Text content (OCR)
Hardcore
MPUTIST
BULK RATE
U.S. Postage
ADLITIS PAID
Tacoma, WA
Permit No. 269
Apple J[, I[+, //e,
Franklin users:
Do you have problems
backing-up your
copy-protected programs?
THE
FRANKLIN
USERS
GROUP
‘Supporting Users of
Ii, I+, FRANKLINS, AND ALL COMPATIBLES
We support all members with a monthly newsletter the ‘Clone Ace,’ a
growing public domain library, and personal attention.
Do you lack parameters for
your copy programs?
Are you looking for programs
that you can AFFORD?
Are you hesitating to
upgrade your equipment due to
expensive prices
quoted in other ads?
It’s simple now.
Just drop us a line.
MEMBERSHIP IS $20.00 A YEAR.
We offer hardware and software at great savings.
Checkmate Multiview 80/160
80 to 160 column display and up to 48 lines.
Compatible with ll + ‘s and all compatibles.
Supports all major operating systems including PCP |.
1! RUNS APPLEWORKS ON 64K CLONES AND Il + 'S !!!
$299
Send $1.00 U.S. funds to:
Reliant |
P.O. Box 33610
Sheungwan, Hong Kong” | Axlon 320 RAM Disk
a re se St Supports all major operating systems including PCP |
IMPORTANT: We have over 1000 PC name-brand $480
programs and various hardware offers. Programs @
U.S. $8.00/PC includes the disk and registered air- THE FRANKLIN USERS GROUP
mail handling. East Wind Rd., Apt. L
Tecumseh, MO 65790
NOW
AVAILABLE
AT YOUR LOCAL
COMPUTER STORE
YOUR DISKS
ESSENTIAL DATA DUPLICATOR Ill
EDO runs on Apple iI plus, tle, IIc and Apple ill (in emulation mode) using one or two disk drives,
EDD allows you to easily and quickly make back up copies of your
“uncopyabie” Apple disks. ll Since EDD has been preset to copy
the widest range of copy-protections possible, you just simply
boot up EDD, put the disk you wantto copy in one disk drive and
a blank disk in the other (EDD will work using one drive also)
and in about 2 2 minutes a copy is made. ll Unlike the “copy-
cards” which only copy “single load” programs, EDD copies
the entire disk. This would be similar to hooking up two
cassette recorders, playing from one, and recording to the
‘other. ll We have even Included an option so you can check
the speed of your disk drives because drive speeds running
fast or slow can damage disks and cause other problems.
1 We publish EDD program lists (Information about
copy-protected disks) every couple of months, which
EDD owners can receive. The current list is included
with the purchase of EDD. ll The bottom line is this; if
EDD can't copy it, chances are nothing will.
Ask for EDD at your jocal computer store, or,
to order direct; send $79.95 plus $2 shipping
Warning: EDD is
5 foreign). Mastercard/Visa accepted
sold for the sole Donen e
Prepayment required.
purpose of
making archival UTILICO MICROWARE
copies ONLY. 3377 Solano Ave., Suite #352
Napa, CA 94558 (707) 257-2420
9 FREE DISKS
With every set of 20 disks you order.
You can get sets for as low as $17.25.
That's a total of 25 disks for as litle as...
69¢ a disk
These are SS/DD Namebrand* 5%”’ floppies
100% guaranteed and include:
reinforced hubs and write-protect tabs
sets without sleeves at $17.25 per set
sets, with Tyvek sleeves at $18.50 per set.
ee ne ee ae for each additional set. orders add 20%. U.S. funds
8. bank. Washington orders add 7.6% sales tax. Send your to:
Softkey Publishing, PO Box 110816, Tacoma, WA 98411
*The
magazine for
the serious user of
Apple }[ computers.
Subscription rates (for six issues):
Please check one
O us
DUS Ist Closs
Let us know your
NEW ADDRESS at
least 30 days in
advance so you
won't miss a single
issue of Hardcore
COMPUTIST (issues
missed due to non-
receipt of change of
address may be
obtained at the
current back-issue
rate).
Fill out your new address on
the form provided, paste
your present address label in
‘the space below and send it
to:
Hardcore COMPUTIST,
‘Subscription Dept., PO Box
110846-T, Tacoma, WA 98411.
bank) to: Hardcore COMPUTIST, PO Box TI0846-T, Tacoma.
Send check or money order (US funds drawn on US
WA 98471.
(Yea! $iaxt fly subscription now: =
Nome
Address
tty
Couritry
VIsA/MC
Signature.
Many of the articles published in Hardcore COMPUTIST detail the removal of copy protection
schemes from commercial disks or contain information on copy protection and backup methods
in general. We also print bit copy parameters, tips for adventure games, advanced playing
techniques (APT's) for arcade game fanatics and any other information which may be of use
to the serious Apple user.
Hardcore COMPUTIST also contains a special CORE section which focuses on information
not directly related to copy protection. Topics may include, but are not limited to: tutorials,
hardware/software product reviews and application and utility programs.
a ESTES
‘What Is A Softkey Anyway? Softkey is a term
which we coined to describe a procedure that removes,
‘or at least circumvents, any copy protection on a
particular disk. Once a has been
performed, the resulting disk can usually be copied by
the use of Apple's COPYA program (on the DOS 3.3
‘System Master Disk).
‘Commands And Controls: In any article appearing
in Hardcore COMPUTIST, commands which a reader
is required to perform are set apart from normal text by
being indented and bold. An example is:
PRIG
Follow this with the RETURN key, The RETURN key
must be pressed at the end of every such command unless
otherwise specified.
‘Conarol characters ore Indicated by being boxed. An
example is:
Cis) 4)
To complete this command, you must first type the
number 6 and then place one finger on the CTRL key
and one finger on the P key.
Requirements: Most of the programs and softkeys
which appear in Hardcore COMPUTIST require one of
the Apple }[ series of computers and at least on disk drive
with DOS 3.3. Occasionally, some programs and
procedures have special requirements. The prerequisites
for deprotection techniques or programs will always be
listed at the beginning of the article under the
“Requirements:”” heading.
Software Recommendations: The following pro-
‘grams (or similar ones) are strongly recommended for
readers who wish to obtain the most benefit from our
articles:
) A Program Editor such as Global Program
Line Editor (GPLE).
2) Sector Editor such as DiskEdit, ZAP from Bag of
Tricks or Tricky Dick from The CIA.
3) Disk Search Utility such as The Inspector, The
Tracer from The CIA or The CORE Disk Searcher.
4) Assembler such as the S-C Assembler or Merlin/Big
Mac.
5) Bit Copy Program such as Copy }{ Plus, Locksmith
or The Essential Data Duplicator
6) Text Editor capable of producing normal i
text files such as Applewriter }[, Magic Window J[
or Screenwriter J[.
‘You will also find COPYA, FID and MUFFIN from
the DOS 3.3 System Master Disk useful.
Super IOB: This program has most recently appeared
in Hardcore COMPUTIST No, 22. Several softkey
procedures will make use of a Super IOB controller, a
small program that must be keyed into the middle of
Super IOB. The controller changes Super IOB so that
it can copy different disks. To get the latest version of
this program, you may order Hardcore COMPUTIST
No. 22 as a back issue or order Program Library Disk
No, 22.
RESET Into The Monitor: Many softkey pro-
cedures require that the user be able to enter the Apple's
system monitor during the execution of a copy protected
program. Check the following list to see what hardware
you will need to obtain this ability.
Apple ][ Plus - Apple //e - Apple compatibles: 1) Place
an Integer BASIC ROM card in one of the Apple slots.
2) Use a non-maskable interrupt (NMI) card such as
Replay or Wildcard.
Apple J[ Plus - Apple compatibles: |) Install an F8 ROM
with a modified RESET vector on the computer's
motherboard as detailed in the “‘Modified ROM’:
of Hardcore COMPUTIST No. 6 of the “Dual ROM’
article in Hardcore COMPUTIST No. 19.
Apple //e - Apple //c: Install a modified CD ROM on
the computer's motherboard. Don Lancaster's company
(Synergetics; 746 First Street; Box 809-HC; Thatcher,
AZ 85552; free voice HelpLine 602-428-4073) sells the
instructions necessary to make this modification. Making
this modification to an Apple //c will void its warranty
‘but the increased ability to remove copy protection may
justify it,
Recommended Literature: The Apple }[ Reference
Manual and DOS 3.3 manual are musts for any serious
Apple user, Other helpful books include: Beneath Apple
DOS, Don Worth and Peter Leichner, Quality Software,
$19.95; Assembly For The Applesoft
Programmer, Roy Meyers and C.W. Finley, Addison
Wesley, $16.95; and What's Where In The Apple,
William Lubert, Micro Ink., $24.95.
Keying In Applesoft Programs: BASIC programs
are printed in Hardcore COMPUTIST in a format that
is designed to minimize errors for readers who key in
these programs. To understand this format, you must
first understand the formatted LIST feature of Applesoft.
An illustration- If you strike these keys:
1@ HOME:REMCLEAR SCREEN
program will be stored in the computer's memory.
Strangely, this program will not have a LIST that is
exact 98 you ued, Instead, the LIST will look like
ar HOME : REM CLEAR SCREEN
Programs don't usually LIST the same as they were
keyed in because Applesoft inserts spaces into a program
listing before and after every command word or
operator. These spaces usually don’t pose
‘want a program to have a list like this:
10 DATA 67,45,54,52
you would have to omit the space directly after the DATA
‘command word. If you were to key in the space directly
after the DATA command word, the LIST of the program
‘would look like this:
18 DATA 67,45,54,52
This LIST is different from the LIST you wanted. The
number of spaces you key after DATA and REM
command words is very important.
Alll of this brings us to the Hardcore COMPUTIST
LuSTing format. In a BASIC LISTing, there are two types
of spaces; spaces that don't matter whether they are keyed
or not and spaces that must be keyed. Spaces that must
be keyed in are printed as delta characters (). All other
spaces in a Hardcore COMPUTIST BASIC listing are
put there for easier reading and it doesn't matter whether
you type them or not.
‘There is one exception: If you want your checksums
(See “*Computing Checksums” section) to match up, you
‘must not key in any spaces after a DATA command word
unless they are marked by delta characters.
Keying In Hexdumps: Machine language programs
are printed in Hardcore COMPUTIST as both source
code and hexdumps. Only one of these formats need be
keyed in to get a machine language program. Hexdumps
are the shortest and easiest format to type in,
To key in hexdumps, you must first enter the monitor:
CALL -151
Now key in the hexdump exactly as it appears in the
magazine ignoring the four digit checksum at the end
of each line (a “'$"" and four digits). If you hear a beep,
you will know that you have typed something
incorrectly and must retype that Tine,
When finished, return to BASIC with a:
E03G
Remember to BSAVE the program with the correct
filename, address and length parameters as given in
the article.
Keying In Source Code The source code
portion of a machine language program is provided
‘only to better explain the program’s operation. If you
wish to key it in, you will need an assembler. The
S-C Assembler is used to generate all source code
printed in Hardcore COMPUTIST, Without this
assembler, you will have to translate pieces of the
for this purpose was printed in Hardcore
COMPUTIST No. 17. To translate source code, you
will need to understand the directives of your
assembler and convert the directives used in the
source code listing to similar directives used by your
assembler.
‘Computing Checksums Checksums are four
digit hexadecimal numbers which verify whether or
not you keyed a program exactly as it was printed
in Hardcore COMPUTIST. There are two types of
‘checksums: one created by the CHECKBIN program
(for machine language programs) and the other
created by the CHECKSOFT program (for BASIC
programs). Both programs appeared in Hardcore
COMPUTIST No. | and The Best of Hardcore
‘Computing. An update to CHECKSOFT appeared
in Hardcore COMPUTIST No. 18. If the checksums
these programs create on your computer match the
checksums accompanying the program in the
magazine, then you keyed in the program correctly.
If not, the program is incorrect at the line where the
first checksum differs.
1) To compute CHECKSOFT checksums:
LOAD filename
BRUNCHECKSOFT
Get the checksums with
&
‘And correct the program where the checksums differ.
2) To compute CHECKBIN checksums:
CALL -151
BLOAD filename
Install CHECKBIN at an out ofthe way place
BRUN CHECKBIN,A$6000
Get the checksums by typing the starting address,
F-series came
xoxox)
And correct the lines at which the checksums differ.
How-To's
Of Hardcore
Welcome to Hardcore COMPUTIST, a
publication devoted to the serious user of
Psp JL and Apple ]{ compatible computers.
Our magazine contains information you are
not likely to find in any of the other major
Journals dedicated to the Apple market.
Our editorial policy is that we do NOT
condone software piracy, but we do believe
that honest users are entitled to backup
commercial disks they have purchased. In
addition to the security of a backup disk,
the removal of copy the user
the option of modifying application
programs to meet his or her needs.
New readers are advised to read this page
carefully to avoid frustration when
attempting to follow a softkey or when
entering the programs printed in this issue.
This month’s cover: Graphics from DEATH IN THE
CARIBBEAN, a hi-res adventure game from Micro Lab.
