]PR#5
CAPTURING BOOT0
...reboots slot 6...
...reboots slot 5...
SAVING BOOT0
CAPTURING BOOT1
...reboots slot 6...
...reboots slot 5...
SAVING BOOT1
SAVING RWTS
]BRUN ADVANCED DEMUFFIN 1.5
["5" to switch to slot 5]
["R" to load a new RWTS module]
--> At $B8, load "RWTS" from drive 1
["6" to switch to slot 6]
["C" to convert disk]
[press "Y" to change default values]
--v--
ADVANCED DEMUFFIN 1.5 (C) 1983, 2014
ORIGINAL BY THE STACK UPDATES BY 4AM
=======================================
INPUT ALL VALUES IN HEX
SECTORS PER TRACK? (13/16) 16
START TRACK: $00
START SECTOR: $00
END TRACK: $08 <-- change this
END SECTOR: $0F <-- change this
INCREMENT: 1
MAX # OF RETRIES: 0
COPY FROM DRIVE 1
TO DRIVE: 2
=======================================
16SC $00,$00-$08,$0F BY$01 S6,D1->S6,D2
--^--
[press RETURN to start conversion]
--v--
ADVANCED DEMUFFIN 1.5 (C) 1983, 2014
ORIGINAL BY THE STACK UPDATES BY 4AM
=======PRESS ANY KEY TO CONTINUE=======
TRK:.........
+.5:
0123456789ABCDEF0123456789ABCDEF012
SC0:.........
SC1:.........
SC2:.........
SC3:.........
SC4:.........
SC5:.........
SC6:.........
SC7:.........
SC8:.........
SC9:.........
SCA:.........
SCB:.........
SCC:.........
SCD:.........
SCE:.........
SCF:.........
=======================================
16SC $00,$00-$08,$0F BY1.0 S6,D1->S6,D2
--^--
[S6,D1=demuffin'd copy]
]PR#6
...reboots endlessly...
Interesting. On the one hand, it would
not surprise me if the demuffin'd disk
couldn't read itself without patching.
But with a DOS 3.3-shaped RWTS, that
manifests itself as grinding (as the
RWTS assumes a disk read error can be
solved by resynchronizing to track $00
and back again).
Perhaps the RWTS has been modified to
immediately give up on any read error.
Or perhaps there is a nibble check
after all. But that would surprise me,
since my EDD bit copy worked.
~
Chapter 2
In Which We Are Surprised
If the RWTS needs patching, my Post-
Demuffin Patcher can probably fix it
automatically. As I recall from my
investigations with a nibble editor,
there was only one change to the
address epilogue.
]PR#5
...
]BRUN PDP
T00,S03,$9B change D5 to AA
(As expected, PDP fixed the RWTS check
for address epilogue nibble #2.)
]PR#6
...loads title then beeps endlessly...
That is most definitely progress. A
minute ago, my copy didn't even load
the title screen.
Possible explanations:
- The disk has 2 RWTSs, and it switches
to the second one after loading the
title screen. (Up'N' Down does this.)
- I didn't convert all the tracks. I
thought T09+ were unformatted, but
maybe I missed one. If the game has
some sort of checksum on the code, it
would fail because some of the code
is missing. (Spy Hunter does this.)
- There really is a nibble check, but
it's weak enough that an EDD bit copy
fools it.
When in doubt, trace the boot.
]PR#5
...
]BLOAD BOOT0,A$800
]CALL -151