Text content (OCR)
Hardcore COMPUTIST’s
The
Book
Of
Softkeys
Volume III
Entire contents copyright © 1987 by
SoftKey Publishing
PO Box 110846-BK
Tacoma, WA 98411
All Rights Reserved. Copying done for other than
personal or internal reference (without express written
permission from the publisher) is prohibited. Any
opinions expressed by the authors are not necessarily
those of Hardcore COMPUTIST or SofiKey Publishing.
The Book Of Softkeys Volume III 1
Other Publications by SoftKey Publishing:
The Book Of Softkeys Volume II....... 160 pages
shows you how to deprotect (softkey):
Apple Cider Spider— Apple Logo— Arcade Machine— The
‘Artist— Bank Street Writer— Cannonball Blitz— Canyon
Climber— Caverns of Freitag— Crush, Crumble & Chomp—
Data Factory 5.0— DB Master— The Dic*tion*ary— Essential
Data Duplicator I & Il— Gold Rush— Krell Logo— Legacy
of Llylgamyn— Mask Of The Sun— Minit Man—
Mouskattack— Music Construction Set— Oil's Well—
Pandora’s Box— Robotron— Sammy Lightfoot— Screenwriter
II v2.2— Sensible Speller 4.0, 4.0c, 4.lc— the Spy Strikes
Back— Time Zone v1.1— Visible Computer: 6502— Visidex—
Visitern— Zaxxon— Hayden Software— Sierra Online
Software— PLUS the complete listing of the ultimate cracking
program...Super IOB 1.5— and more!
The Book Of Softkeys Volume I........ 160 pages
shows you how to deprotect (softkey):
Akalabeth— Ampermagic— Apple Galaxian— Aztec— Bag of
Tricks— Bill Budge's Trilogy— Buzzard Bait— Cannonball
Blitz— Casino— Data Reporter— Deadline— Disk Organizer
Il— Egbert Il Communications Disk— Hard Hat Mack— Home
Accountant— Homeword— Lancaster— Magic Window II—
Multi-disk Catalog— Multiplan— Pest Patrol— Prisoner II—
Sammy Lightfoot— Screen Writer H— Sneakers— Spy’s
Demise— Starcross— Suspended— Ultima H— Visifile—
Visiplot— Visitrend— Witness— Wizardry— Zork I— Zork Il—
Zork Il PLUS how-to articles and program listings of need-
to-have programs used to make unprotected backups.
ue
COMPUTIST magazine
a
The Magazine For Serious Apple II users
The monthly magazine that shows you, step-by-step, how to remove copy-
protection from commercial software for the Apple II series of computers.
2 The Book Of Softkeys Volume III
Table of Contents
How To Use This Book.
What Is A Softkey?.
Alien Addition.
Alien Munchies
Alligator Mix.
Computer Preparation SAT.
Cut And Past
Demolition Division.
@DLM (Developement Learning Materials) software
@EA (Electronic Arts) software.
Einstein Compiler version 5.3.
Escape From Rungistan.
Financial Cookbook.
Flip Out...........
Hi-Res Computer Golf IL.
for.
Learning With Leeper.
Lion’s Share.....
Master Type v1.7.
MatheMagic ..
*Minus Mission.
Millionaire .
Music Construction Set
*One On One...
@PFS software.
@PS (Penguin) Software.
The Quest...
Rocky’s Boots
Sabotage .
Seadragon
Sensible Speller IV.
Snooper Troops II.
SoftPorn Adventure.
Stickybear series. .
Suicide. .
TellStar . .
Tic Tac Show.
Time Is Money.
Modified ROMs.
The Armonitor
The Book Of Softkeys Volume III 3
Introduction
Welcome to the Book Of Softkeys Volume HII, a
compilation of special articles from Hardcore COMPUTIST
magazine (issues 11 through 15) that explain how to remove
copy-protection from specific commercially-sold, locked-
up and uncopyable software for Apple ]{ computer systems.
Hardcore COMPUTIST (now called COMPUTIST ) is
a monthly publication devoted to the serious user of Apple
If computers and compatibles. Hardcore COMPUTIST
magazine contains information you are not likely to find in
any of the other major journals dedicated to the Apple market.
Our editorial policy is that we do NOT condone software
piracy, but we do believe that honest users are entitled to
backup commercial disks they have purchased. In addition to
the security of a backup disk, the removal of copy-protection
gives the user the option of modifying application programs
to meet his or her needs.
Furthermore, the copyright laws guarantee your right to
such a deprotected backup copy:
.."'It is not an infringement for the owner of a copy of a
computer program to make or authorize the making of another copy
or adaptation of that computer program provided:
1) that such a new copy or adaptation is created as an essential
step in the utilization of the computer program in conjunction with
a machine and that it is used in no other manner, or
2) that such new copy or adaptation is for archival purposes
only and that all archival copies are destroyed in the event that
continued possession of the computer program should cease to be
rightful.
Any exact copies prepared in accordance with the provisions
of this section may be leased, sold, or otherwise transferred, along
with the copy from which such copies were prepared, only as part
of the lease, sale, or other transfer of all rights in the program.
Adaptations so prepared may be transferred only with the
authorization of the copyright owner.”
United States Code title 17, §117 (17 USC 117)
Those of you who are not already familiar with Hardcore
COMPUTIST are advised to read the How To Use This Book
article in order to avoid frustration when attempting to follow
a softkey article or when typing in the programs printed in
this book.
4 The Book Of Softkeys Volume III
How To
Use This Book
Commands And Controls
Commands which a reader is required to perform are set apart
from normal text by being indented and bold. An example is:
PR#6
The key must be pressed at the end of every such
command unless otherwise specified. Control characters are shown
as a single symbol. For example:
To complete this command, you must first type the number 6 and
then hold the @) key while you press the (B] key. Be sure to enter
the command into the computer by finally pressing the key.
Requirements
Most of the programs and softkeys which appear in this book
require one of the Apple Il series of computers and at least one disk
drive with DOS 3.3. Occasionally, some programs and procedures
have special requirements. The prerequisites for deprotection
techniques or programs will always be listed at the beginning of
the article under the ‘Requirements:’ heading.
Software Recommendations
The following programs are strongly recommended for readers
who wish to obtain the most benefit from our articles:
An Applesoft Program Editor
such as Call A.P.P.L.E’s Global Program Line Editor (GPLE).
A Sector Editor
such as SoftKey’s DiskEdit,
or ZAP from Quality Software’s Bag of Tricks,
or Tricky Dick from Golden Delicious’ The CIA.
The Book Of Softkeys Volume III 5
A Disk Search Utility
such as The Inspector,
The Tracer from The CIA,
or The CORE Disk Searcher (in this volume).
An Assembler
such as the S-C Assembler,
or Merlin/Big Mac.
A Bit Copier
such as Copy II Plus,
Locksmith,
or Essential Data Duplicator (EDD).
A Text Editor
(able to producing normal sequential text files) such as:
Applewriter II,
Magic Window II,
or Screenwriter II.
You will also find COPYA, F/D and MUFFIN from the DOS 3.3
System Master Disk useful.
Super IOB and controllers
Several softkey procedures will make use of a Super IOB
controller, a small program that must be typed into the middle of
Super IOB. The controller changes Super IOB so that it can copy
different disks. See the Super OB 1.5 article and program in the
The Book Of Softkeys Volume II. Before using any Super IOB
controllers, read the Csaver article in this volume.
Reset Into The Monitor
Some softkey procedures require that the user be able to enter
the Apple’s System Monitor (henceforth called the Monitor) during
the execution of a copy-protected program. Check the following list
to see what hardware you will need to obtain this ability.
Apple il Plus - Apple //e - Apple compatibles:
1) Place an Integer BASIC ROM card in one of the Apple slots.
2) Use a non-maskable interrupt (NMI) card such as Replay or
Wildcard.
Apple Il Plus - Apple compatibles:
Install an F8 ROM with a modified reset vector on the motherboard
as detailed in the Modified ROMs article in this volume.
6 The Book Of Softkeys Volume III
Apple //e - Apple //c:
Install a modified CD ROM on the computer’s motherboard. Cutting
Edge Ent. (Box 43234 Ren Cen Station-HC; Detroit, MI 48243)
sells a hardware device that will give you this ability. Making this
modification to an Apple //c will void its warranty but the increased
ability to remove copy-protection may justify it.
Recommended Literature
Apple Il Reference Manual
DOS 3.3 manual
Beneath Apple DOS
by Don Worth and Pieter Lechner; Quality Software
Assembly Language For The Applesoft Programmer
by Roy Meyers and C.W. Finley; Addison Wesley
What’s Where In The Apple
by William Lubert; Micro Ink
Typing In Applesoft Programs
BASIC programs are printed in this Book Of Softkeys in a format
that is designed to minimize errors for readers who key in these
programs. To understand this format, you must first understand the
formatted LIST feature of Applesoft.
An illustration- If you strike these keys:
1@ HOME:REMCLEAR SCREEN
a program will be stored in the computer’s memory. Strangely, this
program will not have a LIST that is exactly as you typed it. Instead,
the LIST will look like this:
10 HOME : REM CLEAR SCREEN
Programs don’t usually LIST the same as they were keyed in
because Applesoft inserts spaces into a program listing before and
after every command word or mathematical operator. These spaces
usually don’t pose a problem except in line numbers which contain
REM or DATA command words. The space inserted after these
command words can be misleading. For example, if you want a
program to have a list like this:
10 DATA 67,45,54,52
you would have to omit the space directly after the DATA command
word. If you were to key in the space directly after the DATA
The Book Of Softkeys Volume III 7
command word, the LIST of the program would look like this:
10 DATA 67,45,54,52
This LIST is different from the LIST you wanted. The number of
spaces you type after DATA and REM command words is very
important.
All of this brings us to the Hardcore COMPUTIST LISTing
format.
In a BASIC LISTing, there are two types of spaces: spaces that
don’t matter whether they are keyed or not, and spaces that MUST
be keyed.
The latter spaces are printed here as delta characters (+). For
example:
19 NOTES = "NOTE* THAT* THESE* SPACES* MUST* BE* ENTERED"
20 VTAB 10: HTAB 20: PRINT NOTES; : REM THE SPACES BETWEEN COMMANDS
NEED NOT BE ENTERED.
As you see from this example, other spaces in our BASIC LISTing
are put there for easier reading and it won’t matter whether you
type them or not.
Keying In Hexdumps
Machine language programs are printed here as both source code
and hexdumps. Only one of these formats need be keyed in to get
a machine language program. Hexdumps are the shortest and easiest
format to type in. To key in hexdumps, you must first enter the
Monitor with CALL -151 (RETR).
Now key in the hexdump exactly as it appears. If you hear a beep,
you will know that you have typed something that the Monitor didn’t
understand and you must retype that line.
When finished, return to BASIC by typing E803G GER).
Remember to BSAVE the program with the correct filename,
address and length parameters as given in the article.
Keying In Source Code
The source code portion of a machine language program is
provided only to better explain the program’s operation. If you wish
to key it in, you will need the S-C Assembler. Without this assembler,
you will have to convert the S-C Assembler directives (printed in
Hardcore COMPUTIST # 17) to similar directives used by your
assembler.
8 The Book Of Softkeys Volume III
The
Softkeys
The softkeys listed below require Super IOB:
Computer Preparation SAT
Demolition Division
Electronic Arts software
Hi-Res Computer Golf II
Master Type v1.7
MatheMagic
Penguin Software
Rocky’s Boots
Seadragon
Snooper Troops II
Tic Tac Show
Ultima II] Exodus
What is a softkey?
Softkey is a term which we’ve coined to
describe a procedure that removes, or at
least circumvents, any copy-protection on
a particular disk. Once a softkey
procedure has been performed, the
resulting disk can usually be copied by the
use of Apple’s COPYA program (on the
DOS 3.3 System Master Disk) and is said
to be ‘COPYAable.’
The Book Of Softkeys Volume III 9
= Alien Munchies
Gentry Software
Putting The Byte On Alien Munchies
by Tom Phelps
(Hardcore COMPUTIST # 15, page 7)
Requirements:
Apple It with 48K
Means of resetting into the Monitor
One slave disk with a null HELLO program
Alien Munchies by Gentry Software is your common, everyday,
run of the mill ‘‘Fry the aliens on your barbecue grill!”’ arcade game.
(Sure, everyday huh?) This game is slow at the beginning and patient
playing is needed to get to the much more exciting 2nd and 3rd type
of aliens (10,000 and 20,000 points respectively).
The method used to deprotect this game illustrates a very useful
move routine you can use in your own cracks. The problem of
running out of men before reaching these more challenging stages
is solved with an example of the art of Advanced Playing Techniques
(APTs).
Step-By-Step
[4] Boot Alien Munchies.
C2] into the Monitor after the picture has come onto the
screen.
C3] Move page eight out of the way for a boot:
2000<800.8FFM
[4] Boot a slave disk with no HELLO program.