‘Address all advertising inquiries to Hardcore COMPUTIST,
‘Advertising Department, PO Box 110816, Tacoma, WA 98411.
all
photos, deka, tapes they are fo be returned, Unaotened
manuscripts wil be retuned only W adequate return postage is
Entire contents 1005 by Sohkey Pubteting. At
tights reserved. Copying ‘other than personal or internal
reference (without express written permission from the publisher)
inquiries to: Hardeore COMPUTIST, Subscription
Department, PO Box 1108461, Tacoma, WA 98411. Please
Include address label with 7
DOMESTIC DEALER RATES: Call (208) 474.5750 for more
Information.
Change Of Address: Please allow 4 weeks for change of
‘address to take effect.
‘Use postal form 3576 to supply your new
‘and former address using your most recent label.
seus missed due to non-receipt of change of may be
Hardcore Issue 23
COMPUTIST
‘Managing Editor: Ray Darrah Technical Rdltor: Robert Knowles
ss Seattle, W/
, by SoftKey Publishing, 5233 $. Washington, Tacoma, WA 98409
Phone: (206) 474-5750
softkeys
10 Choplifter
Now you can shorten the boot up time and have a deprotected Choplifter as well as APT control
keys that let you really take command. by Todd C. Wilson
13 Mufplot
Ham radio operators, try the Super IOB's Swap Controller and a modified Mufplot RWTS to softkey
this program. by Edward E. Harte, M.D.
14 Flashcalc
Believe it or not, Flashcalc is effectively protected by one byte. Learn about ProDOS protection
schemes by softkeying this business utility. by Doni G. Grande
16 Karateka
With smooth graphics, great sound effects, and realistic action, how could this game miss being
equally well protected? Kick your way to a COPYA-able version. by Danny Pollak
18 Newsroom
This handy graphic package is quickly normalized with Super IOB, by Doni G. Grande
20 £-Z Draw
Some older programs have sophisticated protection schemes worth exploring. This 1980 graphics
system is made COPY-able in our Antique Softkey section. by Nick Galbreath
features
21 Using A.R.D. to Softkey Mars Cars
This fun little maze-type game reboots everytime Reset is pressed. This and others that do the
same thing can be softkeyed by using the Anti-Reboot Disk.by Chris Chenault
22 How to be the Writemaster
Our hardware special feature shows you how to take command of the write-protect status of your
disk by adding your own switch. by William Wingfield Jr.
core
24 Wheel of Money
The Wheel of Fortune TV game show comes to your computer screen. by Jiro Feingold and Ray
Darrah.
departments
4 Input
6 Most Wanted List
6 Bugs
Z Readers’ Softkey & Copy Exchange
Softkeys for: Spectrum Holobyte’s Gato by Clay Harrell, Microlab’s Dino Eggs by Jay O'Donnell,
Electronic Art's Pinball Construction Set by Steve Hite, Avalon Hill's TAC by Ken Black,
Broderbund’s The Print Shop: Graphics Library by Greg Schroeder, Micro Lab’s Death In
The Caribbean by Nick Galbreath.
Hardcore COMPUTIST No. 23 3
Please address letters to:
Hardcore COMPUTIST
Editorial Department
PO Box 110846-K
Tacoma, WA 98411
Include your name, address and
phone.
Correspondence appearing in the
INPUT section may be edited for
clarity and space requirements. In
addition, because of the great
number of letters that we receive and
the small size of our staff, a response
to each letter is not guaranteed.
Unlocking
Lode Runner’s
150 Levels
Thave found a way to unlock Lode Runner's
150 levels. You should start by write protecting
the original disk, just to be safe. Then get out
your best Bit copier and copy tracks 3-B. Then
get out a sector editor and select the DOS 3.3
PATCHED option. Copy sectors C, @-C, 5.
Now you can look at and edit any levels you
can’t get passed.
Paul Kippes
Colby, KS
Hitchhiker’s
Adventure Tips
Look behind the bar.
The dog appears to be hungry.
Have a drink or three.
What can you block the robot panel with?
(Hint. It’s not yours.)
A cleaning robot would probably miss some
things if there was some way to have the mail
in the air while the babel fish is in the air too.
You'll need the atomic vector plotter.
Get some ‘‘Common Sense’’.
The long, dangly bit could do with a spot of
tea, or at least something that tastes almost, but
not quite entirely unlike tea.
The guards can’t kill you if their rifles are
blasted.
The seat cushion feels lumpy.
Steer your boat at something dangerous.
Don't be afraid to say your name to the Beast.
Cover up! The Beast can't stop you from
carving your name if it can’t see you.
Who am I? <RETURN>
It is essential to give back a towel one has
borrowed if that person’s planet is about to blow
up.
Have a talk with Prosser before going to the
pub with Arthur.
Rob
A Bunch of
APT’s
From France
First I want to tell you that I really like your
magazine. It brings lots of interesting
information. So keep up this good work.
‘As you can see, your magazine is also famous
in France. I have, at the moment, an Apple Ile,
two drives, a modem and a mouse. I'm 17 years
old and like games very much but most of the
time I’m not patient enough to play till I end
the game. Here are a few APT’S I found.
The APT’S are of course only possible on
unlocked softwares (readable with Inspector or
Disk fixer). It is also possible that my patches
won't work because of a difference of version.
Anyway, I believe they will work on many
versions.
CONAN:
Trait Track Sector Byte New Value
Wen $05 $09 $F5 EA EA EA
Axes $05 $08 S4E EA EA EA
KARATEKA:
Trait Track Sector Byte New Value
fof> $09 $08 $53 85 Bl AQ 1A 8D BO
soc $08 $64 nn < 1B
SOF $08 $5A nn < 1B
$12 $08 $4 on < 1B
$09 $07 $98 EA EA EA EA
sec $07 $06 EA EA EA EA
SOF $07 $50 EA EA EA EA
SOF $07 $47 on
4 Hardcore COMPUTIST No. 23
MINER II:
Trait Track Sector Byte New Value
Lives $02 $06 SEO on
$02 $01 $38 EA EA EA
Level $02 $06 $D6 nn < 10
CONGO BONGO:
Trait Track Sector Byte New Value
MINER 2049ER:
Trait Track Sector Byte
THE HEIST:
Trait Track Sector Byte
That's it for the moment. Thanks.
Remi Grandjean
France
WANTED:
Silky Syle expose’
Is there anyone out there who can do an
expose on SYLC files. Microsoft uses them in
their spreadsheet MULTIPLAN. Unfortunately
very few of any other programs use this file
format. While MULTIPLAN is friendly, fast
and can perform complicated logic calculations,
it won't graph like the Visicalc/Visiplot
combination. Microsoft indicated some time
ago that they wanted to have a program to graph
for the Apple II but they only wrote it for the
Mac. Is there an easy way to convert SYLC
files to a DIF format, or a program that can read
SYLC files and plot directly?
Robert Classon
Mendon, MA
The Disk Organizer
Meets The 65C02
Yours is easily the best magazine on my
shelf, and I'm going to continue my subscription
as long as I keep my computer, or until you run
‘out of colors for your cover, whichever comes
first.
I purchased the 65C02 from your offer, and
have found one problem you may want to tell
your readers, they may have had the same: My
copy of ‘*Disk Organizer 2.0°’ from Sensible
Software has ceased to work. I have “backups”
of it, and none of them worked. This is easily
the best directory editor I have, (it's also the
only one I have. But anyway.) and I wondered
if any of the other readers had experienced this.
As for your most wanted list, just about every
single one of those programs I’ve seen around,
cracked by somebody or another, and the only
one that I haven't (actually, I have, but the
cracked version didn’t work) is Flight Simulator
I. It will copy with any nibble copier that
supports manual speed changing (I used EDD,
copied according to the listed parameters), but
copying tracks @-22 manually can be a pain in
the ASCII.
Lastly, for you adventurers out there, if the
hints here aren’t enough, there is an excellent
book written by Kim Schuette, The Book of
Adventure Games, which has helped me
through all the adventures I have. It comes
complete with maps and answers to problems,
and short reviews. AT $19.99, it’s a bit (byte>)
expensive, but worth it.
Thanks a lot, and keep up the good work.
Mike Whistler
Del Mar, CA
Mr Whistler: Shortly after installing a 65002
in our computers, we noticed the same problem.
It occurs because the folks at Sensible Software
thought they would be tricky and take advantage
of the 6502's bug mentioned on page 20 of
Hardcore COMPUTIST No. 18.
To cure the problem search your disk for the
sequence ‘‘A9 80 8D FF 02 A9 0A 8D 00 02""
and replace the last byte with $03.
Print Shop
Printer Problems
A word of praise and then a couple of
questions. Your stuff is great, exactly the reason
I'm a confirmed Hardcore subscriber!
Question #1: More on DOS 3.3 will be
greatly appreciated but please, what mechanism
causes the stuff on the disk to go where it’s
supposed to? Is it equivalent to entering
Monitor and typing it in?
Question #2: I agree with you that PRINT
SHOP is great but can you tell me how to get
it to do its work without an extra line feed after
each line of graphics?
My printer card is a ‘*Parallel Printer Card’’
by MicroSystems Engineering of Kokomo,
Indiana and it is not listed on PRINT SHOP’s
menu. I've tried the Menu software for all of
the printer cards they list, but none of them will
let me avoid throwing the hard switch in my
Epson printer and that’s not easily done. Can
you advise me of a more convenient approach?
T'll be grateful.
Ray Werner
Blue Ash, OH
Mr. Werner: A routine in DOS 3.3 called the
file manager is responsible for putting things
on a disk where they are supposed to go. I
suggest you read a book from Quality Software
(21601 Marrilla Street, Chatsworth,
CA 91311) entitled ‘‘Beneath Apple DOS.”
Secondly, several people have written to us
about incompatibility problems with their
printer and ‘‘The Print Shop.’’ We at Hardcore
know of no way to alter ‘‘The Print Shop”’ so
that it will work with other printers. But the idea
would make a heck of an article.
A Different
Wizardry
I just got Issue #20 and the Softkey for
SARGON III worked great. My Wizardry disk
was dated 22-Jan-82. The correct values for the
To get these values I performed the boot code
trace as in HC #20, page 29. However, please
note the address values in step #6 should be B6
A6 & B6 AE, not B9 A6 & B9 AE. Also before
step #7 (6827G) I had to store a @@ in memory
location B6B6 (i.e. B6B6:00). For my disk the
correct values were stored between memory
locations B6B7-->B6CE.
I repeated the above procedure a second time
and got a somewhat different set of checksums.
‘However, these also seem to work.
the checksums may change slightly due to small
variations in disk speed. Although I really don’t
know the exact reason for these variations.
Second set of checksums effective on boot
side:
OC 12 BG 07 18 12 18 29
OD 12 BG 97 11 12 12 21 18
2 B9 87 BA 12 12 69
Also I have an Apple //e so to reset I had
to hit control-reset twice really fast. Oddly
enough, sometimes I got only the first $10
values and not the $18 I have shown above, I
am not sure why but since your article showed
$18 checksum values I assumed these to be
¢. the scenario master side
I put a jump to B69E in track 13 sector E bytes
@8 09 OA, i.e. a 4C 9E BG [replacing BD 88
C0} I simply repeated steps | through 7 in the
article as I previously described, put the
scenario master in when prompted, and hit
control-reset twice when the screen prompted
insert master/duplicate. Listing from B6B6
revealed the following new bytes:
1D 12 4C 99 21 12 EC 07
So for a side 2 backup I did the following
track 13 sector 00 starting byte C@ as before
the routine is as published in HC #20.
‘AE DC 20 BD DD 20 85 OD
8D 68 20 E8 BD DD 20 8D
91 20 85 GE E8 BE DC 20
ED E8 CO 60 00 1D 12 4c
99 21 12 EC 07
Both sides are COPY Aable and both seem
to work. Many thanks to HCC & TACO
Van/Eperen for the ground work. I still spent
several hours on this and I hope it will be helpful
to their readers. .
ic.
Arlington, VA
Assorted
Adventure Tips
ZORK II
WELL, that riddle is pretty tuff, isn't it?
The Dragon just needs a bump on the head
to get him to follow you, and why not cool him
down while you're at it?
Mats can be useful under the door, and if you
can’t get the door open, why not think of it as
a letter, open it.
Boy, that Lizard has a'sweet tooth!
Oddly angled rooms seem to remind me of
“‘take me out to the ballpark’’.
Hardcore COMPUTIST No. 23 5
MINDWHEEL
That woman's riddle makes me crow!
The audience wants a rose, give it to them.
Choose the disc, and use it wisely, it can cut,
and kill!
The toad has wisdom, and a big mouth!
That door could take me for eternity!
You have a GREAT publication! Keep up the
good work!
Ben Youngdahl
Notes on
Sensible Speller
and COMPress
I recently got to look at the ProDOS Sensible
Speller. I was able to use the information in
Hardcore COMPUTIST Issue No. 16
(Deprotecting Sensible Speller for ProDOS). I
found that the Checksum routine occurs in
several places on the diskette. There are four
places that the routine can be found. One of the
places is actually split across two sectors and
can not be found by looking for the first part
of the checksum routine. I just happened to find
it by accident, while looking for just the last
part of the routine. I was using Copy II Plus
as my main copy program. The following is a
track and sector list of where I found the first
three routines:
track sector byte
SOA $67
$18 $6 $68
$l1E $4 $68
‘The last one is split across two tracks starting at:
track sector byte
SOF SE SFF
and continuing to:
track sector byte
SOF = $D $00
Thave found it useful in some cases to change
the third and/or second byte of a multibyte
instrtuction to a NOP ($EA) instruction. This
helps in disassembly later.
