computist scan 44

For The Serious User Of Apple ][ Computers COMPUTIST Issue No. 44 June 1987 USA $3.75 Canada/Mexico $7.00 All Others $13.25 (Page 24) BULK RATE U.S. Postage PAID Tacoma, WA Permit No. 269 Coping With COMPUTIST Welcome to COMPUTIST, a publication devoted to the serious user of Apple ][ and Apple |[ compatible computers. Our magazine contains information you are not likely to find in any of the other major journals dedicated to the Apple market. New readers are advised to read this page carefully to avoid frustration when attempting to follow a softkey or when entering the programs printed in this issue. @ What Is A Softkey Anyway? Softkey is a term which we coined to describe a procedure that removes, or ut least circumvents, any copy- protection on a particular disk. Once a softkey procedure has been performed, the resulting disk can usually be copied by the use of Apple's COPYA program (on the DOS 3.3 System Master Disk). @ Commands And Controls: In any article appearing in COMPUTIST, commands which a reader is required to perform are set apart by being in boldface and indented: PRH6 The key must be pressed at the end of every such command unless otherwise specified. Control characters are specially boxed: 6@P) Press [6]. Next, place one finger on and press [PB]. Remember to enter this command line by pressing 4 @ Requirements: COMPUTIST programs and softkeys require one of the Apple J[ series of computers and a disk drive with DOS 3.3. These and other special needs are listed at the beginning of the article under “Requirements”. 1 Software Recommendations: 1) Applesoft Program Editor such as Global Program Line Editor (GPLE). 2) Sector Editor such as DiskEdit (from the Book of Softkeys vol I) or ZAP from Bag of Tricks. 3) Disk Search Utility such as The Inspector, The CIA or The CORE Disk Searcher (from the Book of Softkeys vol III). 4) Assembler such as the S-C Assembler from S: oftware or Merlin/Big Mac. 5) Bit Copy Program such as Copy ][ Plus, Locksmith or The Essential Data Duplicator 6) Text Editor (that produces normal sequential text files) such as Applewriter I. Magic Window II or Screenwriter II COPYA, FID and MUFFIN from the DOS 3.3 System Master Disk are also useful Super IOB: This powerful deprotection utility (COMPUTIST 32) and its various controllers are used in many softkeys. This utility is now available on each Super IOB Collection disk. @ RESET Into The Monitor: Softkeys oceasionally require the user to stop the execution of a copy-protected program and directly enter the Apple’s system monitor. Check the following list to see what hardware you will need to obtain this ability Apple }{ Plus - Apple //e - Apple compatibles: 1) Place an Integer BASIC ROM card in one of the Apple slots. 2) Use a non-maskable interrupt (NMI) card such as Replay or Wildcard. Apple ]{ Plus - Apple compatibles: 1) Install an F8 ROM with a modified RESET vector on the computer's motherboard as detailed in the “‘Modified ROM’s" article (COMPUTIST 6 or Book Of Softkeys III) or the ‘Dual ROM’s’* article (COMPUTIST 19). Apple //e - Apple //c: Install a modified CD ROM on the computer’s motherboard. Cutting Edge Ent. (Box 43234 Ren Cen Station-HC; Detroit, MI 48243) sells a hardware device that will give you this important ability but it will void an Apple //c warranty. @ Recommended Literature: The Apple }[ Reference Manual and DOS 3.3 manual are musts for any serious Apple user. Other helpful books include: Beneath Apple DOS, Don Worth and Pieter Lechner, Quality Software; Assembly Language For The Applesoft Programmer, Roy Meyers and C.W. Finley, Addison Wesley; and What's Where In The Apple, William Lubert, Micro Ink. @ Keying In Applesoft Programs: BASIC programs are printed in COMPUTIST in a format that is designed to minimize errors for readers who key in these programs. If you type: 10HOME:REMCLEAR SCREEN The LIST will look like: 19 HOME : REM CLEAR SCREEN because Applesoft inserts spaces into a program listing before and after every command word or mathematical operator. These spaces usually don’t pose a problem except in line numbers which contain REM or DATA commands. There are two types of spaces: those that have to be keyed and those that don’t. Spaces that must be keyed in appear in COMPUTIST as delta characters (*). All other spaces are there for casicr reading. NOTE: If you want your checksums (See ‘Computing Checksums™ section) to match up, you must only key in (*) spaces after DATA statements. @ Keying In Hexdumps: Machine language