Cs] Enter the Monitor:
CALL -151
| Move page eight back:
800<2000.20FFM
10 4 The Book Of Softkeys Volume III
At this point, the Alien Munchies program is in memory and in
its proper memory locations. Rather than save a huge chunk of
memory, let’s save some disk space with a move routine.
Furthermore, to bring the game under control a little better, let’s
include an APT routine.
Compact the code:
3000<6000.6FFFM
Enter the space-saving, relocatable move routine:
2000:
2008:
2010:
2018:
2020: C9 40 DO EC EA
If you disassemble this code, it should look like this:
2000- Av OO LOY #$00
2002- A900 LDA #$00
2004- 85 00 STA $00
2006- 85 02 STA $02
2008- A930 LDA #$30
200A- 85 O1 STA $01
208C- A960 LDA #$60
200E- 85 03 STA $83
2010- B1 88 LDA ($08) ,Y
2012-91 02 STA ($02) ,Y
2014- £6 62 INC $82
2016- £6 00 INC $80
2018- DO F6 BNE $2010
201A- £6 63 INC $83
201C- E681 INC $01
201E- AS OL LDA $61
2020- C9 40 CMP #$40
2022- DB EC BNE $2010
2024- EA NOP
Type in the following APT routine:
2025: 20 2F FB
2028: 20 58 FC A2 OB 20 4A F9
2030:
2038:
2040: AD
2048:
2050:
2058:
2060:
2068:
2070:
Ad 00 A9 00 85 00 85 02
A9 30 85 @1 AQ 60 85 03
B1 00 91 02 E6 02 E6 00
DO F6 E6 03 E6 01 A5 01
A2 00 BD 62 20 20 ED FD
E8 EO 12 D@ F5 2C 10 CO
00 CO C9 D9 F@ 07 C9
CE DO F5 4C 00 08 AS EA
8D C9 10 8D CA 10 8D CB
1@ AQ 01 8D FD 12 4C 00
08 EA C9 CE C6 C9 CE C9
D4 C5 A@ CD C5 CE Ad A8
D9 AF CE AQ 00
The Book Of Softkeys Volume III
11
A disassembly of this would show:
2025-20 2F FB JSR $FB2F
2028-26 58 FC JSR SFC58
202B- AZ 0B LOX #$0B
202D- 20 4A F9 ISR $FO4A
2030- A200 LOX #800
2032- BD 62 28 LDA $2062,X
2035- 20 ED FD JSR $FDED
2038- EB INX
2039- E012 CPX #$12
203B- DO FS BNE $2032
203D- 2 19 CO BIT $C@10
2040- AD BB CO LDA $CO08
2043- C9 D9 CMP #§D9
2045- FO 7 BEQ $204E
2047- C9 CE CMP #$CE
2049- DO FS BNE $2040
204B- 4C 80 08 IMP $0805
204E- ADEA LDA #SEA
2050- 8D C919 STA $1009
2053- 8D CA10. STA $10CA
2056- sD CB10 STA $10CB
2059- AN B1 LDA #$01
205B- 8D FD 12 STA $12FD
205E- 4C 08 08 IMP $0800
2061- EA NOP
2062- C9CE CMP #§CE
2064- C69 DEC $C9
2066- CEC9D4 DEC $D4C9
2069- Ch AD CMP $AB
206B- CDC5 CE CMP $CEC5
206E- AD AB LDY #$A8
2070- D9 AF CE CMP $CEAF , Y
2073- — A9 OD LDA #800
Unlike the Sammy Lightfoot APT in The Book Of Softkeys
Volume II, let's make ours optional so you can play normal-style
or with infinite men and a counter in your number of barbecues
to tell you what level you’re on.
Finally, add a JMP to our special routines before the actual
program starts:
7FD:4C 00 20
(41) Save the new-and-improved Alien Munchies:
BSAVE ALIEN MUNCHIES, A$7FD,LS5803
4
12 The Book Of Softkeys Volume III
Harcourt, Brace and Jovanovich, Inc.
Deprotecting Computer Preparation: SAT
by Eddie Fang
(Hardcore COMPUTIST # 14, page 6)
Requirements:
48K Apple Il, Apple Il Plus, or Apple //e
One disk drive with DOS 3.3
Four blank disks
Super IOB and the swap controller
(Optional: File transfer program)
This computer preparation package by HBJ ranks up at the top
with Barron’s computer preparation course for the SAT. HBJ’s
package has a lot of the major words found on the SAT and a lot
of similar mathematical and verbal problems, too.
My problem, however, is that I would like to change the words
and problems for a younger brother or change the problems that
I have finished studying to some newer ones. The frustration of
copying this disk is immense. After trying all of the major bit copiers
to no avail, I decided to try Super IOB. Here is how I did it!
First, get the disk that is labeled A. All the disks follow the same
process, except you will have to modify different programs on
different disks to get each totally broken. Follow these steps
carefully:
[2] Boot the first protected disk. When you hear the drive head
access the first track, hit
[2] Get into the Monitor:
CALL -151
C3] We must move the RWTS down to a safe location for Super
IOB to use:
1900<B800.BFFFM
The Book Of Softkeys Volume III 13
C4] When you get the Monitor prompt again, insert your Super
IOB slave disk and boot it:
C600G
[5] Save the RWTS:
BSAVE RWTS.SAT,AS$1900,L$800
Install the controller at the end of this article (a modified ”
version of the swap controller) into Super JOB and execute Super
IOB:
RUN
[7] When asked if you wish to format the backup first, reply
with a (¥). This will put DOS on the disk and set the bootup program
to HELLO.
Copy the other three sides in the same manner (Steps six
and seven).
Almost Finished
You now have a COPY Aable version, but if you want to modify
it, you will have to change a few line numbers of some of the BASIC
programs. Several of the main programs have a line number 0 which
looks something like this:
0 REM@EOEREEEAOAODOAOAOMED FP
Whenever you try to list a line like this, DOS sees the
(MM GD) FP and clears the program in memory. In other words,
the program self-destructs when LISTed. This situation is easily
circumvented by merely eliminating line zero from these programs.
The general format for doing this is:
LOAD filename
DEL 0,1
SAVE filename
Remove line zero from these programs on your duplicate disk:
Math Item Bank Display on the mathematical side.
Vocabulary Flashcards on the vocabulary flash cards side.
Verbal Item Bank Display on the verbal side.
Frank (I don’t know why they called it that) on the diagnostic and
testing side.
Closing Comments
You should now have four bootable, completely deprotected and
modifiable Computer Preparation: SAT disks. I hope this helps you
as much as it has helped me.
14 The Book Of Softkeys Volume III
controller
410 GOSUB 80 : HOME :A$ = "FORMATTING" : FLASH : GOSUB 450 : NORMAL
: PRINT : PRINT CHRS (4) "INITHELLO,S" S2",D"02",V" VL :VL=
@ : RETURN
1900 REM SWAP CONTROLLER
1910 TK = 3 :ST=0 :LT = 35 :CD=WR
1920 Tl = 0SUB 490 : GOSUB 360 : ONERR GOTO 5501030 GOSUB 430 :
GOSUB 100 :ST =ST +1: IF ST < DOS THEN 1038
1040 IF BF THEN 1960
1050 ST =0 :TK=TK+1: IF TK <LT THEN 1030
1960 GOSUB 490 :TK = T1 :ST=0 : GOSUB 360
1079 GOSUB 430 : GOSUB 100 :ST = ST +1: IF ST < DOS THEN 1070
1980 ST =@ :TK= TK +1: IF BF = @ AND TK <LT THEN 1070
1090 IF TK < LT THEN 1620
1160 HOME : PRINT "COPY* DONE" : END
10010 IF PEEK (6400 ) < > 162 THEN PRINT CHR$ (4) "BLOAD*
RWTS. SAT, A$1900"
The Book Of Softkeys Volume III 15
DLM Software*
(Development Learning Materials)
Softkey For DLM Software
by Chris Chenault & Ray Darrah
(Hardcore COMPUTIST # 13, page 7)
*Specifically for: Demolition Division, Alligator Mix, Alien
Addition, and Minus Mission.
Requirements:
48K Apple Il or Apple //e
Super IOB
A blank disk
Demolition
Demolition Division is a drill that makes division fun for
youngsters. In this game, you use your correct answers to shoot
enemy tanks. You have a choice of speed, difficulty and paddle or
keyboard control.
Alligator Mi
Alligator Mix is a math drill that consists of a mixture of addition
and subtraction problems. In this game, you can only feed the
alligator if the answer to the addition or subtraction problem matches
the answer he has on his tummy.
= Se ee
Alien Addition
Alien Addition is an addition drill made into an arcade game. The
game gives you the ability to change speed and difficulty levels and
is one of many great education games that offer children fun while
they learn.
16 The Book Of Softkeys Volume III
=] Minus Mission
In Minus Mission, falling blobs of subtraction problems threaten
to overcome a robot with green slime. Arcade skill is required as
well as subtraction skill to save the robot.
The Softkey To Them All
For all of these great programs, I have developed a Super IOB
controller that deprotects them nicely. I think it may work on other
DLM releases as well as the four mentioned above.
In any case, here are the steps to follow when deprotecting any
of these educational masterpieces:
[4] Type in the Super OB controller at the end of this article
and save it.
[2] Next, boot a normal DOS diskette and initialize a blank
disk with the filename the same as the disk you wish to copy.
INIT program name
C3] Execute the Super JOB program with the DLM controller
installed.
[4] when Super IOB is finished, try to boot the copy. If
everything comes up OK then you're finished. If you get a FILE
NOT FOUND, CATALOG the disk and RUN the first file you see.
This should have been the program name you used in step 2. You
may go back to step 2 and try again if you like.
controller
1900 REM DLM SOFTWARE CONTROLLER
1910 TK = 3 :ST=@ :LT = 35 :CD = WR :MB = 130 :D0S = 13
1915 GOSUB 360 : GOSUB 278 : GOSUB 360
1920 T1 = TK : GOSUB 49 : GOSUB 360 : ONERR GOTO 550
1030 GOSUB 430 ; GOSUB 100 :ST = ST +1 : IF ST < DOS THEN 1030
1949 IF BF THEN 1660
1050 ST = :TK=TK +1: IF TK < LT THEN 1030
1969 GOSUB 498 :TK =T1 :ST = 9 : GOSUB 368
1070 GOSUB 430 : GOSUB 100 :ST = ST +1: IF ST < DOS THEN 1970
1080 ST =@ :TK=TK +1: IF BF =@ AND TK <LT THEN 1970
1090 IF TK < LT THEN 1020
1100 HOME : PRINT "EVERYTHING*O.K.*NO*DOS* ON* COPY" : END
10010 PRINT CHR$ (4) "BLOAD*RWTS. 13, AS19900"
z
The Book Of Softkeys Volume III 17
Electronic Arts
Software*
Deprotecting Electronic Arts
by Pete Levinthal
(Hardcore COMPUTIST # 13, page 26)
*Softkeys for: Cut And Paste, The Last Gladiator, and One on One.
Requirements:
48K Apple Il, Apple II Plus, or Apple //e
DOS 3.3 disk drive
Super IOB
A sector editor
A blank disk
Electronic Arts’ recent releases have all used very nearly the same
protection. Their protection scheme has been to change the data field
prologue bytes from a normal D5 AA AD to a modified D5 BB
CF on tracks $03 to $20. Tracks $00 to $02 contain the modified
RWTS to read the new data field bytes and hi-res title page. These
three tracks are unprotected normal DOS 3.3. In addition, these
recent releases have a nibble count on track $22, and track $21 is
unused.
Remember that the prologue data field bytes tell DOS where the
data starts on a sector. This is usually identified by the unique
sequence of bytes DS AA AD. Electronic Arts has modified these
to DS BB CF so normal DOS cannot tell where the data starts and
hence, an I/O error occurs when copying with COPYA (or some bit
copiers for that matter).
So, to deprotect the new Electronic Arts releases we must:
[1] Read the original disk with data field prologue bytes of DS
BB CF.
[2] write to a normal DOS 3.3 disk with normal data field
prologue bytes of DS AA AD.
Change the modified Electronic Arts’ RWTS to read normal
DS AA AD data field prologue bytes.
[4] Disable the nibble count.
18 The Book Of Softkeys Volume III
Easy enough, right? We can use Super JOB to do most of the
work and then use a sector editor to complete the process. Here
is the procedure:
| Load Super IOB and type in the controller at the end of
this article.
[£2] With the controller installed, run Super JOB.
Cut and Paste
Ai
When Super IOB is finished, it will have made these sector
alterations:
Track Sector Byte From. To
ol OF 68 20 18
O1 OF 69 A2 60
01 OF 6A Al EB
02 03 47 BB AA
02 03 31 CF AD
If you have copied Cut and Paste, then that’s all. Enjoy your
backup.
