Text content (OCR)
Hardcore COMPUTIST’S
——= Book Of Softkeys ——
SoftKey Publishing
THE
BOOK
OF
SOFTKEYS
volume II
Entire contents copyright © 1986 by
SoftKey Publishing
PO Box 110846-BK
Tacoma, WA 98411
All Rights Reserved. Copying done for other than
personal or internal reference (without express written
permission from the publisher) is prohibited. Any
opinions expressed by the authors are not necessarily
those of Hardcore COMPUTIST or SofiKey Publishing.
The Book Of Softkeys Volume II
The Book Of Softkeys Volume II
able of Conte
Table of Contents.............
Bank Street Writer.
Cannonball Blitz.
Canyon Climber.
Caverns of Freitag.
Crush, Crumble And Chomp.
issee Krell Logo or Apple Logo
Sensible Speller 4.0c, 4.1¢
the Spy Strikes Back.
Time Zone v1.1
Visidex ...
Visiterm ....
Hayden Software
SOL: Sierra Online Software.
How to make DEMUFFIN PLUS.
Super IOB 1.5........--
Using ProDOS On A Franklin Ace.
CrunchList.........
Controller Saver........+.
Making Liberated Backups That Retain Their Copy-protectio
Examining Copy-protected Applesoft BASIC Programs.
APT (Advanced Playing Technique)
Castle Wolfenstein: 31, 54, 70 Miner 2049er: 37__ Serper
Star Maze: 42 Ultima I: 8 The Wizard And The Princess: 98
Wizardry: Proving Grounds Of The Mad Overlord: 52 Zaxxon: 107
2 The Book Of Softkeys Volume II
Introduction
Welcome to the Book Of Softkeys Volume II, a compilation
of articles from Hardcore COMPUTIST magazine (issues 6
through 10) that explain how to remove copy-protection
from commercially sold, locked-up and uncopyable software
for the Apple | series of computer systems.
Hardcore COMPUTIST (now just called COMPUTIST ) is
a monthly publication devoted to the serious user of Apple
Il computers and compatibles. Our magazine contains
information you are not likely to find in any of the other
major journals dedicated to the Apple market.
Our editorial policy is that we do NOT condone software
Piracy, but we do believe that honest users are entitled to
backup commercial disks they have purchased. In addition
to the security of a backup disk, the removal of copy-
protection gives the user the option of modifying application
programs to meet his or her needs.
Furthermore, the copyright laws guarantee your right to
such a deprotected backup copy:
..."‘It is not an infringement for the owner of a copy of a computer
Program to make or authorize the making of another copy or
adaption of that computer program provided:
1) that such a new copy or adaption is created as an essential step
in the utilization of the computer program in conjunction with a
machine and that it is used in no other manner, or
2) that such new copy or adaption is for archival purposes only
and that all archival copies are destroyed in the event that continued
with the copy from which such copies were prepared, only as part
of the lease, sale, or other transfer of all rights in the program.
Adaptions so prepared may be transferred only with the
authorization of the copyright owner.””
United States Code title 17, §117 (17 USC 117)
Those of you who are not already familiar with Hardcore
COMPUTIST are advised to read the What is a Softkey? article
in order to avoid frustration when attempting to follow a
softkey or when entering the programs printed in this Book
Of Softkeys.
The Book Of Softkeys Volume II
What Is A Softkey?
Softkey is a term which we coined to describe a procedure
that removes, or at least circumvents, any copy-protection
on a particular disk. Once a softkey procedure has been
performed, the resulting disk can usually be copied by the
use of Apple’s COPYA program (on the DOS 3.3 System
Master Disk) and is said to be ‘““COPYAable.”’
ml =Commands And Controls:
Commands which a reader is required to perform are set apart
from normal text by being indented and bold. An example is:
PR#6
The key must be pressed at the end of every such
command unless otherwise specified. Control characters are shown
as a single symbol. For example:
6@P)
To complete this command, you must first type the number 6 and
then hold the @) key while you press the (PB) key.
Ml Requirements:
Most of the programs and softkeys which appear in this book
require one of the Apple Il series of computers and at least one disk
drive with DOS 3.3. Occasionally, some programs and procedures
have special requirements. The prerequisives for deprotection
techniques or programs will always be listed at the beginning of
the article under the ‘Requirements:’ heading.
@™ Software Recommendations:
The following programs are strongly recommended for readers
who wish to obtain the most benefit from our articles:
An Applesoft Program Editor such as Global Program Line
Editor (GPLE).
A Sector Editor such as DiskEdit (SoftKey Publishing), or ZAP
from Bag of Tricks or Tricky Dick from The CIA.
A Disk Search Utility such as The Inspector, The Tracer from
The CIA or The CORE Disk Searcher (SoftKey Publishing).
An Assembler such as the S-C Assembler or Merlin/Big Mac.
A Bit Copier such as Copy II Plus, Locksmith or The Essential
Data Duplicator.
A Text Editor capable of producing normal sequential text files
such as Applewriter Il, Magic Window II or Screenwriter II.
You will also find COPYA, FID and MUFFIN from the DOS 3.3
System Master Disk useful.
4 The Book Of Softkeys Volume II
Super IOB and controllers
Several softkey procedures will make use of a Super IOB
controller, a small program that must be keyed into the middle of
Super IOB. The controller changes Super IOB so that it can copy
different disks. See the Super IOB 1.5 article and program in this
volume of the Book Of Softkeys.
@— RESET Into The Monitor
Some softkey procedures require that the user be able to enter
the Apple’s System Monitor (henceforth called the Monitor) during
the execution of a copy-protected program. Check the following list
to see what hardware you will need to obtain this ability.
Apple II Plus - Apple //e - Apple compatibles:
1) Place an Integer BASIC ROM card in one of the Apple slots.
2) Use a non-maskable interrupt (NMI) card such as Replay or
Wildcard.
Apple If Plus - Apple compatibles:
Install an F8 ROM with a modified RESET vector on the computer’s
motherboard as detailed in the ‘Modified ROMs’ article of Hardcore
COMPUTIST # 6.
Apple //e - Apple //e:
Install a modified CD ROM on the computer’s motherboard. Clay
Harrell’s company (Cutting Edge Ent.; Box 43234 Ren Cen Station-
HC; Detroit, MI 48243) sells a hardware device that will give you
this ability. Making this modification to an Apple //c will void its
warranty but the increased ability to remove copy-protection may
justify it.
@™ Recommended Literature
Apple Il Reference Manual
DOS 3.3 manual
Beneath Apple DOS
by Don Worth and Pieter Lechner; Quality Software
Assembly Language For The Applesoft Programmer
by Roy Meyers and C.W. Finley; Addison Wesley
What’s Where In The Apple
by William Lubert; Micro Ink
Ml Keying In Applesoft Programs
BASIC programs are printed in this Book Of Softkeys in a format
that is designed to minimize errors for readers who key in these
programs. To understand this format, you must first understand the
formatted LIST feature of Applesoft.
An illustration- If you strike these keys:
10 HOME:REMCLEAR SCREEN
a program will be stored in the computer’s memory. Strangely, this
The Book Of Softkeys Volume II 5
program will not have a LIST that is exactly as you typed it. Instead,
the LIST will look like this:
1@ HOME : REM CLEAR SCREEN
Programs don’t usually LIST the same as they were keyed in
because Applesoft inserts spaces into a program listing before and
after every command word or mathematical operator. These spaces
usually don’t pose a problem except in line numbers which contain
REM or DATA command words. The space inserted after these
command words can be misleading. For example, if you want a
program to have a list like this:
10 DATA 67,45,54,52
you would have to omit the space directly after the DATA command
word. If you were to key in the space directly after the DATA
command word, the LIST of the program would look like this:
10 DATA 67,45,54,52
This LIST is different from the LIST you wanted. The number of
spaces you key after DATA and REM command words is very
important.
All of this brings us to the Hardcore COMPUTIST LISTing
format. In a BASIC LISTing, there are two types of spaces: spaces
that don’t matter whether they are keyed or not, and spaces that
MUST be keyed. The latter spaces are printed here as delta
characters («). All other spaces in our BASIC LISTing are put there
for easier reading and it won’t matter whether you type them or not.
Ml Keying In Hexdumps
Machine language programs are printed here as both source code
and hexdumps. Only one of these formats need be keyed in to get
a machine language program. Hexdumps are the shortest and easiest
format to type in. To key in hexdumps, you must first enter the
Monitor with CALL -151 (RETRY).
Now key in the hexdump exactly as it appears. If you hear a beep,
you will know that you have typed something incorrectly and must
retype that line.
When finished, return to BASIC by typing E003G
Remember to BSAVE the program with the correct filename,
address and length parameters as given in the article.
MH Keying In Source Code
The source code portion of a machine language program is
provided only to better explain the program’s operation. If you wish
to key it in, you will need the S-C Assembler. Without this assembler,
you will have to convert the S-C Assembler directives (printed in
Hardcore COMPUTIST # 17) to similar directives used by your
assembler. %
6 The Book Of Softkeys Volume II
Apple LOGO
Logo Computer Systems, Apple Computer
How to Copy Apple LOGO
by Anne Rachel Gygi
(Hardcore COMPUTIST # 8, page 7)
Requirements:
Apple It Plus with 64K RAM
One disk drive with DOS 3.3
A sector editor such as DiskEdit
A Bit Copy program such as Locksmith or Copy II Plus
One blank disk
Apple LOGO is copy-protected by writing Track $1 in a non-
standard format. A nibble-count technique is used on this track with
a fixed number of $FFs being written between $D6. If a copy is
made and the number of $FFs between $D6s on Track $1 is not
the same as on the original disk, then the copy will not work.
Track $1 on the distributed disk has the following format:
Number of Bytes: 1 124 1 132 1
Value: $D6 $FF $D6 $FF $D6
Rest of Track: $FF
The logic to read and analyze Track $1 is in the second boot load
Track $0, Sector $@A, which ultimately resides in memory at
$4000—S40FF. There are two constants equal to the number of Sync
Bytes ($FFs) between the three $D6s and these are loaded into
memory locations $40CD (124 or $7C) and $40CE (132 or $84).
These are bytes $7C and $7D on Track $0, Sector $0A.
Unlocking the Turtle
The technique for copying Apple Logo involves making a sector
edit to a bit copy so that the code to seek and read Track $1 is
disabled. The necessary steps are outlined next.
The Book Of Softkeys Volume II 7
[4] Use a bit copier (Locksmith 4.1, Nibbles Away, etc.) to copy
Tracks $0—$22 with no parameter changes. An error on Track $1
is OK.
C2] Use a Sector-Editing program such as DiskEdit or ZAP from
Bag of Tricks to make the following changes to the copied disk.
Track Sector Byte To
SA $13 SEA
SA $14 SEA
$A $15 SEA
$A $22 $4C
$A $23 $55
$A $24 $40
$A $79 $EA
$A $7A SEA
$A $7B- SEA
esssssess
Don’t forget to write the sector back to the disk.
The first set of changes at $13—$15 eliminates (NOPs) the branch
to Logo's RWTS at $3D00 which seeks Track $1. The changes at
$22—$23 cause a branch around the code which reads Track $1
and the final changes at $79—$7B eliminate (NOPs) the branch
which would be taken if the nibble count is not correct.
The resulting disk can now be copied with any bit copier and Apple
Logo will run because it now completely ignores whatever is on
Track $1.
Wes Felty’s APT for...
Lots Of Ships
When you board a ship and leave land, your ship will often
split into two ships. The second ship will attack you, but do
not sink it. Instead, land your ship, exit it and board the second
ship. Then sail it to another continent and exit the ship.
If you reboard the ship and set sail, it may split in two again.
You can leave ships all over the world using this technique.
8 The Book Of Softkeys Volume II
Arcade Machine
Broderbund Software, Inc
Softkey For The Arcade Machine
by Marco Hunter
(Hardcore COMPUTIST # 10, page 9)
Requirements:
Apple with 48K
One disk drive, with DOS 3.3
One blank disk
Old Monitor ROM or modified F8 ROM
Super IOB
Arcade Machine
Although Broderbund Software is generally very thorough with
their protection schemes, they left two holes in the protection 6n
the Arcade Machine.
First of all, Tracks $03—-$11 are normal DOS 3.3 tracks. These
tracks store the various parts of the options available from the menu.
Secondly, although the main file is heavily protected on the disk
(spiral protection and what not), once loaded into memory it is fairly
clean.
Since the menu options take up Tracks $03—$11 we have room
for DOS (Tracks 0—2), as well as room for the main file (Tracks
$12—$22).
Because Track $11 is taken up by the menu options, we must
change the location of our CATALOG. I chose to put it on Track
$12.
Now we have a neat package (all on one disk) just like the original.
