💾 Archived View for mirrors.apple2.org.za › active › 4am › images › games › simulation › Baron%202.1… captured on 2023-05-24 at 23:11:31.
View Raw
More Information
⬅️ Previous capture (2023-01-29)
-=-=-=-=-=-=-
-----------------Baron-----------------
A 4am crack 2015-12-27
---------------------------------------
Name: Baron: The Real Estate Simulation
Version: 2.1
Genre: simulation
Year: 1985
Author: Jim Zuber
Publisher: Blue Chip Software
Media: double-sided 5.25-inch floppy
OS: DOS 3.3
Previous cracks: none (of this version)
Identical cracks:
#506 Millionaire 2.0
Side B boots to a BASIC program that
clears the screen and displays the
error message "WRONG SIDE". So, uh, I
guess I'll start with side A.
~
Chapter 0
In Which Various Automated Tools Fail
In Interesting Ways
COPYA
No read errors on either side, but
the copy boots DOS, runs a startup
program, clears the screen, prints
"Apple ][", swings to a high track,
grinds the disk several times, then
crashes at $AA54.
/!\ Subsequent attempts to boot don't
ever get off track $00. Looking
at the copy in a sector editor,
T00,S00 has been overwritten with a
random chunk of memory.
An actively destructive protection
check. That's not something you see
every day.
Locksmith Fast Disk Backup
ditto
EDD 4 bit copy (no sync, no count)
ditto
Copy ][+ nibble editor
nothing suspicious
Disk Fixer
T00-T02 -> standard DOS 3.3
T11 -> standard disk catalog
T01,S09 -> startup program is "ENTRA"
Why didn't any of my copies work?
There is a runtime protection check
which actively destroys any copies it
doesn't like. (Hint: it doesn't like
any copies.)
Next steps:
1. Trace the startup program
2. Disable the protection check
3. Declare victory(*)
(*) take a nap
~
Chapter 1
In Which We Gain Unfettered Access
And Make The Most Of It
[S6,D1=original disk]
]PR#6
...
<Ctrl-C>
I break to a DOS prompt with unfettered
access.
]CATALOG
DISK VOLUME 254
A 002 ENTRA
B 003 CON
A 002 CDIINC
A 045 BARINIT.BAS
T 038 DATA.RND
T 026 SAVE
T 002 RANDOM.DTA
T 002 GCHAR.DTA
T 002 CHECK
T 004 PLAYER
T 007 MORTGAGE.RND
T 024 Y
]LIST
10 PRINT CHR$ (4);"BLOADCON"
20 CALL 16384
50 PRINT CHR$ (4);"RUNCDIINC"
]BLOAD CON
]CALL -151
AA72- 00 40
; clear screen and print "Apple ]["
4000- 18 CLC
4001- 20 58 FC JSR $FC58
4004- A9 C1 LDA #$C1
4006- 8D 0F 04 STA $040F
4009- A9 F0 LDA #$F0
400B- 8D 10 04 STA $0410
400E- 8D 11 04 STA $0411
4011- A9 EC LDA #$EC
4013- 8D 12 04 STA $0412
4016- A9 E5 LDA #$E5
4018- 8D 13 04 STA $0413
401B- A9 DD LDA #$DD
401D- 8D 15 04 STA $0415
4020- A9 DB LDA #$DB
4022- 8D 16 04 STA $0416
4025- 4C A0 40 JMP $40A0
; set up... something
40A0- A9 23 LDA #$23
40A2- 85 02 STA $02
40A4- A9 00 LDA #$00
40A6- 85 03 STA $03
40A8- A9 01 LDA #$01
40AA- 85 04 STA $04
40AC- 20 28 40 JSR $4028
; get the address of the RWTS parameter
; table
4028- 20 E3 03 JSR $03E3
402B- 84 00 STY $00
402D- 85 01 STA $01
; track = $23 (set at $40A2)
402F- A5 02 LDA $02
4031- A0 04 LDY #$04
4033- 91 00 STA ($00),Y
; sector = $00 (set at $40A6)
4035- A5 03 LDA $03
4037- C9 10 CMP #$10
4039- 90 04 BCC $403F
403B- A9 00 LDA #$00
403D- 85 03 STA $03
403F- A0 05 LDY #$05
4041- 91 00 STA ($00),Y
4043- A0 08 LDY #$08
4045- A9 00 LDA #$00
4047- 91 00 STA ($00),Y
4049- C8 INY
404A- A9 0A LDA #$0A
404C- 91 00 STA ($00),Y
; RWTS command = $01 (set at $40AA)
404E- A5 04 LDA $04
4050- A0 0C LDY #$0C
4052- 91 00 STA ($00),Y
4054- A9 00 LDA #$00
4056- A0 03 LDY #$03
4058- 91 00 STA ($00),Y
405A- 20 E3 03 JSR $03E3
; read it
405D- 20 D9 03 JSR $03D9
4060- A9 00 LDA #$00
4062- 85 48 STA $48
; if the read worked, branch forward
4064- 90 1B BCC $4081
; read failed, off to The Badlands!