On another note, I have some software from
a company called COMPress. It is a tutorial
series on chemistry. Besides using strange
address and data headers, which are different
for some tracks, they also employ an encrypted
directory.and DOS commands. It has been
resistance to the usual bit copiers, Copy II Plus,
EDD, and LockSmith. From what I have seen
so far, the main copy protection is in the first
three tracks. The DOS is almost normal, except
for the encrypted DOS commands and the copy
hints as to where to go from here?
George S. Mochizuki
Madera, CA
Backing up
Gutenburg
While I can not help your readers to break
GUTENBURG, the makers of Copy II Plus
(ver 5.0) can. This letter is written on a copy
of the GUTENBURG master disk created by
Copy I Plus using the built in parameters on
that disk. The only difference I can find between
the master and the copy is that the Serial number
has been lost.
C. G. Ivey, Jr.
Salt Lake City, UT
HC #21:
DB Master 4 Plus Article:
‘The Sector edit step should say 24 EA’s
instead of 23 EA’s
HC #22:
The Macro Editor:
On page 27, a line of source code reading
“92C3: 02293 .DAM.V” is missing.
Super IOB v1.5:
Lines 340 and 600-620 of the Super IOB
checksums should be shaded.
6 Hardcore COMPUTIST No. 23
Most
Wanted
List
Need help
backing-up a particularly
stubborn program?
Send us the name of the program and its
manufacturer and we'll add it to our Most
Wanted List, a column (updated each issue)
which helps to keep Hardcore COMPUTIST
readers informed of the programs for which
softkeys are MOST needed. Send your
requests to:
Hardcore COMPUTIST
Wanted List
PO Box 110846-K
Tacoma, WA 98411
If you know how to deprotect
unlock, or modify
any of the programs below,
let us know. You'll be helping your fellow
Hardcore COMPUTIST readers and earning
MONEY ‘at the same time. Send the
information to us in article form on a DOS
3.3 diskette.
Mouse Cale Apple Computer
Apple Business Graphics Apple Computer
Flight Simulator II Sub Logic
Factory Sunburst Communicating
Jane Arktronics
Bookends Sensible Software
Visiblend Microlab
Sundog FTL Games
Sundog, V2 FTL’Games
Lifesaver Microlab
Catalyst Quark, Inc.
Gutenburg
Jr. & Sr. Micromation LTD
Prime Plotter Primesoft Corp,
‘Zardax Computer Solutions
‘The Handlers. Silicon Valley Systems
Milliken Math Series (NEW) Milliken Publishing
‘The Apple's Core: Parts 1-3. The Professor
King’s Quest Sierra On-line
Hayes Terminal Program Hayes
Fun Bunch Unicom
readers’ softkey & copy exchange
F .
Clay Harrell softkeys.. Jay O’Donnell softkeys... Steve Hite’s softkey to... acai
= = ay
Gato C t inball
onstruction Set
Spectrum HoloByte Inc.
1050 Walnut, Suite 325
Boulder, CO 80302 © 198 é Electronic Arts
: 2755 Campus Dr.
Requirements: San Mateo, CA 94403
Apple //e or //c with 128K (program iby B Schroeder vets
At least si at Requirements:
it one dis ive MicroLab, Inc. :
COPYA 2099 Skokie Valley Road Apple }{ Plus or //e
pbs Da Highland Park, IL. 69935 Copy program such as Locksmith 5.0
ier ‘ Disk sector editing program
: : 48K Apple J[ Pinball Construction Set is a fascinating
Gato is an excellent WWII submarine Blank disk Program that allows you to construct and play
program! It plays very nicely, and even has a ino Eggs Disk your own pinball machines. You control sound,
built-in fake “ et" screen so that it Super JOB v1.5 Scoring, colors, gravity, bounce, and all other
looks like you're busy with financials -in case aspects of the game. The complexity of your
you're using Gato at work! The protection used Dies Fann. wee peviewed nicely, Bs 'Y control is such that the game has even been
n Gato is also very good, and it could involve arrah in Hardcore COMPUTIST no. 10, so referred to as a low level programming
a lot of time to deprotect because of the subtle Twoa't bocher with decriblig Hs gan hae language. Unfortunately, backing up this
Protection that is deep in the program. Inspection of the address and data epilogues program can be quite a problem. Althou
The Gato DOS lives in the RAM card around
$1000, but the protection code lives at $B65A.
You may run COPYA and copy the original
disk, and it will almost run...
The routine at SB6SA does a nibble read on
track $11, looking for a byte sequence of $AA
AB. If the sequence is not found, it loads the
accumulator with #$00 and pushes it on the
stack. Then the program locks up. But if the
Correct bytes are found, it loads the accumulator
with #$01 and pushes that on the stack. Then
the program continues happily along.
So we must find this routine on the disk, and
change it so that no matter what, it pushes #$01
on the stack instead of $0. Using a disk search
To deprotect Gato, do the following:
1) Copy the original Gato disk to a blank disk
using COPYA with no modifications.
2) RUN your favorite sector editor and make
the following byte changes to your COPYA
copy of Gato:
Track Sector Byte From To
$15 sc $8C. $AD.$A9
$15 sc $80 $E9. $01
$15 $C $8E- $C $08
$15 $c SOF SA9_—_—($67
revealed that they had been altered. Copying
the disk with Super IOB was no problem from
there, but the disk would not run. There were
several locations in the DOS that checked for
these markers. You could attempt to search for
and change all these places, but in the case of
this game, two changes will do. Both tell the
checking routines (one in DOS, one in a
normally empty location in DOS) to ignore the
epilogue and other errors.
Install the controller here into Super IOB
v1.5 and copy the Dino Eggs disk. It uses the
Fast routine in version 1.5. You now have a
COPYA-able version of Dino Eggs.
controller
1900 REM DINO EGGS CONTROLLER
1919 TK=6 :LT=35 :ST=15 :LS=15 :CD= MR: FAST
sl
ae et? ee: GOSUB 178 : GOSUB 619
use cosiB 49 case 230 GOSUB 619: IF PEEK
(TRK ) = LT THEN 1050
1040 TK= PEEK (TRK) wledbeah ag GOTO 1020
1950 HOME ; PRINT "COPYDONE™ ;
5000 DATA 158 ,231 ,213 ,178
5010 DATA 2"CHANGES
5020 DATAO ,9 ,66 ,24
5030 DATA ,11 ,117 ,24
3) Write the sector back out to your COPYA
copy of Gato.
#S01 and then branch to the end of the routine.
This is the best (and safest way) to disable the
protection. And you’re all done!
$38F4
1930 - $E89B 5020 - $2253
1040 - SFECE 5030 - $8300
igh
parameters are available for Nibbles Away II,
Locksmith 5.0, Essential Data Duplicator, and
other copy programs, several different
Protection schemes have been employed during
different releases of this game. I found that none
of the parameters would give me a working
copy. The technique described here not only
gave me a working copy, but resulted in a copy
that is COPYA-able.
1) Make a copy of the entire disk. Locksmith
5.0 Fastcopy works just fine. You can use
Nibbles Away II, Essential Data Duplicator or
Copy II Plus, employing just the normal default
parameters, if you wish. The important thing
is to ignore any errors you get on track 6.
COPYA will not work. It dies due to an /O
error on that track.
2) Using a disk sector editing program, read
track 3, sector 6 on your copy. I used ZAP from
Bag of Tricks, but any editor with similar
ilities will do. Look for the pattern AO 01
20 CF 17 20 D9 1E. This pattern occurs only
‘once in this sector, and is found in the last half.
If you are using ZAP, the offset is +92. This
code disassembles as follows:
LOY #301
JSR $17CF
JSR $1ED9
3) Change the $A0 to $60 (an RTS in machine
language) and write the modified sector back
to the disk.
That's it. You now have a COPYA version
of Pinball Construction Set.
Hardcore COMPUTIST No. 23 7
readers’ softkey & copy exchange
Ken Black’s softkey for...
Lethe
Tactical Armored
Command
Avalon Hill Microcomputer Games
4517 Harford Rd.
Baltimore, MD 21214
Requirements:
48K Apple Jf
Super IOB v1.5
TAC disk
An initialized DOS 3.3 disk
TAC (Tactical Armoured Command) is one of
those irritating programs that is hard to get a
good bit copy back-up. I found out it’s easier
to deprotect (softkey) it than to make a bit-
copied backup. This procedure is easily and
quickly done with Super IOB’s NewSwap
controller.
The procedure is pretty straightforward but
will require some changes to make it work
properly. Not only were epilogues and sync
bytes on the disk changed, but the Applesoft
programs on it were written with altered DOS
commands. Rather than change the programs,
it is easier (and less time consuming) to copy
the altered commands to DOS 3.3. This can be
done by copying track 1, sector 7 to the new
disk
This is how to do it:
1) Turn on your computer and press Reset.
2) Enter the monitor and moye the boot code
into RAM
CALL -151
9600<C600.C6FFM
3) Alter the re-located boot code to jump into
the monitor after the RWTS is loaded in.
96F8:A9 00 8D 4A 08 4C 01 08
4) Boot up the TAC disk partially.
9600G
5) You should be in the monitor with the disk
still spinning. Move the TAC RWTS to a safe
location.
6000<B800.BFFFM
6) Boot normal DOS 3.3 with a small or no
HELLO program and BSAVE the TAC RWTS.
6GP)
BSAVE RWTS.TAC,A$6000,L$800
7) If you haven't already done so, INIT a blank
disk with DOS 3.3.
INIT HELLO
8) Install the controller following this softkey
into Super IOB v1.5 and copy TAC onto your
freshly INITialized disk (don’t format).
9) Have fun with your backup copy.
If you really wanted to, you could use a
totally normal DOS or even a high-speed DOS
and change the commands ‘FIXDOSFL”’,
“GETIT”, and “KEPIT"’ found in the
Applesoft programs to MAXFILES, BLOAD,
and BSAVE, respectively. In this case, do NOT
copy TAC’s track 1, sector 7 to the new disk.
RASS
8 Hardcore COMPUTIST No. 23
controller
1000 REM TAC CONTROLLER FOR S-10B V1.5
1005 TK=1 :ST=7 :CD=WR : GOSUB 490 : GOSUB 360
106 GOSUB 430 : GOSUB 100 : GOSUB 490 : GOSUB 360
: GOSUB 108
1010 TK=3 :LT=35 :ST=15 :LS=15 :CD=WR : FAST
=1
1020 GOSUB 360 : GOSUB 490 ; GOSUB 610
1030 GOSUB 360 : GOSUB 490 : GOSUB 610
(TRK ) = LT THEN 1050
1040 TK = PEEK (TRK ) :ST=PEEK (SCT) : GOTO 1020
1950 HOME : PRINT "DONE" : END
1910 PRINT CHRS (4) "BLOAD‘RNTS. TAC, AS1900"
1F PEEK
controller checksums
1900 ~ $3568 1030 - S$OAQB
1005 - $8068 1040 - $3EA4
1906 - $0680 1050 - SOFAS
1910 - $05D2 10010 - $2BFA
1020 - $389F
Greg Schroeder’s softkey for...
The Print Shop:
Graphics Library
Broderbund Software
17 Paul Drive
San Rafael, CA 94903
$49.95
Requirements:
Apple II
Super IOB v1.2
After reading the Tutorial For Disk
Inspection in Hardcore 16, I decided to attempt
to write a controller for the Graphics Library
disk for Print Shop. The disk is in standard
format for tracks $1-$22 and can be copied
normally. On track 0 sectors $0-$F the data
field epilog bytes have been changed to DE A9
instead of the normal DE AA. I attempted to
use line 1024 of the super controller (in the
tutorial) to normalize this track but my
controller didn’t work, so I used line 1028 to
ignore the epilogs instead. This is the routine
that was dropped when Super IOB was updated
in Hardcore 14. I find this routine very useful
and am glad it was included in the Super
Controller. I was even more impressed with it
when I used it on side two of the Graphics
Library disk and copied it, even though each
side used a different protection method. I hope
this softkey is some help to you.
| Nick Galbreath’s softkey for...
readers’ softkey & copy exchange
Controller
1900 REM GRAPHICS LIBRARY CONTROLLER BY
GREG SCHROEDE! o
1910 TK
1920 T1 = TK : GOSUB
1928 POKE 47495 , 24 ; POKE 47406 ,96 : POKE 47497
124 : POKE 47498 ,96 :
1030 GOSUB 430 : GOSUB 100 :ST=ST +1: IF ST<
DOS THEN 1030
1040 IF BF THEN 1060
1950 ST =@ ;TK= TK +1 > IF TK < LT THEN 1030
1060 GOSUB 490 :TK = Tl ‘ST =0
1969 POKE 47405 , 208 : POKE 47406 ,19 : POKE
47497 ,208 : POKE 47498 , 183
1970 GOSUB 430 ; GOSUB 106 :ST =ST+1: IFST<
DOS THEN 1070
1980 ST =0 :TK=TK+1 : IF BF =@ AND TK <LT THEN
1070
1090 IF TK < LT THEN 1020
V100 HOME ; PRINT "DONE*WITH*COPY™ ; END
Controller Checksums
1908 ~- $3568 1060 - $9300
1910 ~ $3266 1069 ~ $735F
1028 = $CLIA 1070 -~ $7B5A
1928 - $4D7F 1980 - $F3CF
1930 - $5B7E 1090 - $7A41
1040 - $C1A5 1108 - $7692
1050 - $8FFO
Death In The
Caribbean
Micro Lab
2099 Skokie Valley Rd.
Highland Park, IL 60035
$35.00
Requirements:
Apple IL
Super IOB v1.2
Two blank disk sides
a
Death in the Caribbean is a beautiful graphic
adventure game; however, like many adventure
games (or just in general) it is protected. Its
protection involves a drastic changing of header
and epilog bytes on tracks $1-$22 and reset
plugs. Amazingly enough, Micro-Fun forgot to
plug Control-C! So the first part of our softkey
would be to get the RWTS routine by breaking
into BASIC. Do so by following these
instructions:
ic Boot up your copy while holding down
2) When you break into BASIC, enter the
monitor by typing
CALL-151
3) Move the RWTS routine into ‘‘safe’’
memory by typing
6800<B800.BFFFM
4) Boot up a slave disk.