programs are printed in COMPUTIST as hoth source code and hexdumps. Hexdumps are the shortest and easiest format to type in. You must first enter the monitor: CALL -151 Key in the hexdump exactly as it appears in the magazine, ignoring the four-digit checksum at the end of each line (a **$** and four digits) A beep means you have typed something that the monitor didn’t understand and must, therefore, retype that line. When finished, return to BASIC with: E£003G BSAVE the program with the correct filename, address and length parameters given in the article. @ Keying In Source Code The source code is printed to help explain a program’s operation. To key it in, you will need the S-C Assembler Without this assembler, you will have to translate pieces of the source code into something your assembler will understand. A table of S-C Assembler directives appears in COMPUTIST 17 @ Computing Checksums Checksums are four-digit hexadecimal numbers which tell if you keyed a program exactly as it appears in COMPUTIST. There are two types of checksums: one created by the CHECKBIN program (for machine language programs) and the other created by the CHECKSOFT program (for BASIC programs). Both appeared in COMPUTIST 1 and The Best of Hardcore Computing. An update to CHECKSOFT appeared in COMPUTIST 18. If the published checksums do not match those created by your computer, then you typed the program incorrectly. The line where the first chee! differs has an error. @ CHECKSOFT Instructions: LOAD filename BRUNCHECKSOFT Get the checksums with: & (RETURN) and correct the program where the checksums differ. @ CHECKBIN Instruct CALL -151 BLOAD program filename Install CHECKBIN at an out of the way place BRUN CHECKBIN,A$6000 Get the checksums by typing the starting address, a period and ending address of the file followed by a EY) (RETURN). XXX.XXxX| Correct the lines at which the checksums differ, ee You have a LEGAL RIGHT to an unlocked backup copy Our editorial policy is that we do NOT condone software piracy, but we do believe that users are entitled to backup commercial disks they have purchased. In addition to the security of a backup disk, the removal ‘of copy-protection gives the user the option of modifying programs to meet his or her needs. Furthermore, the copyright laws guarantee your right to such a DEPROTECTED backup copy “It iy not an infringement forthe owner of a copy of w computer program to make 0 |) that such a-new copy or adaptation is created as an essential step in the utilization of the computer program in conjunction with ‘4 machine and that it is used! in no other manner, or 2) thar such new copy or adaptation is for archival purposes ‘only and that all archival copics are destroyed in the event that continued possession of the computer program should cease to be rightful ‘Any exact copies prepared in accordunce with the provisions ofthis section may be leased. sold, or otherwise transerra, akong with the copy from which such copies were prepared only as part of the lease. sale. or other transfer of all rights in the program, Adaptations. so prepared may be transferred only with the authorization of the copyright owner United Stares Code ttle 17. $117 7, Be assured of receiving the latest issue of COMPUTIST each month without the hassle of making a trek to the local computer store and not finding COMPUTIST so of course you ask the clerk if they have COMPUTIST and they tell you they don’t carry COMPUTIST but maybe you could try the computer store down the block because they might have an issue of COMPUTIST so you go to the computer store down the block and ask them if they have COMPUTIST but of course they don't (they just ran out of COMPUTIST yesterday) so you ride your unicycle clear across town to see if the computer store across town has COMPUTIST but when you go inside and ask for COMPUTIST they don't have COMPUTIST either and suggest that you try the store you originally went to in the first place so you end up going home disgusted that you missed another issue of COMPUTIST, Can't Find COMPUTIST Anywhere? Stop searching and subscribe now! annual subscription rates (12 issues): U.S. subscription sent third class $32 U.S./Canada/Mexico sent First Class $45 U.S./Canada/Mexico First Class plus library disk $100 Other Foreign $75 Other Foreign plus library disk $140 @ Use the form on the right to order or renew your subscription. WYou may upgrade your current subscription to a magazine + disk combination by sending $5.50 ($6.50 foreign) per remaining issue. @ Check your mailing label to see if you need to renew your subscription. @ If you're moving, let us know at least 30 days in advance. Issues missed due to non-reciept of Change of Address may be acquired at the regular back issue rates. Remember, the Post Office does not forward third class mail unless requested. COMPUTIST is not responsible for replacing issues lost while forwarding order is in effect Is it time to renew? Yes I want to subscribe. Enclosed are U.S. Funds (drawn on a U.S. bank) for a 12 issue subscription. C) New Subscriber | Please renew my current subscription {] This is a change of address (include latest address label) 0 U.S. $32 CI U.S./Canada/Mexico First Class $45 (1) U.S./Canada/Mexico First Class plus Library Disk $100 () Other Foreign $75 CJ Other Foreign plus Library Disk $140 Name Dt Address City State Zip Country zs = = ” Exp. Signature cP44 U.S. Funds drawn on U.S. bank, please. Subscription will not commence until funds are received. Send orders to: COMPUTIST PO Box 110846-T Tacoma, WA 98411 Are you moving soon? Take time now to save time later! : GrACUAEL @en 4) i002 40 ¢ per disk? to the Senior PROM Peay version 3.0 4 And that INCLUDES the Tyvek sleeve, too? fi complete set of utilities g instantly available inROMto examine, modify, and backup your Apple software! ominexoce ST $S/DD : = aa if The Senior PROM isa hardware device with Machine 5 Vg ” sets 0: iS Language utilities instantly available from any program: for use * 100% . Enter the Monitor to examine or change memory, a guaranteed. + Display where in memory a program was running. with: egcinforeed: «Disassemble, view or save ANY memory. * Apple ake + Instantly switch between two different 64k programs. * Commodore " - Edit, search, and examine disks without booting DOS. * Atari * Tyvek + Initialize and copy disks without booting DOS first. * Epson sleeves & All utilities in ROM & instantly available at any time! © TRS-80 Write-protect Sophisticated sector editor & memory/disk detective. tabs included. Also, a program may be interrupted to examine or alter ee ee Big ee eats Salley Publishing each ser and made checks / money orders payable 10 Soll Includes many Machine Langauage utilities such as Step PO Box 1108467 | Publishing. and Trace, an Assembler, and more. Undetectable by ‘ici ie any software or hardware, doesn't use a peripheral slot. Address Economically priced at $79.95 for prepaid orders with ri Din Gity check or money order. Credit card orders available for shea ot" UPS Country $88.95. Specify //e, or //e Standard or Enhanced, For [Sisal orders call 347-743-4044, 10-5 E.S.T. OF 313-349-2954 Modem 24 hrs. Not intended for illegal ure. Nutting \dge \nterprises 43234¢ Ren Cen Station, Detroit, MI 48243 Stopes" tat Signature. op It's Ready and waiting We've been working hard to compile The Book of Softkeys S17. 95 Volume III. HURRY! Order yours now! The Book of Softkeys Please send copies of The Book of Softkeys - Volume Ill. Enclosed is $17.95 plus $2 ($5 Foreign) for shipping and Volume III Handling per book, US funds drawn on US banks. Washington State residents add 7.8% sales tax. Send check/money order to: Featured in The Book of Softkeys Volume III are: SoftKey Publishing ft ee PO Box 110937-T Alien Addition * Alien Munchies * Alligator Mix * Computer Preparation SAT Tacoma, WA 98411 * Cul And Paste * Demolition Division * DLM (Developement Learning j Materials) software * EA (Electronic Arts) software * Einstein Compiler version 5.3 * Escape From Rungistan « Financial Cookbook « Flip Out « Name _ IDF Hi-Res Computer Golf Ii © Knoware « Laf Pak # Last Gladiator Learning Address _ a 4 = With Leeper * Lion's Share * Master Type v1.7 * MatheMagic * Minus City __ State Zip Mission ¢ Millionaire « Music Construction Set * One On One ® PFS software * PS (Penguin) Software * The Quest * Rocky's Boots * Sabotage * Country —— reave Seadragon * Sensible Spelier IV « Snooper Troops Il » SoftPorn Adventure z= Exp * Stickybear series © Suicide * TellStar * Tic Tac Show * Time Is Money Signatur See | 44 * Transylvania * Type Attack * Ultima Ill Exodus * Zoom Graphics * Breaking Locksmith 5,0 Fast Copy * Csaver * The Core Disk Searcher * Modified ROMs * The Armonitor - is: ssa W s gir vl ll hy i This month's cover Graphics from Penguin's “The Coveted Mirror Address all advertising inquiries to COMPUTIST, Advertising 0 Box 110816, Tacoma, WA 96411. Mail ot requests for Writer's Guides to COMPUTIST, PO K. Tacoma, WA 98411 Manuscripts are assumed to be submit won al