Pull Out Your Sector Editor
If you have copied The Last Gladiator or One on One, then you
will need to pull out your sector editor and make the following
modifications (to the copied COPY Aable disk):
The Last Gladiator
ell
Track Sector Byte From To
IF OE 05 AO 18
IF OE 06 20 60
IF QE 68 20 18
IF OE 69 A2 60
1F OF 05 AO 18
1F OF 06 20 60
1F OF 68 20 18
1F OF 69 A2 60
The Book Of Softkeys Volume III 19
= One On One
Track Sector Byte From To
09 02 1F Ol FD
0c 04 05 AO 18
el 04 06 18 60
oc 04 07 88 C8
oc 04 DC AO 18
oc 04 DD FF 60
Now you're all done! Don’t forget to write the sectors back out
to your COPYAable copy as you change them.
Electronic Arts controller
1900 REM ELECTRONIC ARTS
1010 TK = @ :ST = :LT = 33 :CD= WR
1626 T1 = TK : GOSUB 490 ; IF TK > 3 THEN RESTORE : GOSUB 210
1030 GOSUB 430 : GOSUB 100 :ST = ST +1: IF ST < DOS THEN 1638
1035 1F TK = 2 THEN GOSUB 210
1040 IF BF THEN 1060
1950 ST =@ :TK=TK+1: IF TK < LT THEN 1030
1960 GOSUB 490 :TK = T1 :ST = @ : GOSUB 230 : IF TK = ® THEN GOSUB
1119
1070 GOSUB 430 : GOSUB 100 :ST = ST +1 : IF ST < DOS THEN 1670
1980 ST = 0 :TK=TK +1; IF BF=@ AND TK<LT THEN 1970
1090 IF TK < LT THEN 1028
1100 HOME ; PRINT "DONE*WITH* COPY” : END
1110 POKE 19615 ,170 : POKE 19025 ,173 : POKE 18024 ,24
1120 POKE 18025 ,96 : POKE 18026 ,235 ; RETURN
62010 DATA 213 ,187 ,207
20 The Book Of Softkeys Volume III
= The Einstein Compiler v5.3
The Einstein Corporation
Softkey For The Einstein Compiler Version 5.3
by Marco Hunter
(Hardcore COMPUTIST # 11, page 6)
Requirements:
48K Apple jf Plus or equivalent
One disk drive with DOS 3.3
A blank disk
COPYA from the DOS 3.3 System Master
A sector editing program
Although it has a few shortcomings, the Einstein Compiler is
probably the best of its kind available. The compiler produces a
file which is usually saved as a huge Applesoft program and tricks
DOS into thinking it is loading an Applesoft file, when it is actually
loading a compiled program as well as a library of subroutines. But
that is for a review, and this is a softkey. Suffice it to say that Einstein
is most likely your best bet in Applesoft compilers.
Einstein is a program which resides on an essentially normal disk.
The infamous nibble-count technique is used to ensure that an
original disk is being used. The procedure for locating a nibble count
usually involves much time, knowledge of Assembly language and
Assembly language tricks. A little luck can also come in handy.
Fortunately, all nibble counts involve some method of accessing the
disk. Since a disk controller card can reside in any of the Apple’s
slots, the nibble count must adjust itself to the slot being used. The
most popular method is to load the X- or Y-register with the slot
number (technically, the slot number * 16) and then to access the
location CO8C + X or CO8E + X. In Assembly language, it would
look like one of these.
LDA $C08C,xX LDA $CO8E,X
LDA $C08C,Y LDA $CO8E,Y
Note: Other options include LDY $CO8E,X and LDX $CO8C,Y.
The Book Of Softkeys Volume III 21
Since both the register loaded and the index used can change,
it is best to search for CO8C or CO8E. Because two-byte addresses
are always reversed in machine language, the bytes to search for
are 8C C0 and 8E CO. After locating these bytes on a disk, preferably
with a disk search utility such as Bag of Tricks or The CIA, you
should disassemble the code to find out if it is truly a nibble count.
Try to avoid searching tracks 0-2 because these generally contain
DOS or some type of RWTS which are usually full of 8CCO0’s, but
not nibble counts. Many times the code around a nibble count will
contain many PLA’s and PHA’s. The software companies hope that
by playing around with the stack they can fool most people.
Once you have located a nibble count, you can eliminate it in
several ways. You could either put an RTS (return from subroutine)
at the beginning, NOP (no-operation does nothing) the entire routine,
jump out of it, or avoid jumping into it in the first place. Keep in
mind, however, that some companies also protect their disks by
including checksum routines which can detect the presence of altered
code. Sierra On-Line is one company known to do this (See SOL:
Sierra OnLine Software article on page 108 of The Book Of
Softkeys Volume II).
Of course, some knowledge of Assembly language is an invaluable
aid when tracking down protection schemes. If you don’t happen
to know any Assembly language yet, it would be well worth your
time to pick up a good book on it. Assembly language is not as
mysterious and hard to learn as many people would have you believe.
If you can learn the hexadecimal number system and condition
yourself to think in it when necessary, half the battle of learning
Assembly language will be behind you. Even if you never write
a single Assembly language program, just being able to follow code
written by others is a valuable skill.
Well, enough talk. On to the process!
J located the bytes on Einstein and figured out a way to jump
around the routine, so that everything went as normal.
[4] Make a copy of Einstein with COPYA.
C2] Use your sector editor to modify:
Track Sector Byte From To
08 04 2A BD 4C
08 04 2B 8C E2
08 04 2C co 1
x
22 The Book Of Softkeys Volume III
Escape From Rungistan =
Sirius Software
Softkey For Escape From Rungistan
by Chris Chenault
(Hardcore COMPUTIST # 15, page 6)
Requirements:
48K Apple JI or Apple //e
One disk drive with DOS 3.3
A sector editor
Escape from Rungistan is a unique adventure featuring graphics,
sound and animation. At the beginning of the game, you awake in
a foreign prison and hear the guard say that you are to be shot at
sunrise. There is no other choice but to attempt to break out. As
the game progresses, you battle bears, snakes and test your skiing
ability.
This adventure is written with an ‘Old West’ flavor and the author
shows a great sense of humor. To aid your efforts at playing this
game, the author added a clue file to keep you from getting too
flustered.
Escape With Diskview
The locking procedure on this disk consists of a combination of
many fairly simple procedures, but together they give you endless
trouble. I used DiskView to discover that this is a DOS 3.3 disk
with the last byte of the address prologue marker changed to $F7
from $96 on tracks $03-$22.
Using this pre-analysis, it seems to be a disk that a slightly
modified COPYA would deprotect. Unfortunately, because some of the
last few tracks have been damaged for protection, this won’t work.
I finally came up with the following method after discovering that
it had a normal CATALOG on the correct track and a greeting
program called START. I discovered this with the help of DiskEdit.
Now for the procedure.
The Book Of Softkeys Volume III ‘ 23
; Step-By-Step
[4] Boot the DOS 3.3 System Master disk.
C2] Insert a blank disk and format it with START as the boot
(greeting) file:
INIT START
[£3] Re-insert DOS 3.3 System Master and load F/D:
BLOAD FID
C4] Write-protect your Escape From Rungistan disk.
[5] Drop into the Monitor and modify DOS so that the last byte
of the address prologue is ignored:
CALL —151
B969:29 00
Ce] Start F/D going:
803G
Copy all the files (using the = wildcard feature of F/D)
to the disk you INITed in step 2.
When F/O informs you that a file named START already
exists, hit so that we will get the file from the Rungistan
disk.
The copy at this point won’t work because the DOS on the original
disk has strange DOS commands. This is how they have been altered:
Normal Command Rungistan Command
RUN ARC
CLOSE SVRTT
READ DNRT
OPEN CBSE
MAXFILES —FILMAXES
BSAVE AVESB
BLOAD ODABL
ALL OTHERS rubbed out
Ds] Use your sector editor to read track $01, sector $07 from
the original disk and write it to your new unlocked disk. This changes
the commands to Rungistan commands).
You’re done! To CATALOG your new disk, study the code and
do APTs, simply boot a normal disk before starting. Your copy of
Escape From Rungistan is COPY Aable.
%
24 The Book Of Softkeys Volume III
Financial Cookbook
Electronic Arts
Deprotecting The Financial Cookbook
by Pete Levinthal
(Hardcore COMPUTIST # 15, page 6)
Requirements:
Apple If
A Replay card, Wildcard or other 48K copy card
A blank disk
COPYA from the DOS 3.3 System Master
A sector editor
Here is a quick-and-dirty method to copying the Financial
Cookbook from Electronic Arts. This method requires a copy card
such as the Replay or Wildcard.
Since the Financial Cookbook requires 64K of memory to run,
it is no big deal to use a copy card to load the program back in.
The trick to this method is to copy memory at just the right time.
The object is to escape the protection but catch the program before
it starts loading into the RAM card (thus preventing us from having
to copy 64K of memory).
The Cookbook disk is completely copyable with COPYA except for
track 6, which is the nibble count track. The boot proceeds like any
other Electronic Arts release: it loads a title page and then does a
nibble count and loads the program. Listen to the program load and
you will hear the nibble count (sounds weird, eh?). We want to copy
memory after the nibble count but before the RAM card is activated.
Just after the nibble count, the drive will stop and the text page will
flutter for a second. Press the copy card switch at this instant. You
will only have a second or two to do it. You may have to practice
a few times.
After this process, use your copy card utility disk to make binary
files of the memory.
Now copy tracks $12 to $14 of the original Financial Cookbook
to a blank initialized disk using a slightly modified COPYA then run
a sector editor and change bytes $80 to 00 00, bytes $84 to
The Book Of Softkeys Volume III 25
00 00, bytes $88 to 00 00, bytes $3C to 00 00 and bytes $40 to
00 @0 to allocate tracks $12 to $14 and the DOS tracks as used in
the VTOC. Finally, copy the binary (B) files of memory to this disk
using F/D or some other utility.
You're all done! Just BRUN the memory files and, if all went
correctly, the program will restart, read in some data from tracks
$12 to $14 and all is fine.
Step-By-Step
[1] Boot the Financial Cookbook and after the title page and
the nibble count, and just after the drive stops (for just a second!),
hit the copy card switch.
[2] Copy all 48K of memory.
Cs] Process the copied memory using your copy card utility
disk to create normal binary files from it.
[4] Start COPYA going, then break it at the title page:
RUN COPYA
eo
C5] Enter the Monitor:
CALL —151
[6] Make COPYA so that it will only copy specific tracks:
302:16
35F:16
2DE:20 B@ 02
2B0:A9 OF 8D D1 02 8D D2 02 60
3D0G
70
RUN
C7 When the copy is done, get out your sector editor and make
the following changes to your freshly created disk:
Track Sector Bytes To
$i $00 $80, $81 $00, $00
$11 $00 = $84, $85 $00, $00
$il $00 $88, $89 $00, $00
$1 $00 $3C, $3D $00, $00
$il $00 $40, $41 $00, $00
Finally, transfer the memory files to this disk using F/D.
Now you’re all done! Just BRUN the memory files to restart the
program.
26 The Book Of Softkeys Volume III
Flip Out
Sirius Software
Deprotecting Flip Out
by Clay Harrell
(Hardcore COMPUTIST # 12, page 11)
Requirements:
48K Apple II or Apple }I Plus with old-style F8 Monitor ROM
One blank initialized DOS 3.3 disk
Flip Out is a hi-res strategy game from Sirius Software (R.1.P.)
which requires you to send all ten of your marbles through the
playing course before your opponent does. Each player starts with
ten of his opponent’s marbles and then takes turns dropping these
marbles into the Flip Out playing field (of which there are many
variations). Your first goal is to trap your opponent’s marbles in
a spot where they will be difficult to recover. Each marble dropped
may cause a chain reaction, so some strategy is required. After the
players have dropped all ten of their opponent’s marbles, they begin
to drop their own marbles through the course. This continues until
one of players wins by getting all his marbles through the course.
Who Stole the ROMS?
Flip Out is well done and challenging! But after I bought it and
was done playing a game, I hit and did not see the usual
Monitor prompt (I have an old-style F8 Monitor ROM on the
motherboard). My computer rebooted as if I had a new-style F8
Monitor ROM! This intrigued me into investigating this strange
phenomenon.
What I discovered was that the main program (not the boot code)
will copy an image of the new-style F8 Monitor ROM into a slot
@ RAM card if one is found. Of course, I had a RAM card and
they had it turned ON instead of the motherboard ROMs. It is easy
to understand what they are doing if you just remember what
memory the RAM card occupies.
The RAM card occupies memory from $D000 to $FFFF. This
may seem strange since the motherboard ROMs (Applesoft and the
The Book Of Softkeys Volume III 27
monitor) also occupy $D000 to $FFFF. However, there are a set
of soft switches that can turn ON motherboard ROMs or turn ON
the RAM card. An example of this occurs when you boot your 48K
DOS 3.3 system master and it loads Integer BASIC into the RAM
card. Now you have two languages available that occupy the same
logical memory space, $D000 to $FFFF. You can switch between
the two with INT and FP. When the INT command is typed in, the
soft switches are thrown so that the language card is read-enabled.
Likewise, the FP command read-enables the motherboard ROMs.