5) Save the RWTS routine with
BSAVE RWTS.DIC,A$6800,L$0800
Run Super IOB with the swap controller
listed at the end of this article installed. Copy
both sides of Death in the Caribbean. The
controller copies track @ as is, then beginning
with track 1 starts swapping the RWTS in and
out until done. During the copy procedure,
Super IOB changes track 0, sectors 2 and 3 as
in the following table:
Track Sector Byte Fron To
$00 $82 $E7 $96. $D5
$00 $02 $F1 $03" SAA
$00 $02 SFC $E5 SAD.
$08 $03 $35 $96 $DE
$08 $03 $3F SFF SAA
$00 $03 $55 $03 $05
$00 $03 $5F $96 SAA
$00 $03 $6A $F2 $96
$08 $03 $91 $03 $DE
$00 $03 $9B $82 SAA
Death in the Caribbean is finally (at last!)
cracked. Enjoy!
controller
1000 REM DEATH IN THE CARIBBEAN
1910. TK = 9 :ST =O :LT = 35 :CD = WR $
102071 =TK : GOSUB 490 ; IF TK>@ THEN GOSUB 360
1030.GOSUB 430 : GOSUB 190 :ST=ST+1: IFST<
DOS THEN 1036
1040 IF BF THEN RESTORE : GOSUB 319 : GOTO 1060
1950 ST = 0 :TK= TK+ 1 ; ON (TK = 1)):GOSUB 360 :
IF TK < LT THEN 1030
196 GOSUB 490 :TK = T1 :ST = 0): GOSUB 360
187 GOSUB 430 : GOSUB 100 :ST = ST +1: IF ST <
DOS THEN 1078
1080 ST = 9 :TK= TK+1 : IF BF =O ANDTK<LT THEN
19708
1090 1F TK < LT THEN 1020
1100 HOME ; PRINT "COPYDONE!".; END
5000 DATA LO°CHANGES ,0 ,2 ,231 ,213
5001 DATA ,2 ,241 ,170
5002 DATA ,2 ,252 ,173
5003 DATA® ,3 ,53 ,222
5004 DATA ,3 63 ,170
5005 DATA @ ,3 ,85 ,213
5006 DATAG .3.,95 170
5007 DATA ,3 ,106 150
5008 DATA ,3.,145_,222
5009 DATAG 3,155 170
10010 IF PEEK (6490 ) <> 162 THEN PRINT CHRS (4
) "BLOAD*RNTS DIC, A$1900"
Controller Checksums
1008 - $3568 5000 - SOB4F
1918 - $3266 5001 - $2285
10926 - $2060 5002 - $1AIB
1039 _~ $3661 5003 - $1F5A
1949 - $5472 5004 - $2770
Hardcore COMPUTIST No. .23 9
softkey for...
by Todd C. Wilson
uit
Choplifter
Broderbund Software
17 Paul Drive
San Rafael, CA 94903
$34.95
Requirements:
48K Apple J[
DOS 3.3
1 Blank disk
Choplifter disk
Flying low along the ground to avoid the
Satellites, I spotted a group of people.
Landing quickly, I helped them inside.
Rumbling over the plains came a squadron
of tanks. Suddenly a jet fired its missles at
me. Time to go. Jerking up on the control
stick, I sent the chopper skyward. Just missed
me! Whoops! Satellites are coming in, too
low to dodge. Firing at one, I backed up and
crashed into the other. Blast! The chopper
lost control and spun down to crash into the
desert. Ten people lost. Next chopper,
please. I am, of course, playing Choplifter.
The only difference is that the one I'm
playing is deprotected.
According to the electronic grapevine,
Choplifter is so heavily protected that even
copy card has a hard time copying it. EDD
Il can copy the entire disk, but the booting
time is twice as long and has a tendency to
fail.
Being a software ‘‘purist’’, I tend to shy
away from copy-cards, due to the fact that
1 am too cheap to buy one and that none of
them work on an Apple //c. And for a matter
of fact, neither does Choplifter. Snarl, snarl!
But that is all in the past. Choplifter is
about to join the ranks of deprotected
software. If you wish to skip the main bulk
of this article and get right to the softkey,
be my guest. You can always read this later.
How Broderbund Protected Choplifter
When the disk controller card loads in and
Tuns track $00, sector $00, the code copies itself
from $800 to $200 - which is also the location
of the keyboard buffer! It then messes around
with the data in $800, and loads the second
sector into $300 and transfers execution to $301.
$301 to $328 builds a RTS table and some code
in $100 to $1FF (the stack), and then goes to
$131 through a jump via RTS’ code. $131 to
$1FF does many, many things. First it clears
text page 1 & 2, and copies ROM Basic into
the language card, if one is present. Then the
BRK & reset vectors are set to the disk
controller card. $188 to $18F is a very good
piece of misdirection. It seems to call a routine
at $190 and then exit via a RTS to $405. But
it DOESN'T! That code is just there to fool you.
10 Hardcore COMPUTIST No. 23
cn
At $190 it loads in 4 pages of code into $400
to $7FF - text page #1. This is Standard
Operating Procedure. This is done so that, if
you stop the program, the screen and the code
will be erased by whatever you type. The code
is read in from the disk by the common 4 x 4
format (See: Quality Softwares beneath APPLE
DOS, pages 3-13 to 3-21 on Data Field
Encoding). Not only is this fast as heck, many
other DOSs use this - Atari, Commodore, etc.
Transfer is then given to $4A3 from $1FB
to $1FF, again by a RTS. This code starts out
by copying $500 to $SFF into $200 to $2FF
(notice the keyboard buffer use again) and $600
to $6EF into $300 to $3EF. It then resets the
character hooks ($36,$37) and keyboard hooks
($38,$39) to $326, which Zaps the memory and
reboots if anything is printed or the keyboard
is read. Then it appears to clear out $CQ@ to
$C000, but it doesn’t - it clears out $C00 to
S$C7F, then $D80, $E81, $F82, ect., on up to
$C000. It seems Broderbund made a mistake.
The opcode at $4F2 should be a BNE instead
of a BPL.
In any case, control is transferred by some
nifty code to $440. At $440, the hi-res screens
are cleared out, and the title page is loaded up,
plus some code at $6000 to $63FF. By using
an in-line DECrement memory opcode, control
is given to $400, not $700 as it appears. $400
gobbles up the stack, and loads some more code
into $500. By this time, $200 and $201 hold
the value of $6300, which is the next piece of
code to be run. Onward!
The code at $6300 could have been left out,
i
and I would have been happy. The only reason
for this code is to check for an Apple J[,][+,
or //e Monitor ROM.
This is what got me mad in the first place!
This code is responsible for Choplifter not
booting on a //c. The //c’s ROM doesn’t match
with any of the ‘‘known’’ ROMs. Result: Re-
boot and try again.
When the above routine exits, the new code
at $500 is run. This code is the best piece of
protection ever concocted! By using the fast 4
x 4 format, the code makes some in-line mods
and THEN runs them. The result is quite
different than that expected. Control is given
to $4000, which does 3 instructions, then goes
to $566.
At last! This.is the code that loads in the main
program, The program is loaded into
$800-SIFFF, and then into $6000-SBFFF.
Control is given to $6BF, which loads in the
necessary zero-page values, then checks the
game for errors. If the checksums match,
co
THE
il
control is given to $800 - and Choplifter is run!
(Whew!)
The Softkey
The softkey is the result of 8 hours worth of
work; writing what is known to the trade as a
tapeworm. A tapeworm is simply a program
that can insert itself into another program,
monitor and/or stop it when it gets so far. This
is exactly what the softkey does. It boots the
disk, then loads in the second sector, copies it
to $3000, modifies it, runs it, etc. When the
tapeworm gets so far, it replicates itself, finishes
its work, copies the zero page to $1F00, and
then -- dies. Its work is done, and thus it
commits suicide so that we may gain from it.
‘The tapeworm was built by moving the disk
controller card into $B600-$B6FF, and then
modifying it to enter the Monitor instead of
$801. Then, by using some code, a printer, lots
and lots of paper, logic, more code, and just
plain luck, the boot code was traced. By
Choplifter A.P.T. Control Keys
change the X-axis of the joystick
VW) -change the Y-axis of the joystick
5B) -reset the game to demo mode
©) -toggle unlimited choppers option
plus 1 number: change playing level (@ to 3)
-plus 2 numbers: change the number of seats in your chopper to the 2-digit number
(@@ to 64. 64 and up will give you the maximum amount of seats)
ill
copying parts of the code and feeding it to the
tapeworm, it grew large enough to handle
everything the protection threw at it.
When the Monitor bell rings and the drive
stops, we have in memory a copy of Choplifter
($800 to $1EFF and $6000 to SBFFF) and the
zero-page values at $1F00 to $1FFF. Here's
how to get all of Choplifter:
1) Boot a DOS 3.3 disk, INIT a slave disk with
a blank HELLO file, and delete it.
INIT HELLO
DELETE HELLO
2) Type in the TAPEWORM, FIXUP, and
MOVER hexdumps listed (listings #1, #2, and
#3). Save as follows:
BSAVE TAPEWORM,A$2000,L$149
BSAVE FIXUP,A$1D91,L$A9
BSAVE MOVER, AS$2000,L$4C
3) Load the tapeworm program
BLOAD TAPEWORM
4) Insert your Choplifter disk into drive 1, slot
6 and start the tapeworm on it's journey through
Choolifier’s ‘nemines:
CALL 8192
5) When the Monitor beeps (if the cursor looks
funny, ignore it), check and make sure that no
errors have occurred:
2000<4000.5FFFV
You should get no coding listed. If you do,
or the Monitor will not accept your input,
reboot the slave disk and go back to step 3.
Hardcore COMPUTIST No. 23 11
Sometimes, for unknown reasons, the
tapeworm will not work. This is shown by
garbage on the hi-res screen. If this happens,
go back to step 3.
6) If everything seems fine, enter the following:
800:4C 60 26
@DAB:20 91 1D
2000<800.8FFM
2100<6000.BFFFM
This step patches the program so the Mover
and APT programs will work and save page 8
from the reboot. The last command moves the
code from $6000 to $C000 down to $2100.
7) Insert your slave disk, and enter:
C600G
CALL-151
800<2000.20FFM
3D0G
BLOAD FIXUP,A$1D91
BLOAD MOVER, A$2000
BSAVE CHOPLIFTER,A$800,L$7900
That's it! Choplifter is now a BRUNable file.
Just to make sure, the file length of the file
should be 123 (that’s the 3-digit number just
left of the filename when you CATALOG a
disk).
The MOVER
The MOVER program sets the reset vector
to the Monitor, and then moves the code from
$2100 to $80FF into $6000 to $BFFF, but it
does it backwards. Starting with the code at
$8000, it moves it to $BFQ0, then $7F00 to
$BEO9, etc. It then fixes the program so that
an 800G from the Monitor will restart the game.
The FIXUP
The FIXUP program takes care of the one
thing that Choplifter cannot do: redraw the
screen. First it wipes the top 2 lines of hi-res
page 1 and page 2 to black, and then redraws
the ground at the bottom. Then it copies the
saved zero page from $1F00, and calls $9021,
which redraws the scoring block. The last line
exits to $12C1, which displays hi-res page 1.
And Some A.P.T.s
The pele oan cals be Or oe
Pressing will toggle the Unlimited
Cuipe opack It will also reset you to the
first chopper. Pressing (JP) and then two (2)
numbers will change the amount of seats in your
@1 will make a very hard game,
will make a very easy game.
Pressing ) will restart the program, by
re-entering the demo mode.