our standard rates ol payrnent, SoliKey publishing and exclusive rights. For more information on Submitting manuscripts, cunsult Gur writer's guide Entire contents copyright 1986 by SoltKey Publishing, All rights reserved. Copying done for other than personal or intemal willioul express written permission trom the publisher) ed The editorial staff assumes no lability or responsibility for the products advertised in tho magazine. Any opinions expressed by the authors are not necessarily those of COMPUTIST Magazine or SoftKey Publishing COMPUTIST will replace tost is publication date. We cannot be hi beyond 60 days Apple usually refers to an Apple Il computer and is.a trademark at Apple Gomputers, inc SUBSCRIPTIONS: Rates (for 12 issues) U.S. $42, US. Ist Glass, Canada & Mexico $45, Foreign $75. Direct inquities (o: COMPUTIST, Subscription Department, PO Box 110846, Tacoma, WA 98411 DOMESTIC DEALER RATES: Call (206) information Change Of Address: Pie address to take eff fot 60 days following the esponsible for mail loss 5750 for more lo non-raceipl regular back issue rate Issue 44 COM PUTIST Publisher/Editor: Charles 8. Haight Managing Es Technical Editor: Robert Kn Advertising: 206) COMPUTIST is published monthly hy Sof Pho hwo Media, Birmi Publishing. $233 §. Washington, Tacoma WA 980 softkeys: 7F Arcade Boot Camp by Jim S. Hart 22 Goonies § Zorro by Clay Harrell 24 Coveted Mirror by Mare Batchelor 25 Crimson Crown by Tony Phalen 26 Compubridge by The Nipper 2S Fleet System 3 by Clay Harrell beatures: 73 Making DOSless Utilities You can use the techniques presented here to load your favorite programs into memory from disk without destroying DOS. by Adam Levin 20 Pixit Printer Drivers The secrets behind how Pixit talks to printers is revealed in this article. Now. you can finally use this program with your strange printer card. by Kevin Surtorelli cone: 76 An Owners Review of the Z-RAM Memory Expansion If you are shopping for a memory expansion board, here is some stuff you should know about Applied Engineering’s memory expansion. by Jerry D. Greer 7S 4 Routine Investigation of: The Joystick If you have been wondering just how the Apple joystick works, this article is for you. Also presented is a better ML routine for reading the joystick. by R. Wideman departmeuto: 4 Input 70 Readers’ Softkey & Copy Exchange Cavalier Computer's Microwave by Sreve Ellis, Sublogic’s Eseape by Charles Taylor Catalyst 3.0 by Kevin Sartorelli, DLM’s Number Farm and Alphabet Circus by The Nipper. Avant Garde’s Joe TI an’s Pro Football by Tony Phalen, Sierra On-Line’s Black Cauldron by The Nipper, International Granprix by Steve Ellis Please address letters to: COMPUTIST Editorial Department PO Box 110846-K Tacoma, WA 98411 Include your name, address and phone number, Correspondence appearing in the INPUT section may be edited for clarity and space requirements. In addition, because of the great number of letters that we receive and the small size of our staff, a response to each letter is not guaranteed. Our technical staff is available for phone calls between 1:30 pm and 4:30 pm (PST) on Tuesdays and Thursdays only. Opinions expressed are not necessarily those of COMPUTIST or SoftKey Publishing. Certificate Maker on a Franklin Tam a recent subscriber to your excellent magazine, I find it to be the best source of Apple information around. Thave used the softkey for Infocom programs described in COMPUTIST No. 24 and found it to work on several of my disks. However, T recently purchased ** TRINITY” and when I tried to back it up 1 was unable to, Do any of your readers have a method which will work with this new program? Thave used Springboard’s “CERTIFICATE MAKER” on my Laser 128 and found it to be a very useful program. When a friend purchased this program and tried to use it on his Franklin 1000 he was unable to use it since it is in ProDOS. When I tried to patch it as 1 have done with other programs on the Franklin the disk would subsequently not boot, A call to Springboard’s help desk resulted in the information that "CERTIFICATE MAKER™ would not work on a Franklin and that there was no way to make it do so. However, with some experimentation 1 believe I have found a way. First, create a ProDOS disk with any volume name. Then copy the ProDOS system file to it. Using a program such as Copy ][ Plus Ver. 6.6, copy all the “CERTIFICATE MAKER” files to this disk. Then change the volume name to that which is on the ““CERTIFICATE MAKER™ disk. In this case it was “CMIA.” The ProDOS file