When we boot our deprotected version, DOS will load the main
file which from then on will access the menu options on Tracks
$03—$11.
Here’s how
[4] First of all, boot up with a DOS that has the ability to
INITialize a disk (a fast DOS is recommended).
The Book Of Softkeys Volume II 9
[2] Next, type in the Super IOB controller at the end of this
article and SAVE it. (See the Controller Saver article.)
C3] With the controller and Super IOB merged, execute the
Super IOB program:
RUN
[4] When Super IOB asks you if you want to format the target
disk, you must type a This formatting is necessary because
the controller does a special format to the disk which puts the
directory on Track $12 instead of $11.
[5] Once Super IOB has copied Tracks $03—$11, boot up the
Arcade Machine:
PR#6
Ce] Get into the Monitor when the main menu appears.
aa Move the main file and sensitive memory to safety:
2000<9600.B600M
8000<B600.C000M
8A00<0.900M
Boot the disk that Super IOB formatted (you should get a
?FILE NOT FOUND error, but don’t worry):
6OP)
Enter the Monitor:
CALL -151
Put a patch just before the beginning of the Arcade Machine
code:
8FD:4C 00 93
(41) Type in this routine that moves the memory back to where
it used to be:
9300: A2 @@ BD 00 20 9D 00 96
9308: E8 DO F7 EE 04 93 EE 07
9310: 93 AD 04 93 C9 40 D® EA
9318: BD 00 80 9D 00 B6 E8 DO
9320: F7 EE 1A 93 EE 1D 93 AD
9328: 1D 93 C9 CO0 DO EA BD 00
9330: 8A 9D 60 00 E8 DO F7 EE
9338: 30 93 EE 33 93 AD 33 93
9340: C9 @9 D®@ EA 4C 00 08
10 The Book Of Softkeys Volume II
You can check your typing by comparing it to the following
disassembly:
9300 A2 00
9382- BD 00 20
9305- 9D 00 96
9308- £8
9309- DO F7
930B- EE 04 93
930E- EE 07 93
9311- AD 0493
9314- C9 40
9316- DOEA
9318- BD 60 80
931B- 9D 80 B6
931E- £8
931F- DO F7
9321- EE 1A93
9324- EE 1D 93
9327- AD 1D 93
932A- C9 CB
932C- OO EA
932E- BD 00 8A
9331- 9D 80 60
9334- E8
9335- DO F7
9337- EE 30 93
933A- EE 33 93
933D- AD 33 93
9340- C9 09
9342- DBEA
9344- 4C 00 08
LOX #800
LDA $2008,
STA $9600,
{NX
BNE $9302
INC $9304
INC $9307
LDA $9304
CMP #$40
BNE $9302
LDA $8008,
STA $B606,
INX
BNE $9318
INC $931A
INC $931D
LDA $931D
CMP #§CO
BNE $9318
LDA $8A00,
STA $0000,
INX
BNE $932E
INC $9330
INC $9333
LDA $9333
CMP #809
BNE $932E
IMP $8800
(12) Save the main file:
BSAVE ARCADE “MACHINE, AS8FD, LS8D04
[43] Return to BASIC:
FP
Type in this short greeting program:
x
x
d< de
>< de
10 PRINT CHRS (4) '‘BRUN ARCADE * MACHINE”
[48] save it:
SAVE HELLO
The Arcade Machine is now COPYAable.
The Book Of Softkeys Volume II
11
The backside (with all the sample games) can be copied with any
good bit copier.
If you don’t have a bit copier, you can insert a POKE 47426,24
into Line 10 of COPYA to copy it.
One final note: The options from the Arcade Machine were all
written in Applesoft. If you T) into the Monitor and type
to get into BASIC after choosing one of the options, you can then
list the file.
controller
410 GOSUB 80 : HOME : AS = "FORMATING" : FLASH : GOSUB 450 : NORMAL : POKE
44033 ,18 : POKE 44703 ,18 : POKE 44764 ,18 : POKE 42347 ,96
415 POKE 43364 ,255 : PRINT : PRINT CHR$ (4) “INIT*HELLO,V"VL",S"S2
"\D" 02 :VL=@ : RETURN
1000 REM ARCADE MACHINE
1010 TK = 3 :ST = :LT= 18 :CD=WR : POKE 47426 24 : GOSUB 1120
1020 T1 = TK : GOSUB 490
1030 GOSUB 430 : GOSUB 100 :ST = ST +1: IF ST < DOS THEN 1030
1040 1F BF THEN 1060
1950 ST=0 :TK=TK+1: IF TK<LT THEN 1030
1060 GOSUB 490 :TK=T1 :ST=9
1070 GOSUB 430 ; GOSUB 100 :ST = ST +1: iF ST < 00S THEN 1070
1980 ST = :TK=TK+1: 1F BF = @ AND TK <LT THEN 1070
1990 IF TK < LT THEN 1020
1100 HOME : PRINT : PRINT "DONE*WITH*COPY" : END
1120 POKE 44033 ,17 : POKE 44703 , 17 : POKE 44764 ,17 : POKE 42347 .76
1130 CD = RD :S0 = S2 :DV = D2 : GOSUB 80 :TK = 18 :ST = : GOSUB 430 :
GOSUB 100
1140 POKE 9985 ,18 : FOR A= 10052 TO 10115 : POKE A ,O : NEXT :CD=WR
: GOSUB 80 : GOSUB 100 :TK = 3 : RETURN
4
12 The Book Of Softkeys Volume II
The Artist
Sierra On-Line
Softkey for The Artist
by Walt Campbell
(Hardcore COMPUTIST # 8, page 12)
Requirements:
Apple Ji Plus or Apple //e, 48K.
At least one disk drive
The Artist master disk
A blank disk
FID or COPYA
The Artist is the graphics package used to develop some of Sierra
On-Line’s biggest selling games, such as Crossfire and Mouskattack.
That is what the introduction to the program claims and after using
the package for quite awhile, I can believe it. It contains two separate
but compatible screen drawing routines, a zoom lens type bit editor,
a 21-color fill routine, shape table construction and editor utilities,
and some nifty high-speed byte-shape design and move routines.
All in all, an exceptional set of graphics tools.
The problem, as with all of Sierra On-Line’s programs, is that
it’s copy-protected. The copy-protection scheme is similar to the
one outlined by Dan Price in the Screenwriter II softkey (Book
Of Softkeys volume I). The program uses direct disk access to check
the format of the disk tracks for embedded keys. If the keys are
not present, it clears memory and reboots the disk. The program
is otherwise pretty much box-stock DOS 3.3 and can be easily copied
using FID or COPYA from the DOS System Master disk.
I jumped into the project of deprotecting the disk after reading
Mr. Price’s softkey, feeling confident that in a short time I would
have identified the subroutine that checked the disk, bypassed it,
and have a ‘clean’ unprotected copy. Eight hours later I was no closer
to a copy and much more frustrated. I took a break from the
computer and skimmed through my back issues of Hardcore
COMPUTIST looking for a hint or clue that might aid me in
‘cracking’ this code.
The Book Of Softkeys Volume I! 13
In Ray Darrah’s article Boot-code Tracing Pest Patrol (see Book
Of Softkeys Volume I), I found a discussion of concealed code and
disguised jumps in machine language programs. This ‘turned on a
light’ and I returned to the project with new optimism. Two hours
later I had my unprotected copy! Once discovered, the procedure
is (naturally!) simple and can be done in fifteen minutes. Before
outlining the procedure I would like to explain the protection scheme
more fully in hopes of aiding other enterprising hackers and maybe
saving them hours of time. Those of you not interested in the
procedures used to break the copy protection can skip to the fix
below.
The copy protection method used on The Artist is similar to the
one used on Screenwriter II, but the author of the program not only
uses concealed jumps and stack manipulation to hide return
addresses, he has a particularly sneaky portion of code that actually
tewrites itself before it checks the disk, and then rewrites itself after
it’s done to conceal its existence.
After much experimentation, I isolated the disk checking routine
to a range of code in the main menu program. This code plays some
tricks with branch instructions and forces branches to what seems
to be the middle of other valid instructions. It pushes addresses on
the stack and executes a machine language return to jump to those
addresses, etc. This kind of code has become pretty standard in copy
and code protection but is frustrating, nonetheless.
After digging through this mess I came to a section of code that
seemed to make no sense whatsoever and ended by jumping to an
area of memory that I knew contained no program code! | started
inserting breaks in the code to try and isolate the offending section
and, BINGO! I found a short section of disguised code that actually
rewrote successive bytes of the program! This type of protection
was new to me and may serve to illustrate further the possibilities
available to machine code programmers in code manipulation.
The program loads the Y-Register with a value of $29, indexes
to an address $29 bytes away from itself, and performs an exclusive
‘OR’ operation (EOR) with a value of $8A on the code at this new
location.
This transforms a seemingly meaningless section of code to a
detailed byte-check of the tracks on the disk and checks for the
embedded keys. If the proper format keys are not found, it clears
memory and reboots the disk. If it finds the proper keys, it rewrites
itself and returns to the main section of code! Once I got this far
in the analysis the fix became obvious and extremely simple.
THE FIX:
In order to remove this protection it is necessary to first copy the
disk with either the COPYA or the FID programs. The Artist
14 The Book Of Softkeys Volume I
master disk uses a binary Hello program, so if you use FID to copy
the programs, you must either INIT your blank disk to BRUN the
Hello program (as outlined in the Dan Price’s Screenwriter Softkey)
or use a DOS utility, such as ProntoDOS, to change the disk boot
program. Using a modified DOS-like ProntoDOS also will
noticeably speed up program disk access and the loading and saving
of hi-res pictures.
Once you have prepared your new program disk and it contains
all the files from the original master disk, follow the series of steps
listed below:
[4] Boot up a normal DOS 3.3 disk:
PR#6
[2] Insert the copy of The Artist in your disk drive.
3] Unlock the MAIN MENU program so it can be modified:
UNLOCK MAIN MENU
[4] Load the MAIN MENU program:
BLOAD MAIN MENU
| Enter the Monitor:
CALL -151
[£5] Modify Address $4257 from $8A to $57 and Address $4662
from $B9 to $60:
4257:57
4662:60
6] Save the modified MAIN MENU program:
BSAVE MAIN MENU,AS$4000,LS4D
Finally, relock the now modified program:
LOCK MAIN MENU
Alternatively, if you used COPYA to copy the disk, the changes
can be made directly to the disk with a sector editor. On my copy
of The Artist, the first change to make was at Track $05, Sector
$0C, Byte $5B. I changed this byte from $8A to $57. The second
change is at Track $05, Sector $08, Byte $66. This byte needs to
be changed from $B9 to $60. This probably won’t work on a FID
copy because the sector allocation may be different.
THAT’S IT!! You now have a copy of The Artist that is
unprotected and COPYAable!
The Book Of Softkeys Volume II 15
Bank Street Writer
Bank Street Writer
Softkey For Bank Street Writer
by Earl Taylor & Steve Morgan
(Hardcore COMPUTIST # 10, page 12)
Requirements:
Apple Jf, Apple It Plus, //e (minimum 48K and Applesoft)
One disk drive and DOS 3.3
Blank disks
The Bank Street Writer is a word-processing program particularly
suited to the beginner. As such it includes many features to prevent
confusion and accidents which might be experienced by the computer
novice. In developing this softkey we have attempted to retain as
many of these features as possible.
The original disk is able to operate with several different
configurations of hardware. It requires (and checks for) a minimum
of 48K of motherboard RAM. In addition, the presence of Applesoft
is verified. If a 16K RAMcard is installed in Slot 0, Applesoft will
be placed there if necessary. If Applesoft is in Motherboard ROM,
the extra 16K will be used to increase the user’s text memory
allowing about 3,200 words instead of 1,300 without the card. If
installed into an Apple //e, the program will use the //e’s extra
memory and the (@) (open-apple), (€) (closed-apple) keys along
with the four cursor movement keys
Extensive error-trapping is performed and hitting is totally
non-destructive to the user’s text, requiring only a press of the
key to carry on.
After experiencing some difficulty in getting the softkey version
to properly operate the disk drive, we came upon a feature not
described in the manual. The program actually prevents the user
from accidentally or otherwise INITing or SAVEing files to the
master disk (something that our instincts prevented us from trying!).
We have made an effort to maintain as many of these user-proof
features as possible in our softkey. The unlocked softkey version
supports all but the following features of the original:
16 The Book Of Softkeys Volume II
1) At least 48K of RAM and Applesoft must be resident in the
machine at the time the softkey version is booted.
Our start-up program is in Applesoft. It is possible to enter
the program as an Integer BASIC file and include a few
statements to load Applesoft into the RAM card. The program
will then work normally. All the users we know have Applesoft
in ROM on the Motherboard; therefore, we felt this was not
a serious limitation.