Also, by pressing Gand then a number
from @ to 3, you select the level you wish to
play on. This is not part of the package, but
was left in by the original author. This is useable
from either the demo or during play.
while
1. hexdump for...
the TAPEWORM
BSSSSRRSSR
2SRBSSSSTss
SSESRSISLSS
EBRL2SSESSSSS SSRVSRESTESVS
BSSSATAVSRSLS SRSSASSSSES ASSSSEVTSESSE
PRSSSSSSSR SLSVESSRLE
BEEE FR55E282 EPSESSSS TE
SSSSSSssse
SBRsSFS
SRSRATRSSSES SSSSSRSESSS SSSRSSI2BSES
$3 S88888
TSSSsS RVs
SSRssesseseer
BRSce
SBSRSRSSSKER VBSAVSSSSSRKS KRSISSSSSSIS SLVVLSSSIS
8
2
BSSIVSRSSES SAVSSSRLSESS SSSCSSSSTES SRSSRSSLSES
BSOSRRRSSISA SVASVSEVSRS SSSSELRASS
SSSSSASSOR SSVISOSASES
SBLSRRVRSRSS
Sass
BSrsR
$E230
$BA7F
$703F
$EB85
$5052
SESFO
SOFFB
$16C8
$4939
$8561
SEAL
$9055
$2066
$1EIB
‘$53F2
$7759
$328F
$1786
$2088
‘$F463
$3693
$7708
$8939
‘$5F57
$2037
‘S69EF
$1706
‘SEAD7
$4772
2140: 90 98 1F CA DBF? 4C 59 $5CFC
2148: FF $BBA3
2. hexdump for...
the FIXUP
1D91; 4C El 1D AB 27 AS 00 $90¢2
1D98; 99 08 20 99 00 24.99 08 $F2E4
1DAO: 46 99 00 44 88 10 Fl A2 $4828
1DA8: 19 BD O2 1C 85 26 85 28 $314A
1080: BD C2 1C 85 27 49 68 85 $0730
1088: 29 AD 27 AQ 55 49 7F 91 $9067
1000: 26 91 28 88 10 F7 CA 19 $6A96
10c8: £0 A2 06 BD 00 1F 95 00 SCELD
1000: EB 06 FB AQ FF 85 79 20 $1880
1008: 21 99 A9 98 85 79 4C C1 SB5CE
WDE: 12 2C 16 CB C9 92 08.03 $0831
TOES: 4C 90 98 C9 95 0B 11 AD $290F
10F0: 87 OB 49 49 8D B7 OB AD $5478
10F8: 90 8D 1C 73 68 68 18 60 $B47A
1E00; C9 90 FO 01 69 98 48 AD $3409
1E08; 00 CB 10 FB 2C 18 CB 29 $9464
1E10; OF AB A FG 18 690A 88 $8333
1E18: 10 FA 8D D1 69 68 AB AD $4320
1E20; 90 CO 10 FB 2C 10 CO 29 $5350
1E28; OF 18.60 D1 60 80 01 60 $CAg9
1E30: 8D 7C 61 8D AB 616868 $4A9B
1638: 18 60 $88A7
3. hexdump for.
the MOVER
2000: AD 08 CD 2C 10 CO C9 9B. $7FBB
2008: D9 03 4C 59 FF AS 59 80 $3004
2010; F2 03 A9 FF 8D F303 49 $007
2018: A5 8D F4 03 AD 00 84.00 $D4C4
2020: 84 02 A9 80 85 O1.A9 BF $9649
2028: 85 03 A2 60 B10 91.02 $749C
2030: CB DB F906 81 C6 .03.CA $FSBA
2038: DB F2 A9 20 80 00 08 AD $1087
2040: 94 80 B1 08 AD 1D 8D 02 $66EF
2048: 08 4C 00 08 SBAF9
12 Hardcore COMPUTIST No. 23
softkey to...
Just use the Super IOB’s Swap Controller and a
modified Mufplot RWTS to softkey this useful
program. Mufplot is designed to help ham radio
operators to predict optimum operating
frequencies.
by Edward E. Harte, M.D.
Base(2) Systems
Requirements:
Mufplot disk
Super IOB v1.2
A way into the Monitor
A Blank Disk
The program Mufplot by Base (2) Systems
is designed to aid ham radio operators in
predicting optimum operating frequencies. It is
a very useful program, the only drawback was
the copy protection. The first copy of the
program I used self-destructed after six months
use, forcing another cash expenditure to replace
it. This motivated me to de-protect the program.
Upon examining the disk I found the
following protection schemes.
One, the address and data epilogs have been
changed to FF FF. The program used normal
DOS address and data headers, but with an
interesting twist. Prior to the normal DOS
header of DS AA 96 is a pseudo header of DS
AA BE. This header apparently would mislead
a nibble copy program, such as Copy II Plus.
The second protection scheme became
apparent when I changed a normal DOS to
account for the changed address and data
epilogues. Even though the address and data
marks were ok, cataloging the disk resulted in
an I/O error. It turned out that a checksum error
was occurring.
"As noted in the CIA files, a likely cause for
checksum errors is a change in the byte
translation tables. I booted up Mufplot and
entered the monitor via my Wildcard II. A peek
at the byte translation tables revealed the
following changes. Memory location $BA29
had AA instead of 96 and $BAAA had 00
instead of AA. A quick insertion of the byte
table changes, along with the above epilogue
changes allowed inspection of the normal
catalog. Needless to say, I felt like the explorer
who found a treasure.
The technique to copy the disk presented here
does not require utilization of the above
information, but I included it to hopefully
protection. To break the
Te een Coma aoe tS! This
will allow us to use the modified Mufplot
RWTS to read the disk and write to another disk
with a normal RWTS.
The Technique
1) Boot a normal DOS disk.
2) Initialize a destination disk.
3) Boot the Mufplot disk.
4) At the menu stage, enter the monitor by
whatever means.
5) Move the modified RWTS to a safe location.
1900<B800.BFFFM
© Boot up a slave disk.
7) Save the RWTS to your Super IOB disk.
BSAVE RWTS.MUFPLOT,A$1900,L$800
8) Install the controller into Super IOB and run
it. Do not use the format option.
9) Enjoy!
controller
1000 REM MUFPLOT CONTROLLER
1910 TK = 3 :ST = :LT=35 :CD= WR
1920 T1 = TK ; GOSUB 490 : GOSUB 360 ; ONERR GOTO
550
1830 GOSUB 430 : GOSUB 100 :ST = ST +1:
DOS THEN 1038
1040 IF BF THEN 1060
1950 ST = 0 :TK= TK +1: IF TK <LT THEN 1030
1960 GOSUB 499 :TK = T1 :ST = 0 ; GOSUB 360
1970 GOSUB 439 : ee: :ST=ST+1: IFST<
DOS THEN 107
1980 ST = Tkerkel IF BF ©@ AND TK <LT THEN
1970
1998 IF TK < LT THEN 1020
pedi PRINT "COPY* OK, * NO* DOS* ON* COPY"
{00 Rea con CURATION TIME
10010 PRINT CHRS (4); "BLOAD* RWTS.MUFPLOT,
AS19090"
IFST<
controller checksums
2077 - $0255 1970 - $AFIB
1910 - $EBSE 1980 - $8299
1920 - $2AD8 1999 - $F6B4
1930 - $3CD9 1100 - $E2A5
1949 - SE49C 19000 - $8EF6
1950 - $3CF3 19018 - $8344
1060 = SA7IE
Hardcore COMPUTIST No. 23 13
a proDOS softkey for...
iFlashcale
Flashcalc is one of the first products from Paladin (aka Visicorp) since the
Software Arts - Visicorp lawsuit. This is not Visicalc, but it does have most
all of the features plus full support for most 80 column cards. It is written
by the same folks who wrote Magic Office System (distributed by Artsci,
Inc.). Flashcalc is a ProDOS based program, and can serve as an introduction
to ProDOS copy protection.
by Doni G. Grande
Paladin (Visicorp-Paladin)
2895 Zanker Rd.
San Jose, CA 95134
$99.00
Requirements:
FlashCale
COPYA
Any sector editor
Like many ProDOS programs, Flashcalce
allows you to place it onto a hard disk. This
means that Flashcalc must use ProDOS for most
of its disk access, and probably checks the disk
only when it is loading to insure an original disk
is in the drive. Also, the protection scheme is
probably either a nibble-counting type or a
signature checking type. This is also supported
by the fact that the original is COPY Aable, but
that the copy will not run.
To try to find the protection code, you must
have a place to start looking. There are two
possibilities: (1) ProDOS itself has been
changed or (2) the startup code does the
protection check. There is a simple way to
check for #1:
1) Boot a standard ProDOS disk and get into
Basic.
2) CATALOG the disk. You will
probably be able to do this if a mostly standard
ProDOS has been used.
3) Type
PREFIX,D1
to set the ProDOS prefix to that of the protected
disk.
4) Now run the Ist ‘‘xxx.SYSTEM”’ file in the
catalog by typing
-xxx.SYSTEM
If the program starts executing using this
procedure, then you have a standard ProDOS
and the program must be doing its own copy
protection dirty work. The secret here is that
ProDOS always runs the first file with the name
“*xxx.SYSTEM”’ when a disk is booted. By
following the above steps, you have booted the
original disk using the version of ProDOS in
memory!
If you have come this far, then the protection
code is buried in the program itself somewhere.
So now you must try to catch the program
executing the copy protection. When a COPYA
Flashcalc is booted, ProDOS gets loaded and
then it almost immediately re-boots the disk.
This means that the protection scheme is very
early in the boot process. The first place to look
is in the “‘xxx.SYSTEM” file mentioned above
(FC.SYSTEM on the Flashcalc disk). This can
14 Hardcore COMPUTIST No. 23
be done by placing the protected disk in the
drive and typing
BLOAD FC.SYSTEM,A$2000,TSYS
Note that xxx.SYSTEM files always load in
memory at location $2000, and they are of type
SYS. Now, lets look and see what Flashcalc
does upon booting.
Enter the monitor and type 2000L. This will
produce the following:
2000- Ad 00 LDA #$00
2002- A215 LOX #$15
2004- 90 59 BF STA $BF59,X.
2007- CA DEX
2008- 10 FA BPL $2004
AQ CF LDA #SCF
8D 58 BF STA $BF58
AQ O1 LDA #$01
8D 6F BF STA $BF6F
AD 30 BF LDA $BF30
80 26 28 STA $2026
20 00 BF JSR $BFO0
80 nt
25 20 AND $20
DO F2 BNE $2014
2022- 4C 08 22 JMP $2200
2025- 03 Mm?
2026- 00 BRK
2027- 08 22
2028- 07 90
This code references locations $BF58-$BF6F
in locations $2000-$2011. A close look at
Quality Software’s Beneath Apple ProDOS
(BAP) will show you that this is where ProDOS
keeps its map of free-and used memory.
ProDOS keeps this map as a bit-map. A one
bit means that that page of memory is in use,
and a zero bit means that it is available. The
following table shows the relationship between
memory locations and the bit map.
Memory. $BFxx location
Page Lo
HE 01234567 B9ABCDEF
fi 58 ‘ 59
1 5A a5: 5B
2 6c - 5D
3 5E SF
4 60 61
5 62 63
6 64 65
7 66 67
8 68 69
9 6A 6B
A 6c 60
B 6E 6F
The low page numbers are arranged in the
order that ProDOS examines the bits within
each byte of the bit-map. For example, at
location $200A, a $CF is stored in location
$BF58. Examining the table above shows that
$BF58 controls memory from $0000-$0700. A
$CF would mean:
Page # 00 01 02 03 04 05 06 07
$Fe 11901111
Therefore pages 2 and 3 are available, and
the rest are used. Continuing in this manner
shows that Flashcalc is marking memory as
available in the following chunks:
$800-$B7FF - Lines 2000-2008
$200-$3FF - Lines 200A-200C
$B800-S$BEFF- Lines 200F-2011
After all this memory management, the data
from location $BF30 is stored at $2026. Again,
looking at BAP shows that $BF30 is the last
slot and drive accessed in the form DSSS0000,
where D=0 is drive 1, D=1 is drive two, and
SSS is 1-7 to indicate the slot number. This is
beginning to look interesting. The only reason
to get a slot and drive number is if a disk access
is about to be done!
Location $201A bears out this suspicion: a
JSR to $BFO0, the entry point of ProDOS's
machine language interface (MLI). A full
description of the MLI can be found in BAP,
so only the pertinent information will be given
here. Immediately after a JSR to the MLI,
ProDOS expects to find two pieces of data: (1)
A single byte indicating what function the MLI
is to perform, and (2) a two byte address in lo,
hi form pointing to where the MLI can find the
rest of the parameters for this call.
In this case, the first byte at $201D indicates
a call to the READ_BLOCK function and the
next two bytes show that the address of the
parameters is $2025. The parameter block and
interpretation for the READ_BLOCK
command is:
location value meaning
$2025 $03 Three parameters follow
$2026 $xx Slot and drive parameter
$2027 © $2208 Address to load data to
$2029 $0087 Block number to read
Note that the byte at $2026 was filled with
the correct value by the code at $2014-$2017.
This call means that the MLI will load block
7 from the disk to the address $2200. If this
call is successful, the zero flag will be set and
the branch at $2020 will not occur. Then, the
IMP $2200 will jump into the code just read!
To find out what happens at $2200, re-route
the jump at $2022 to jump to the monitor by
typing:
2023:59 FF
Then start the program with
2000G
The disk should come on and then you will
get the monitor back.
Now, list the code at $2200 by typing
2200L
‘The first few instructions will be:
2200- AB 00 LOY #300
2202- B9 O08 22 LDA $2200,Y
2205- 99 00 40 STA $4000,Y
2208- CB INY
2209- DB F7 BNE $2202
220B- 4C GE 40 JWP $400E
220E- 20 75 40 JSR $4075
This code
You will quickly find yourself back in the
monitor, but the code will have been moved.