must be patched to allow it to run on the Franklin. Since this is ProDOS 1.1.1 use a sector editor to search for and change SAE $B3 SFB SEO $38 to SA2 SEA SEA $E0 $38 and $69 SOB $DO $03 to $69 SOB SEA SEA. When this disk is booted the logo and main title of the program come up. When the option to make a certificate is selected, and the program asks for the number of the certificate to be used, insert the original disk after typing the number. The program then runs normally. This use of a pre-boot disk may not be the best way to make this program run on the Franklin, but due to my limited time to experiment, it seemed the easiest way. Perhaps another reader with more time and experience can describe a better solution. Richard A. LaLonde Port Huron, MI APT’s for Karateka I found 2 APT's for Karateka. These patches only work on a broken copy such as the one Presented in an earlier issue of COMPUTIST. Infinite Hits is just as it squnds. No matter what hits you... your flags (health) doesn’t diminish. One Shot Kill is also as it implies. All you have to do is punch or kick the foe once. and he is dead! This also works with the evil Akuma and his pet bird. Only one restriction applies to One Shot Kill. Hitting the bird before you enter his chamber (before the man-eating gate) just sends him away as it did before. To kill the bird, you must kick down his door, and then punch or kick him. Infinite Hits: 1) Scan your disk or file for the bytes: C6 B6 DA 04 AY 00 85 SD 60 2) Change all but the 60 to EA's: EA EA EA EA EA EA EA EA 60 One Shot Kill: 1) Scan your disk or file for the bytes: (I found 3 occurences) C6 B7 2) Change these two bytes to EA’s: EA EA Mare Batchelor Lompoc, CA 4 COMPUTIST No. 44 Stellar Seven APT Here is how to get unlimited Fuel and Shields in Stellar Seven. Get out a sector editor and change track $04, Sector $04: (all values given in hexadecimal) TRACK SECTOR BYTE FROM TO $04 $04 $7B 80 EA $04 $04 $7 FC EA $04 $04 $7D 81 EA $04 $04 $91 EF EA $04 $04 $92 80 EA $04 $04 $93 FB EA $04 $04 $94 8h EA $04 $04 $95 AQ EA $04 $04 $96 00 EA $04 $04 $97 £5 EA $04 $04 $98 13) EA $04 $04 $99 80 EA $04 $04 $9A FC EA $04 $04 $98 81 EA $04 $04 $9E 00 92 $04 $04 SBE 80 EA $04 $04 $BF FE EA $04 $04 $00 81 EA $04 $04 $0C 8D EA $04 $04 $00 FE EA $04 $04 $0E 81 EA $04 $04 ‘SDF 60 EA $04 $04 SE1 00 92 Alan Takagi Phoenix, AZ Time Zone Fix I'm writing to tell you of a problem with the Time Zone softkey in COMPUTIST No. 31. Making the sector edits described in the softkey resulted in a copyable Time Zone where I couldn't pick any items up. If you can't pick the oxygen mask up in the time machine, then exchange the following sector edits for those in the earlier softkey. TRACK SECTOR BYTE FROM TO $03 SOF 300 SCE 360 $03 SOF $01 $03 SEO Next. [ would like to make a plug for the best word processor on the market for an Apple //e or //c. Over two years ago I wrote a program to download custom character fonts to my Apple DMP printer. I thought it was great and used this capability almost daily. My program has become obsolete, however, now that I can print almost any number of custom fonts, each with a multitude of different styles and sizes, with MultiScribe, by StyleWare. I couldn't be happier. Bryce L. Fowler Palo Alto, CA Another Pirate Letter Although T agree with the other pirates that people will seldom buy high-priced originals, T believe that that’s not the real reason why we do what we do. Speaking for myself and friends, we consider pirating a sport. For Instance, even though I've got a ton of wordprocessing disks, I go that extra mile to crack or trade for that extra utility I’ll probably never use There is great competition among pirates. The pirate with the most games and the biggest number of allies is the one the other pirates come to first. It’s a social event when pirates get together and discuss what they just traded und brag about what they just cracked. Of course, the leader of the group is in charge of What goes on. 1 have several apprentices who I plan on teaching the trade. In return, they go out and look for games I want. They make the trade after it's been cleared through me. It works out well and everyone enjoys himself. As long as there is fun in the “Hack** the pirate population will flurish, It can't be stopped, Most pirating is done on modems in the privacy of one’s own home. Remember this - beware of Dragon Law. They have been known to turn in pirates. They receive money for each pirate they hook And thanks COMPUTIST for making my sport