2.) The original boots VERY QUICKLY compared to the softkey
version,
Bank Street Writer (BSW) uses a powerful bulk-loading
scheme to bring its files into memory. This scheme depends
on the format of the data on the disk and, of course, that is
what we want to change. If you’re not the kind who likes to
wait around, we strongly recommend the use of one of the fast
DOSs such as Diversi-DOS, Hyper-DOS, ProntoDos, etc.
The Boot Process
The following paragraphs describe the boot activity of the original
disk as an insight into the softkey method. You may, of course,
simply follow ‘The Softkey Steps’ if you wish.
BSW,, like all disks, has a Track @, Sector ® that must be readable
by the disk controller card’s firmware at $C600 (assuming the card
is in Slot 6). This data is loaded into $800—$8FF and executed.
At this point, more data is read from Track @ and placed into memory
at $1000—$1700. Execution is passed to the code starting at $1400.
At this point the program verifies that at least 48K of RAM is
present, printing a message and stopping if it finds less. If all is
well, the BSW DOS is loaded from Tracks $1 and $2 into
$9600—$BFFF.
Next, the type of hardware configuration is determined and an
identifying character is printed in the upper left corner of the screen.
There are four possible configurations which may occur. A value
of 0, 1, 2, or 3 is stored in memory location $1F depending on
the type of hardware.
Value = Screen character: representation
: No Applesoft and no ramcard in Slot 0.
: Applesoft in ROM or ramcard and 48K.
: Applesoft in ROM and ramcard in Slot 0
: Apple //e.
WNns
i}
maas
The Book Of Softkeys Volume II 17
If no motherboard ROM Applesoft is found but a ramcard is
detected, the type-checking code automatically loads Applesoft from
Tracks 3, 4 and 5 into the card and activates it. For all intents, this
is the same configuration as a 48K Apple I Plus ($/F = 1).
If $1F = @ after the type-check, the program informs the user
that Applesoft is required and stops. For the other configurations
more data is loaded into memory as follows:
$1F= Tracks loaded into memory
1 SOE, SOF, $10 $6000 to $8FFF
2 $06, $07, $08 $0000 to $FFFF
$09 $8B00 to $9AFF
3 SOA, $0B, $0C $D000 to $FFFF
$0D $8B00 to $9AFF
Next, hi-res graphics page two is displayed and filled with the
title page from Tracks $18—$19. More data is read into $400—$7FF
from Track $1A. The drive head is then positioned to Track $11
and the BSW DOS is cold-started with a jump to $9D84.
Track $11 contains a file directory like a normal disk. The BSW
DOS loads in an Applesoft greeting program at $800 and RUNs
it. The program filename is A followed by 7 backspace characters
and 22 spaces. When we later modify normal DOS to read the
catalog, this filename will not appear since the backspaces cause
the visible characters to be overwritten by the spaces when printed
to the screen.
Program A first detects if the key has been pressed during
the boot. If so, the UTILITY program is run (more on this later).
Otherwise, A loads two other small binary files. One is called 0$301
which loads at $301 and the other is INIT, loaded at $2D0. Once
these are loaded, A continues the boot with a CALL 2048. This
begins execution of the code loaded earlier at $400.
Another hardware-dependent load is performed next as follows:
SIF Tracks loaded into memory
1 $1F $9000 to $9BFF
$20, $21 $2500 to $3CFF
$22 $3400 to $3FFF
2 $1B, $1C $0800 to $1FFF
3 $1D, $1E $0800 to $1FFF
At this point, the disk access is finally completed and the drive
is shut off. The next statement to be executed is at $525. This code
does some initialization and patching and then starts the program
18 The Book Of Softkeys Volume II
with an indirect jump through $0000 to either $6009 for hardware
type 1 (SIF = 1) or $098F for types 2 and 3.
The Protection
The copy-protection on the BSW disk consists essentially of
changes to address and data prologue and epilogue bytes on some
tracks and non-standard encoding and sectoring (for fast load) on
other tracks.
Half-tracks, track-arcing, track synchronizing, and nibble counting
do not seem to have been used. The disk can be bit-copied but seems
to be speed sensitive which might indicate that the original was
written at slower than normal speed.
The Softkey
To obtain an unprotected version of BSW, the original is allowed
to load the required ranges of memory under the control of a small
machine language program. At specific points in the boot, the
program breaks into the monitor.
A slave DOS is then booted and used to save the files in the normal
DOS 3.3 format.
Finally, a BASIC program is written to emulate the functions of
the original boot process, ending with a CALL 1317 ($525) to do
the initializing and start the program.
In an effort to make things a little more sensible, notes are included
with the softkey steps. There are quite a number of files to capture
and many machine language patches to perform, so we suggest you
take your time and double check any typed-in code.
C4] Boot DOS 3.3 into your system.
[£2] Enter the Monitor and change the VTOC buffer (explained
later):
CALL -151
B3BF:A5
C3] Return to BASIC and clear the program memory:
FP
[4] Initialize a disk with this modified VTOC:
INIT HELLO
[£5] Move the disk ][ controller ROM into RAM:
3600<C600.C6F7M
The Book Of Softkeys Volume II 19
| Enter the following machine language
A9 @5 8D 21 08 AQ 37 8D
22 08 4C 01 @8 AO 00 BO
2D 37 99 F8 13 C8 CO 05
DO F5 8D 84 14 8D 86 14
8D A@ 17 AQ 4B 8D B6 14
AQ 32 8D 25 15 AQ 37 8D
26 15 4C 00 14 AQ 01 85
1F 60 A9 4C 8D 25 05 AQ
59 8D 26 05 AQ FF 8D 27
@5 4C 84 9D AQ 2C 8D CA
14 8D D1 14 4C 00 14
Check your entry against the following disassembly:
36F8-
36FA-
36FD-
36FF-
3702-
3705-
3707-
370A-
3700-
370E-
3710-
3712-
3715-
3718-
371B-
3710-
3720-
3722-
3725-
3727-
372A-
372D-
372F-
3731-
3732-
3734-
3737-
3739-
373C-
373E-
3741-
3744-
3746-
3749-
374C-
AO 05
8D 21 08
AQ 37
8D 22 08
4C 01 08
AD 08
B9 2D 37
99 F813
c8
CO 05
DG F5
8D 84 14
8D 86 14
8D AO 17
Ag 4B
8D B6 14
AQ 32
8D 25 15
AQ 37
8D 26 15
AC 00 14
AQ OL
85 1F
60
AQ 4C
8D 25 05
A959
80 26 05
AQ FF
8D 27 05
4C 84 9D
AQ 2C
8DCA 14
8D D1 14
AC 00 14
LDA #805
STA $0821
LDA #$37
STA $0822
IMP $0801
LDY #$00
LDA $372D,Y
STA $13F8,Y
INY
CPY #805
BNE $3707
STA $1484
STA $1486
STA $17A0
LDA #$48
STA $1486
LDA #$32
STA $1525
LDA #837
STA $1526
IMP $1400
LDA #$01
STA $1F
RTS
LDA #$4C
STA $0525
LDA #$59
STA $0526
LDA #$FF
STA $0527
JP $9084
LDA #$2C
STA $14CA
STA $14D1
IMP $1490
The Book Of Softkeys Volume II
Save the boot ROM and program:
BSAVE CODEBREAK,AS$3600,LS14F
How
CODEBREAK Works
The CODEBREAK program was developed by boot code tracing
the original disk. It operates as follows:
3600 . 36F7
3732 . 3743
3744 . 374E
Copied from the disk controller card, reads in
the track.
Places JMP ($4C) to $FF59 at $0525 which
allows us to break into the Monitor after the
last files are loaded. The boot is continued by
cold-starting the BSW DOS with a JMP $9D84.
Used later to store $2C (a harmless BIT
instruction) on top of two JSR instructions used
to load the hi-res page two graphic. We will
change the JMP $1400 at $372A to a JMP
$3744 after we have saved the logo. We can
then use the space from $4B00—$S5AFF for the
third portion of the type 2 and 3 loads.
Whew! Let’s Get Some Files
Put the BSW disk in the drive and execute CODEBREAK:
3600G
[3] When the drive stops, make the following machine language
patch:
1300: 2C 81 CO 20 55 13 FO 06
130
C 80 CO 4C 15 13 20 3E
1310: 13 FO 1C EA EA
A 1300L should produce:
1300- 2C 81 CO
1303-28 55 13
1306- FO 06
1308-2 80 CO
130B- 4C 15 13
13QE- 20 3E 13
1311- FOIC
1313- EA
1314- EA
1315- A201
ete...
BIT $C081
ISR $1355
BEQ $130E
BIT $C080
IMP $1315
JSR $133E
BEQ $132F
NOP
NOP
LDX #$01
The Book Of Softkeys Volume II 21
Because our softkey requires Applesoft to be installed before
running, some minor changes to the BSW type-checking routine at
$1300 are needed to maintain maximum compatibility. The BSW
type-checker normally first checks for a RAMcard by writing and
verifying that every bit pattern can be stored at $D000. This would
clobber Applesoft which might have been loaded there by the user
before running the softkey version. To handle this situation, the
above code first enables motherboard ROM with a BIT $C@81 and
calls the BSW ‘check for Applesoft’ routine at $1355. This routine
returns with the zero flag set if Applesoft is found. If it is found,
we go to $130E where we check for a RAMcard via the JSR $133E.
If a RAMcard is found, the code branches to the //e-checker at
$132F. That code will exit with a ‘type 2° if a //e is not found or
with a ‘type 3° if it is found.
If Applesoft is not found in motherboard ROM, execution falls
through to $1308. We couldn’t have gotten here with the softkey
version if Applesoft were not in Slot 9, so it is re-activated and the
code exits indicating a ‘type 1’. If the ramcard check at $13E fails,
the routine also exits as a ‘type 1’.
Let’s Continue
Move the BSW code out of the way so our slave disk can
boot:
1400<9000.9BFFM
Put the slave disk in the drive and boot it:
c600G
22] We will now save as many files as possible:
BSAVE TYPECHECK,AS1300,L$69
BSAVE BSW.LOGO,A$4000,L$2000
BSAVE BSW.48K.1,A$6000,L$3000
BSAVE BSW.48K.2,A$2500,L$1B00
BSAVE BSW.48K.3,A$1400,LSAA6
EE | We are ready to move on to the ‘type 2’ files. So hop into
the Monitor and load CODEBREAK:
CALL -151
BLOAD CODEBREAK
Prepare CODEBREAK for ‘type 2’ files:
372E:02
(45) Enable the ‘hi-res graphic load disabler’:
372B:44 37
22 The Book Of Softkeys Volume II
Put the BSW disk in the drive and execute the modified
CODEBREAK program:
3600G
Remember, the hi-res graphics load has been disabled so don’t be
alarmed when you don’t see the logo appear.
(47] Move the file out of the way so we can boot:
2800<800.1FFFM
Boot the slave disk again:
C600G
Save all of the ‘type 2° files:
BSAVE BSW.64K.1,A$6000,LS3000
BSAVE BSW.64K.2,A$2800,LS1800
BSAVE BSW.64K.3,AS4B00,LSFA6
[20] To get the //e files, enter the Monitor, load CODEBREAK,
and tell it we want ‘type 3° files:
BLOAD CODEBREAK
CALL -151
372E:03
[21] Prevent the hi-res graphic load:
372B:44 37
[22] Put the BSW original in the drive and start up
CODEBREAK:
3600G
[23] Move this file out of the slave disk’s boot path:
2800<800.1FFFM
Put the slave disk in the drive and boot it by typing:
C600G
[25] Now save the //e files:
BSAVE BSW.//E.1,A$6000,L$3000
BSAVE BSW.//E.2,A$2800,L$1800
BSAVE BSW.//E.3,AS4B00,LSFA6
What’s Next?
We must now capture the initialization code which resides in pages
$5—$7. This is not as straightforward as the other files because this
The Book Of Softkeys Volume II 23
memory range is part of the page 1 text screen. When we jump to
the Monitor at $FF59 it immediately begins to print its prompt and
scroll the screen. This action quickly destroys the BSW data stored
there.
The data must be moved out of the text page before anything is
printed. We could modify CODEBREAK to move the data before
jumping to the Monitor, but we hate typing in code especially when
there is an interesting alternative. BSW short-circuits the character
switch pointer ($36—$37) by pointing it to an RTS instruction at
SFF58 just before it cold-starts its DOS. This is necessary to prevent
its DOS from destroying the data in the text page, since DOS
normally prints a few prompts and carriage returns to the text screen
as it starts up.
We will take advantage of this by entering the Monitor at $FF62
instead of $FF59. This will prevent the Monitor from fixing the
character switch and give us time to move the data manually. Si
no characters can be printed to the screen, we will be ‘blind’ for
a moment so type carefully.
