[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

HACKED IT! (Mastery Development)

A. REGISTERING MASTERY DEVELOPMENT FOR FREE

WARNING: I've only tried this on MY hardware. I
         have no idea if this will work for you.
         It could even be potentially destructive.
         But, if your system is ALREADY dead, then
         no loss if this screws up, right?

Hack peformed on  Version 7.4, Copyright 1999

1. At the screen complaining about your expired
   year of service, please send money, upgrade, etc
   etc, press Control-Reset. The computer beeps
   twice and drops to the monitor "*" prompt
2. Type: 4C18G and press {RETURN}
3. Drive light flickers - it updated your license!
4. Press Control-OpenApple-Reset to reboot
5. It WORKS! Boots right up, "Start the network"

Yeah, err, I feel a little guilty about the above. I
sorta hacked this in about 2 hours. My aunt who gave
me this dead MD hardware ditched her class-lab of 12
Apple IIe's because the server expired in, and with
the company gone, it had been dead for more than a
year, just sitting there in her classroom. They
pitched all the machines -- and the student cards --
about a month ago. Probably went to the scrapyard.
If I had acted a little sooner here...
:( :( :( :( :( :( :( :( :(


Registration Hacking notes:
At the registration screen, hit Ctrl-Reset
Ctrl-B to get BASIC.. write a tiny program..
Raw text dump from Decimal 2048 to 49151 shows...
Decimal 18100: text "licensing fee is PAST DUE."
Decimal 19363: Just past keycode entry text
4B26G = prints KEYCODE
4B59 -> JSR 4065 = ENTER RESPONSE
4065 = ENTERING CODE
4081 = DISPLAY "Enter key code"
  Weird code masking of entry point. Get addr
  at $04, push it (PHA), get addr at $05, push it
  again, RTS jumps to secret pushed address + 1.
  Neat!  04.05:70 4B
4b71 = ENTERING CODE YET
*** Entered keyCode goes into mem locations: 4C2B+X
4BE1 checks, rejects my typing "... 1 more try..."
4E85 = BOOT WHICH SLOT (oops corrupts mem, reboot..)
4C18 = drive access.. writes CONFIRMED ACCESS CODE!


- - - - - - - - - - - - - - - - - - - - - - - - - -


B. TO DELETE MASTERY DEVELOPMENT SYSTEM PASSWORD

 1. Remove Teacher network card
 2. Turn on MD hard drive.
 3. Boot from a 5.25" ProDOS disk with BASIC on it.
 4. At the BASIC prompt, type:
      PREFIX /M3/PARMS
      RENAME PASS,PASS.OLD
      NEW
      SAVE PASS
 5. Reinstall Teacher network card, boot network
 6. When prompted for the Teacher password, just
      press {RETURN} -- you're IN!



- - - - -

Won't let me set date before 1999.
I used Jan 1, 1999  12:00 AM...

- - - - -

Mastery Development system tells me:
SYSTEM DRIVE: SCSI ID 4, 532.6 MEGS

                    Size  Used
/M1 - Mastery Dev   32.7  28.6
/M2 - MD Backup     32.7  28.6
/M3 - MD Data       30.7   4.0
/U1 - User #1       32.2   0.0
/U2 - User #2       32.2   0.0
/L1 - Locker #1     31.7   2.4
/L1 - Locker #2     31.7   1.8
/L1 - Locker #3     31.7   0.0
/L1 - Locker #4     31.7   0.0

- - - - -
Snarfing files off the drive may be harder than
I thought, because the process is exceptionally
technical for installing new software. Here's
what it asks for "advanced install" of software:

1. ProDOS or DOS 3.3? DOS 3.3
2. How many disk SIDES (1-99)? 1
3. Does it need a DATA disk on the network? YES
4. Enter volume number of Boot Volume (all
     subsequent volumes will be assigned
     consecutive numbers following the boot
     volume number): 254
5. Enter name of startup program: HELLO
6. Launch program with RUN, BRUN, or EXEC? R
7. Specify minimum amount of memory needed on
     student workstation for this program to
     run: 48K/64K/128K/256+K: 48K
8. Set network [write] delay 1-None 5-Forever: 1
9: select write access (enable/ignore/disable): D
10:Run in GS Fast or Slow mode? S
11.Require system password or free access? Free
12.Printer delay (long/short/doesn'tprint): Long
13:Enter name of program to appear in menu: TEST
14:Does it need multiple menu entries? NO

Whoa! Okay, I do see a method for hacking it.
Format a disk without any OS, write a short
1-sector boot program, and use a disk editor to
fill all the empty sectors with text labels with
the track and sector info for that sector.

Install the disk, and now you have a tool for
probing the installed volume files, to look for
those labels in those sectors.. (this may not
work if it doesn't copy "free" sectors)

*fools with it some more*

:)

-Mr. Boffo