Re: More info so far Re: Weird idea re Print Shop

[Steve Nickolas <lyricalnanoha@usotsuki.hoshinet.org>]

The recap so far:

1. Print Shop uses a heavily hacked DOS 3.3, but the portions it directly 
uses are more or less the same as the official version.  (The only 
protection relevant to my copy, which is already cracked, is that the VTOC 
catalog sector is wrong; this is rectified by patching the third byte of 
T$11S$0 to "$09" (I think it's "$01" on the existing copies)).

2. This DOS 3.3 has been relocated and/or cut down, so that it uses a 
smaller memory footprint; Print Shop will in certain cases step on the 
memory of standard DOS, but so far will work fine if DOS has been 
relocated. (Its code goes up into the lower 9Axx area.)

3. Itself it seems to use only 4 commands: BLOAD, BSAVE, DELETE, INIT.  In 
all cases, these commands are invoked via the text output hooks (i.e., 
PRINT CHR$(4)), and not directly through calls into DOS.  For example, 
reset it from a MONITOR ROM and type these commands:

	*3EAG
	*INT
	>CATALOG
	>MONIOC
	>BRUN HELLO

and you will see that it still has most of DOS 3.3 under the hood, as well 
as how it uses the PRINT CHR$(4) technique to load itself.

4. There are two disk checks; one of these was located at $7016, within 
MENULIB, and the other is yet unknown but may lie in MENULIB or SYSLIB. 
If defeated or reworked, it may be possible to convert Print Shop to 
files.

5. All filenames are compatible with ProDOS, even if the code is not.  The 
memory layout also does not seem like it would interfere with ProDOS, 
being that it runs on a 48K machine and doesn't seem to step on a 
different DOS which is located in extended memory.

6. Error handling is done by patching the running DOS with JMPs; I have at 
least identified 2 cases of it, although as I cannot currently access my 
main computer, I do not have a reference for this claim.  This generally 
works like this:

	LDA	#$4C
	STA	patchpoint
	LDA	#<erh
	STA	patchpoint+1
	LDA	#>erh
	STA	patchpoint+2

	*code to print the command line through the $FDED vector*

	LDA	#$00
	BEQ	noerr		; always
erh:

of some sort or variant.

I remain convinced that it may be possible first to do a files crack 
(which would be capable of running on top of UniDOS or another 400/800K 
DOS 3.3 variant), and second to take that crack, rewrite parts of the code 
and port the whole thing to ProDOS-8 (making it hard disk installable). 
However, I have at present been unable to complete my analysis.

-uso.