List the code at $400E. The first thing you see
is a JSR $4075, so without looking any further,
type
4075L
It begins with:
4975- 20.91 40 JSR $4091
4978- 90 61 BCC $4078
497A 60 RTS
4078- AD 36 BF LDA $BF30
4076-2970 AND. #S70
4080- 4A UsR
4g81- 4A UsR
4982- 4A tsk
4983- 4A UsR
4984- 99.09 ORA #SCO
4986- 85°37 STA $37
4g88- A900 LDA #800
48A- 85 36 STA $36
4g8C- A9 AD LDA #SAD
4O8E- 6C 36 00 JMP ($0036)
First, look at the code at $407B-$408E.
Remember that $BF30 contains the drive and
slot number in the form DSSS0000. With this
in mind, and assuming that you boot from drive
1 in slot 6 so that this should be 01010000,
follow the code. You will find that, by the time
you reach $408A, locations $36-$37 will
contain 00C6, which will cause $408E to jump
‘to C600. This reboots the disk! We have found
part of the protection code!
Now, look back at $4075. It contains a JSR
$4091, then if the carry flag is clear, it executes
the rebooting code. This must mean that the
carry flag is set if all is okay, and cleared
otherwise. One more excursion is in order. List
the code at $4091-$40DC. I'll leave it up to you
to do a full deciphering of this code. However,
I will tell you that it looks for the following bit
pattern on the disk:
19101010 11191011 60. ..000 11101100
SAA $EB $00 SEC
The special thing to note here is the string
of zero bits between $EB and $EC. Normally,
ProDOS cannot read or write a string of zeros
reliably. In fact, if ProDOS read the above, it
would see just $AA EB EC, and completely
ignore the zeros! Apparently, the protectors of
Flashcalc have written the string of zeros using
a special write routine. The software just looks
for the sequence $AA EB 00 EC. This will not
be found on a disk copied by COPYA and some
bit copiers. This type of protection I call
signature analysis, because the protection code
looks for a certain signature on the disk.
At the end of the protection code, you can
see the following sequence (without the
comments, of course):
49D1- CMP #$EC Is byte a $EC?
4903- BNE $4008 Go if not
49D5- SEC Signal everything OK
49D6- BCS $4909 jump always
4908- CLC Signal bad disk
49D9- LOA $0088,X Turn off the drive
400C- RTS Return to caller
Since we want to set the carry flag no matter
what, the only change would be to change
location $40D8 from a CLC ($18) to a SEC
($38). This would cause the calling routine at
$4075 to think that everything was just fine.
Believe it or not, Flashcalc is effectively
protected by just one byte!
The procedure to make a copyable version
of Flashcalc is as follows: 1) COPYA the
original Flashcalc disk. 2) Use a sector editor
to make the following change. Note that
ProDOS uses a different notation for disk
access. I have given the ProDOS block number,
the DOS 3.3 sector number, and the actual
Physical sector number for the patch. Most Zap
programs use the DOS 3.3 sector notation, so
if you don't know which one to use, DOS 3.3
is your best guess.
ProDOS Block: Block 7
DOS 3.3 Sector: Track #, Sector 1
Physical Sector: Track 8, Sector D
Change byte’$DB from $18 to $38
Hardcore COMPUTIST No. 23 16
softkey to...
KARATE KARATE KARATE KARA‘
TE KARATE KARAT!
E RARATE KARATE
KARATE KARATE KARATE KARATE K.
KARATE KARA’
TE KARATE KARATE KARATE
Al
ARATE,
RATE RARATE KARATE KARATE KARATE KARATE KARATE
KARATE KARATE KARATE KARATE KARATE KARATE KARATE KARATE KARATE EARATE KARATE KARATE
KARATE KARATE TE
KARATE
TE ARATE KARATE KARATE
=
:
:
:
=
s
5
Beet —
Sor
aa
by Danny Pollak
Broderbund Software
17 Paul Dr.
San Rafael, CA 94903
Requirements:
Apple ][ Plus with 64K
Karateka
One blank disk
Karateka is a recent release from Broderbund
Software which has set the trend for upcoming
games, With smooth graphics, great sound
effects, and a realistic action, how could this
game miss? Broderbund didn’t overlook a single
minor detail. In his review of Karateka in issue
no. 19, Jeff Hurlburt closed with this statement:
“Simply put, Karateka is a breakthrough. Art
merges with technology to produce a game
almost as much fun to watch as to play.””
Their Protection
An examination of the Karateka disk shows.
that the game resides from Track $00 to Track
$20. Track $01 contains a loader which reads
in another loader from Track $02.5. Then,
depending on the value in the accumulator, the
second loader loads in a portion of the game.
With this in mind, I set out to deprotect
Karateka.
The Softkey
1) The first thing we need to do is to initialize
the blank disk so that it will BLOAD the
program when booted. Boot an initialized disk
(preferably with a fast DOS). Then insert the
blank disk and type in the following:
CALL -151
9E42:34
INIT KARATEKA
DELETE KARATEKA
2) The next thing we need to do is move the
disk controller ROM down to RAM where we
will modify it so that it will exit into the Monitor
upon loading Bootl.
9600<C600.C700M
96FA:98
9801:4C 59 FF
3) Execute the modified controller by entering
9600G
4) Boot! has now been loaded into memory at
$800. Move it to $9800 and modify it so that
it will also exit into the Monitor.
5) Execute the controller at $9600 again.
9600G
6) The code at $9800 has now loaded another
section of code at $300. This code moves a
portion of itself to $1000, jumps to $1000, and
then reads data from the disk and stores it from
$200 to $7FF in memory. At $3BE there is a
jump to $300. We will move this code at $300
to $9300 and modify it so that instead of
jumping to $300, it will move the code from
$200-$7FF to $2100-$26FF and then exit to the
Monitor.
9300<300.400M
9305:93
93BE:4C 00 60
16 Hardcore COMPUTIST No. 23
7) Execute the disk controller for the last time.
9600G
8) The code that was read in at $300 is
responsible for reading data from Track $01 and
storing it from $4000-$41FF in memory. It then
jumps to the subroutine at $4000 which reads
data from Track 2.5 and stores it from
$5000-S57FF. The routine at $5000 loads a
certain portion of the game depending on the
value in the accumulator.
We can alter the code at $300 so that it will
exit into the Monitor instead of jumping to
$4000. Do this by entering:
390:4C 59 FF
300G
9) An examination of the code at $4000 shows
a jump to $5000 at $401E. Alter this code to
exit into the Monitor and then execute it.
401E:4C 59 FF
4000G
10) Examining the code at $5000 shows that
depending on the value of the accumulator,
execution will either fall through to the jump
to $5300 or branch past the jump statement and
continue executing. Before the jump to $300
back at step 6, the accumulator was loaded with
$80. This value would cause the execution to
fall through to the jump to $5300. The code at
$5300 loads the main portion of the game and
then jumps to $200. We will alter the code so
that after it loads the game, it will exit to the
Monitor.
5320:4C 59 FF
5300G
11) The main program is now in memory
located at $800-$FFF and $6000.$9FFF. We
will compact the code and then boot the
initialized disk.
2700<800.FFFM
2F00<6F00.9FFFM
6F 00:00
6F01<6F00.70FFM
6eP)
12) Enter the following hexdumps. The routine
at $2000 is the memory move which will put
the program back in its proper locations. The
routines at $6FQ0-$70FF will be moved to
$F600-SF7FF on the language card. The routine
at $6F00 loads the picture of the castle. The
routine at $6F20 loads the files for each section
of the game. The routine at $7000 swaps the
area occupied by DOS with all of Bank 2 on
the language card and part of Bank 1. This
routine is used when DOS is needed to load a
sez
20
+90
FIO: 20
C9
sRBIss
ss
25
ge
=F
2
q
2
SSESSS SRSSTSBSaS
MS SBSSRSRaS
2ese
as SISSSSRISw
a
Sxs SS
a
2£e
SSRs SSSVSSRSss
Baus {zzz
)Saseasesrs seen
3:
Ee
eae
SESaS SSeS
: 2C 83,08 2C 83 CHAD AD $5089
Tea oan $8A45
7010: 84 1 1 S7IAF
: FE 91 Fo pe $7588
7020: F346 FO.E6 FF AS FOCI $50F1
7028: F890 69/20 8B 8B. SESE
7036: 85 $2330
7038: FF/81 FC/48 (81 FE/91 FC $0567
7040: 68 91 FE CB‘De FBE6 FD $8050
7048: £6 FF AS FF C9 DA 96 E9 $6C2F
1050: 60 $970¢
13) The next thing that must be done is to alter
the Karateka code so that it will jump to our
routines when it goes to load a portion of the
program.
210E:4C 20 F6
214B:20 08 F6
2299:F1
229C:F1
14) That's it for now. Now all that is left to
do is to save the file and we will have the main
program stored as a single file on disk.
BSAVE KARATEKA,A$2000,L$5100
15) We're not done yet. Now we must capture
the picture and the other portions of the game
which are loaded in during play. We will let
the loader from Karateka do this for us. For
the loader to work, the disk read head must be
located at Track $01. We must use DOS to
cause the read head to seek to Track $01 and
alter our main program so that after it has
moved itself to its original location, it will exit
to the Monitor.
300:20 E3 @3 4C D9 03
B7EC:@1 60
B7F4:00
390G -——
2088:4C 59 FF
2299:4F
229C:4F
2000G-—___——
16) We will now use the loader which is located
at $300 to load each section of the game. After
we load each section, we will use our swap
routine at $F700 to move DOS back into place
and then save the files to our initialized disk.
At this point it would help to have two disk
drives, but it is not mandatory. If you only have
disk, save the files for that section, seek the read
head back to Track $01 and then put the
Karateka disk back into the disk drive. If you
have two disk drives, then you need only to
4000<A000.BFFFM
C083
F700G
A851G
17) The files are now in memory. If you have
two disk drives, then complete this section and
skip step 18. If you have only one disk drive,
then go to step 18, Insert the initialized disk into
drive two and enter the following:
BSAVE LOAD@,A$4000,L$2600,D2
BSAVE LOAD@A,AS1000,L$1000
9EEOG
F700G
COEA
18) Insert the initialized disk into drive one and
enter the following:
BSAVE LOAD@,A$4000,L$2000
BSAVE LOAD®A,A$1000,L$1000
6000:A9 B7 A@ E8 4C BS B7
B7EC:01 00
B7F4:00
6000G
9EEOG
F700G
Reinsert the Karateka disk into drive one.
19) There are five different loads during the
game and also the picture. We have just saved
the first load to disk under the names LOADO
and LOAD@A. To get the other four sections
loaded and saved to disk, you need to loop back
up to step 16. There are two things that will
be done differently. After you type EJB), you
will enter the number of the section (0-4) that
you want to load. You already loaded section
@ so the next number will be 1, The only other
change that must be made is when you save the
files. Replace the @ with whatever number
section that you loaded. For instance, you
would use BSAVE LOAD4,A$4000,L$2000
and BSAVE LOAD4A,A$1000,L$1000 if you
had just loaded in section four. Loop back to
section 16 and follow the instructions doing the
changes described above. After you have done
this for all five sections, go to step 20.
20) The only thing left to do is to capture the
picture file on disk. Do this by entering the
following:
3A5G
2000<A000.BFFFM
C083 q
F700G A |
A8S51G rn
BSAVE PICTURE,AS2000,L$2000
. insert your initialized disk into drive 2 and save
£0" $DEF3 the files. The read head on drive 1 will still be A Final Word
OA $BF96 at Track $01. Insert the Karateka disk into drive Now you have a completely COPYA-able
5D SSEF8 Lae pe Mt the following: version of Karateka. Maybe someone out there
$4900 390:4C 59 FF can come up with some APTs which will stop
$0733 you from being hit or continue the game if you
8 $A3C3 401E:4C 59 FF get killed. There are many jump tables
JAD $9258 4900G —— throughout the main code which could help in
$7696 your search for a certain routine, Good Luck!
FB $1097 200
= 5900G ——— P %
Hardcore COMPUTIST No. 23 17
—Se —— ———$——— ——
softkey to...
by Doni G. Grande
PHOTO LAB
i
LAYOUT
18 Hardcore COMPUTIST No. 23
Springboard Software Inc.
7807 Creekridge Circle
Minneapolis, MN 55435
$49.95
Requirements:
Any Apple with at least 64K of memory
(required by Newsroom)
Super IOB v1.5
A sector editor with search functions
The Newsroom is a terrific program for
producing newsletters, Unfortunately, the
program disk must be left in the disk drive at
all times, and it cannot be easily copied. This
is a great deterrent for schools, as a spilled Coke
quickly does the disk in! The only alternative
is to deprotect Newsroom.
Delving into the Newsroom
The Newsroom can be partially deprotected
by use of a Super IOB controller. However, the
final copy will not run because of four reasons.
1. The Newsroom switches between normal
and modified DOS to access different disks
Patches to switch DOS’s were entered at $BA69
and $BA7F. Since we want Newsroom to only
access normal DOS disks (including itself),
these patches must be circumvented by placing
an RTS as the first byte in the routines.