casier! LOOK FOR ME! The COPY CAT Newark, NY Hint Decoder Program If any of my fellow COMPUTIST readers have sent away for the hint book for The . you've noticed that there are a ton of hints in it. The bad news is that each one is encoded. The task of decoding them could take hours (if not years) to get them all. The Hobbit is the same way except there are only a few hints that are encoded. The task is still time consuming. If you're like me, lazy, and don't want to spend the time decoding all of those hints, just type in the following program and it will take care of everything for you. 10G$="" : HOME ; INPUT "TITLE:*” ;7$ :6= LEN (TS) :A=(80-G) /2+1: PRL HTABA : PRINT TS . PRINT . PR# O 20 iF TS = "THES HOBBIT" THEN B= 76 :C = 90 :D £65 :E=75 Fe=-1l tJ=15 30 IF T$ = "THE* CRIMSON* CROWN” THEN B = 65 :C= 78 :D=79 E=90 .Fe12.J=-14 40 GET AS 50 FORG =B TOC: IFAS =CHRS (G) THEN PRINT CHRS (G+F), :L=L+1 .65=G$+CHRS (6 +F) 60 NEXT G 70 FOR H =D TOE - IF AS = CHRS (H) THEN PRINT CHRS (H+J); sL=L+1.G5=G5+CHRS (H +J) 80 NEXT H 90 FOR Q = 32 T0 64 : IF AS = CHRS (Q) THEN PRINT CHRS (Q): -L=L4+1 :GS=GS + CHRS (Q) 100 NEXT Q 110 1F A$ = CHRS (13 ) THEN PRINT . PR# 1 PRINT GS . PR#O :G$="" 120 IF AS =CHRS (27 ) THENGS ="" : INVERSE : PRINT “CANCELLED” ; NORMAL ; PRINT 130 GOTO 40 Operating the Program The first thing you should do is to turn on your printer, then run the program. When the program asks you for the title of the game type in The Crimson Crown or The Hobbit, this will set it up according to the encoded hints. If you make a mistake. don’t panic just press escape and that line will not be sent to the printer. Sorry there is no delete function included in the program. ‘A few more things. For those of you who can't figure out the riddles in The Crimson Crown, here are the answers in order; FEAR, CLOUDS. and DREAMS. I've been able to get all of the treasures in The Crimson Crown except the scroll and the stone tablet (you need the scroll in order to get the stone tablet). If anybody can help me with this please write to: Keith Parker 117 Chestnut Circle Richmond, IN 47374 p-s. Thanks so much for publishing the ultimate Apple magazine. It has really helped me learn more about the Apple computer. Speeding Up Microtype Concerning your softkey for Microtype in COMPUTIST No. 29, I have put normal or fast DOS onto Microtype. By following these steps. You to may put fast or normal DOS on your disk. 1) Initialize a disk by the filename of HELLO using your DOS. 2) Copy tracks $3-$22 or decimal 3-35 from your unprotected Microtype. 3) Now here comes a step that might take a little while. Take all the dates off of the end of the filenames. You can speed this process by using a sector editor to do this on track $11 or decimal 17. Everything will now run fine. You may even put Microtype on a hard disk Concerning deprotection of Mastertype: 1) Use a swap controller to copy tracks $1-$22 or decimal 1-35. 2) Then copy on track $@ from the 3.3 system master. By doing this you change the read/write routine to normal while keeping their strange command table. You also climinate the almost murder to copy track @ of Mastertype Have fun with your unprotected programs. Matthew Bancrott The Christmas Elf (age 11) S. Dartmouth, MA Fixing Modified CTRL Y Recently I have observed a condition that although I can correct it, I can't explain the cause. Sound familiar I have been using a modified F8-ROM (COMPUTIST No, 19), All functions seem to work fine and I enjoy it A short time ago I had a need to use the APPLE-USR function from the Monitor (1¥) . which as you know causes a jump to location $3F8 where a user routine can be located, No amount of coaxing would cause the (JY) to initiate the routine. A direct call to this address would produce the routine action. Systematically, I back tracked through the Monitor to the CHRTBL ($FFCC) and SUBTBL ($FFE3) to where the keyboard character decode tables are. All seems correct, the Earl Taylor Article did change the call COMPUTIST No. 44 5 address from SFEC9 to $FEC4. This was added to the routines by him with the change in the SUBTBL., | found that a swap of the addresses in the table would cause the routine to function. That is, a swap in the table with another function and both routines would work. Nothing was changed except the location in the table. Actually, in se T swapped locations in the table with [2IB). but I have tried other table locations without any problems. Thave used this on two Apple J Plus systems, one wit Apple Language Card and