Tell CODEBREAK to turn off the drive and JuMP into the
Monitor without resetting the character output switch:
BLOAD CODEBREAK
CALL -151
3732:2C E8 CO 4C 62 FF
Put the BSW original in the drive and boot it with:
3600G
You will not see any of the characters you type, so be careful. If
you think you made a mistake, type (3X) and start over.
Move the file out of the way (be careful):
2500<500.7FFM
Reset the character output switch and enter the Monitor:
FF59G
You should now see the Monitor prompt. If you type 2500L, you
should see:
2500- 208604 JSR $0486
2503- AS 1F LDA $1F
2505- OA ASL
etc...
If this is what you see, you've got it! If not, try Steps 27 through
29 again.
Put the slave disk back in the drive and boot it:
c600G
24 The Book Of Softkeys Volume II
[31] Save the code beginning at $0525:
BSAVE BSW.$525.$7FF,A$2525,L$2DB
Getting The CATALOGable Files
The next step is to capture the CATALOGabIe files from the BSW
original. In order to do this, the RWTS (Read or Write a
Track/Sector) routine of our slave DOS must be modified to handle
the non-standard prologue and epilogue bytes of the BSW disk.
[32] Enter the Monitor and make the necessary changes to DOS:
CALL -151
B8E7:D4
B8F1:D5
B8FC:D6
BOSF:96
BO6A:BF
B991:94
B994:18 60
A CATALOG of the BSW original should reveal the names of
the files mentioned earlier. Notice the extra blank line at the top
of the listing. This is where the A filename was printed. Since it
is a tedious procedure to change DOS like this, it is convenient that
we can place all these files into memory at the same time.
[33] Load the files:
BLOAD INIT,AS6300
BLOAD 0$301,A$7301
BLOAD PASSWORD!,AS$8000
LOAD UTILITY
UTILITY contains two lines that call a machine language
subroutine. This routine is used by UTILITY to change the BSW
DOS from non-standard to standard and back again depending on
whether the BSW disk or the data disk is being accessed. UTILITY
calls the routine through the now famous ampersand ( & ) vector.
Happily, our slave DOS will be the same format for both the BSW
softkey disk and our data disks. If we remove the & calls, UTILITY
will work fine with our new unlocked BSW disk.
Prepare to edit line 12:
HOME: POKE 33,33: LIST 12
Using the keys, and right arrow (]Jkey, remove
from this line the &1 and &@.
The Book Of Softkeys Volume II 25
Remove the &1 and &@ from line 98:
LIST 98
To save the files, we must switch back to standard DOS
sector marker bytes. Insert the slave disk and type:
CALL -151
B8E7:D5
B8F1:AA
B8FC:AD
B935:DE
B955:D5
BOSF:AA
B96A:96
B991:DE
We can now save the files in standard format:
SAVE UTILITY
BSAVE INIT,A$6300,L$18
BSAVE 0$301,A$7301,LSCF
BSAVE PASSWORD!,AS$8000,LS$180
We have finally obtained all the required files from the BSW
original disk. The remaining tasks are:
1) Write a program to emulate the boot process.
2) Write two small machine language DOS patches.
The Emulation Program
Many of the BSW files were relocated before they were saved
to our slave disk. These files can be loaded back into position simply
by specifying the Address parameter of the BLOAD command.
However, there are four files that must be given special
consideration.
The BSW. 48K. 3 file is loaded by the BSW original between $9000
and $9BFF. This would destroy our slave DOS’s file buffer even
if we set MAXFILES 1. A close examination of the file reveals that
it contains no meaningful data past $9AA5 which is the bottom of
the first DOS file buffer. When we saved the file in Step 12, the
length parameter was shortened to allow us to BLOAD the file
without overwriting the file buffer.
For types 2 and 3, the same problem occurs with BSW. 64K.3 and
BSW.//e.3 and the same solution has been used.
The BSW.64K.2 and BSW.//e.2 files both need to be loaded in
the range $800—$1FFF. This is normally Applesoft program space
and would conflict with our HELLO program.
The solution is to cause DOS to load our HELLO program into
the unused space starting at $2000 instead of the normal $800. Since
our program will be fairly short, we can load it at $2000 for all
26 The Book Of Softkeys Volume II
three hardware types and not conflict with BSW.48K.2 at $2500.
After booting the slave disk, type in the following Applesoft
program. When you have checked for and corrected any errors,
SAVE it with SAVE HELLO feu).
100 IF PEEK (104 ) <> 32 THEN POKE 8192 ,@ : POKE 104 ,32 : PRINT CHRS
(4) “RUN HELLO"
11 TEXT : HOME : NORMAL : IF PEEK (49152 ) = 155 THEN POKE 49168 ,@ :
POKE 104 ,8 : PRINT CHR$ (4 ) “RUN UTILITY"
120 |F PEEK (49152 ) = 197 OR PEEK (49152 ) = 229 THEN POKE 49168 ,6 :
PRINT CHRS (4) “FP”
130 POKE 49168 ,@ : PRINT CHRS (4) "MAXFILESi"
140 PRINT CHR$ (4) "BRUN TYPECHECK ,A$1300"
175 PRINT CHRS (4) "BLOAD BSW.LOGO, AS40900"
180 POKE 49234 6 : POKE 49237 ,@ : POKE 49232 ,@ : POKE 49239 6
190 PRINT CHR$ (4) "BLOAD 0$301,A$301"
200 PRINT CHRS (4) “BLOAD INIT,A$2D0"
210 PRINT CHR$ (4) "BLOAD WRITEPROTECT , A$B760"
220 1F PEEK (31 ) > 1 THEN 268
230 PRINT CHR$ (4) "BLOAD BSW. 48K. 1, A$6000"
249 PRINT CHR$ (4) "BLOAD BSW. 48K .2,A$2500"
250 PRINT CHR$ (4) "BLOAD BSW. 48K.3,A$9000" : GOTO 340
260 PRINT PEEK ( - 16255 ) + PEEK ( - 16255 )
270 IF PEEK (31 ) = 3 THEN 310
280 PRINT CHR$ (4) "BLOAD BSW.64K.1,A$D000"
290 PRINT CHRS (4) "BLOAD BSW.64K.2,A$800"
30G PRINT CHRS (4) “BLOAD BSW.64K.3,A$8B00" : GOTO 340
310 PRINT CHRS (4) "BLOAD BSW. //e.1,A$D000"
320 PRINT CHRS (4) “BLOAD BSW. //e.2,A$800"
33Q PRINT CHRS (4) "BLOAD BSW. //e.3,A$8B00"
340 POKE 44802 ,234 : POKE 4483 , 234 : POKE 44804 .234 : POKE 44723
+4: POKE 216 ,255
345 PRINT CHR$ (4) "BLOAD PATCH, ASBFC8”
359 PRINT CHR$ (4) "BRUN BSW. $525. $7FF,A$525"
This program does not create any variables. In particular, the
CHR$(4) must be used repeatedly rather than defining a D$ =
CHR$(4) since strings would be stored below HIMEM and conflict
with files to be loaded there. The program length has been minimized
by deleting unnecessary spaces in DOS commands since it must fit
between $2000 and $24FF.
The HELLO program begins by determining where it has been
loaded. Location 104 ($68) contains the high byte of the start of ©
Applesoft program pointer which is normally $08. If this value is
not 32 ($20) then the program pokes a zero at 8192 ($2000) and
changes the pointer to point there. A DOS command to RUN
HELLO then reloads the program at $2000 and starts it running.
Of course, the second time through, 104 will contain 32 and the
program carries on.
The Book Of Softkeys Volume II 27
Line 110 tests for the key waiting at the keyboard and, if
found, resets the start of Applesoft pointer to $0800 and RUNs
UTILITY. As a handy exit, Line 12 checks for upper or lower-
case e at the keyboard and, if found, gives the DOS FP command
to reset the pointer to $0800, clear the program and stop. This is
convenient when you want to examine files on the disk; just hit 1E)
during the boot, then load whatever you wish to look at.
Line 130 clears the keyboard of any other keys and then sets
MAXFILES 1. Line 14@ runs TYPECHECK to determine the
hardware configuration and lines 15@—19@ load the files common
to all three hardware types. Line 160 sets the soft-switches to display
the hi-res page 2 logo. The WRITEPROTECT file in Line 190 is
created below.
Line 200 checks location 31 ($1F) and skips to line 140 if *
“type 2’ or ‘type 3” has been determined by TYPECHECK. For ‘type
1’, lines 218—239 load the ...48K files and GOTO 320 to finish
execution.
Line 240 write-enables the RAMcard so it may be loaded for types
2 and 3. Line 250 directs flow to either the ...64K or ...//e file
loading.
Line 320 pokes three NOPs into DOS at 44802 ($AFQ2). This
skips putting DOS onto data disks initialized by BSW and, although
not done by the original BSW, the 4 poked at 44723 frees that extra
space for data storage. The Applesoft ONERR flag 216 ($D8) is
set to prevent DOS from issuing its own error messages since the
program handles these itself.
Another small piece of code is loaded into DOS in line 33@ and
the initialization program is run to start the BSW program.
The Write-Protect Patch
There is a small section of code at $B700 in the BSW DOS which
is called whenever a write operation is about to be performed. This
code reads the catalog track of the disk in the selected drive and
checks for the non-standard disk bytes of the original BSW disk.
If it finds this pattern, the carry flag is cleared, location $9AAC
is loaded with a $4D and the routine returns to the caller. If the
pattern is not found, the carry flag is set and the routine returns.
We originally thought this might be some kind of copy protection.
It turned out to be a routine to prevent the user from writing to the
original disk when he should not. Simply putting a write protect
tab on the disk would provide similar protection, but this disk is
likely to be used by children and it is easier to remove the write-
protect tab than to change the format of the disk (as we have seen).
In addition, the UTILITY program is used to customize BSW to the
user’s needs. It stores the initialization data on the BSW original
disk and the write-protect tab would need to be removed for this
operation.
28 The Book Of Softkeys Volume II
It seemed logical to find a way to support this valuable feature.
DOS maintains a buffer at $B3BB which contains the VTOC
(Volume Table Of Contents) for the most recently read disk. This
buffer is read from Track $11, Sector $0 on any standard DOS disk.
It is also written to a disk when that disk is INITed.
Not all bytes in the VTOC are used by DOS. Before we INITed
our slave disk, we changed one of these unused bytes ($B3BF) to
an $A5. This byte will be used by our own routine at $B700 to
determine if the disk about to be written is our softkey version of
BSW.
Enter the Monitor and type the code that implements this
feature on the softkey disk:
CALL -151
B700: A@ 09 B9 EB B7 99 3D B7
B708: B9 47 B7 99 EB B7 88 10
B710: F1 AC C1 AA ADC2 AA 20
B718: B5 B7 BO 10 AC BF B3 CO
A5 FO 03 38 BO 06 A9 4D
8D AC 9A 18 AQ 00 8D BF
B3 AQ 09 B9 3D B7 99 EB
B7 88 10 F7 60 00 00 00
00 00 00 00 00 00 00 00
11 00 FB B7 BB B3 00 00
01
Disassemble and check this code
B700L
B700- AG 09 LOY #809
B702- B9EBB7 LDA $B7EB,Y
B7@5- 9930B7 STA $B73D,Y
B7@8- B947B7 LDA $B747,Y
B7OB- 99EBB7 STA $B7EB,Y
B7GE- 88 DEY
B7OF- 10F1 BPL $B702
B711- ACC1AA LDY $AACI
B714- ADC2AA LDA $AAC2
B717- 208587 JSR $B7B5
B71A- BO 10 BCS $B72C
B71C- ACBFB3 LOY $B3BF
B71F- CO AS CPY #$A5
B721- FO 93 BEQ $B726
B723- 38 SEC
8724- BO 06 BCS $B72C
B726- A9 4D LDA #$4D
B728- 8DAC9A STA $9AAC
B72B- 18 CLC
B72C- A908 LDA #$00
The Book Of Softkeys Volume II 29
B72E- 8DBFB3 STA $838F
B731- A009 LDY #$09
8733- 893DB7 LDA $B73D,Y
B736- 996B87 STAS$B7EB,Y
B739- 88 DEY
B73A- 10 F7 BPL $8733
B73C- 60 RTS
B73D.B750
B730- 00 08 00
B740- 00 00 00 00 00 00 00 00
8B748- 11 00 FB B7 BB B3 99 05
B750- 01
Save the code:
BSAVE WRITEPROTECT,AS$B700,L$51
WRITEPROTECT uses the RWTS routine to read the VTOC from
the disk into the VTOC buffer at $B3BB. In order to do this without
disturbing BSW’s use of RWTS, $B700—$B710 save the current
RWTS parameters into temporary storage at $B73D and replace
them with the VTOC-reading parameters from the table at $B747.