If you read your RAM card manual you can see that the softswitch
at memory location $C08 (assuming your RAM card is in slot zero)
will allow you to look at your RAM card’s memory. But have you
ever tried typing $CQ80 from the Monitor? It will lock up your
Apple, requiring you to power OFF and then back ON again to
recover.
Recovering the ROMS
This phenomenon occurs because you have switched to the RAM
card’s memory $D@00—$FFFF and turned OFF the motherboard’s
ROMs. When you do this, the computer loses control since there
is no longer a Monitor ROM available from $F800—$FFFF to
oversee your Apple’s operations! You cannot recover from this
condition, even with a (RSE).
To get around this problem you must first type:
C081 C081 N F800<F800.FFFFM
from the Monitor. This reads the motherboard’s ROM, but allows
you to write to bank 2 of the RAM card. It moves the F8
motherboard ROM into $F800—FFFF in bank 2 of the RAM card!
Now you may type C080 to turn ON the RAM card and look at
its memory, since a copy of the $F8 monitor ROM is in the RAM
card from $F800 to $FFFF.
This is what Sirius and other software publishers will sometimes
do to prevent people from utilizing their RAM cards for deprotection
purposes. With a RAM card in slot @, no matter what $F8 ROM
you have in the motherboard, your Apple will only look at the new
style $F8 ROM image in your RAM card. Thus, the Apple clears
memory and reboots when is pushed! This is an easy
problem to fix, now that we have identified it. Just take your RAM
card out of your computer and you may into the Monitor as
usual. As demonstrated in the softkey for Sensible Speller (see article
on page 82 of this volume of The Book Of Softkeys), you can
sometimes get away with moving your RAM card to a slot other
than ® where the program does not expect to find a RAM card.
Flip Out is a single-load program. To deprotect single-load
programs, there are 3 basic things which we need to determine:
1. What memory is used by the program. 2. The starting address
28 The Book Of Softkeys Volume III
of the program. 3. How to get the memory saved to a normal DOS
3.3 disk and reloaded back into memory in the proper place(s).
Keep these three items in mind as we snoop through Flip Out
or any other single load game.
Sirius has changed its protection schemes a lot in the last few
years. The height of their protection mania was demonstrated in
games like Bandits and Fly-wars. The problem with hi-tech
protection is that a program might not boot on a Rana drive, or on
an Apple //e or some other flavor of Apple. Sophisticated protection
schemes are also costly and drive up the retail price of software.
In light of this, Sirius chose a much simpler, but still effective, copy-
protection scheme for Flip Out. Just try and copy it with Nibbles
Away or another bit copier and you'll see just how effective it is!
A Bit of Boot Tracing
Keeping in mind the three things we must figure out to deprotect
a single-load game, the first thing I generally do is to find what
memory is required to run the program. To do this we can flip
through memory (remember that shape tables, etc. don’t disassemble
into meaningful code), or we can trace the boot and see where the
program gets loaded to. I prefer to trace the boot when it is fairly
simple, which it is on Flip Out.
So, boot up normal DOS 3.3 (so we can save a piece of code
for later examination, if you wish) and enter the Monitor with:
CALL —151
Now we must copy the code in the disk controller ROM down to
RAM so we can modify it to our liking. Do this by typing:
8600<C600.C6FFM
from the Monitor. Now we have the disk controller ROM code
where we can modify it, and start to trace the boot.
If you did not know already, the disk controller ROM reads track
zero, sector zero into memory from $800 to $8FF. Then it JMPs
to $801 and starts executing the code (which continues by loading
in a little more code, which then loads in more code, which
then.....well, you get the idea).
At the end of the code at $8600 we see a JMP $0801. We must
change this to JMP $FF59, which will exit us in the Monitor after
it is done loading track zero, sector zero into $8000 to $8FF. Put
Flip Out in drive one and type:
86F9:59 FF N 8600G
The drive will recalibrate and, a second later, beep into the Monitor
just like we told it. To turn OFF the drive motor, type:
COE8
from the Monitor prompt. If you want to, you can save this hunk
The Book Of Softkeys Volume III 29
of code to your normal DOS 3.3 disk with:
BSAVE BOOT@,AS800,LS100
(since this process did not disturb DOS which lives from $9600 to
$BFFF). Now type:
801L
to flip through the code just loaded. Here’s what you should find:
801-
803-
804-
806-
807-
808-
899-
80A-
89C-
80F-
811-
813-
815-
817-
819-
81C-
81F-
821-
823-
824-
826-
828-
829-
82B-
82D-
82F-
831-
833-
835-
838-
83A-
83C-
83E-
841-
843-
845-
847-
84A-
84c-
84E-
88A-
30
AS 2B
AA
85 FB
4A
4A
4A
4A
99 CO
8D 88 30
AG 00
84 00
Ag 0B
85 81
A230
AD 81 CO
AD 81 CO
Bl 00
9198
8
DO F9
£6 1
CA
DO F4
AG FB
84 F7
Ag 04
85 F8
85 FA
BD 8C CO
19 FB
C9 AD
00 F7
BD 8C CO
19 FB
C9 DA
DO F3
BD 8C CO
19 FB
C9 DD
00 EA
AC 29 04
LDA $28
TAX
STA SFB
LSR
LSR
LSR
LSR
ORA #$C
STA $3000
LDY #800
STY $00
LDA #$D8
STA $01
LDX #§30
LDA $C081
LDA $C981
LDA ($0) ,Y
STA ($80) ,Y
INY
BNE $081F
INC $81
DEX
BNE $081F
LDX $FB
STY $F7
LDA #$04
STA $F8
STA $FA
LDA $CA8C,, X
BPL $0835
CHP #$AD
BNE $0835
LDA $C@8C, x
BPL $083E
CMP #SDA
BNE $083A
LDA $CO8C,X
BPL $0847
CMP #$DD
BNE $083A
IMP $0429
Put the
code from
ROM into
the slot
zero RAN
card.
Load code
into RAM
starting
at page
$04
Look for
adata
field
epilogue
of AD,
DA, DD
JMP BOOT2
The Book Of Softkeys Volume III
This code loads in the final loader BOOT2 over the text screen
memory ($400 to $7FF) and JMPs to $429. Now we need to examine
BOOT2 (the game loader) to see where it actually loads in the game.
You might notice that this is slightly difficult since 80072 gets
loaded over the text page, and when we hit this memory
pretty much hits the bit-bucket. But BOOT] (the code which we are
now looking at in $801—$88C) can be changed to load BOOT2
somewhere else and gracefully into Monitor. To do this we
can change the load byte from page $04 to page $14, and change
the JMP $429 to jump into the Monitor. Then we can examine the
BOOT2 loader. To do this, from the Monitor, enter:
830:14 N 88B:59 FF
The next thing we must change is the disk controller ROM code
at $8600. We need it to execute, but not write over, the modified
code at $801. To do this, we can tell it to load track zero sector
zero at $6000 (instead of $800) and jump to our modified code at
$801. Of course our code will load BOO72 into $1400 so we can look
at it. If you are, go back and don’t return until you understand what
is going on.
OK, put Flip Out in drive one and type:
8659:60 N 86F9:01 08 N 8600G
The drive will recalibrate and boot zero will read track zero, sector
zero into $6000 (thus, not overwriting our code at $801). It will
then jump to $801 (BOOT1) and load BOOT2 into $1400 to $17FF.
Unfortunately, it will keep reading BOO72 into $1400 to $17FF
because we haven’t changed enough code. So, after a few seconds,
hit 4
Now if you want to, you can put your normal DOS 3.3 disk in
a drive and save B007T2 with BSAVE BOOT2,AS$1400,L$400.
Next type 1429L and examine 80072. You will notice that
memory from $800 to $BFF gets wiped clean and that a reset error
routine gets moved to $8F@0—$8F80. This is a good indication that
Flip Out lives from $C00 to $8F80! I'll let you sort through the
BOOT2 code to find out for sure, or you can take my word for it.
The last tidbit of information that the BOOT2 loader reveals is the
starting location of Flip Out. Look at the code at $17CC—$17E4
and you’ll see how it wipes out memory from $800 to $BFF and
then JMPs to $7809 to start the game.
Now we have filled requirements one and two. All that is left
is to save the memory from $C00 to $8F80 on a normal DOS 3.3
disk. This is easy since a 48K slave disk does not destroy memory
from $900 to $96FF. So just boot Flip Out and, when the drive
stops, T) into the Monitor. Now boot your 48K slave disk and
save Flip Out to disk! In cook-book fashion, here are the steps
necessary to get a BRUNable version of Flip Out.
The Book Of Softkeys Volume III 31
The Steps
Ce] Turn your Apple OFF and remove your RAM card.
Ca] Boot Flip Out then after the drive stops and Flip Out is
loaded into memory, hit to enter the Monitor.
[2] Boot a 48K slave disk:
PRG
| Enter the Monitor by typing:
CALL-151
C4] So that the program will execute when BRUN, enter some
code which JMP’s to $7800 to start up the game:
BFD:4C 00 78
[5] BsAvE Flip Out by typing:
A964:FF
BSAVE FLIP-OUT,ASBFD,L$8383
If you want the title page displayed, you will also have to perform
the following steps:
[6] Reboot the Flip Out disk and into the Monitor when
you see the title page.
[7] Boot your 48K slave disk and BSAVE the picture by typing:
PR#6
BSAVE PIC,A$2000,LS1FFB
BLOAD the Flip Out file and the picture file:
BLOAD FLIP-OUT
BLOAD PIC,AS2000
Enter the Monitor and type in the following code which
will display hi-res page 1 and wait for a key to be pressed before
it JMP’s to the start of the game:
CALL -151
BEO:AD 10 C0 AD 50 CO AD 54
BE8:C@ AD 57 C0 AD 52 C0 AD
BF0:00 CO 10 FB 4C 00 78
BSAVE the file by typing:
A964:FF
BSAVE FLIP-OUT,ASBE0,LS$83A0
%
32 The Book Of Softkeys Volume III
Hi-Res Computer Golf II B
Avante-Garde Creations
== Using Super IOB to Copy Hi-Res Computer Golf
by Jeff Rivett
S (Hardcore COMPUTIST # 12, page 6)
Requirements:
Apple JI Plus or equivalent
Super IOB and the swap controller
Two blank disks
Using the following method will help you to remove the copy
protection from a lot of older software. Although simple, it’s a great
solution when your program is constantly accessing the disk and
the DOS is reasonably close to DOS 3.3. It’s well worth trying in
many cases, because it is so easy.
How it works
First the original disk is booted to get the copy-protected DOS
into the machine. This is the only tricky part because you have to
have some means of stopping the execution of the program so that
the Apple’s Monitor can be entered. In Avant-Garde’s Golf II, the
Reset vector is set to re-boot the disk. However, if you lift the drive
door prior to hitting twice, the disk drive will shut OFF and
the protected DOS will still be in memory. The RWTS (Read/Write
Tracks & Sectors) of the protected DOS can then be moved to a
safe location prior to booting up with a normal DOS disk. The
protected RWTS can then be saved and utilized by Super OB, with
the swap controller installed, to read the protected disk. For Golf,
you only have to leave the disk drive door open to capture the
RWTS, but for most other programs you will need an old-style
monitor F8 ROM or one of the Non-Maskable Interrupt (NMI) copy
cards to do the trick.
When Super [OB has the swap controller installed, it will load
in a protected disk’s RWTS at $1900-$2100. When it comes time
to read the protected disk, this RWTS is moved into $B800—$BFFF.
For writing, the normal RWTS is moved back into $B800—$BFFF.
The Book Of Softkeys Volume III 33
In other words, the disk is deprotected by reading it with a protected
RWTS and writing the copy with a standard RWTS.
[1] Boot the Golf I disk and when the DO YOU WANT TO
SEE THE INTRO? prompt appears, open the disk drive door and
hit (RESET). Hit 1) a second time to turn OFF the drive. The
Golf II DOS will still be in memory.
[2] Enter the Monitor and move the Golf I RWTS to $1900:
CALL -151
1900<B800.BFFFM
[3] Boot up with a slave DOS 3.3 disk which has a small or
null HELLO program:
C600G
[4] Insert the disk which has Super OB on it and BSAVE the
Golf RWTS:
BSAVE GOLF.RWTS,AS1900,LS800
[5] Load in the Super JOB program:
LOAD SUPER I0B
Type in or EXEC in the swap controller and make sure that
the file BLOADed in line 10010 is called GOLF. RWTS):
Run Super OB and copy both sides of the Golf disk. The
Golf DOS should NOT be copied.
Golf IT has a strange bug that can be fixed by adding a line to
the Applesoft file called SW/NG. PRACTICE. FP. To fix this bug,
LOAD the file and add this line:
2 POKE 16611 ,1
If you use the technique I have just outlined on another disk and
it seems to work (except for the fact that the copied program will
not run), you may be able to figure out what is going on by tracing
the now readily accessible code and making modifications where
necessary. This is something that cannot be taught. Sometimes the
modifications will be quite simple, like adding a POKE statement
to an Applesoft program or omitting portions of an Applesoft or
machine language file.