2. The Newsroom uses drive three to load
parts of the program, As we all know, there
is no drive three, and DOS 3.3 loudly signals
this with an error. Upon closer examination,
I discovered that Newsroom sets up a RAM disk
as drive three on a 128k Apple and copies most
Newsroom includes a large file
of “‘clip art’’ and other graphic
utilities to help you produce
newsletters. Deprotect this
handy graphic package by
using the Super IOB v1.5.
aed Gili
tr
Ih
of it’s programs to this RAM disk upon bootup.
‘That is why program transfer is so quick using
a 128k Apple. On a ][ Plus, the programs are
loaded from the disk drive when needed. Drive
three is used by the Newsroom DOS to
designate the RAM drive.
3. Newsroom checks a disk before accessing
it to be sure that the desired disk is in the drive.
There are three possible outcomes to this check:
a. Program Disk: verified by presence of
modified address epilog marks and the presence
of SSI NR on track $11 sector $00.
b. Clipart Disk: verified by presence of
normal address epilog marks and SSI CLIP on
track $22 sector $00.
c. Storage Disk: verified by presence of
normal address epilog marks but not Clipart
disk.
Notice that the presence of the modified
address epilog marks ($ADBB instead of
$DEAA) is checked, but then a double check
is made in all the above cases. Unfortunately,
the program checks for these modified epilog
marks first, and then does the other checks. This
means that to defeat the protection scheme, the
routine which checks for the modified epilog
marks must be changed to always return the
correct value corresponding to the disk which
is supposed to be in the disk drive. The second
check will then determine which disk is actually
in the drive. Very close (and long) examination
of Newsroom’s code revealed that location
$3AD contains the expected value returned by
the protection code AND-ed with $80. $3AD
contains $80 if altered epilog marks (program
disk) are expected and $82 if normal epilogs
marks are expected. The protection code must
return the value at $3AD AND $7F and the
carry flag clear whenever it is called.
4. On the latest version of Newsroom (the
one that allows you to convert hi-res pictures
in the photo program) there is a nibble count
during boot up.
Step By Step
As usual, we can now use our findings to
deprotect the disk. Following is a step by step
procedure which you can follow to copy the
Newsroom.
1) Install the Super IOB controller at the end
of this article into your copy of Super IOB v1.5
and RUN it. Note that if you have the later
version of Newsroom (the one that allows hi-
res picture conversions in the photo section),
you will have to change the 15 in line 1100 to
a 20.
2) Search the disk for the following bytes and
change to the indicated sequences. Note that
they will be found in more than one location
on the disk, so be sure to search the entire disk!
Search for: AE E9 B7 BD 8E CO BD 8C CO AD
Change to: AD AD 03 29 7F 18°60 EA EA EA
Search for: 2C 50 CB A9 O1 85 FB 20 24 IF
Change to: 2C 50.00 A9 09 38 BO 09 EA EA
Note that the second sequence will only be
found if you have the later version of
Newsroom as it is the nibble count routine.
About The Controller
The Newsroom controller normalizes the
Newsroom DOS by performing sector edits
which simulate the routine to change to normal
DOS. If you have the later version of
Newsroom, there are more changes that have
to be done to Newsroom so that it will read
normal disks. That is why you must make the
15 in line 1100 a 20.
In addition to normalizing the Newsroom
DOS, the controller also disables the DOS
switching routines by placing an RTS as thier
first instruction.
The two POKEs of line 1010 set DOS to the
super extended retry mode. I found that because
of the strange sector marks being used by
Newsroom, the sectors are harder than normal
to read with normal DOS. Therefore, some
sectors will speed by and some sectors will take
a while to read. Hopefully the super extended
retry mode will make DOS patient enough to
read every sector of your Newsroom original.
Finally, if your clipart disks aren’t
COPY Aable, you will have to deprotect them
by using the Super IOB controller and removing,
the “‘GOSUB 1100”’ in line 1020.
Many Thanks to Glen Tatum
controller
1900 REM NEWSROOM CONTROLLER
1910 T= 0 :LT=35 :ST=15 ;LS=15 :CD=WR : FAST
1 ; POKE 48573 ,O : POKE 48588 , 208
RESTORE : GOSUB 170 : GOSUB 490 : GOSUB 610
2 IF TK = @ THEN GOSUB 1100
1030 GOSUB 230 : GOSUB 490 : GOSUB 610): IF PEEK”
(TRK ) = LT THEN 1050
1940 TK = PEEK (TRK) :ST = a ee GOTO 1020
1950 HOME : PRINT "COPYDONE"
ee eRe READ AL ,A2 : OME A A2:
: RETURN
5000 OA 173 167 ,237 ,187
5010 DATA 13470 ,222 13475 ,170
5020 DATA 13109 ,222 ,13119 ,170 ,13201 ,222
5030 DATA 13204 ,234 ,13205 ,189 13206 ,140
13207 , 192 , 13208 ,16 , 13209 ,251 , 13219
,201 13211 ,178
5049 DATA 12905 ,96 ,12927 ,96
5050 DATA 12469 ,222 12467 ,170 ,12462 ,222
5060 DATA 12221 ,48 ,11985.,40
controller checksums
1900 - $3568 5000 - $1542
1910 - $1EB4 5010 - $A6B7
1920 - $5698 5020 - $3148
1930 - $6301 5030 - $5185
1040 - $F4AD 5049 - $DC3E
1950 - $9EF2 5050 - $AAGS
1100 - $FCB7 5060 - $B72F
Hardcore COMPUTIST No. 23
19
This 1980 graphics system has some useful functions which more recent
programs still lack and it has some sophisticated protection schemes, too.
by Nick Galbreath
Sirius Software, Inc.
10398 Rockingham Dr., Ste. 12
Sacramento, CA 95827
Requirements:
Any of the Apple ][ line
COPYA or an equivalent sector copier
A blank disk
E-Z Draw, though very old (published in
1980), is still a complete graphics package and
has some very useful functions which the more
modern programs lack. It also has a very
sophisticated protection scheme which, though
not hard to copy, appears to be very hard to
crack. If you are only interested in the cracking
go to the end of this article.
The Scheme
As mentioned in my Controller Writer article
(HC #16), E-Z Draw uses eight different
address headers per track and the epilog bytes
change nearly every sector. This changes every
track so there is really no pattern. It is F8 ROM
protected by loading its own monitor routine
into the RAMcard and its RWTS routine is
nonstandard so using Demuffin or a Swap
controller produces only ‘I/O ERROR."’
This discouraged me, until I finally did get
into the monitor and found how E-Z Draw reads
in sectors. It ANDs every byte with $DS (the
normal byte for an address header). If the result
is $DS5 then it has found the first byte in the
address header. It also does a similar routine
for the last byte in the address header ($96).
The Crack
was very complicated, too. If you’re a novice
In the Geld dt coetting andl leechten’ code, I
a ee a. mer
pat enter the monitor and disable the
checksums:
We need some space in DOS so we can add
some extra code to read in the E-Z Draw sector.
A good place is the $B600 area since it is only
used when putting on DOS after initialization.
To free it enter:
B74A: 60
AS6B: 60
The second change prevents a Hi-file from
time. And now, our patch:
B600:29 DS C9 D5 68 29 96 C6
B608:96 D@ 03 4C 6D B9 4C 54
B610:B9
Check your typing against the following:
B600- 29 D5 ‘AND #$05
B6G2- C9 D5 CMP #$05
B604- 60 RTS
B6B5- 29 96 AND #596
B6G7- C9 96 CMP #596
B689- DB 83 BNE $B60E
B6OB- 4C 6D B9 JMP $B96D
BODE- 4C 54 B9 JMP $8954
20 Hardcore COMPUTIST No. 23
To enable this patch enter:
B9S4: 20 00 B6 EA
B969: 4C 05 B6 EA
Go back to basic with GQ and run
COPYA. When done copying, you will have
cracked it! It will boot up just fine, however
IT suggest adding a new DOS since one can then
RESET out of the program normally.
Also if one needs more space on the diskette,
UNLOCK and DELETE FPBASIC and
APPLESOFT for 57 sectors. To get 5@ more
‘sectors, run a program that rebuilds the VTOC
(like FIXCAT or Disk Recovery) or copy all
the files (yuk!) onto a new disk.
Recap
Boot up a DOS 3.3 System Master diskette.
CALL-151
B92D: 18 60
B989: 18 68
B74A: 60
AS6B: 60
B60@: 29 DS C9 DS 68 29 96 C9
B608: D0 63 4C 6D B9 4C 54
Run COPYA and copy the E-Z Draw master
disk.
BRUN MASTER CREATE
And add a new DOS with the hello file named
“SIRIUS SOFTWARE (C) 1980". Copy
complete! &
Using ARD To Softkey...
a
a
wah Pee |
8943 Fulbright Ave.
Chatsworth, CA 91311 |
Requirements:
Apple IL
48K slave disk
A blank disk
A sector editor
Mars Cars disk
Your first question after reading the title must
be ‘‘What in the world is an ARD?”’ Well, the
ARD (Anti-Reboot Disk) is a disk that’s had
its boot sector modified so that it fails to boot
the rest of the DOS, but jumps to the Monitor
instead. Some disks reboot after Reset is
pressed. The ARD prevents this. Most of the
memory is left alone except for $800-8FF,
$300-355, and the Monitor’s favorite hangouts
in Zero Page. In this way, the RWTS could be
captured for use in Super IOB. It can also be
used to capture a single load program if it does
not need those locations I mentioned. As an
example, we will use this to crack Mars Cars
from Datamost.
Preparing the ARD
1) Initialize a blank (or unwanted) disk.
2) Run your sector editor and then make the
following changes to track 0, sector 0:
3) Write it back to the disk and you now have
an official Anti-Reboot Disk!
How it Works
When a disk first boots up, the ROM on the
controller card reads track 0, sector @ into
$800-8FF then it jumps to $801, where it
normally continues the boot process. That is
what we're interested in. In step 2 we changed
the code stored in the first sector so that it turns
off the drive and jumps into the Monitor for
you. Here it is:
81- AD E8 CO LDA $COES
804- 4C 59 FF JMP SFF59
Complicated, isn’t it? $COE8 is the soft
switch that turns off the drive, and $FF59 is,
of course, the entry point into the Monitor.
From there, the rest of the sector is ignored.
Once it reaches the Monitor, the computer
thinks everything is normal except for the lack
of DOS.
Using It
Using the ARD is easy. After the game is
loaded and running, remove the program disk
and replace it with the ARD. Hit Reset and let
the disk do its magic. After the drive stops you
should be in the Monitor and free to do what
you wish. From here you can move the game
or RWTS out of the way and boot normal DOS
from there.
Mars Cars is a fun (but lame) little maze-type
game. The main difference between this and
other maze games is that the game's walls are
also edible. If you’re in trouble, you can eat
HoH us a uu tH i
F Byte Deprotecting Mars Cars
by Chris Chenault SF
gl- AS AD
o2- 29 «£8
93- co CO
j a4 99 4C
Mars Cars - dO 59 a hole through a wall and get away.
Datamost, Inc. 06- 18 FF
To deprotect Mars Cars we require a Mars
Cars disk, the ARD, and a blank slave disk with
no HELLO program
1) Boot the Mars Cars disk. Press a key to get
past the title picture and the irritating tank noise.
You should now be at the menu.
2) Remove the game disk and insert the ARD.
3) Press Reset and let the ARD do its thing.
4) When you are in the Monitor, move the
program out of the way with
2000<8000.BEFFM
5) Boot your empty slave disk and enter the
Monitor.
6@P)
CALL-151
6) Type in the hexdump with this article. All
it does is move the game out of its hiding place
and jump into it. Save the program like this:
BSAVE MARS CARS,A$800,L$7800
That's all you do. Play the game by typing
“<BRUN MARS CARS”.
hexdump for...
ARD: Mars Cars
9800: A2 00 BD 00 20 9D 00 80 $B8D5
9808: E8 DO F7 EE 04 08 EE 07 $D9C
0810: 08 AD 04.08 C9 5F DOES $4348
0818: 4C 00 70 $8059
Hardcore COMPUTIST No. 23 21
A hardware special feature:
How to be the
WriteMaster
You can take command of the write-protect status of your disks
by making this simple hardware modification: add your own
switch! Why not change that red LED to amber or green or to
a tri-state LED to indicate whether your drive is in normal or
write-protect status?
by William Wingfield Jr.
its:
One disk drive
Soldering Iron (optional)
Drill and bit
Hardcore COMPUTIST No. 22
Note: The procedure described in this article
oni Sees of the disk drive which
Hardcore COMPUTIST will
not be Wa tee Ur areca for any damages
incurred while following this procedure.
When a person gets heavily into the
deprotection scene, he often finds himself
going through write- protect tabs at a
substantially increased rate. In addition, he
finds himself often notching disks to use
the elusive backsides.
All this led me to make my first
modification to my Apple: the adding of
my own switch which controlled the write-
protected status. It was something that I
thought should have been standard
equipment. In fact, some Commodore
drives come with this feature.
Over the past four years, I’ve had my
write master switch configured several
different ways depending on how I was
using the drive at the time.
If your drive is under warranty you may
not wish to perform the modification
described below. However, instead of
drilling a hole in the front of your drive,
you can connect a switch with wire
to let it hang out the back of the drive. This
way you can remove it if you have to
return the drive for any reason and it’ll
look like new. I had my switch this way
until the day my warranty expired at which
time I mounted the switch on the front of
the drive.