Then the RWTS is called to read the VTOC.
If an error occurs, it may well be because the disk is unformatted
so we exit as ‘OK-to-write’ by branching to $B72C. If no error
occurs, the value at $B3BF is compared to our constant ($A5). If
our protected disk was in the drive, this byte would match and the
branch to $B726 would be taken. Otherwise, it is safe to write the
disk so the carry is set and we branch to $B72C.
At $B726, $4D is stored at $9AAC (like the original), the carry
is cleared indicating ‘not-OK-to-write’ and execution drops into the
exit code at $B72C.
At $B72C, a is stored at $B3BF to guarantee that a $A5 is never
written out to a data disk since that would write-protect it. Then
at $B731, the parameters saved at the start of the routine are restored
before returning to the caller.
One other tiny piece of initializing code is needed to satisfy
the BSW program’s use of DOS. Enter it as follows:
BFC8: 20 DC AB A9 10 8D F@ B3
BFDO: A9 23 8D EF B3 60
and then:
BSAVE PATCH,ASBFC8,L$14
Your softkey slave disk is now ready to boot! We have used this
softkey version of BSW to write this article and that has allowed
us to weed out many of the bugs. We were able to test all three
hardware-dependent versions to some degree, so you should have
30 The Book Of Softkeys Volume II
few, if any problems. The use of a fast DOS makes a welcome
improvement. We have successfully used Diversi-DOS but have not
tried any of the others, although they should work just as well.
The tutorial on the back of the BSW master disk is not protected
and may be copied with the normal copy methods, but for maximum
protection we recommend that you mark the disk as a ‘‘master’”
so BSW cannot write to it. This can be done by using Steps | to
4 of this softkey to INIT the disk on which you wish to copy the
tutorial. Then, use the DOS 3.3 FID program to copy all the files
from the original tutorial disk to the INITed back-up disk.
An alternative method is to use a disk-ZAP type program to modify
the fifth byte of Track $11, Sector $@ to an $A5. This method can
be used to protect other disks that might be accidentally written by
someone using the BSW program.
%
Sean Williams’ APT for...
Castle Wolfenstein
How to Kill The S.S. Guards
If you are tired of running into S.S. guards, especially when
you no longer have any grenades to destroy them with, use
the following technique and any S.S. can be killed with the
use of bullets.
1) As the S.S. guard approaches, point your gun at him and
run into him.
2) As the screen is going through the collision routine press
the key which makes the gun point at the S.S. guard again.
3) To take his bullet-proof jacket away, press (0).
4) If the screen replies with SEARCHING..., run into the
guard again. (Remember to point your gun at him again during
the collision routine).
5) Press (U) again and the guard will lose his bullet-proof
jacket.
6) The guard can now be killed with plain bullets.
Note: This procedure works best if you are wearing a vest
yourself. .
The Book Of Softkeys Volume IT 31
Canyon Climber
Datasoft
Softkey for Canyon Climber
by John Liska
(Hardcore COMPUTIST # 10, page 8)
Requirements:
Apple Il with 48K
FID
One blank disk
Canyon Climber is an excellent 3-level arcade game in which you
attempt to scale a hi-res version of the Grand Canyon.
To remove the copy-protection, you need to make some
modifications to DOS so that errors generated by the nonstandard
end of address and end of data marks are ignored. The single binary
file can then be transferred to a normal 3.3 disk with the use of FID.
| First boot up with a DOS 3.3 disk and make the
modifications to DOS:
PR#6
CALL -151
B925:18 60
B988:18 60
BE48:18
3D0G
[2] BRUN FID and use the wildcard character (= ) to transfer
the one file on the original Canyon Climber disk to a standard 3.3
disk. You must do this because the file name contains embedded
control characters.
BRUN FID
Once you have transferred the file, use a disk editor or Copy J
Plus to change the file name so that its control characters are
eliminated.
32 The Book Of Softkeys Volume II
Caverns of Freitag
Muse Software
Backup For The Caverns Of Freitag
by C. J. Singer
(Hardcore COMPUTIST # 6, page 6)
Requirements:
Apple Il, with 48K and Applesoft in ROM
One disk drive
FID from 3.3 System Master disk
One blank disk
The Caverns of Freitag original disk
Being the parent of three kids who like to play games on the
computer, my first thought after purchasing a program is how to
back it up before the kids have an accident with the original.
What I usually first try to do is backup the disk with Locksmith,
but I don’t really care for this method because it doesn’t allow you
to look at the program to see how it works and it does not allow
you to modify it.
Here’s my first, albeit somewhat tedious, explanation of how to
backup the Caverns of Freitag. | will provide another, easier method
next. The game comes from Muse Software, of Castle Wolfenstein
fame.
The Hard Way
C4] Boot the Caverns of Freitag disk from slot 6:
PR#6
[£2] while the disk is booting, stop the HELLO program from
running: .
C3] To make sure the HELLO program is in memory, type:
LIST
You should see THE CAVERNS OF FREITAG listed on your
monitor.
The Book Of Softkeys Volume II 33
If no program is listed, go back to Step 1 and try again.
C4] The Caverns of Freitag uses a modified DOS, which has
changed some of the DOS commands. The INIT command has not
been changed, however, so we can INITialize a blank disk, which
will contain the modified DOS along with the HELLO program
currently in memory. So, insert a blank disk into your drive and type:
INIT HELLO
If you want to see how Muse has modified the normal DOS
commands you can use a sector editing program, such as ZAP from
Bag of Tricks or DiskEdit, to view Track $1, Sectors $7—$8. If
you compare what you find with a list of the normal DOS commands
you will find that:
the SAVE command has been changed to LSDK
the CATALOG is now KSJFLKA
the MON to 983
and BSAVE to 87364.
| Now put your original disk back in the drive and use Muse’s
modified CATALOG (KSJFLKA) to see what files are on the disk:
KSJFLKA
[£6] Write down the list of files which are displayed so that you
can save them to the disk you just initialized. You don’t have to
write down the HELLO file since it has already been transferred.
The first file on your list should be a binary file called
OILER so load it into memory:
BLOAD OILER
When a new binary file is loaded into memory, its address
is stored at $4A72—$AA73 (hi/lo format) and its length is stored
at $AA60—$AA61. So enter the Monitor and display the address
and length of the file OJLER:
CALL -151
AA72.AA73
AA60.AA61
For the OILER file you should come out with an address of $02DE
and a length of $00D5.
[9] Put your backup disk in the drive and use the 87364 (the
modified BSAVE command) to save the file, using the address and
length parameters you just determined in the previous step:
87364 OILER,AS@2DE,LS00D5
Repeat the process of BLOADing each binary file from the
Caverns of Freitag original disk, determining its address and
34 The Book Of Softkeys Volume II
length and using the 87364 (BSAVE) command to transfer the files
onto the backup disk.
(41) For the Applesoft files on the list, you can just LOAD each
one of them from the original disk and, then, LSDK (SAVE) them
onto the backup disk.
Like I said; the above procedure is long and tedious, but it works.
Now for the easy method!
The Easy Way
[4] Go through Steps 1 through 4, outlined above.
C2] Insert your DOS 3.3 System Master and boot it
PR#6
[3] Load the FID program into memory at $6800 where it won’t
get overwritten when we boot the Caverns of Freitag disk in the
next step:
BLOAD FID,AS6800
C4] Boot the original Freitag disk and, again, stop it from
running the HELLO program:
PR#6
6}
Cs] Enter the Monitor, memory move FID from $6800 back
down to $803 and, then, run FID to copy the files:
CALL -151
803<6800.9000M
803G
[£6] Copy the files from the original disk to the blank, initialized
disk using FID’s wildcard option.
Now that you have a backup copy you can look at the Caverns
of Freitag, using (5C) and KSJFLKA for CATALOG. You can
LOAD or BLOAD to study or modify any of the files on the disk.
If you have a sector editor you may even want to change Track
$1, Sectors $7—$8, so that they will contain the normal DOS
commands, instead of the ones which Muse put on the disk.
bg
The Book Of Softkeys Volume II 35
Crush, Crumble & Chomp
Automated Simulations (Epyx)
Backing Up Crush, Crumble & Chomp
by Jeff Rivett
(Hardcore COMPUTIST # 7, page 5)
Requirements:
Apple II Plus or compatible
Replay II card and utility disk with SOFTMOVE program
Crush, Crumble, and Chomp
An initialized DOS 3.3 disk with HELLO as the boot program
FID program from 3.3 System Master disk
Crush, Crumble, and Chomp is copy-protected only on areas of
the disk that contain the two main Applesoft programs. The rest
of the files, and there are a few of them, can be transferred to a
copy disk using any file transfer program.
The main (copy-protected) files are called:
CG@N)CCMAIN
CENjcc
C4] Run FID (or any other file transfer program) and copy all
the files, except the two copy-protected ones, from the original to
the blank initialized disk:
BRUN FID
C2] After transferring the unprotected files to your initialized
copy disk, boot the original Crush, Crumble and Chomp disk:
PR#6
[C3] Make a Replay copy at the point where the set-up program
starts and asks you the question DO YOU WANT TO CONTINUE
A SAVED GAME?
[£4] Now, run SOFTMOVE from the Replay II utility disk.
SOFTMOVE assumes that there was an Applesoft program in
memory when you pushed the Replay button to make the copy. This
36 The Book Of Softkeys Volume II
Applesoft program is put back into memory intact, with a normal
DOS resident instead of the copy-protected DOS.
[£5] You can now save the Applesoft file to the disk that contains
all the files you have transferred. Save it with the name CEIN)CC:
SAVE C@N)CC
Ce] Boot the original again. This time let the set-up progress
to the point where the play actually starts and then make another
Replay copy. Repeat the SOFTMOVE procedure you used previously
on the first protected program. Save this file as CEON)CCMAIN:
SAVE C@N)CCMAIN
That’s all there is to it. These files can now be modified at will.
A last note: The SOFTMOVE program is a surprisingly useful
utility. For instance, if you typed in a huge Applesoft program and
forgot that there was no DOS in the machine, you might want to
shoot yourself (but don’t). With Replay I] and SOFTMOVE you can
make a Replay copy and have the file on disk in no time, almost
as if DOS was in the machine all along.
Johnny Yukon’s APT for.
iner 2049e
Unlimited Bounty Bobs
For this APT you need to have an old F8 ROM on the
motherboard or Integer card. This APT will let you choose
the starting level and will give an unlimited number of Bounty
Bobs to player number one.
1) Boot up Miner 2049er and go through the joystick
adjustment routine.
When the game asks ONE OR TWO PLAYERS?, hit
to get into the Monitor.
3) Enter the desired starting level minus 1 at $814 and the
actual starting level at $812. For instance to start on level 05
type: 814:04 N 812:05
4) Enter the following:
0972:A9 @3 8D 16 08 8D 17 08 4C 81 09 N 981G
5) The game will start up and player number one will have
an unlimited number of Bounty Bobs.
The Book Of Softkeys Volume II 37
Data Factory 5.0
Micro Lab
Softkey For Data Factory Version 5.0
by L.S. Davis
(Hardcore COMPUTIST # 8, page 14)
Requirements:
48K Apple If Plus or equivalent
Two blank disks
DEMUFFIN PLUS (see How To Make DEMUFFIN PLUS article)
Like most of us, I try to follow the Golden Rule: back-up thy
disks. I did just that with Data Factory Ver. 5.0 using Locksmith
4.1.1 followed the parms carefully, read the notes and yes, it works.
However, to use the bit-copy of The Data Factory you must:
[4] Boot the disk.
C2] Open disk drive door and press when the computer
Starts to beep repeatedly.
C3] Close door and press when the computer prints
BREAK IN 5.
C4] Use the program.
This procedure sounds simple and works well, but that irritating
beeping noise causes wives to yell, dogs to howl and nerves to be
on edge. What a pain. I just wanted a copy, not problems! Why
did this disk act this way? Having read Hardcore COMPUTIST from
issue no. 1, I thought maybe the answer would be in there. So...
I searched through my old issues.
Finding lots of good hints and ideas, I began. The first thing I
saw when I booted the copy was BREAK IN 5. Applesoft, I hoped.
Articles in Hardcore COMPUTIST had mentioned using
DEMUFFIN PLUS, so | thought maybe I could DEMUFFIN the files
over to normal DOS. I tried this, but had no luck. The program
did try to work, but came up instead with the infamous J/O ERROR.
Back to Hardcore COMPUTIST for more reading.
Finding several articles which referred to reducing error checks
38 The Book Of Softkeys Volume II
on copying, I began again. I looked through my What’s Where In
The Apple book and found an area of code that looked promising.