the other with a Cocx 16K-RAM Card, with the same reaction and results, Oh! Lalmost forgot to tell you what it did before the change - “Nothing”. It merely behaved as though you had just hit ‘Return’. Has anyone else experienced thi: prablem?? Any explanations or suggestion: If this has been discussed before, T missed it. T enjoy your excellent magazine and always look forward to the next issue. Keep up the great work. I learn something with each issue. Ralph H. Benson Richardson, TX Odds and Ends Here are a couple of odds and ends that I’ve collected and thought that other readers may find some interest in. APT for Lode Runner (G@ will give you extra men ("J will quit the current level and send you to the next level If you use either of these hidden options, you will not be able to save your score. APT for Conan Unlimited men: search for the byte sequence CE 4B 03 and change it to EA EA EA, Unlimited hatchets: search for the byte sequence CE 4E 03 and change it to EA EA BA, APT for Lost Tomb Unlimited men: search for the byte sequence CE F4 02 and change it to EA EA EA. Unlimited whips: search for the byte sequence AE Fl @2 F@ 0A CA and change the CA to EA. Both of these changes should be within $50 bytes of each other. Ultima IV with Mockingboards Ultima IV, when played with a Mockingboard installed, is truly a superb game to play. The music has to be heard to be believed. There are, however, “secret’ keys that enable the user to be able to play any of the tunes at will from the title screen after the Mockingboard has been activated. Apparently Origin System either forgot to mention it or the accidently left in a music test mode while debugging the game. Whatever the reason, here are the keys to press to get the different tunes: C - Castle Theme Song D - Dungeon Music Q - Main Surface Music T - Theme Music B — Lord British's tune (1-5) - play different variations of curr- ent theme ® - turn off music T found out about the keys while playing around in the code and thought users might be interested in Knowing about the: Easter Eggs"* (to coin an old phrase from the Atari 2600 games). Computer identification If you write programs for several different flavors of Apples. you undoubtedly need to be able to find out which one you're on. Here is a short routine 10 accomplish the feat: 1 ADDRESS = 64898 20 1D = PEEK( ADDRESS) + PEEK( ADDRESS + 1) 30 IF 1D = 208 THEN PRINT "FRANKLIN ACE 2000" 40 IF 1D = 253 THEN PRINT "LASER 128" 50 1F 1D-= 264 THEN PRINT "APPLE ][+" 60 IF 1D = 296 THEN PRINT "APPLE //E" 70 |F 10 = 420 THEN PRINT "APPLE //E (ENHANCED) " 80 IF 1D = 468 THEN PRINT "APPLE //C” I do not have access to an original Apple JI or to earlier series Franklin computers. I encourage readers to send those ID values in so that others may benefit. Jim S. Hart Jacksonville, NC Quickloader Deprotects You can deprotect a few single-load programs using Southern California Research Group's **Quickloader”’. After your program is running, push “~B’ and “‘RESET™” (very few pointers are disturbed) then SAVE or BSAVE ete. 6 COMPUTIST No, 44 One program this works with is Recall’ (Sams Software) “Instant BSAVE INSTANT RECALL, A$803,L4500 Put a Regular DOS on Tracks 0-2 and: 10 PRINT CHRS(4)"BRUN INSTANT RECALL” Add Pronto DOS or Diversi DOS or like and the program loads faster than original, Works where COMPUTIST softkey for this program did not on my copy. (//e and //¢ version). Thomas J. Scott Mattapan, MA Apple Writer with a Corvus This letter is being typed on a //e with Apple Writer //e word processing software. The disk which booted the computer is a ‘'softkeyed”’ copy of the original master disk which was purchased along with the computer some two or three years ago, I'm grateful to COMPUTIST for providing the instructions which helped me to make this backup. There is a feature in this Apple Writer which apparently is not covered in the published documentation. When the disk starts booting type a “°C”? and near the end of the boot you will get a prompt “ENABLE CORVUS IN SLOT 6? Y/N.”* In order to make this work properly you must first boot the Corvus then do a CTRL-RESET and type PR#4 (4=appropriate slot) to boot the Apple Writer, if you neglect the CTRL-RESET it won't work. Respond with a “Y"* and if you have a Corvus in slot 6 the Apple will reach out and stroke and tickle it and cause you to be able to load and/or save files to the Corvus. One would think that this same technique would work for a Sider. But try as we might, I and others have been unable to do. this successfully. Being grossly ignorant of these things myself, | solicited the aid of a man who is, I think, quite expert at things pertaining to Apples, Siders, and Corvuses (Corvi?). After he made some unsuccessful tries he suggested that I get my Apple dealer to pose the question to Apple on their “*hot-line."