What’s Already There
If you’ve ever had the cover off your
drive to adjust the speed, or out of
curiosity, then you've probably looked at
the write-protect switch. It’s a normally
closed (NC) micro-switch with a lever that
senses the lack of a notch in the disk that’s
in the drive. If there is no notch, then the
switch is opened (or turned OFF) and all
write attempts are subdued. Similarly, if
a notch is found then it rests in its normally
closed (or turned ON) position which
allows writing to occur.
Possible Modifications
The simplest modification is to wire a
SPST switch parallel with the one in the
drive (fig. 1). If the new switch is in the
OFF position, then the drive will operate
as it always has. If the new switch is in the
ON position, then the computer believes
there is a notch in the disk and will allow
writing to any disk. This lets you write to
the back of a disk without a notch (and to
22 Hardcore COMPUTIST No. 23
the front with a write-protect tab too, so
be careful).
You can disconnect the switch in the
drive completely and connect the wires to
a SPST switch and have complete control
of the R/W operations. ON writes anytime
and OFF never writes but I’ve found it
more convenient to have a position that lets
the drive switch read the disk.
If we use a SPDT switch with a center-
off position, we can do whatever we want
(fig. 2). In one ON position, the disk will
be checked for a notch by the drive switch.
In the other position, we can write
anytime. Finally, in the center on position,
nothing can be written at all - ultimate
control of the write protect status!
Installation
Begin by removing the four screws from
the bottom of the drive that secure the
cover and remove it. Next, remove the
four screws from the sides of the face
plate, open the drive door and let it slide
off the tracks as you move the face plate
forward.
A small plastic ring secures the LED in
its mount. Remove it as illustrated on
page 23 by slipping a small knife or
screwdriver under it and prying the ring
straight back until it pops off.
Next, gently pull the LED out of the
mount and the face plate will be free of the
drive. Refer to fig. 3 as a guide to the
mounting hole. The face plate on Apple
disk drives has a thin aluminum sheet on
the front so a small pilot hole (1/16”" -
1/8’’) should be drilled as a guide first.
This will keep the drill bit from biting into
the aluminum.
Put the face plate on something soft so
It won’t be marred and drill from the back.
Access to a drill press is an advantage but
not a necessity.
The simplest way to mount the switch
is to drill the recommended size hole, wire
the switch the way you want and then
secure it with the retaining nut.
Re-assemble the drive and make sure
that the added wire doesn’t interfere with
the inserting or removing of disks or the
movement of the head. There is ample
room in the bottom of the drive for the
wire.
A more professional look can be
achieved by drilling a hole slightly smaller
than recommended and threading the
switch into the plastic. Screw the switch
in until the shaft is flush with the front of
the faceplate. The retaining nut isn’t
needed. Wire the switch and re-assemble
the drive.
I’ve found that having the switch operate
vertically is the most convenient. The up
position, toward the disk, is the position
that checks the disk. The down position,
toward the red LED, is the BECAREFUL
position, it can always write.
What About the LED
If you’ve grown tired of always seeing
a red LED this is a good time to change
it to amber or green. I used a 3PDT switch
and a tri-state LED to give a visual
indication of the mode the drive is in. Wire
the extra 2 poles as a polarity reverser to
the LED wires and the tri-state. Red
signals that the write protect is bypassed;
green that the disk is checked for
protection. If your 3PDT has a center off
position, then the LED light will not light
at all in the center position.
Advantages
Now you don’t need a separate
game-save disk for your adventures. Just
use the back of the disk for saving. The
same idea works well for your spread sheet
program, data base or word processor. Of
course it is a simple way to quickly double
the storage capacity of your disks.
Finally, I would like to say that making
this modification is easier than it sounds.
Also, I have never had a problem using
both sides of my disks.
pes weee 280202 Existing
WIRES
ADDED
WIRES
EXISTING
WIRES
Hardcore COMPUTIST No. 23
core’s
$$$$$$$$$$$SS$SS$S$S$SSSS$SS$SSS$SSS$SSSSSS$SSSSSSSS$SSSSSSSSSS$S$S$SS$SSSSSSSSSSSSSSSSSS
$$$$$$$$$$$$$$$S$$$$$$SS$$SS$$SS$SSS$S$S$SSSSSSSSSSSSSSSSSSSSSS$SS$SSSSSSSSSSSSSSSSSSSSESS
$$$$$$$$$$$$$$$$SS$SSSS$S$$SS$SSSS$S$SSS$$SSSSSELESSS$SSSSSSSSSSSSSSSS$SSSFSSS$SSS$SSSSSSS$SSSSS
SSSSSS$S$SSSSSSSSSSSSSSSSSSSSSSSSSSS*~
S$SSSS$SSSS$SSSSSSSSSSSSSSSSSSSS”
S$S$SS$$SSSSSSSSSSSSSSSSSSSS*”
$SS$$SSSSS$SSSSSSSSSSSSSSS”
$$S$$$SSSS$SSSSSSSSSSSSS°
SS$S$$S$S$$S$S$SSSSSSSSSSS
SSSSS$SSSSSSSSSSSSSSSS
S$$$$$$SS$SSSSSSSSSSSS
S$$$SSS$SSSSSSSSSSSS
S$S$SSSSSSSSSSSSSS$S°
S$FSSS$SSSSSSSSSSSS
S$$SSSSSSSSSSSSSSSS'
$SSSS$SSSSSSSSSSSS
S$SSSSSSSSSSSSSSSS
$$S$SS$SSSSSSSSSSSS
$$S$SSSSSSSSSSSSSS
S$$$$$S$S$SSSSSSSSSSE
S$$$$S$S$S$SSSSSSSS
S$$$$S$SSSSSSSSSSSS.
S$$SSSSSSSSSSSSSSSSS
S$$$SSSSSSSSSSSSSSS.
$$$SSS$$S$SSSSSSS$SSSS
SFSFSFS$SSHSSSSSSSSSSSSS
S$$S$SSS$SSSSSSSSSSSSSS
S$$S$S$SSSSSSSSSSSSSSSSS.
S$$SS$$SSSSSSSSSSSSSSSSSSs
S$S$S$$$SSSSSSSSSSSSSSSSSS.
S$SSSSSSSSSSSSSSSSSSSSSSSSS$.
$S$$$SSSSSSSSSSSSSSSSSSSSSSSSS>,
$$$$$$SS$$SSSSSSSSSSSSSSSSSSSSSSSS$9.
~* &$S$SSSSSSSSS$SSSSSS$SSSSSS$SSSSSSSSSS$
*SS$$SSSSSSSSS$SSSSSSS$SSSSSSSSSSSS
SSSS$$SSSSSS$SSSSSSSSSSSSSSSSSSS
OF
SS$SSSS$$S$SSSSS$$SSSSSS$SSSSSSS
“S$$$S$SSSSF$$SS$$$SSSSSSSSSSS
SS$$SS$SSSSSSSSSSSSSSSSSSSSS
“S$$$SSSSS$$SSSSSSSSSSSSSS
$$SSSS$SSSSSSSSSSSSSSSS
“$S$$$$$$$$SSSSSSSSSSSS$$
S$$SSS$$SSSSSSSSSSSSSS
S$SSSS$$SSSSSSSSSSSSS
SSSS$SSSSSSSSSSSSSSSS
IS$$$$S$SSS$SSSSSSSSSSS
i$$$$SSSSSSSSSSSSSSSS
iS$$$SS$$SSSSSSSSSSSS
I$$$$$$$SSSSSSSSSSSSF
I$S$$$$$F$SSSSSSSSSSSS$
bSSS$$S$SS$SSSSSSSSSSS$S
S$S$$$$$SSSSSSSSSSSSS
/$$$$S$S$S$$SSSSSSSSS$S$
S$$SSS$$SSSSSSSSSSSSSSSS
\A) SF$H$HFHSFSSSSSSSSSSSSSS
e$SSS$S$SSSSSSSSSSSSSSSS
eSSSSSSS$SSSSSSSSSSSSSSSSS
SSSSS$FFS$SSSSSSSSSSSSSSSS
$$$SSSSS$SSSSSSSSSSSSSSSSSS
2S$SS$SSSSSSSSSSSSSSSSSSSSSSSS
aSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
+ SSSSSSSSS$$SSSSSSSSSSSSSSSSSSSSSS
va $$SSSSSSSSSSSSSSFS$$SSSSSSSSSSSSSSSS
$$$$$$$$S$$SS$S$$S$SSSS$$S$S$SSS$S$SSSS$$$$992299SSSSSS$S$$$$$$S$S$SS$SSSSSSSSSSSSSSSSSSSSSS
$$$S$$$$S$$S$S$S$SSSSSSSSS$SSSSSS$SSS$SSSS$SS$SSSSSSSSSSSSSSS$S$S$SSSSSSSSSSSSSSSSSSSSSSSSS
$$$$$$$$$$S$S$SSSS$SS$SS$$SSS$S$$SSS$S$SSSS$SS$SSSS$SSSSSSSSSS$S$SSSSSSSSSSSSSSSSSSSSSSSSS
The Wheel of Fortune TV game show comes to your computer screen.
by Jiro Feingold
and Ray Darrah
Requirements:
An Apple ][, //e or //c
2 or 3 players
One disk drive
A few free hours for typing
After eagerly reading my latest issue of
Hardcore COMPUTIST, I flicked on the tube
and watched a game show called ‘The Wheel
of Fortune."’ Near the end of the show I had
a revelation: What if Hardcore COMPUTIST
printed a program that would simulate being on
this show? Needless to say, I immediately sat
down at my Apple keyboard and cranked out
the following program which does just that.
Rules
In case you haven't seen it, The Wheel of
Fortune is a game show where contestants have
to solve a hangman-type puzzle in order to win
money. The money is then used to purchase
prizes. Of course my version of the game has
no prizes and the money therefore can be
thought of as points.
At the start of each turn the player has the
following options:
1) Spin the wheel
2) Guess at the puzzle
3) Buy a vowel (if the player has enough
money)
Spinning the Wheel
When the wheel stops spinning the player’s
indicator will be on a money value, a lose-turn
space, a free-spin space or a bankrupt space.
If the wheel stops on a money space then the
player must guess a consonant he thinks is a
24 Hardcore COMPUTIST No. 23
letter of the puzzle. If he guesses correctly, then
those letters are revealed in the puzzle, the
player receives the amount of money indicated
on the wheel multiplied by the the number of
occurences of the consonant he guessed in the
puzzle and the player gets another turn. If the
player guesses a consonant that is not in the
puzzle, then play continues with the next player.
If the wheel stops in a free-spin space then
that player is awarded a free spin and the wheel
automatically spins again. Players can have
more than one free spin.
If the wheel stops in the lose-turn space then
play continues with the next player, unless the
player who spun the wheel has a ‘free spin’
(indicated by an asterisk above his name). In
which case the player then can use his free spin
to spin the wheel again.
If the wheel stops in a bankrupt space then
that player loses all money earned during this
puzzle and play continues with the next player
(unless of course the player has a free spin).
If the player elects to guess at the puzzle then
the player must type what he thinks the puzzle
is. If the player guesses the puzzle correctly,
then he is awarded all the money earned during
this puzzle and play continues with the next
player and a new puzzle. If the player guesses
incorrectly, play continues with the next player.
‘When guessing the puzzle, spelling and
punctuation are extremely important.
Buying Vowels
If the player wishes, he may unveil specified
vowels in the puzzle. Each occurence of the
vowel will cost the player $150. If the player
guesses a vowel that is not in the puzzle, then
play continues with the next player, unless the
first player has a free spin! The letter ‘*Y”’ is
not recognized by ‘The CORE Wheel of
Money”’ as a vowel.
Winning the Game
At the end of four puzzles the player who has
acquired the most money by completing puzzles
is declared the winner.
Typing It In
First type in the first BASIC program listed
at the end of this article and save it with:
SAVE CORE WHEEL OF MONEY
Next type in the first hexdump and save it
with:
BSAVE OBJ.CWOM,A$300,L$79
To keep you from accidentally seeing the
answers to the puzzles, the words for The
CORE Wheel of Money are provided as an
encoded hexdump. To get the words, type in
the second hexdump and save it with:
BSAVE CWOM.WORDS.BIN,A$2000,L$847
To decode the words and put them in a text
file, a BASIC program is provided. Type in the
second BASIC program at the end of this article
and save it with:
SAVE CONVERT WORDS
To perform the conversion, type:
RUN CONVERT WORDS
To Start up The CORE Wheel of Money,
type:
RUN THE CORE WHEEL OF MONEY
All of the puzzles used in The CORE Wheel
of Money are divided into seven categories:
thing, things, person, people, title, phrase and
place. Note that the title catagory can mean
more than just a title of a book or movie.
‘A modification you might try is to convert
the game to hi-res and have a shape table that
looks somewhat like Vanna White reveal the
letters.
Now if I could only play the game as well
as Merv Griffin.
Source Code for...
Core’s Wheel Of Money
9983-
9069-
9028-
9924-
FCAB-
9300:
9302:
SSCSLSERE SHSSSTSTSETSSSSTSSELELLSLESSLSLESTESLVSEA
CUR. VAR
STRT.VAR |
SCRN.PTR
cH
WAIT
AB 03
: AM FE
ZRSSRSLASLSFASSS ARSE SPRASSS B
8 &
8
RASTESLS
3
Showing the first 100000 of 129743 characters.