Ina 48K Apple with DOS 3.3 booted, the code at $B8DC—$B943
is a routine which reads in a sector of data from the disk. If any
Read errors are encountered, the 6502’s carry bit is set and the 1/0
ERROR message is printed. At $B942 is the instruction which sets
the carry bit (SEC, op code $38), so if this instruction is changed
from SEC to CLC (CLear Carry, op code $18) then any Read errors
will be ignored. Hopefully, making this change would solve my
problem.
I booted the System Master to clear the trash already in memory
and made a CALL -151 Ga), entered B942:18 (RETR) (as if I
knew what I was doing) and placed my disk with DEMUFFIN PLUS
in the drive. I typed BRUN DEMUFFIN PLUS, then placed the
copy of The Data Factory in the drive and (WOW!) no I/O ERRORs.
It read the disk! Just luck? I wondered.
So, I turned off the machine and started over. I initialized two
disks with just a HELLO program and made one copy of each Data
Factory disk using the following steps:
C4] Boot System Master:
PR#6
E2] Clear the BASIC program in memory:
FP
[£3] Initialize two disks with TDF as the boot file:
INIT TDF
C4] Enter the Monitor:
+CALL -151
[5] Change the instruction at $8942 from SEC ($38) to CLC
($18) so that any Read errors are ignored:
B942:18
| Re-enter BASIC:
3D0G
Place a copy of DEMUFFIN PLUS in the drive and get up
and running.
Note: If you don’t have DEMUFFIN PLUS, you can create it by
modifying MUFFIN. See the article on How To Make DEMUFFIN
PLUS in this volume.
BRUN DEMUFFIN PLUS
There are two Data Factory disks: one Report, one Utility.
DEMUFFIN all the files on each to a disk formatted in Step 2 above,
using the ‘wildcard’ option ( = ). Replace the file called TDF on
both disks.
The Book Of Softkeys Volume II 39
When you have finished copying both disks, reboot with
a normal 3.3 disk:
PR#6
Both of your DEMUFFINed disks are standard 3.3 DOS and are
COPYAable. However, on each disk is a file TDF. This file on each
disk contains line 5 which reads: PRINT CHR$ (4) ““BRUN
READER, A$8E0@0”’. This file contains the code which causes that
obnoxious beeping. All we have to do is change the boot program
(TDF) so that it does not load and execute this code.
Load the Applesoft file TDF, delete line 5 and then reSAVE
TDF:
LOAD TDF
5
SAVE TDF
You should do this to both disks. If you want to, you can also
DELETE the file READER which is not used after you delete line
5 in TDF.
In order to prevent a reboot if is pressed, the binary file
AMPER FACTORY. OBJO needs to be modified.
[41] Load the AMPER FACTORY. OBJO file into memory (it
loads at $8240):
BLOAD AMPER FACTORY.OBJO
[42] Enter the Monitor:
CALL -151
[443] Change the instructions at $8340 from JMP $C600 (reboot
the disk) to three NOP’s:
8340: EA EA EA
Return to BASIC:
3D0G
[45] Save the modified code:
SAVE AMPER FACTORY.OBJ0,A$8240,L$1305
The disk will now boot and work just like the original, except
that you can now hit without the disk rebooting.
I have run the deprotected copies and have not yet found any
problems. I hope you have as much fun using this softkey as I had
making it. You may notice that I worked from the copy of the
original, not the original. This is much safer. That’s another of the
Golden Rules I like to follow: never use the original disk to make
changes.
40 The Book Of Softkeys Volume II
DB Master
Stoneware, Inc.
Softkey For DB Master
by Dan Lui
(Hardcore COMPUTIST # 7, page 6)
Requirements:
Apple Jt with 48K
One disk drive
DB Master (old version)
COPYA
The Inspector, or similar program
One blank disk
The old version of DB (Data Base) Master is protected very well.
The disk contains three different protection schemes.
First, it uses half-tracks from $6.5—$22.5. Second, the closing
address and data marks have been changed from the normal DOS
3.3 $DE / $AA to $DF / $AA. Third, there is a nibble-count-like
checking routine to check Track 0.
Breaking the nibble-count scheme is the most difficult task of all.
The following procedure will unlock this program. It also works
for DB’s utilities disk:
C4] Put in the DOS 3.3 System Master and type:
LOAD COPYA
[C2] Add the following lines to COPYA:
199 GOSUB 400
248 GOSUB 420
259 GOSUB 420
400 POKE 47413, 223: POKE 47423, 171: POKE 47505, 223: POKE 47515, 171
405 POKE 48351 ,201: POKE 48352,12: POKE 48353, 105: POKE 48354, 0:
POKE 48355 , 24: POKE 48356, 76: POKE 48357, 107: POKE 48358, 190
410 POKE 48741, 223: POKE 48742, 188: RETURN
428 POKE 48741, 107: POKE 48742, 190: POKE 47413, 222: POKE 47423, 170:
POKE 47505, 222: POKE 47515, 170
425 POKE 48741, 107: POKE 48742, 198: RETURN
The Book Of Softkeys Volume II a1
C3] Save the new COPYA in case you run into errors.
SAVE DB COPYADB
C4) Execute the program
RUN
| After the disk has been copied, use the Jnspector, or some
other sector editor to read and modify the following sectors:
Track Sector Byte From To
00 03 $35 DF DE
00 03 $3F AB AA
00 03 $91 DF DE
00 03 $9B AB AA
00 0E $0A A2 DO
00 0E $0B 00 12
O1 OF $C7 AQ 60
03 01 $3E 20 60
| Write-protect the disk before running.
The above procedure eliminates all three of the protection schemes
Stoneware provided on the older version of the excellent DB Master.
4
Ferrel Wheeler’s APT for...
tar Maze
Eliminating Snails and Wheels
It seems the pinwheel and the wall snail are extremely
difficult to shoot so, instead of wasting a bomb on them, here’s
a method for destroying them and anything else in the game
at no risk.
1) Drive repeatedly straight into a wall at a fairly slow speed
until the ship is completely inside a wall.
2) Once inside, turn around and position the ship so that
only enough of its nose is sticking out to still allow for firing.
When in this position, nothing can hit the ship, not even
when the snail is walking on the same wall the ship is in!
You can even use this technique to go through walls, but
this seems to use up a lot of fuel.
42 The Book Of Softkeys Volume II
Essential Data Duplicator I
Utilico Microware
Copying the uncopyable - EDD
by Steven Zupp
(Hardcore COMPUTIST # 8, page 26)
Requirements:
48K Apple J or equivalent
One disk drive
Essential Data Duplicator Version I
A blank initialized disk with no HELLO program
A basic knowledge of machine language helps but is not necessary
Integer firmware card or other means of {R&seing into the monitor
EDD (Essential Data Duplicator), in my opinion, is one of the
most incredible copy programs around. My main reason for this
praise is due to the fact that EDD requires few or no parameter
changes to duplicate many copy-protected programs currently on
the market. Its power almost makes Locksmith 4.1 look like COPYA.
Unfortunately, along with its incredible copying abilities comes
an incredible copy-protection. EDD uses four phases of super-fast
track-arcing that sounds more like an army of cockroaches tap
dancing than a disk booting. Instead of encrypting the data on the
disk itself, the tracks of data are placed in a mosaic jumble of normal
tracks, half tracks, and (yes, believe it or not) quarter tracks. This
technique is loosely known as ‘checkerboarding’ and is a very
difficult scheme to crack.
Luckily for everybody, EDD is a one-time-only load program
which leaves it open to attack from snapshot-type devices. In fact,
a friend of mine armed with his Wildcard and some address changes
successfully copied it, but his copy takes forever to load, is hard
to modify, and takes up most of a disk. So, armed with my trusty
Integer firmware card I decided to try it my way.
Getting The Data
This section deals with the breaking process in detail. If you just
The Book Of Softkeys Volume II 43
want to do it, then go to the section labeled ‘Summary.’
Boot EDD. Press any key a couple of times to get to the main
menu, then flip the switch on the card to Integer (if it’s not already
there) and press (RESET). You should end up in the Monitor.
Conveniently, EDD mainly uses the memory $800—$3FFF, with
the hi-res picture residing at $4000—$5FFF. There is some code
in the keyboard input buffer ($200—$300) but is has no effect on
the main program, and I assume it is part of a disk-loading routine.
Before booting up our normal 3.3 slave disk we need to move
the code at $800—$8FF to a safe location ($6000—$60FF) so it
won’t get stomped upon. To move the code out of the way type:
6000<800.8FFM
This moves $800—$8FF, to $6000—$60FF.
Now boot up DOS 3.3 by inserting your initialized disk in the
drive and typing:
C600G
This boots the disk in the drive in Slot 6. If your disk controller
is in another slot, replace the 6 with that slot number; i.e. Slot 7
= C700G.
When the cursor appears, enter the Monitor by typing:
CALL -151
To relocate the portion of memory we moved back to its original
location, type:
800<600.60FFM
Next we will make this hunk of data useable.
WARNING
You should now save this in case you mess up the steps following.
If there is an accident, just BLOAD DATA and begin again at
Making It Useable. To save it type:
BSAVE DATA, AS$800,LS5800
Making It Useable
The main copy-protection routine in EDD starts at $21C9.
Assuming you still have the EDD data in memory, and are still in
the Monitor, make the following modification
21C9:60
This puts an RTS at the beginning of the routine that checks certain
memory locations. All there is to be done now is to add a short
routine which will perform some necessary housekeeping functions.
Since we will not be using hi-res page 2 ($4000), we can put our
44 The Book Of Softkeys Volume II
routine over it. Because the body of the program starts at $800,
we must put a jump to our routine before that. So at $7FD we will
put a jump instruction to $4000. Type this:
7FD:4C 00 40
In our routine there are three things that need to be done:
1. Disconnect the DOS pointers. The reason for this is EDD writes
over DOS when in operation. When DOS is connected, the
CSW (Character output SWitch) and KSW (Keyboard input
SWitch) vectors are pointing to DOS. DOS looks at the
characters coming in and going out and then sends them back
along their merry way to the monitor COUT and KEYIN
routines. If DOS is connected (the pointers are set for DOS
locations) and those locations in DOS are erased, the computer
will seemingly die, unable to input or output characters. If you
want to learn more about this process refer to the section of
this article titled More On DOS Hooks.
2. Change two Zero-Page locations. These are used by EDD to
display which drives and slots are being used. These have
nothing at all to do with the operation of the program, but it
is nice to have them correct.
3. Jump to the actual start of the program (no, it’s not $800).
Also changing the reset vector to C600 adds a nice touch so that
when is pressed, EDD will reboot instead of breaking into
Applesoft. If your controller is in another slot you can change the
slot (6) to whatever slot you want, although the wisest thing to do
would be to move your controller to slot 6.
Examine the code below then type in the hex dump that follows.
4000- A9 00 LDA #$99 | ----------------------------------
4002- 8D F2 03 STA $03F2 Sets RESET vector
4005- A9 C6 LDA #$C6 to reboot
4007- 8D F3 03 STA $03F3 from slot 6
4Q0A- 20 6F FB JSR $FB6F ----~-----------------------------
400D- AQ FO LDA #$FO
4Q0F- 85 36 STA $36
4011- AQ FD LDA #$FD
4013- 85 37 STA $37 Disconnects DOS
4015- AQ 1B LDA #$1B
4017- 85 38 STA $38
4019- AQ FD LDA #$FD
401B- 85 39 STA $39
401D- A9 68 LDA #$60
4Q1F- 85 OA STA SOA Sets up screen
4921- A960 LDA #$60 display locations
4023- 85 0B STA $0B and starts program
4825- 4C 5E 09 IMP $095E
The Book Of Softkeys Volume II 45
4000: A9 0 8D F2 03 A9 C6 8D
4008: F3 03 20 6F FB AS FO 85
4010: 36 A9 FD 85 37 A9 1B 85
4018: 38 AQ FD 85 39 A9 60 85
4020: BA AQ 60 85 OB 4C SE 69
Now that you have entered the routine, it is time to save the whole
thing. Type the following:
BSAVE EDD, AS7FD, L$382B
That’s it! You can DELETE the file DATA now if you want to, or
keep it on hand as a space taker-upper on your disk.
Just BRUN EDD whenever you want to use it, and hide the
original in a locked safe in a bomb shelter and you should feel safer
(watch out for safecracking rats wielding magnets, however.)
Summary
| Boot EDD and press any key twice to get to the menu. Now
use whatever device you have to enter the Monitor. After you are
in the Monitor type:
6000<800.8FFM
C2] Now insert your blank disk and type:
C600G
Cs] When the prompt appears, re-enter the Monitor:
CALL -151
C4] Type in the new code.:
800<6000.60FFM
2C19: 60
7FD: 4C 00 40
4000: A9 00 8D F2 03 A9 C6 8D
4008: F3 03 20 6F FB A9 FQ 85
4010: 36 A9 FD 85 37 A9 1B 85
4018: 38 AY FD 85 39 AQ 60 85
4020: 0A AQ 60 85 OB 4C SE 09
| Save it as EDD:
BSAVE EDD, AS7FD, L$382B
That’s all! Just type BRUN EDD to run it.