If you happen to have a Replay II card, you can make a copy
of the program at the title page and another copy with normal DOS
3.3 in the machine. You can then use the ‘Compare’ option on the
Replay II utility disk to compare the copy-protected DOS with
normal DOS 3.3. This is often very helpful in making patches that
allow the new copy to run properly.
4
34 The Book Of Softkeys Volume III
P| Knoware
Knoware, Inc.
Softkey for Knoware
by Doni G. Grande
(Hardcore COMPUTIST # 14, page 6)
Requirements:
Apple If Plus with 64K RAM
A way'to into the Monitor
COPYA
A sector editor
Three blank disks
Knoware is a very interesting game - simulation - educational
program. The player starts out in a company working in the
mailroom. The objective is to become chairman of the board. In
order to accomplish this, you must use computer application
programs for spreadsheet analysis, wordprocessing, and database
use. All of the application programs may be used on their own, so
once you make chairman of the board, you have learned how to
use all of the programs!
First of all, only the first (out of three) disk is protected. Secondly,
Knoware checks the disk in the drive to be sure it is an original.
However, it is fairly easy to short-circuit this check. The procedure
to make a COPYAable version of Knoware is as follows:
C4] Use COPYA and duplicate the original Disk #1.
C2] Use a sector editor to make the following changes:
Track Sector Byte From To
$17 $01 $14 $4C $A9
$17 $01 $15 $8D $00
$17 $01 $16 $20 SEA
This changes the file ONESHOT. OVR (A$2000,LSFBA), and prevent
a call to a protection-check subroutine by replacing the JSR $208D
with a LDA #00 and a NOP, which tricks the program into thinking
there is an original disk in the drive.
The Book Of Softkeys Volume III 35
C3] Now use COPYA to copy Disks 2 and 3, and you have the
complete set.
One modification that you might want to make is to allow a fast
DOS to be used. There is a check in the file ONESHOT. OVR to see
if the I/O hooks have been changed. Some fast DOS versions do
change these. The following change will defeat this check:
Track Sector Byte From To
$10 $OF $01 $D0 $EA
$10 $OF $02 $0C $EA
$10 SOF $05 $C9 $A9
$10 SOF $06 $9E $00
An Alternate Procedure
This procedure may not work on all versions of Knoware. This
is an alternate way to unlock Knoware.
[4] Use COPYA and copy the original disk #1.
[2] Insert the copy of disk #1 into drive 1 and type the
following:
CALL -151
BLOAD ONESHOT.OVR
2010:A9 00 EA
BSAVE ONESHOT.OVR, AS$2000,LSFBA
BLOAD BOOTKW
9FD:EA EA
A01:A9 00
BSAVE BOOTKW,A$800,L$852
[£3] use COPYA to make copies of disks #2 and #3.
z
36 The Book Of Softkeys Volume III
Laf Pak
Sierra On Line
Normalizing Laf Pack
by Ferrel Wheeler
(Hardcore COMPUTIST # 13, page 9)
Requirements:
Apple It
1 blank disk
1 initialized disk (preferably with a fast DOS)
COPYA from the DOS 3.3 System Master
Any sector editor program such as DiskEdit or ZAP
Laf Pak is a collection of four small but very enjoyable and
playable games. Number one in the pak is Creepy Corridors, a
maze type game that is by far the most fun, especially with the
hilarious sound effects. Apple Zap is a four way shoot’em up game.
Space Race is a game in which you race an opponent or the computer
through a multitude of little bird-like aliens. Finally, Mine Sweep
is an almost impossible game in which you try to clear a mine field
in a given amount of time.
In trying to backup this disk, I first noted that the publisher was
Sierra On-Line. Many companies use a standard copy-protection
method on most of their products and I figured Laf Pak was
protected, like most of their other products, with a nibble count on
track 0. This turned out to be true. A check is made at the beginning
of each of the individual games. It is always helpful to know of a
company’s past methods of copy-protection when trying to unlock
any of their software. For example, the original Zork softkey in The
Book Of Softkeys Volume I, page 156, still works for all of
Infocom’s adventures, almost all of Automated Simulations software
can be DEMUFF /N-ed, and the boot-code-trace for Hard Hat Mack in
The Book Of Softkeys Volume I, page 101, can be used on
some other Electronic Arts games.
To disable the the disk checking routines for Laf Pak, I simply
had to find the first JSR (a subroutine call) at the beginning of each
of the games and replace it with NOP’s (no operation). For example:
The Book Of Softkeys Volume III 37
Creepy Corridors starts at $800 and at $808 there is a JSR $1B33
which is the call to the disk verification scheme. In machine code
this code is 20 33 1B, so I simply used a disk searcher to find these
three bytes on the Laf Pak disk. With Laf Pak this can easily be
done since the disk is written in standard DOS 3.3 format. I found
similar calls in the other three games and recorded the locations
of all the bytes that needed to be changed to EA (op code for NOP).
So, to back up Laf Pak simply use COPYA to copy the entire disk
(always write-protect your original first!). Then use a sector editing
program to make the following changes to the backup.
Trak: 4 4 4 14141499 9 CCC
Sector: ®@ 0 0 ® 0 0222777
Byte: 8 9 A D E F F 10 11 F 10 11
From: 20 33 1B 20 @D 72 20 7C 13 20 33 17
To: EA EA EA EA EA EA EA EA EA EA EA EA
You now have a completely unprotected backup of Laf Pak which
can be copied with any standard copier. If this is all you want you
can stop here, but I wasn’t satisfied because using a full disk for
a backup of a game is usually a waste of disk space. I wanted each
game normalized, i.e. BRUNable and F/Dable. I also wanted the Laf
Pak machine to work as normal from a standard binary file.
Normalizing each game will illustrate the method of using memory
moves to compact binary files and will also illustrate how to pass
commands to DOS from within machine language programs. When
we are done there will be plenty of room on the disk for any other
games you want to store with Laf Pak.
The first thing to do, while the sector editor is still handy, is to
change the name of the file that is run on boot up. It is named LAF
PAK, but is preceded with seven ©) s. Since we will want to load
this file in from hand, we need to get rid of the control characters.
Use your sector editor to read in track $11, sector $F and, beginning
with byte $0E, type in LP ($CC $D0) and enough spaces ($A0)
to cover the seven s ($88) and the ASCII codes for LAF PAK.
Write this sector back to disk. Now when you CATALOG your
backup Laf Pak disk, the first file should be a 4-sector binary file
named LP.
Before we actually begin you need to boot your initialized disk,
type in the following code at $800 and save it as PAGE MOVER.
CALL -151
800:A2 00 A@ FF 84 3E C8 84
808:3C 84 42 BD 25 @8 85 43
810:E8 BD 25 08 85 3D E8 BD
818:25 08 85 3F E8 20 2C FE
820:E0 06 D@ DE 60 60 00 00
BSAVE PAGE MOVER,AS800,L$28
38 The Book Of Softkeys Volume III
In Assembly language this looks like:
9800- A2 00 LOX #$08
9802- AQ FF LDY #$FF
9804- 84 3E STY $3E
9806- C8 INY
G807- 84 3C STY $3C
0809-84 42 STY $42
980B- BD 25 98 LDA $0825,X
@8GE- 85 43 STA $43
0810- E8 INX
@811- BD 25 68 LDA $0825,X
@814- 85 3D STA $3D
@816- E8 INX
9817- BD 25 98 LDA $0825,x
O81A- 85 3F STA $3F
@81C- £8 (NX
$810- 20 2C FE JSR SFE2C
9820- EO 06 CPX #$06
0822- DO DE BNE $0802
9824- 60 RTS
This routine uses the Monitor’s move subroutine at $FE2C (note
the Y-register must be @ on entry) to perform block page moves
where a page is considered to be 256 bytes starting at an address
of the form XX09, i.e. the low order byte is 00. If $800 is considered
the first byte of the routine, then the ‘table’ begins at byte $825.
A table entry is 3 bytes designating which pages to move and where.
For example, if I wanted the Monitor to perform the following move:
1100<2200.33FFM, the table entry would be: 825:11 22 33 . You
can have as many as 85 table entries but you must set byte $21 to
3 times the number of memory moves to be performed (in other
words, set it to the total number of bytes in the table). As long as
you load this code on a page boundary, then bytes $0D, $13 and
$19 are the only bytes you have to change to relocate the code. These
locations should hold the hi-byte of the page to which you relocate
the code. If you are using an assembler, you can make all of these
changes in the source code by simply changing the origin and the
contents of the table.
Our goal is to have 5 binary files, the 4 games and the menu or
FUN MACHINE file which we will name LAF PAK. We will change the
menu file to simply BRUN the selected game instead of loading it
in directly from disk as it does on the original disk.
On the original, when you are playing any of the games and you
hit (Ec), the game will BRUN a file called BOOT. OBJ which in turn
loads in the menu. We will simply change each game to BRUN LAF
PAK instead of BOOT. 0B/.
The first thing we need to do is to save each of the games. I will
illustrate all of the steps in detail for the first game, Creepy
Corridors.
The Book Of Softkeys Volume III 39
Creepy Corridors
[4] Boot the initialized disk on which you saved PAGE MOVER
(preferably a disk with a fast DOS on it). Insert your Laf Pak backup,
load the boot-up file LP and get into the Monitor.
BLOAD LP
CALL -151
C2] LP starts at $1400 where it first reads in the I/O routine at
$220. Whatever the accumulator is holding on entry to $220
determines which game (or the menu) is to be loaded. A @ means
Creepy Corridors and a 4 means the menu. At $1438, the
accumulator is loaded with 4 (indicating that the menu is to be
loaded) and a jump is made to $220. We can change this JMP
instruction ($4C) to a $60 (RTS) so that the I/O routine will be
loaded, but not executed. To do this type:
143A:60 N 1400G
Upon examination of the I/O routine at $220, you can see that each
game and the menu are loaded in three seperate chunks. The
destination addresses and the number of pages to be loaded in each
chunk are given in the tables at $2FA and $2EB, respectively. With
this information and a little bit of hexadecimal addition, the following
addresses can be determined:
Creepy Corridors: $800-1CFF $4000-SFFF — $7000—94FF
Space Race: $800—-1SFF $6000-—6EFF $8000—93FF
Mine Sweep: $800—-IEFF $4000—SFFF — $8700—94FF
Apple Zap: $4000-—SFFF $6000—7EFF $7D00—8CFF
Fun Machine: $800—EFF $4000—60FF — $9000—94FF
| We are going to let the Laf Pak routine read in each game,
then stop it before it jumps to the beginning of each game. This
is done by changing the JMP at $28A to a RTS:
28A:60
[4] Now we just need to load the accumulator with ® for Creepy
Corridors and jump to $220. This is done by changing the code at
$1438 so that the accumulator will contain a @ when the I/O routine
executes:
1439:00 4C N 1438G
[£5] The code is now in, so let's change BOOT. OBJ to LAF PAK
so the menu will be loaded if is pressed:
14C5:CC C1 C6 A® D@ C1 CB AG
40 The Book Of Softkeys Volume II!
We next can compact the 3 chunks of code into one
contiguous block with the following memory moves:
1D00<4000.5FFFM
3D00<7000.94FFM
Since PAGE MOVER will live at the end of the block (at $6200),
we need to call this subroutine before the main program is run. So
we put a JSR $6200 at the beginning of the code:
7FD:20 00 62
Now insert the initialized disk with PAGE MOVER on it, load
it in and change it so that it will run at this new location:
BLOAD PAGE MOVER,AS6200
620D:62 N 6213:62 N 6219:62
Note that the inverse of the moves made in step 6 are
7000<3D00.61FFM & 4000<1D00.3CFFM, which give us the table
entries for the move code:
6225:70 3D 61 40 1D 3C
Save the game:
BSAVE CREEPY CORRIDORS,AS7FD,LS5A80
You now have a completely normalized Creepy Corridors game
which can be BRUN to your heart’s content. Before going on, you
should first test it by clearing memory and then running it from disk.
An easy way to clear memory without turning your Apple OFF is
by typing:
800:00 N 80<800.9500M
If something goes wrong, BLOAD the file and check the code at
$6200 for any typos.
In case you got lost along the way, here are the basic steps we
performed in order to capture a compacted version of Creepy
Corridors.
Ca] Load the game into memory.
Compact the game code into one contiguous area of
memory.
Ce] Append the PAGE MOVER routine onto the end of the
compacted code and fix it so it will run properly there.
[dD] Put the proper values into the PAGE MOVER table.
BSAVE the game after inserting some code at $7FD that
calls the PAGE MOVER routine before the game tries to execute.
When the game is BRUN, the PAGE MOVER routine de-compacts
the code.
The Book Of Softkeys Volume III 41
For the other three games, the steps are very similar to those we
performed for Creepy Corridors.