4066- 4C D0 40 JMP $40D0
...
4081- 60 RTS
The protection check is reading track
$23 -- an extra track that is normally
unused. All of my copies stopped at
track $22, which explains why they all
failed.
; corrupt part of DOS in memory
40D0- A9 00 LDA #$00
40D2- 8D 00 A0 STA $A000
40D5- EE D3 40 INC $40D3
40D8- AD D3 40 LDA $40D3
40DB- C9 FF CMP #$FF
40DD- D0 F1 BNE $40D0
; track = $00
; sector = $00
; RWTS command = $02 (write!)
40DF- A9 00 LDA #$00
40E1- 85 02 STA $02
40E3- 85 03 STA $03
40E5- A9 02 LDA #$02
40E7- 85 04 STA $04
40E9- A9 F6 LDA #$F6
40EB- 8D 67 40 STA $4067
40EE- A9 10 LDA #$10
40F0- 8D 68 40 STA $4068
40F3- 20 28 40 JSR $4028
After the protection check fails, it
intentionally overwrites T00,S00.
; clear all of this out of memory
; (up to the previous instruction)
40F6- A9 00 LDA #$00
40F8- 8D 00 40 STA $4000
40FB- EE F9 40 INC $40F9
40FE- AD F9 40 LDA $40F9
4101- C9 F5 CMP #$F5
4103- D0 F1 BNE $40F6
; crash
4105- 4C 3E AA JMP $AA3E
That explains the behavior I saw on my
non-working copy.
Continuing from $40AF...
; check the data we actually read from
; track $23, sector $00
40AF- AD 00 0A LDA $0A00
40B2- C9 00 CMP #$00
40B4- F0 03 BEQ $40B9
; first byte doesn't match, off to
; The Badlands!
40B6- 4C D0 40 JMP $40D0
; execution continues here (from $40B4)
40B9- AD 01 0A LDA $0A01
40BC- C9 00 CMP #$00
40BE- F0 03 BEQ $40C3
; second byte doesn't match, off to
; The Badlands!
40C0- 4C D0 40 JMP $40D0
; execution continues here (from $40BE)
40C3- AD 02 0A LDA $0A02
40C6- C9 00 CMP #$00
40C8- F0 03 BEQ $40CD
; third byte doesn't match, off to
; The Badlands!
40CA- 4C D0 40 JMP $40D0
; execution continues here (from $40C8)
40CD- 4C 08 41 JMP $4108
...
; exit gracefully
4108- 60 RTS
So this entire routine is unnecessary.
Well, it clears the screen and prints
"Apple ][". But everything after the
the JMP at $4025 is just the protection
check.
[S6,D1=fresh (uncorrupted) copy]
[Disk Fixer]
["D" for directory mode]
[select "CON"]
T13,S0E,$29 change "4C" to "60"
Quod erat liberandum.
---------------------------------------
A 4am crack No. 542
------------------EOF------------------