Date: 01/10/12
Software: Toy Shop by Br0derbund - 1986
Originals provided by: Tempest
Converted to working NIB images by: datawiz

Description:
Toy Shop was a fun application that allowed you to print out paper models,
which allowed you to cut them out, fold, and glue them together. 20 working
paper models are available.

6 Disk Images total:
Master Disk Side A (boot this)
Master Disk Side B
Data Disk 1 Side A
Data Disk 1 Side B
Data Disk 2 Side A
Data Disk 2 Side B

Additionally, I have included all 20 model files printed into PDF files so 
they can be used on modern computers.

Technical Notes:
Strangely, this is one of the few applications released by Broderbund and not
a game, which is what they are normally known for. This game has some pretty
heavy format-based copy protection. Specifically, it uses 18-sector protection
which stores the equivalent of 18 sectors of data within a track. While I
haven't looked, I expect that this protection is very similar to other big
Broderbund game titles released around that time that also had 18-sector
protection (Airheart, Wings of Fury, and a bit later Prince of Persia).

Why protect an application like this? Well, I have 2 ideas on this. First,
they had already developed the protection scheme, so why not use it? Secondly,
and I think more plausible, is because this app has so many graphics, it
actually takes advantage of the additional space. So perhaps the 18-sector
protection wasn't for protection, per se, but for more storage and to reduce
the need for ANOTHER data disk (or removing some of the models to fit).

Initially, I intended on deprotecting the software, and I got to the point
where I could use their own 18-sector DOS read routines to load in arbitrary
tracks into memory locations I specified. I had assumed that only the Boot
disk had 18-sector protected tracks, and on the master disk I found that
tracks 1-4, 1c-22 had 18-sector protection and the remaining were 16 sector
standard DOS 3.3 format tracks. The program's code has a second DOS to read
and write standard dos 3.3 as well.

When I dumped the 18-sector tracks, I realized that they were all full of 
data and code, and when I looked at the 16-sector tracks I did not have enough
free sectors to store the extra sectors for the 16-sector crack. This is a
problem, as you can guess. Well, out of curiosity, I decided to look at the
other 5 disk sides. Imagine my surprise when I found that almost all the
tracks on the remaining disk sides had 18-sector formatting! This poses a HUGE
problem, and makes it unfeasible to do a full 16-sector rewrite without a
lot of work. And, as you can guess, these 18-sectors were full of graphics 
and there was little room to store extra sectors for a crack.

So, I decided to build .NIB images, expecting them to NOT work, as almost
every format based copy protection scheme also includes a secondary protection.
Normally, this would mean nibble count routines that would fail on a copy and
reboot or lock up the program. Well, after a few attempts with bit copiers, I
converted the images to NIBs, and ran them under emulation (Virtual II on a
Mac). Imagine my surprise to find that everything worked 100% with no
additional nibble patching needed to defeat nibble counting. So there was no
secondary protection outside of the 18-sectoring, which also makes me think
that the decision to use 18-sectoring was for the additional disk storage space.

If you are not interested in Apple II pirate history, then stop reading now...
--------------------------
Apparently, this application was never cracked and released in the golden days
of the Apple II when piracy hovered around BBS' and local copy meets. Having
been in part of this scene in the later 80's, I was intrigued by this, and I
think having been involved then and now seeing the application and protection, 
I can shed some light on it. I'm not sure there's any interest, but I'm a bit
of an Apple II Pirate Archaeologist, so I find it fascinating.

First of all, in the Apple II pirate underground, it was unfashionable to
pirate anything but games. There were probably just as many educational titles
available for the Apple II during the mid-80s, but if a legitimate cracking
group released an educational title, other competing groups would ridicule them.
This sounds utterly ridiculous, but in those days the competition was high and
this was a rule. So even a very challenging app like Toy Shop would have fallen
under the category of "edu-ware" and the top tier crackers would not have touched
it. For an example of the ridicule a group would go through, you can find crack
screens from groups like First Class, Coast to Coast, USAlliance and others who
"rag" on groups like The Bunnymen and Circle of Deneb who did release edu-warez.
Once this top tier of groups turned on you, you were treated as pariahs on all of 
the top tier BBS' of the day. 

Assuming that the top-tier crackers associated with these groups were not interested
in working on a crack for this, there were not many other people with the
knowledge to undertake a full crack of this, which may be another reason it was
never done. Research the index of Computist magazines. There are no full cracks
ever reported, just some tips for nibble copy parameters. Also, while the app itself
is neat, it's not something all that interesting or fun (like a game), which means 
there probably wasn't a high demand to have it cracked.

Because the disks are packed full of data, a 16 sector crack is really unreasonable.
If you look at games based on 18-sector protection, in most cases there is enough
space on the disk to store the additional 2 sectors per track. You can then rewrite
the game's dos to load in the additional sectors as needed. Refer to Airheart, Wings
of Fury, and even Prince of Persia. Origin later came out with 18-sector protection
on Tangled Tales, and the Brain Trust crack of this game appears to use an additional 
boot disk for the initial load up of the 18-sector tracks, which is another approach
if there's not enough free space on the disk.

Finally, while this game would have been difficult to crack back in those days, there
is an approach that could have been used to distribute a working copy. A program
could be written to read a track on a protected disk, and save it's nibbles out.
A separate program would be written to re-assemble the nibble images back into a 
disk that has a non-standard format that would work (assuming the crackist removed
secondary protection in the nibblized images). The downside to this is that, obviously,
you still have an uncracked version, but the bigger issue is that for each disk side,
it takes 2 disks of data to store the nibblized disk data. That will essentially
DOUBLE the application. So, Toy Shop is a 3 Disk program, that's 6 sides. It would take
12 disks total for the nibblized images, plus another disk for the re-assembly program
for a total of 13 disks! This is essentially with SST (Saltine's Super Transcopy) does,
but this application would be custom written for the game/app you are pirating. I
have seen something like this in the BBS scene before, but I can't remember which
game it was for (perhaps Battle Chess for the Apple IIe, release by the Byte Bastards).

In our days of modern technology and virtual disk images, it's really no
big deal, but recall technology in the mid-80s: Disks were NOT cheap, data was transferred
over TELEPHONE lines. Analog! At earth-shattering speeds of 2400 Baud IF YOU WERE LUCKY.
Most people still puttered along at 1200 or maybe 300 BPS still...

Assuming 20 minutes a disk side, you are still looking at over 4 hours to upload/download
this program as a pirate. Back then, most reputable pirate boards ran on a credit
system. You had credits to use for downloads, or a ratio that gave you so many download
credits per upload. So spending hard earned credits to download this would seem silly,
especially if your opportunity cost is something like Airheart or Wings of Fury. Also,
disk space on BBS' were at a premium, so I can also see BBS System Operators getting
angry at a person uploading this "junk" (recall, this would have been considered an
edu-ware), and they would probably nuke (delete) it on the spot to save space for an
highly anticipated game or utility.

This is long and rambling. Sorry if you were forced into reading it. You will never, ever
get those precious minutes back. It just amuses me that I keep encountering rich
background stories as I tear into this old software, and my mind looks back at the events
and environments of those days. I'm sure I'll run into more, and I can't wait.

Rich/datawiz