Space Race
1) - Cs] see Creepy Corridors
[4] The accumulator should hold a 1 so that Space Race will
be loaded:
1439:01 4C N 1438G
[5] Change 8007. OBJ to LAF-PAK:
962:8D 84 C2 D2 D5 CE A@ CC
96A:C1 C6 A@ DO C1 CB
Compact the game’s code with the following memory
moves:
1600<6000.6EFFM
2500<8000.93FFM
[7] Insert the code which calls the PAGE MOVER routine:
7ED:20 00 39
Insert the initialized disk, load the move routine and relocate
it:
BLOAD PAGE MOVER, AS3900
390D:39 N 3913:39 N 3919:39
Put in the table for PAGE MOVER:
3925:80 25 38 60 16 24
Save the game:
BSAVE SPACE RACE,AS7FD,L$3180
Mine Sweep
mal - C3] see Creepy Corridors.
[4] The accurhulator should hold a 2 so that Mine Sweep is
loaded in:
1439:02 4C N 1438G
[£5] Change BOOT. OBJ to LAF PAK:
96D:CC C1 C6 AQ DO C1 CB AO
42 The Book Of Softkeys Volume III
| Compact the code with the following memory moves:
2900<800.1EFFM
6000<8700.94FFM
Cy Insert some code which calls the PAGE MOVER routine
and jumps to the start of the game:
28FA:20 00 GE 4C 00 08
Insert the initialized disk, load PAGE MOVER and relocate
it:
BLOAD PAGE MOVER, AS6E00
6EOD:6E N 6E13:6E N 6E19:6E
[9] Install the memory move table at $6E25:
6E25:87 60 6D 08 29 3F
Finally, save the game:
BSAVE MINE SWEEP,AS28FA,LS4580
Apple Zap
al - C3] see Creepy Corridors.
C4] The accumulator should hold a 3 so that Apple Zap is
loaded:
1439:03 4C N 1438G
[£5] Change BOOT. OBJ to LAF PAK:
63BD:CC C1 C6 AQ DO C1 CB AO
| No moves are necessary since the code is already
contiguous.
[C7] Insert the code which jumps to the beginning of the game:
3FFD:4C 00 60
PAGE MOVER is not used with this game,so...
Insert the initialized disk and save the program:
BSAVE APPLE ZAP,AS3FFD,LS4D03
Before we move on to the menu program, I would like to note
that Mine Sweep, Apple Zap and the menu all store standard hi-res
pictures at $4000—$5FFF. Those of you who are ambitious and
wish to save about 50 more disk sectors can pack these pictures and
insert the unpacking routine with them to make these files even more
The Book Of Softkeys Volume III 43
compact. If you just want to be able to BRUN each of the games
and do not care about the ‘Fun Machine’ menu, then you have
completed this task and you can stop here. But if you would like
to use the menu program on occasion, then read on.
The Fun Machine
Capturing the menu program is similar to the above except that
we must intercept the jump to the I/O routine to load in a game
and replace it with our own BRUN routine. At $862, the number
of the game that is chosen is utilized to get an address from an
address table at $D62. This address is stored in $00.$01 which is
used as a vector to the correct entry into the I/O routine. We will
place our own address table at $D62 so that $00.$01 becomes a
pointer to the correct game that should be run. We will then print
out BRUN with the code:
86C- LDY #$06
86E- LDA $0879,Y
871- JSR $FDED
874- DEY
875- BNE $086E
877- — JMP $0E30
87A- NURB
At $E30, we will place a routine that uses the address in $00.$01
to print the name of the game. The code to do this looks like:
E30- — LDY #$00
£32- LDA ($99) ,Y
E34- JSR $FDED
E37- INV
E38- BNE $9£32
The result is that DOS will BRUN the desired game from the Fun
Machine menu. All of the steps are summarized as follows:
4] - C3] see Creepy Corridors.
[£4] The accumulator should hold a 4 so that the menu is loaded:
1439:04 4C N 1438G
Type in the code below which will print out the DOS
command BRUN (preceded by a and a (3D):
86C:A0 06 BO 79 08 20 ED FD 88 DO
876:F7 4C 30 OE CE D5 D2 C2 84 8D
Type in this code which will print out the name of the game
to be run:
E30:A0 00 B1 00 20 ED FD C8 DO F8
44 The Book Of Softkeys Volume III
Next, install in memory a table which contains the names
of the four games (each followed by ):
E40:C3 D2 C5 C5 DO D9 AO C3
E48:CF D2 D2 C9 C4 CF D2 D3
E50:8D C1 D@ D@ CC C5 A® DA
E58:C1 DO 8D D3 D@ C1 C3 C5
E60:A@ D2 C1 C3 C5 8D CD C9
E68:CE C5 A@ D3 D7 C5 C5 DO
E70:8D
Now, put the addresses of the names in the address table:
D62:40 GE 51 OE 5B GE 66 OE
Compact the menu code with the following memory moves:
F00<4000.60FFM
3000<9000.94FFM
[£7] Insert the code which calls the PAGE MOVER routine:
7ED:20 00 OE
Insert the initialized disk, load the PAGE MOVER and
relocate it:
BLOAD PAGE MOVER, ASE0O
EQD:0E N E13:0E N E19:0E
Install the PAGE MOVER table:
E25:40 OF 2F 90 30 34
Ge] Of course, we also have to save the compacted code for
the menu:
BSAVE LAF PAK,AS7FD,LS2D03
Now you have a completely normalized Laf Pak that you can put
on any one of your game disks. I hope the techniques I have
illustrated will come handy when you are trying to normalize other
copy-protected games.
The Book Of Softkeys Volume III 45
Sierra On-Line Inc.
Softkey For Learning With Leeper
by Marco Hunter
(Hardcore COMPUTIST # 13, page 8)
Z Learning With Leeper ©
=
=
Requirements:
48K Apple Jl or compatible
One disk drive and DOS 3.3
COPYA from the DOS 3.3 System Master
A sector editor
A blank disk
The three things you can count on in this life are death, taxes, and
Sierra On-Line’s nibble counts. With this in mind, I tackled Learning
with Leeper, a recent educational release from Sierra. As usual, the
disk is normal DOS 3.3, easily COPYA-able but it will not work
correctly). I discovered that the nibble count checks track $0. This
was also standard Sierra.
Tracks $00, $03, and $1F are popular tracks for Sierra On-Line
nibble counts. I decided to go all-out and remove the nibble count
entirely. But when I finally found the nibble count routine, I decided
that the easiest thing to do was simply avoid jumping into it, rather
than trying to modify it. Let’s deprotect Learning With Leeper:
[4] Boot the 3.3 System Master as usual (PR#6 (EUR) ).
C2] Use COPYA to make a backup of Learning with Leeper.
Use your sector editor to modify these bytes on the new
copy eliminating the nibble count routine:
Track Sector Byte From To
$03 SOF $2C $20 $EA
$03 $OF $2D $00 $EA
$03 $OF $2E $12 SEA
4
46 The Book Of Softkeys Volume III
Lion’s Share
Davka Corporation
Softkey For Lion’s Share
by Jan Eugenides
(Hardcore COMPUTIST # 12, page 14)
Requirements:
Apple If Plus or equivalent
One blank disk
Super IOB
The Lion’s Share is a pretty good adventure, with some nice
graphics. I enjoyed it, but even more, I enjoyed figuring out the
protection scheme. It was much more of a challenge than getting
the sword out of the snake pit! First, for those of you who just want
to backup the game, here’s the softkey:
Ga] Boot your DOS 3.3 System Master and clear any program
in memory.
PR#6
FP
[2] Enter the Monitor and make some modifications to DOS
CALL -151
BA69:60
BA6A<BA69.BA91M
BCDF:60
BCE0<BCDF.BCF8M
[£3] Put in a blank disk and put this modified DOS on it:
INIT A
[4] Turn the disk over and put this DOS on the back side, too.
You will have to cut a notch in the side of the disk to allow you
to use the back:
INIT A
The Book Of Softkeys Volume III 47
[8] Put side one of The Lion’s Share in the drive, start the drive
with the drive door open then press the (GREAK) key:
PR#G
Close the door, wait for the break message and then clear
the program in memory:
FP
a Enter the Monitor and move the RWTS to a safe place for
booting:
CALL -151
2000<B800.BFFFM
Put your Super JOB disk (or some other disk with a very
short Hello program) in the drive, boot it and save the RWTS:.
6@P)
BSAVE RWTS.LIONS,AS2000,LS800
[£9] Load Super JOB, type in the controller at the end of this
article and then RUN Super IOB.
Copy both sides of the original Lion's Share disk to both
sides of the disks you formatted at the start of the procedure.
(47) You're done! Boot your copy and enjoy!
Beneath The Softkey
When I booted the game, I noticed a prompt at the bottom of the
screen. This usually means that some form of DOS is being used.
Going on this assumption, I decided to have a look at tracks $0—2
of the disk, to see if I could ferret out the system.
No dice. I couldn’t read the disk at all, nor would it CATALOG.
Using a Hardcore COMPUTIST program called Diskview 1.1A, I
managed to peek at the raw nibble dump, and it was definitely
nonstandard. So, I resorted to a little trickery.
First I removed the top 8 RAM chips from my machine. These
are the ones nearest to the left rear of the Apple, inside the white
box labeled ‘‘RAM.”’ (Scary, isn’t it?) Then I booted my System
Master. (It has to be the master, and not a slave disk.) This had
the effect of loading DOS 16K lower in memory than usual. (The
higher memory was in my left hand!)
You see, the master disk checks to see how much memory is
available and loads DOS in at the top of this available memory. A
slave disk, on the other hand, always loads DOS into the same
location, namely the location it was in when the slave was made.
48 The Book Of Softkeys Volume III
I then initialized a slave diskette, using my now 32K Apple. I’ll
call this the 32K slave. Next, I replaced the RAM chips, and booted
The Lion’s Share.
Pressing causes the disk to re-boot, since the reset vector
has been changed, so I took advantage of this fact. I now removed
the game disk, and put in my 32K slave. Pressing
the disk to boot, and regular old DOS 3.3 was loaded in at its 32K
location. Because of this, Davka’s DOS was still intact in the upper
memory! Now it was a simple matter to save this Davka DOS with
an address of $9D00 and a length of $22FF.
I now had Davka DOS on my disk as a binary file. You may be
able to use this method on other protected disks. Just keep the 32K
slave around for future use.
The next step was to boot up the System Master again, thus placing
DOS 3.3 back in its normal location at $9D00. I now BLOADed
Davka DOS at $2D00. (It can be anywhere, really, as long as it
doesn’t overwrite DOS 3.3)
Using the Monitor VERIFY command I made a print-out of all
the locations which were different between the two DOSs. This is
a nifty command which compares two ranges in memory and tells
you if they are the same or not, and if not, what the differences
are. Check the Apple reference manual for more information.
In this case, the command was 2D00<9D00.BFFFV. (Turn on
your printer first with a PR#1, and set it to skip the perforations
if you can.) This gave me a complete list of all the changes!
With my trusty copy of Beneath Apple DOS in hand, I proceeded
to analyze the changes. I saw that the spelling of the SAVE and
INIT commands had been altered but the rest of the commands were
the same.
Most importantly, I discovered that both the read and write
routines had been changed, as well as their translate tables. No
wonder I couldn’t read the disk; it was scrambled!
Then it was no problem. I just patched the DOS 3.3 read routine
to match that used by Davka. Sure enough, I could now CATALOG
the game disk. Of course, the DOS 3.3 write routine was still
standard, so all I had to do was F/D all the files over to a normal
disk, right? Not quite, but close!
Once I had copied all the files to a normal disk, I booted it and
tried to run the game. It worked perfectly until I tried the SAVE
GAME option, and then it bombed.
The Apple obligingly informed me that it had stopped at $BA78.
Hmmm. Isn’t that unused space in DOS? Yep, it sure is. But Davka
put a routine there which changed the address and data markers back
to standard, so that their game could read and write to standard disks.
(Pretty sneaky, huh?)
I replaced this whole section with 60’s (RTS), and also the section
at $BCDF, which was part of the same routine.
The Book Of Softkeys Volume III 49
After I had initially deprotected The Lion’s Share, I discovered
something which made the overall softkey procedure a little easier.
What I found was that The Lion’s Share boot program would
BREAK (stop execution) if was typed as the disk booted. After
the BREAK occurred, typing:
FP
CALL -151
2000<B800.BFFFM
allowed me to enter the Monitor and move the Lion’s Share RWTS
to a safe location. After booting with a slave disk, I just BSAVEd
the RWTS.
To automate the copy process a little, I modified the SWAP
Controller of Super IOB so that it would utilize the Lion’s Share
RWTS. All these changes were incorporated into the softkey
procedure which I detailed at the beginning of this article.
Ta Daaa!
