💾 Archived View for mirrors.apple2.org.za › active › 4am › images › games › action › Donkey%20Kong%2… captured on 2023-07-10 at 19:14:50.
⬅️ Previous capture (2023-01-29)
-=-=-=-=-=-=-
--------------Donkey Kong--------------
A 4am crack 2015-03-18
---------------------------------------
Name: Donkey Kong
Genre: arcade
Year: 1983
Author: Michael Cranford
Publisher: Atari
Media: single-sided 5.25-inch floppy
OS: custom
Other versions:
- 1200 Club
- The Freeze
- various uncredited cracks
- Asimov has an uncracked .nib image
Identical cracks: Dig Dug (no. 248)
~
Chapter 0
In Which Various Automated Tools Fail
In Interesting Ways
COPYA
immediate disk read error
Locksmith Fast Disk Backup
unable to read any track
EDD 4 bit copy (no sync, no count)
works
Copy ][+ nibble editor
modified addres and data epilogue
bytes ("AA DE EB" for each)
Disk Fixer
["O" -> "Input/Output Control"]
set Address Epilogue to "AA DE EB"
set Data Epilogue to "AA DE EB"
all tracks readable
T00 -> looks like a DOS 3.3 RWTS
no sign of rest of DOS though
no sign of a catalog on any track
Why didn't COPYA work?
modified epilogue bytes (every track)
Why didn't Locksmith FDB work?
modified epilogue bytes (every track)
Next steps:
1. capture RWTS with AUTOTRACE
2. convert disk to standard format
with Advanced Demuffin
3. patch RWTS to read standard format
~
Chapter 1
In Which We Attempt To Use The Original
Disk As A Weapon Against Itself
[S6,D1=original disk]
[S6,D2=blank disk]
[S5,D1=my work disk]
]PR#5
CAPTURING BOOT0
...reboots slot 6...
...reboots slot 5...
SAVING BOOT0
CAPTURING BOOT1
...reboots slot 6...
...reboots slot 5...
SAVING BOOT1
SAVING RWTS
]BRUN ADVANCED DEMUFFIN 1.5
["5" to switch to slot 5]
["R" to load a new RWTS module]
--> At $B8, load "RWTS" from drive 1
["6" to switch to slot 6]
["C" to convert disk]
--v--
ADVANCED DEMUFFIN 1.5 (C) 1983, 2014
ORIGINAL BY THE STACK UPDATES BY 4AM
=======PRESS ANY KEY TO CONTINUE=======
TRK:...................................
+.5:
0123456789ABCDEF0123456789ABCDEF012
SC0:...................................
SC1:...................................
SC2:...................................
SC3:...................................
SC4:...................................
SC5:...................................
SC6:...................................
SC7:...................................
SC8:...................................
SC9:...................................
SCA:...................................
SCB:...................................
SCC:...................................
SCD:...................................
SCE:...................................
SCF:...................................
=======================================
16SC $00,$00-$22,$0F BY1.0 S6,D1->S6,D2
--^--
[S6,D1=demuffin'd copy]
]PR#6
...grinds...
My copy can't read itself yet. I have a
tool to fix that.
~
Chapter 2
In Which We Remove All Traces Of Copy
Protection Using An Automated Tool That
I Wrote For Just Such An Occasion
[S6,D1=demuffin'd copy]
[S5,D1=my work disk]
]PR#5
]BRUN PDP
T00,S03,$91 change AA to DE
T00,S03,$9B change DE to AA
T00,S03,$35 change AA to DE
T00,S03,$3F change DE to AA
T00,S06,$AE change AA to DE
T00,S06,$B3 change DE to AA
T00,S02,$9E change AA to DE
T00,S02,$A3 change DE to AA
(Just RWTS fixes. There doesn't appear
to be any further protection.)
Quod erat liberandum.
---------------------------------------
A 4am crack No. 273
------------------EOF------------------