More On DOS Hooks
This exercise is for some rainy day when you have nothing better
to do.
46 The Book Of Softkeys Volume II
First boot a normal DOS disk. Whenever you get a cursor on the
screen, type:
CALL -151
to get into the Monitor. Now we will check the present settings of
the CSW and KSW switches. Type:
36.39
You should see:
36- BD 9E
38- 81 9E
This means CSW is set to $9EBD and KSW is set to $9E81, both
DOS locations. Now we will erase DOS. Type:
800: 00
801<800.BFFFM
Wait about 5 seconds. Your Apple is temporarily dead. It will
continue to be so until you press to resurrect it.
When you press [RESE!), there will be a beep and you will see a
status line indicating $9DC1. What happened is when you pressed
the computer realized what happened, set the CSW and
KSW switches back to normal, and showed you where the screw-
up was.
When the move routine had finished, the Apple needed to output
a character, the ** prompt for the monitor. So it looked at the CSW
pointer which still pointed at DOS, which we just erased. When
it went to the location $9EBD all it found was zeroes. It couldn’t
signal an error. It couldn’t even beep or show any sign of output
or input. Well, fortunately we have the key for such
situations. The key is wired directly to the Apple’s
microprocessor, which means it couldn’t care less what the CSW
and KSW pointers were. What happened is the routine went
through memory and fixed all the locations to default values,
including our pointers. The Apple has a very good memory and it
loves to beep at us when we screw up, and it does just that by beeping
and telling us exactly where the error was.
Now that we're back on stable ground let’s look at our pointers
and see what’s happened. Type:
36.39
You should see:
36- FO FD
38- 1B FD
Note that these are the Monitor locations COUT1 and KEYIN. When
DOS is not connected (like now) these are the values that are present.
When DOS is connected all input and output goes to DOS and then
to these locations.
The Book Of Softkeys Volume II a7
Now clear the memory from $800—$BFFF again by typing:
800:00
801<800.BFFFM
After a few seconds you will see the Monitor prompt again. Why
did the Apple die the first time we did this and not now? It is because
the first time we did this the CSW and KSW pointers were pointing
at the DOS locations which we later erased, causing massive heart
failure. This time they were pointing at safe ROM routines which
cannot be erased.
So remember to never erase or change the routines at $9EBD and
$9E81 unless you know how, and have the incoming data ending
up at $FDF@ and $FD1B.
Alternative devices
The snapshot-type devices currently on the market advertise the
ability to stop the execution of any program. However, when I tried
to use Wildcard to stop EDD and jump into the Monitor there were
problems. Evidently, EDD can recognize that something’s amiss
when this is done because it changes parts of itself and will not
resume operation. If you have another type of snapshot card, or
want to try it anyway, just use it to break into the Monitor instead
of a firmware board.
I will list what I know about EDD so that if you want to try fixing
or avoiding this problem you can give it a try. My friend successfully
made a Wildcard copy of EDD using a few address changes. This
suprised me since I had found, when I had used it and gone into
the Monitor, that it had changed itself. His copy took up a whole
disk and was not easily modified. Here are the changes he made
if you want to try them with your snapshoter or figure out their
meaning.
113A: AQ
113B: 0B
113: EA
21D8: 00
21DF: 00
21DE: 00
Some of the area around $CE9 was also changed, and there are
probably others.
48 The Book Of Softkeys Volume II
Essential Data Duplicator If
Utilico Microware
Copying Essential Data Duplicator III
by Joseph Leathlean
(Hardcore COMPUTIST # 10, page 7)
Requirements:
48K Apple Il or Apple II Plus
One disk drive
Blank disk with no HELLO Program
Integer Firmware Card or other means to into the Monitor
The method of backing up the Essential Data Duplicator I which
appeared in the previous EDD softkey can be modified so that the
technique also works on EDD IH. Only two changes need to be
made.
On EDD III the main copy-protection scheme starts at $3EE8
rather than at $21C9. This byte has to be changed to $60 (RTS).
The program’s main entry point has also been moved from $095E.
On the version dated January 25, 1984, the new entry point is $0955.
On later versions the entry point is $0953. You may have to
experiment with your version to find the proper entry point.
So if you want to perform this EDD III softkey, follow the
procedure explained in the previous EDD and make the following
changes:
[4] Place a $60 at address $3EE8 instead of at $21C9.
C2] For the January 20, 1984 release of EDD change address
$4026 in the hexdump to a $55. For later versions try changing it
to a $53.
%
The Book Of Softkeys Volume II a9
Gold Rush
Sentient Software
Deprotecting Gold Rush
by Clay Harrell
(Hardcore COMPUTIST # 9, page 7)
Requirements:
48K Apple I with at least one DOS 3.3 disk drive
Old-style F8 Monitor ROM or Super-Saver ROM
Blank disk
Gold Rush
It seems that there are many ‘maze’ games flooding the Apple
market, now. Most have pretty much the same theme of eating all
the dots before you get destroyed. I do enjoy these games, but variety
is the spice of life! Gold Rush uses the ‘avoid the bad guys’ theme
without the maze. It is entertaining, fun, and different from other
chase "em games. Being intrigued by the game, I wanted to learn
more about it...
Gold Rush boots fairly quickly and is a ‘single-load’ game, which
means it does not require any other data from the disk after the initial
load. These types of programs are candidates for BLOADable files.
When booting the disk, an Applesoft prompt appears at the bottom
left of the screen which means there is some sort of modified DOS
present. Disks like these are excellent candidates for deprotection
with Super IOB. The Swap controller is probably the most versatile
since one doesn’t usually have to figure out the protection used when
using it. With this in mind, we merely boot Gold Rush, into
the Monitor and move RWTS from $B800—$BFFF down to $1900
where the standard Super IOB swap operates. This is done from
Monitor with the command 196@<B800.BFFFM
Now boot a 48K slave disk and run SUPER IOB.SWAP which
is Super IOB with the NewSwap controller merged (see Super IOB
in this volume). Remember that booting a slave disk only destroys
memory from $00—$8FFand $9600—$BFFF, so this keeps our Gold
Rush RWTS safe at $1900—$20FF.
50 The Book Of Softkeys Volume II
After making the copy, our new disk is quite CATALOGable.
Also, the disk is now deprotected and completely COPYAable and
runs fine (providing the boot file name is BOOT instead of the normal
HELLO). But remember, this is a single-load game, and as I
mentioned before, a good candidate for a BLOADable file.
CATALOG
reveals one file named BOOT. You can BRUN this file and the game
will load and execute just fine. But we want this game in a file that
we can FID to another disk or BLOAD. To start the analysis:
BLOAD BOOT
Now enter the Monitor with:
CALL -151
and type:
AA60.AA73
The first two bytes listed are the length of the last BLOADed file,
and the last two bytes listed are the address the last BLOADed file
was loaded at. These are in ‘bassackward’ order, with the low byte
first and the high byte last (in other words, 00 03 means $0300,
or 88 45 means $4588). We can see from this listing that the file
BOOT loads at $300 and is fairly short (less than $100 bytes long).
If you examine the code at $300, you will find that Sentient is
using second stage DOS to load in the game from $800 to $95FF,
and then jumps to $BQ0 to start the game.
Sentient Software RWTS is not as friendly as the normal RWTS.
They load $1B with the track number, $1C with the sector number
and, $1F with the top page to load to. Then they Jump SubRoutine
to $B7B5 to do the load. Look at the code and try to understand
it (If you cannot, well, forget it).
After some groaning and grunting, we now know that Gold Rush
loads from $800—$95FF and starts at $B00. With this necessary
information in hand, here are the exact steps for deprotecting Gold
Rush:
[4] Boot DOS 3.3 and INITialize a disk with a null HELLO file.
FP
INIT HELLO
[2] Boot Gold Rush and after the game loads and the drive stops
spinning, into the Monitor.
C3] Move page eight out of the way so we can boot:
6400<800.8FFM
[4] Boot the disk you just initialized:
C600G
The Book Of Softkeys Volume II 51
C5] Enter the Monitor:
CALL -151
[£6] Move $800 to its original location:
800<6400.64FFM
Alter the program so that it JuMPs to the entry point:
7FD:4C 00 OB
Tell DOS that we can BSAVE more than 121 sectors:
A964:FF
[9] Save Gold Rush:
BSAVE GOLD RUSH,AS7FD,LS8E04
Gold Rush is now deprotected into a BRUNable file that you can
FID to any disk.
APT for Proving Grounds Of The Mad Overlord...
izardr
Creating a powerful Bishop
It seems as though a lot of Wizardry players already know
how to create a very powerful bishop, but here is the technique
anyway:
1) Take the bishop into the maze and then camp.
2) Inspect the bishop’s character and choose the identity 1]
option.
3) Keep trying to identify item #9 until the word SUCCESS
appears at the bottom of the screen.
The bishop should now have 100,000,000 experience points.
52 The Book Of Softkeys Volume II
Krell LOGO
Krell Software Corp.
Using Super IOB To Copy Krell LOGO
by Andrew Harrison
(Hardcore COMPUTIST # 10, page 8)
Requirements:
Apple Jt plus with 64K or //e
Krell LOGO
Super [OB
Swap controller
One blank disk
Integer Firmware card or other means of entering the Monitor
Krell LOGO version A can be copied with the use of the Super
IOB program which has the Swap controller installed. Super JOB
and the Swap controller can both be found in the Super IOB article
in this volume. You will also need some way to (RESET) into the
monitor so that the LOGO RWTS can be saved to disk.
[4] Boot up with the original Krell LOGO disk and then
into the Monitor.
C2] Move the RWTS to a safe location:
1900<B800.BFFFM
C3] Boot up a DOS 3.3 slave disk with no HELLO program:
PR#6
[4] Save the Krell LOGO RWTS to the same disk that has the
Super IOB program on it:
BSAVE LOGORWTS,AS1900,LS800
[5] Format a blank disk with the HELLO program listed below:
FP
10 PRINT CHRS(4)'‘BLOAD BANNER.SHP"”’
The Book Of Softkeys Volume II 53
20 PRINT CHRS(4)‘‘RUN KRELL.START"’
INIT HELLO.LOGO
Load the Super JOB and type in or EXEC in the Swap
controller:
Change line 10010 to read:
10010 PRINT CHRS(4)‘‘BLOAD LOGORWTS,AS1900"
Run the Super JOB program copying from the original Krell
LOGO disk to the disk initialized in Step 5. Do not reformat the
duplicate disk.
RUN
[9] After the copy has been made, RENAME the old HELLO
file on the copied disk as LOGO.START
RENAME HELLO,LOGO.START
The file that is now called LOGO. START has a CALL 2167
which needs to be removed in order for the copy to work properly.
LOAD the LOGO. STARTUP file and remove this CALL. It should
be in the first line of the program. Be sure to reSAVE the program
after you have made the change.
z
Eric Holman Whitaker’s APT for...
Castle Wolfenstein
The S.S. will not follow you if...
Hold up an SS Stormtrooper and search him. After you have
confiscated his bullets (search him twice to be sure), you can
leave the room without fear of the SS following you.
Castle Wolfenstein tries to ge the S.S. to follow you and
then shoot you on the run.
If the S.S. gent is out of bullets, the game decides that he
is not much good and does not send him trailing after you.
54 The Book Of Softkeys Volume II
Legacy of Llylgamyn
Sir-Tech Software, Inc.
Breaking Windows: Softkey For Legacy of Llylgamyn
by Jim Kaiser
(Hardcore COMPUTIST # 8, page 10)
Requirements:
Apple Ii, Apple It plus, Apple //e or compatible with one disk drive
A Sector Editing Program, such as DiskEdit
COPYA from DOS 3.3 System Master Disk
Two blank disks
Legacy of Llylgamyn is one of the scenarios in the Wizardry Series.
After trying to back up my original using the softkey presented in
Hardcore COMPUTIST # 4 and not succeeding, I set out to do it
myself. The program uses what Sir-Tech calls ‘Window Wizardry’,
a technique they probably implemented upon seeing a LISA
computer in action. I liked the ‘window’ concept so much that I
purchased Legacy of Llylgamyn as soon as it came out.
Both sides of Legacy of Llylgamyn can be copied with COPYA
if DOS is patched so that any errors encountered when reading or
writing are ignored. The COPYA version of the boot side (side B)
needs a sector-edit performed on it so that the routine to check for
a non-original disk is circumvented. This routine is on Track $1A,
Sector $0C of the boot side. The scenario disk (side A) is unprotected
and the COPYA version of it will work just fine.