Thaved played the whole game through on my copy, and it works
perfectly. It works exactly like the original, only now I don’t have
to worry about damaging it because I can make backups. Also, I
can peek at the files if I feel too frustrated, although this game isn’t
that hard. Not like Zork III, anyway! I can also check out the
program to see how it works and learn some more. That’s what
it’s all about, right?
controller
1900 REM SWAP CONTROLLER (LIONS SHARE )
1010 TK = 3 :ST= 9 :LT=35 :CD=R
1020 T1 = TK : GOSUB 498 : GOSUB 369 : ONERR GOTO 559
1030 GOSUB 430 : GOSUB 100 :ST = ST +1: IF ST <DOS THEN 1030
1040 IF BF THEN 1068
1050 ST = :TK=TK+1: IF TK <LT THEN 1030
1069 GOSUB 490 :TK=T1 :ST = @ : GOSUB 360
1970 GOSUB 430 : GOSUB 100 :ST = ST +1: IF ST < DOS THEN 1070
1080 ST = 9 :TK=TK+1 : IF BF = 0 AND TK < LT THEN 1070
1990 IF TK < LT THEN 1028
1108 HOME : PRINT “REMEMBER* T0* COPY*BOTH* SIDES" : END
10010 PRINT CHRS (4) "BLOAD* RWTS.LIONS, A$1900"
b
50 The Book Of Softkeys Volume III
Lightning Software
Master Type Softkey
by Peter Rongays
(Hardcore COMPUTIST # 15, page 8)
Requirements:
48K Apple Il Plus or equivalent, with
Old F8-ROM or copycard
Super IOB
One blank disk
Bruce Zweig’s Master Type has been one of the best-selling pieces
of software for the Apple Il ever since it was released back in 1981.
The program’s most unfortunate drawback is a common one: it is
copy-protected. Since the program is undoubtedly being used in a
fair number of schools throughout the USA and elsewhere, there
is a corresponding demand for information on how to backup this
disk. The reluctance of an instructor to turn over the only copy of
a $40 program to a group of precocious eight-year-olds is entirely
understandable.
Luckily, as I found out, Super JOB has little difficulty in copying
Master Type. This article will explain how to make the backup.
Judging from the EDD III parameter list for Master Type, it
appears to have been protected by Lock-It-Up, one of those copy-
protection utilities that you may have seen advertised as being able
to produce an ‘uncopyable’ disk (Note: The ‘uncopyable’ disk is
close kin to the ‘unsinkable’ Titanic). Indeed, Master Type is
protected fairly well, as evidenced by its several months stay on
the Hardcore Most Wanted List and the difficulty of backing it
up with a bit copier.
Upon booting Master Type, the familiar Applesoft prompt will
appear while the game loads, an indication that a disk can be copied
by Super JOB with the Swap Controller installed, as long as its
RWTS can be captured by some means. This is the case with Master
Type, but the Super IOB copy made with the standard Swap
Controller will not work because the text of some of the DOS
The Book Of Softkeys Volume III 51
commands have been altered. You can verify this by booting Master
Type, halting it with an old Monitor or NMI and then
examiming memory from $A884 to $4908. About half of the normal
DOS commands have been blanked out entirely and, of those that
remain, nine are the same as with normal DOS and five have had
their text changed:
DOS 3.3 Command
Master Type Command
INIT
DELETE
CLOSE
READ
EXEC
WRITE
OPEN
CATALOG
NOMON
PR#
IN#
FP
BLOAD
BRUN
SAVE
KILLDE
CLOSE
READ
EXEC
WRITE
OPEN
CATNDOG
NOMON
PR#
IN#
FP
YZ123
YZ23
Because the majority of Master Type is written in Assembly
language, it would take a bit of work to track down the location
from which these altered DOS commands are being executed. This
would be required if you wanted to make the program totally
compatible with DOS 3.3. Instead of all this work, I decided to
modify the Super [OB Swap Controller a bit so that the entire Master
Type disk, with the exception of the sectors that contain the RWTS,
would be copied. A Master Type disk with a hybrid DOS is thus
created. It will be normally formatted and completely COPY Aable,
but its DOS will still use the altered commands. If you examine
the Master Type controller listed at the end of this article you will
see that it is the Swap Controller with lines 1010, 1060 and 10010
modified and line 1065 added.
One other change that must be made to the copy of the Master
Type disk is to fill in two of the free areas in the RWTS with
hexadecimal $60’s. This is necessary because Master Type can store
user-created lessons on normally formatted disks. On the original
Master Type disk, this free space contains some code which modifies
the RWTS depending upon whether the original or a data disk has
to be read. This code won’t be needed, or present, on the copy.
Therefore, we will just replace it with a bunch of machine language
RTS’s.
With a little more effort, I’m sure Master Type could be made
to work with a totally normal DOS, but it probably is not worth
the effort to do so unless you have some modifications or
enhancements you would like to add to it. I will leave that chore
up to the more ambitious readers.
52 The Book Of Softkeys Volume III
Making the Copy
[2] Boot up the original Master Type disk and, after the program
has been loaded, stop it with a or NMI.
C2] From the Monitor, move the Master Type RWTS to a ‘safe’
location:
1900<B800.BFFFM
[3] Boot up a DOS 3.3 slave disk and then BSAVE the Master
Type RWTS onto a disk which contains Super IOB:
BSAVE RWTS.MASTER TYPE, A$1900,L$800
[4] Enter the Monitor and fill in two of the ‘holes’ in the RWTS
with $60’s (RTS’s) before initializing a blank disk:
CALL -151
BA69:60 N BAGA<BA69.BA94M
BCDF:60 N BCE@<BCDF.BCFEM
INIT HELLO
[5] Load Super JOB, install the controller and then make a copy
to the disk initialized in Step 4 above. Note: Do not reformat the
disk.
controller
1990 REM MASTER TYPE CONTROLLER
1910 TK = @ :ST = 10 :LT = 35 :CD = WR
192 T1 = TK : GOSUB 499 : GOSUB 369 : ONERR GOTO 550
1930 GOSUB 430 : GOSUB 108 :ST = ST +1: IF ST < DOS THEN 1030
1949 |F BF THEN 1960
1950 ST=@ :TK=TK +1: IF TK<LT THEN 1030
1960 GOSUB 499 :TK =T1 :ST=@ : IF TK =@ THEN ST = 18
1965 GOSUB 360
1978 GOSUB 430 : GOSUB 100 :ST = ST +1: IF ST < DOS THEN 1070
1988 ST =@ :TK=TK +1: 1F BF =@ AND TK < LT THEN 1078
1990 IF TK < LT THEN 1020
1100 HOME : PRINT "EVERYTHING*O.K.*NO*DOS*ON* COPY" : END
19910 IF PEEK ( 6400 ) < > 162 THEN PRINT CHR$ (4) “BLOAD
RWTS . MASTER* TYPE, A$ 1990"
An Alternate Softkey by Harry Noel
I don’t have an F8 Monitor ROM, so I had to find another way
to load in Master Type’s RWTS. This is how you can do it:
| Boot a normal DOS 3.3 disk and insert the Master Type
disk.
The Book Of Softkeys Volume III 53
[2] Enter the Monitor with:
CALL -151
[£3] Move BOOT into RAM and modify it to jump to $8801:
8600<C600.C6FFM 86FA:88
[4] Place a jump into the Monitor and start the boot:
8801:4C 59 FF
8600G
[5] stop the drive and move $800 to $8800:
COE8
8800<800.8FFM
Ce] Set an indirect jump to the modified read routine:
880E:80
a Return contro] after reading the RWTS and start the read:
884A:4C 59 FF
8600G
Stop the read and move the RWTS to a safe location:
COE8
1900<B800.BFFFM
Boot the Super IOB disk:
And type:
BSAVE RWTS.MASTER TYPE,AS$1900,L$800
Now continue at step 4 in Mr. Rongays’ article and you will have
a COPYAable version of Master Type.
If you want to make this disk totally DOS 3.3, you must go one
step further.
First, copy all the files off the broken Master Type to a normal
DOS 3.3 disk (I used Copy II Plus v4.4C to transfer files) and get
teady to use your sector editor (I used Tricky Dick). Find all the
occurences of these low-byte ASCII codes: CATNDOG, KILLDE,
SAVE, YZ123,YZ23. Change them to CATALOG, DELETE,
INIT, BLOAD, BRUN respectively. Then find these high-byte
ASCII codes: YZ123 and YZ23 and change these to BLOAD and
BRUN, respectively. You now have a normal copy of Master Type.
4
54 The Book Of Softkeys Volume III
MatheMagic
International Software Marketing
Softkey For MatheMagic
by Doni G. Grande
(Hardcore COMPUTIST # 14, page 7)
Requirements:
Apple II with 48K
COPYA from the DOS 3.3 System Master
Super [OB
A blank disk
MatheMagic is a program which transforms your microcomputer
into the ultimate calculator. With it, you can program your computer
in the same way you would a programmable calculator.
The program disk itself is copy-protected, but it can use and
initialize normal data disks. This is done by altering RWTS when
access is needed to the original disk, and then changing it back to
normal when a data disk is accessed. The only parts of RWTS I
found changed were the following locations:
Location: $B991 $BCAE $BC60
From: $DE $DE SFF
To: $DF $DF $FE
The first two locations are the address epilog start bytes and the
last location is the sync mark used in the protected DOS. The only
problem with just changing these locations to their normal values
is that the program keeps changing them back whenever it accesses
the program disk, generating an I/O ERROR. Also, since the
program is a compiled basic program, it is very difficult to discover
the location in the program at which this change is made.
The answer to the problem is to let the program change DOS to
access the program disk, but patch the RWTS subroutine to change
those locations back to normal whenever it is called.
The main entry to RWTS is at $BD00, and a JuMP to the patch
can be made there if the original instructions at this entry point are
duplicated in the patch. After DOS is put back to normal, the patch
The Book Of Softkeys Volume III 55
jumps back to RWTS and all operates normally!
The steps required to make a normal copy of MatheMagic are:
4) Boot a normal DOS disk.
C2] Enter the Monitor, move an image of the normal DOS 3.3
RWTS to $1900 and then modify it so it can be used by Super JOB
to read the protected MatheMagic disk:
CALL -151
1900<B800.BFFFM
1A91; DF
1DAE: DF
BSAVE RWTS, AS1900, LS$800
C3] Run Super IOB with the Swap Controller installed to make
a copy of MatheMagic. The Swap Controller will use the RWTS
created in Step 2 to read the disk.
[4] Type in the following short patch:
0360:84 48 85 49 AO DE 8D 91
@368:B9 8D AE BC AQ FF 8D 60
0370:BC 4C 04 BD
This is the patch which will be executed just before RWTS is
entered. The Monitor listing is:
0360- 84 48 STY $48 Store Y and A as RWTS would
0362- 85 49 STA $49
9364- A9 DE LDA #$DE Fix data and address marks
9366- 8D91B9 STA $B991
9369- 8D AEBC STA $BCAE
936C- AQ FF LOA #S$FF = Might as well fix the sync byte too
@36E- 8D 68BC STA $BC60
9371- 4C64BD JMP $BD84 Return control to the RNTS
[£5] Save this patch on the copy of the MatheMagic disk:
BSAVE DOSPATCH, A$360, L$14
[6] Load the file WATH.HELLO from the copy disk and add the
following:
227 PRINT CHRS( 4) "BLOAD* DOSPATCH"
228 POKE 48384, 76 :POKE 48385, 96 :POKE
48386, 3 :POKE 48387, 234
This places a JMP to $360 and a NOP as the first instructions in
RWTS so that DOSPATCH is executed before every call to RWTS.
[7] Save WATH. HELLO back to the copy disk:
UNLOCK MATH.HELLO
SAVE MATH.HELLO
56 The Book Of Softkeys Volume III
Millionaire
Blue Chip Software
Softkey For Millionaire
by Ryan Hodge
(Hardcore COMPUTIST # 12, page 7)
Requirements:
48K Apple I[ Plus equivalent
F/D from the DOS 3.3 System Master
A blank disk
Integer Card or modified F8-ROM or NMI card
[4] INIT a blank disk with /4/T/AL as the null hello program.
INIT INITIAL
[£2] Load F/0 from the DOS 3.3 System Master and modify DOS:
BLOAD FID
CALL -151
B925:18 60
B988:18 60
BE48:18
B8FB:29 00
C3] Run F/D and copy these files onto a normal DOS 3.3 disk:
CHAIN, COMMON, INDUST, STOCKS, MESDATA, PLAY, DESCRIP, PLAYER,
RANDOM. DTA (and SAVE if it’s on your disk):
803G
[4] Boot (PR46 (GET) the original Millionaire disk and when
the screen ‘asks’ if you wish to resume an old game, hit (or
use your NMI card) to enter the Monitor, repeat the DOS changes
in step 2 and finally, put the Millionaire hello program, /N/T/AL,
onto your normal disk containing the other Millionaire files:
SAVE INITIAL
The Book Of Softkeys Volume III 57
~ Music Construction Set
Electronic Arts
Backup And Modify Music Construction Set
by Dan Rosenberg
(Hardcore COMPUTIST # 12, page 27)
Requirements:
a separate list is given for each version
Many readers probably own a copy of Music Construction Set
(MCS) which, in my opinion, is the best music program currently
available for the Apple. However, I suspect that many owners of
MCS are dismayed, like I was, by their inability to back up or modify
the program. Because MCS is protected, it has an annoying habit
of checking for an original program disk from time to time. For
the user, this copy-protection measure means increased wear on the
original MCS disk in addition to slowing down the overall process
of composing music.