[4] Get out your DOS 3.3 Sytem Master disk and run COPYA:
RUN COPYA
[£2] After the drive has stopped, halt the program:
[3] Prevent COPYA from reloading COPY.OBJO by deleting
line 70:
70
C4] Enter the Monitor:
CALL-151
The Book Of Softkeys Volume II 55
| Patch DOS so that any Read or Write errors are ignored:
B7C0:18
Ce] Return to Applesoft:
3D0G
(7) Run the program:
RUN
Copy both sides of the original Legacy of Llylgamyn disk.
[3] After you have copied both sides, put the original disk away
in a safe place.
Run your sector-editing program on the backup copy.
[11] Read Track $1A, Sector $0C of the boot disk (side B)
(22] Start editing at byte $15, entering the following bytes:
DO 16 EA AD 2D 00 CE FB 00 D0 F8
AD DE 00 AQ 01 48 A5 01 48 AS 00
48 60 A9 00 FO ED
(3] Write the sector back to the disk.
The scenario side (side A) is not protected on The Legacy of
Llylgamyn, so no modifications to the scenario side of the disk are
needed. You should now have a working copy and, by the way,
you have to write-protect both sides of this disk. The only difference
between the master scenario and the duplicate is that the master is
write-protected. This disk is now COPYAable
OF SPECIAL INTEREST
I was bothered and didn’t like to always have to switch disks for
the scenario, just to enter the master disk, and then the duplicate.
So, I set out to find how I could modify the disk so that I could
enter the duplicate without a write-protect tab over the hole and still
be able to have the program not give the dreaded NOT A MASTER
DISK error. To make this modification, you should edit Track $6,
Sector $A, Byte $73, Change it from a CB to a C3. You no longer
have to put in the master and then, the duplicate. Just enter the
duplicate and press twice. Now, if I could just figure out
how to pronounce *‘Llylgamyn’’,
bg
56 The Book Of Softkeys Volume II
Mask Of The Sun
Ultrasoft, Inc.
Softkey For Mask Of The Sun
by John J. Liska
(Hardcore COMPUTIST # 7, page 27)
Requirements:
Apple If Plus
One disk drive (two are preferred)
Mask of the Sun program disk
DOS 3.3 System Master
One blank disk
Now you can unlock one of the most maddening adventures I have
ever attempted to solve.
In this diabolical foray, your quest is to retrieve the legendary
‘Mask of the Sun’ and live to tell the tale. You will encounter many
things along the way which will defy common sense and your own
intuitive logic, yet must be met.
The basic procedure is the same as the modified COPYA / DOS
combination used to unlock Zork / in the Book Of Softkeys Volume
I. The only change to DOS seems to be the use of non-standard
end marks on Tracks $03—$22 and incorrect checksums on the DOS
tracks.
The first problem is to get the information off the original disk
and onto the copy disk. Here is how:
[4] Boot the DOS 3.3 Master Disk:
PRY6
| Clear program in memory and initialize the front side of
the disk you wish to copy to:
FP
INIT SIDE A
C3] Drop into the Monitor:
CALL -151
The Book Of Softkeys Volume II 57
[4] Modify DOS so that it ignores end marks and checksums. :
B92D:18 60
B989:18 60
Cs] Put back in the System Master and use COPYA to copy SIDE
B to the back side (the side you didn’t initialize in step 2):
RUN COPYA
| When finished with the back side, use FID to copy every
file (using the wildcard ( = ) and prompting features of FID) from
side A except LL(V27) to the front side of the freshly INITialized
disk:
BRUN FID
We now have all the files copied except the one that checked for
copy-protection. In order to make this disk work, we have to make
a Start-up file.
Type in this start-up program and save it to the front side
of the copy:
10 PRINT CHRS( 4) ‘EXEC DISK”
SAVE SIDE A
That's it! Whenever you boot, you will get a FILE NOT FOUND
message, but that is O.K. The reason for this is because the text
file named DISK is trying to BRUN LL(V27), but since it isn’t on
this disk, DISK just goes on to the next command.
You now have a copy of Mask of the Sun on a normal disk for
you to examine until you bust (or solve the adventure, whichever
comes first).
Now, would someone please tell me how I can get past the
BLASTED snake!
Paul Andersen’s APT for...
Serpentine
Extra Snakes
After all the snakes have appeared in the cage, type 1 (8)
to get extra snakes.
58 The Book Of Softkeys Volume II
Minit Man
Penguin Software
Backing Up Minit Man
by Clay Harrell
(Hardcore COMPUTIST # 10, page 28)
Requirements:
48K Apple with old-style (or modified) F8 Monitor ROM
One disk drive with DOS 3.3
Two blank disks
Minit Man
Super IOB
Minit Man is a Choplifter-type game from Penguin Software. The
game plays well and has nice graphics, demos and title pages.
Unfortunately, its slow loading is practically unbearable at times.
My original intent was to make Minit Man load at the speed of light...
But in order to do this I had to first remove the disk’s copy-
protection. Minit Man proved to be a challenge on which I had to
use some of my own programming to overcome Penguin’s
protection. First, let’s talk about the protection used in Minit Man.
You can protect a program by various means, or you can protect
a disk full of programs with some sort of DOS modification. DOS
modifications are the least successful of protection schemes, since
someone always seems to find a way to copy all the files onto a
normal DOS disk, eluding all the protection.
MUFFIN—DEMUFFIN—DEMUFFIN PLUS
The classic program for dealing with modified DOSes is
DEMUFFIN PLUS. \t works much the same way as Apple’s
MUFFIN program works.
MUFFIN was written to read files from a DOS 3.2 disk and then
write them to a DOS 3.3 disk.
DEMUFFIN was a variation of MUFFIN, allowing the hardcore
DOS 3.2 user to copy disks from DOS 3.3 to DOS 3.2.
DEMUFFIN PLUS operates on the same principle, but uses
whatever DOS is in memory to read the disk, and then writes out
to an initialized DOS 3.3 disk. While this is a powerful utility, it
The Book Of Softkeys Volume II 59
only works with programs that are based on DOS and that have a
CATALOG track with normal, or somewhat normal, files.
Now, with this tidbit of information in mind, how do we know
that a disk uses a modified DOS? There are many hints, the foremost
being the appearance of a BASIC prompt at the bottom of the screen
during booting.
Some publishers have bypassed the routine that outputs the
prompt, but you can still guess that there’s a modified DOS present
if the boot sounds like a normal DOS boot, but the disk won't copy
with COPYA.
Modified Minit DOS
Minit Man’s protection scheme falls into this category of modified
DOS protection. Upon booting the disk, the normal DOS boot sounds
are heard and a prompt appears at the bottom left of the screen.
Instead of attempting to use DEMUFFIN PLUS, we are going to
use a different approach to the deprotection of Minit Man, using
Super IOB.
The actual modification on the Minit Man disk is that the end of
address and end of data markers have been changed on every track
to DA AA instead of the usual DE AA. In addition, the start of
address markers on every other track have been changed to D4 AA.
96 instead of DS AA 96.
The Super IOB controller starts copying from Track $2 (we do
not want the protected DOS residing on Tracks $0—$1) of the
protected disk and writes back to the same tracks of our normal
DOS 3.3 Disk.
With the Super IOB controller in hand we can now start to
deprotect Minit Man. Here are the first few steps:
[4] Type in the Minit Man controller (listed at the end of this
softkey) and save it with the SAVE CONTROLLER program (see
Controller Saver article in this Book Of Softkeys) or just LOAD
SUPER IOB and type in the Minit Man controller and go to Step 2.
EXEC SAVE CONTROLLER
C2] Copy Minit Man with its controller placed into Super IOB
| Boot a normal DOS 3.3 Disk (preferably with a fast DOS
since the load is so slow on the original Minit Man) and initialize
the disk with HELLO as the boot program. Then FID all the files
to the freshly INITed disk.
INIT HELLO
BRUN FID
When the copy is done you will have the bulk of Minit Man
deprotected. Now we must make the programs on the Minit Man
60 The Book Of Softkeys Volume II
disk compatible with DOS 3.3, since the protected DOS has some
built-in routines that normal DOS does not. (Notice you can now
CATALOG the disk and see the files that make up Minit Man).
[4] Clear any program in memory and get the HELLO program:
FP
LOAD HELLO
[5] Make the following changes:
1 HOME
5 HGR2: HGR
6 CALL 33072
6] Save the program:
SAVE HELLO
Now some other files on the disk need to be changed to complete
the deprotection. Follow these steps:
Remove the file PLAYGAME PROG:
DELETE PLAYGAME PROG
Clear any program in memory and type this short one:
FP
1 PRINT CHRS( 4); ‘EXEC PROG”
Save it:
SAVE PLAYGAME PROG
Replace the program DEMOSETPROG with the following:
DELETE DEMOSETPROG
FP
1 PRINT CHRS( 4); ‘EXEC DEMO"
SAVE DEMOSETPROG
Now you must create some text files to load in the game and/or
demo files. You may use a word processor that creates normal text
files or you may create an Applesoft program to create them.
Note: The file names must be typed exactly as shown or you will
get a ?FILE NOT FOUND error.
[41] Create the text file PROG that contains:
BLOAD DP.7.2.SHAPES
BLOAD DPBC,A8516
BLOAD DP7,A16384
BLOAD PACPICS,A2048
BLOAD DP.7.2.ANNEX,A22574
BLOAD MEMSORTSC01,A$5CO1L
The Book Of Softkeys Volume II 61
LOAD PACMOVE,A$6000
BLOAD TRAINS,A14000
BLOAD DP.7.2.ANMX
CALL 23553
(42] Now create the text file DEMO that contains:
BLOAD DP7.DEMO,A16384
BLOAD DPBC.DEMO,A8516
BLOAD DP.7.2.SHAPES.DEMO
BLOAD PACPICS.DEMO,A2048
BLOAD DP.7.2.ANNEX.DEMO,A22574
BLOAD MEMSORTSC01.DEMO,A$5CO1
BLOAD PACMOVE.DEMO,A$6000
BLOAD TRAIN.DEMO,A 14000
BLOAD DP.7.2.ANMX.DEMO
CALL 23553
Be sure to carefully enter the text files exactly as shown above.
Have fun with lightning fast Minit Man!
Minit Man controller
1000 REM MINIT MAN CONTROLLER
1910 TK = 2 :ST=9 :LT = 35 :CD=WR
1920 T1 = TK : GOSUB 490 : GOSUB 1118
1030 GOSUB 439 : GOSUB 100 :ST = ST +1: IF ST < DOS THEN 1030
1040 |F BF THEN 1060
1050 ST= 9 :TK=1K +1 : GOSUB 1110 : IF TK < LT THEN 1030
196 POKE 47505 ,222 : POKE 47413 ,222 : GOSUB 230 : GOSUB 490 :TK =T1
iST=0
1070 GOSUB 430 : GOSUB 100 :ST = ST +1: IF ST < DOS THEN 1070
1080 ST= :TK=TK +1: IF BF = 8 AND TK < LT THEN 1070
1090 IF TK < LT THEN 1020
1100 HOME ; PRINT : PRINT "DONE*WITH* COPY" : END
1110 POKE 47505 , 218 : POKE 47413 , 218 : IFTK/2=INT (TK/2) THEN 230
1120 RESTORE : GOTO 190
63010 DATA 212 ,170 ,150
62 The Book Of Softkeys Volume II
Mouskattack
On Line Systems
Backing Up Mouskattack
by Clay Harrell
(Hardcore COMPUTIST # 7, page 6)
Requirements:
48K Apple
One disk drive, with DOS 3.3
DOS 3.3 System Master
Mouskattack
One blank, initialized 48K slave disk
Although Mouskattack is a rather old and not so thrilling maze
game, it warrants discussion on deprotection methods and the use
of DOS from protected programs.
Upon booting the Mouskattack disk, the prompt appears on the
lower left side of the screen, indicating that a somewhat normal DOS
is used by the program.
If you boot a normal DOS 3.3 disk, then put your Mouskattack
disk in the drive and type CATALOG, a directory does appear. You
will not see any files, just copyright notices and names of the authors
involved. These, however, are files in the directory.
The disk seems almost unprotected and to confirm this, | made
a copy with COPYA from the DOS 3.3 System Master. It reads the
non-DOS tracks slowly. This is due to the sector skewing used by
On-Line in hopes of a faster loading game and not due to the
protection. However, the people at On-Line were not too successful
in carrying out their intention and we shall see why, in a moment.
The first three tracks (the DOS tracks) read at the normal speed
because they are normal DOS, just like those in your DOS 3.3 System
Master.
After making my COPYA cop
Showing the first 100000 of 251228 characters.