The MCS disk uses a version of DOS 3.3 called DOS 3.3P (the
P stands for Protected.) Most copy programs will copy the MCS
disk without errors, but the copy will not work because the
program(s) check the disk for its originality.
Luckily it is not too difficult to defeat DOS 3.3P. Once the
protection has been defeated it is possible to make some
modifications to MCS.
The Copy
The first thing to do is determine which version of MCS you have.
The different versions require entirely different copy methods. I
know of two different versions, which I will call version 1 and
version 2. Version 1 does not support the cassette output function
(it won’t ask you if you would like cassette output), and the files
A3,A4, P3,Nand O appear in the catalog. Version 2 allows you to use
cassette port output, and A3, A4 and P3 do not appear in the
CATALOG. Check for which version you have, and then use the
appropriate method.
58 The Book Of Softkeys Volume III
MCS version 1 cop:
Requirements:
48K Apple I{ Plus or equivalent
COPYA from the DOS 3.3 System Master or bit copy program
A blank disk
[4] Boot up with any DOS 3.3 disk:
PR#6
[2] Copy your MCS disk with COPYA onto the blank disk. If
COPYA has any trouble making a copy, get out your bit copy program
and copy tracks $0—$22 with the standard parameters:
RUN COPYA
C3] Insert the copy of MCS and load the binary file called A4:
BLOAD A4
| Enter the Monitor by typing:
CALL -151
[5] Make the following modifications to the image of A4 in
memory:
9131:60
913A:EA EA
4C00:60
Resave the file A4 by typing:
BSAVE A4,A$4A00,LSB60
Cy Boot up your copy of the MCS disk and start constructing
(musically, that is).
MCS version 2 copy
Requirements:
Apple If Plus or equivalent
A blank disk
Text-Editing program or...
MAKE TEXT from the DOS 3.3 System Master disk
The Book Of Softkeys Volume III 59
[4] Boot up a DOS 3.3 disk and then initialize a blank disk with
a ‘null’ HELLO program:
PR#6
FP
INIT HELLO
[£2] Boot up with the original MCS disk:
PR#6
[£3] When the title page saying ‘Will Harvey’s Music
Construction Set’’ comes up, hit (ESET). Be sure to
as soon as you see the title page!
[4] The Monitor prompt should now be showing, so place the
disk you initialized in step 1 into the drive and type in the following
commands:
BSAVE H,AS400,LS600
BSAVE A3,ASAQ0,LS4000
BSAVE A4,A$4A00,LS4B60
BSAVE N,A$7400,L$120
BSAVE P3,A$300,LSD0
[£5] Now, boot up with the disk which contains the MCS files.
Since you can’t do a PR#6| from MCS, you will have to turn
the power OFF (or T) on the Apple //e).
[6] Load in the file called A4 and then enter the Monitor:
BLOAD A4
CALL -151
| Next, type:
86D9.86DB
Tf you get 4C 8@ C6 in response, then type:
86D9:EA EA EA
7F39:60
Note: If your new copy doesn’t work, type in:
910D:60
If you didn’t get 4C 00 C6, then type:
9131:60
913A:EA EA
Save your changes by typing:
BSAVE A4,A$4000,LS4B60
The new copy will now work, but you’ll want a program to start
it off. Since part of Music Construction Set uses the normal BASIC
60 The Book Of Softkeys Volume III
memory and there is little room for a machine language program,
we will use an EXEC file. You will either need a word processing
program or you can use MAKE TEXT from the DOS 3.3 System Master
to create the EXEC file. Note: if you use MAKE TEXT, don’t make
any typing mistakes because the backspace characters will be saved
into your file.
C3] Get out your word-processor or MAKE TEXT and create a text
file which contains the following commands:
HGR
POKE -16301,0
BLOAD A3
BLOAD A4
BLOAD P3
BLOAD N
BLOAD H
POKE, -16368 ,13
CALL 2156
Save this text file under the name MCS, HELLO on your copy
of the Music Construction Set:
SAVE MCS.HELLO
(41) Type in the following program and save it on the disk as
the Hello program:
FP
10 PRINT : PRINT CHRS (4 ) "EXEC*MCS.HELLO"
SAVE HELLO
(42) To copy any of the music files from the original MCS disk
to the copy, a file-transfer program like F/D can be used. Both the
music file and its . OBJ file have to be transferred. For instance, if
you want the song ‘‘Dixie’’ on your copy of MCS, then the files
DIXIE and D/X/E. OBJ will both have to be transferred.
(a3) You can now boot up your new Music Construction Set disk
and use it normally. If you are using a DOS other than DOS 3.3
(Pronto-DOS, Diversi-DOS, etc.), you'll] find the program will run
much faster. I recommend you get one of these fast DOS’s as they
are well worth the money.
Alternz
Requirements:
48K Apple }{ Plus or equivalent
COPYA or a bit-copy program
Disk-editing program
A blank disk
The Book Of Softkeys Volume III 61
G4] Make a copy of the original Music Construction Set disk
with COPYA (If COPYA won’t copy it, use a bit-copier):
RUN COPYA
C2] Use your disk-editor to make the following changes to the
copy of the MCS:
Track Sector Byte From To
$B $2 $D9 $4C $EA
$B $2 $DA $00 SEA
$B $2 $DB $C6 SEA
$B $D $29 $20 $EA
$B $D $2A $00 $EA
$B $D $2B $4C $18
Don’t forget to write the modified sectors back to the copy of MCS.
MCS Modifications
It is also possible to customize the Music Construction Set. For
example, say that you have your Mockingboard in a slot other than
4. The slot that MCS expects to find the Mockingboard in can be
easily changed with the program below. Note that there are two
different DATA statements and you should use one or the other
depending upon which version of MCS you own. Just type the
program in (using the appropriate DATA statement) and save it as
MB SLOT CHANGER by typing:
SAVE MB SLOT CHANGER
Just RUN the program when you want to have MCS utilize a
Mockingboard in another slot. The program can also be used if MCS
will not boot because you have a card in slot 4 that is not a
Mockingboard. Just run the MB SLOT CHANGER program and then
change the Mockingboard slot to one of the slots in your computer
that is empty.
5 REM DATA FOR VERSION 1
10 DATA * 35946 , 35951 ,35956 , 35962 ,35967 35972 ,35982 , 35987
35992 ,35998 , 36003 ,36008 ,36019 ,36022 ,36027 , 36030
5 REM DATA FOR VERSION 2
10 DATA * 35932 , 35937 , 35942 , 35948 , 35953 , 35958 , 35968 , 35973
35978 ,35984 , 35989 ,35994 ,36008 ,36005 ,36013 ,36016
15 REM TYPE IN ONLY 1 SET OF DATA!
20 DIMA(16 ) : TEXT ; HOME
3@ FOR | = 17016 : READA(! ) : NEXT
40 INVERSE : PRINT "MCS* MOCK | NGBOARD* SLOT* CHANGER”
5 NORMAL : VTAB 5 : PRINT "WHAT* SLOT* WOULD* YOU* LI KE* TO* PUT*
YOUR* MOCK | NGBOARD* IN, * OR* HAVE* MUS|C* CONSTRUCT IO * SET*
LOOK* FOR* A* MOCK INGBOARD?* (1-7) :"; : GETZ$
62 The Book Of Softkeys Volume III
60 Z=VAL (Z$) : IFZ<10RZ>7 THENHTAB 1 : GOTO 50
7 PRINT "MAKE* SURE* YOUR* MUS IC* CONSTRUCT I ON* SET* *DISK* IS* IN*
THE* DRIVE... .AND*KEY" ; : GET Z$
8Q PRINT : PRINT CHR$ (4) “BLOAD* Ad"
90 FOR | = 17016: POKEA(I ) ,2 +192 ; NEXT
100 PRINT : PRINT CHR$ (4 ) "BSAVE*A4, A$4A00, L$4B60"
110 PRINT : PRINT “DONE.” : END
If you performed the alternate copy method (sector edit method)
‘on version 2, then the above program will not work for you because
your disk does not have a file called A4 on it. However, you can
still change the Mockingboard slot if you have a sector-editor. The
bytes to modify are stored on track $B, sector $8.
Get your disk-editor running and read in track $B, sector $8 from
the copy of MCS you made. The table below shows the bytes to
modify. You will need to substitute the slot number you want your
Mockingboard in for the n in the To column. For instance, if you
want to use slot 2 for the Mockingboard, change the bytes listed
in the table from $C4’s to $C2’s.
Byte From To Byte From To
$5C $C4 $Cn $8A $C4 $Cn
$61 $C4 $Cn $90 $C4 $Cn
$66 $C4 $Cn $95 $C4 $Cn
$6C $C4 $Cn $9A $C4 $Cn
$71. $C4 $Cn $A5 $C4 $Cn
$76 $C4 $Cn $A8 $C4 $Cn
$80 $C4 $Cn $AD $C4 $Cn
$85 $C4 $Cn $BO0 $C4 $Cn
After changing the bytes, don’t forget to write the sector back to
your disk.
Cassette Port Output
Version 1 of Music Construction Set does not allow you to use
the cassette port for output as does version 2. Using the cassette
port for output allows you to play the music through an external
amplifier and speaker for improved sound quality (especially if you
turn the treble all the way down on your amplifier). Adding cassette
port output to version 1 of MCS is really quite simple if you have
a little knowledge of the Apple’s built-in I/O.
Sound can be output to the Apple’s speaker by referencing address
$C030 or to the cassette output by referencing address $C020. The
binary file called A4 controls the output of MCS, and the changes
necessary for cassette output need only be applied to this one file.
The program listed below will allow you to pick the output path
(speaker or cassette) and will make the necessary modifications to
A4. Type in this program and SAVE it as CASSETTE OUTPUT.
The Book Of Softkeys Volume III 63
CASSETTE OUTPUT
10 DATA * 23 ,43 , 46 ,66
20 TEXT : HOME
30 FOR | = 1704: READA(I ) : NEXT
4@ INVERSE : PRINT "MCS* CASSETTE/APPLE* SPEAKER* OUTPUT* TOGGLE”
5Q NORMAL : VTAB 5 : PRINT "DO* YOU*WANT* <C>ASSETTE* OR* <A>PPLE*
SPEAKER* OUTPUT* (C*OR*A) :" ; : GET Z$
60 IF Z$ <> "C" AND Z$ <> "A" THENHTAB 1 : GOTO 50
7 PRINT : PRINT CHR$ (4) "BLOAD* Ad" N
80N= 33: IF Z$= "A" THENN = 49
90 FOR | = 1704: POKE A(i ) + 21800 ,N : NEXT
10 PRINT : PRINT CHRS (4) "BSAVE*A4, A$4AQ0,L$4B60"
110 PRINT “DONE.” : END
When you want to switch from speaker to cassette output (or vice-
versa), just:
RUN CASSETTE OUTPUT
Final Words
Since your new Music Construction Set is now on a normal DOS
3.3 disk, if a DOS error is generated (like trying to load a non-
existent file), the program will leave you in BASIC (version 2 only).
To return to MCS just type:
CALL 2156
Anything that you were working on at the time of the error will
still be intact.
That about does it for my modifications to Music Construction
Set. 1 am sure that if you poke around a bit, you can come up with
some more enhancements for MCS. A good place to start
investigating is the area around $7F00. Happy constructing!
z
64 The Book Of Softkeys Volume III
PFS software*
Software Publishing Corp.
Deprotecting PFS Software
by Gary J. Wolfe
(Hardcore COMPUTIST # 14, page 6)
AAAI AA
* This softkey applies to: PFS:File, PFS:File //e, PFS:Report,
PFS:Report //e, PFS:Graph, PFS:Graph //e.
Requirements:
Apple Il Plus or equivalent
One disk drive
COPYA from your DOS 3.3 System Master
Sector-editor with search capability (Zap, Inspector, etc.)
Although most of PFS’s software can be backed-up by using Copy
II Plus’ normal-copy (not bit-copy) utility, I prefer to completely
remove the copy-protection from commercial software that I own.
Even though the PFS series of programs are written in Pascal, the
disk-protection code is written in Assembly language and can be
fairly easily circumvented. To remove the protection from any of
the PFS programs listed above, you will need some sort of disk-
search utility. The entire disk has to be searched for a byte sequence
of DO 64 88 98 F@ 27. This code is found in a routine which checks
the disk for the presence of extra bits in the sync fields, a protection
scheme called the ‘bit insertion technique’. If the extra bits are
present, an $FF will be pushed on the stack, otherwise, a $00 will
be pushed onto the stack before the routine returns to its caller. By
changing the second byte of the search sequence from an $04 to
a $29, the protection code can modified so that it will always push
an $FF onto the stack whether the ex
Showing the first 100000 of 265205 characters.