* The dealer did this and the reply he got from Apple was that the solution to my problem would be for me to buy a PRODOS version of Apple Writer which would work on the Sider. Seems that this is the super easy way out for Apple - they don’t do anything and I spend $200 for a new piece of software that I don’t really need. James T. Baker Huntsville. TN Create with Garfield and PrintMaster First of all, | would like to thank you for a speedy delivery of my sample edition of COMPUTIST. I found it very interesting and thought that I might be able to contribute something to your softkeys After looking through the ‘Most Wanted" list, | found that there are two programs that I've cracked and am now going to pass onto you. Create with Garfield: Boot up COPYA and change - 8934:18 60 B990:18 60 Use a sector editor and for each of these, change the bytes to 18, FQ. 82, 49: Track $1D, Sector $02 Track SIF, Sector S00: Track SIF, Sector $06: Track $22, Sector $04 i.e, One change would be; Track $1F, Sector $00-18: A2 00 60, This changes the read during moves on menus (from AADE to DEAA) PrintMaster; T don't know how to physically change the disk for this. but all you have to do is to copy the disk with COPYA or Copy || Plus sector copy. Then use Copy ][ Plus bit copier and use the Sync on tracks I, 2, & 3. This should now work. Word of warning: only use Copy ][ Plus to syne the tracks, I tried with other bit copiers and they didn’t work. One last note before I go. A friend lent me one of his COMPUTISTs. and it had parameters for Law of the West. Hardball. and various other ones. All that was mentioned was that I crack these using Locksmith 5.0. Is there any reason for using the parameters if Locksmith copies it normally? Robert Brown Sydney, Australia APT for Raid Over Moscow Locksmith Praise I enjoy your magazine very much but it’s very hard to find someone that sells it up here. Thave an APT for Raid Over Moscow from Access Software. Press the ‘*”"" key during the title page and you will start playing at the last screen inside the Reactor Room without going through the other 7 or 8 screens. The two games I just can’t back-up are Fight- Night from Accolade and Impossible Mission from Epyx. Thanks for a super magazine. Wakit So British Columbia, Canada APT's for Oldies but Goodies After many hours of programming and playing games I have found many simple and user-modifiable APT's for some of the older Apple || games. Most of these require that you have a broken copy of the game Snake Byte: BLOAD SNAKE BYTE No. of Snakes Gold Rush: BLOAD GOLD RUSH CALL-151 BE3:No. of Men Threshold: Unlimited Ships: 45B0:EA EA EA 7ECD:EA EA EA Prevent the laser from overheating: 7666:4C 7D 76 Unlimited Fuel: 7323: EA EA 7839:EA EA EA Night Crawler: BLOAD NIGHT CRAWLER CAL 340A:No. of Ships 3300G T would like to thank Nibbles *N’ Bytes and Lancer of Brand-X for the needed help they have given me in disassembling the code that made these APT’s possible. Keep up the good work! Roman Drozd Perry Hall, MD There is a new piece of software I feel your readers should know about. For anyone who thinks the Locksmith series is obsolete, and hasn't seen the Locksmith 6.0, I suggest you buy it. Ithas many useful utilities, far more than the 5.0, and a readable, informative manual, The most interesting feature is the Automatic Boot Tracer, which sumates the operation of the 6502. It is possible to “boot"’ a disk under the control of this utility, and trace the boots to find JMP’s to nibble count routines, or find out where a certain routine occurs, stop the ABT, examine code if you wish, and continue The bit-copier is also a lot better than the 5.0 bit copier. Last but not least, the file disk is not protected, Ray Brovke New Brunswick, Canada A New Print Shop The latest version of the Print Shop (Broderbund Software) can’t be deprotected by the softkey published in COMPUTIST No, 17: This article was a great help as it gave me a place to start. Tracing the whole disk failed to find any JuMP (or JSR) to address $BCEO, L booted the original disk and jumped into the monitor using a Wildcard 2. Tracing the HELLO routine (which loads at $800) does indeed find an indirect jump to the infamous: SBCEO - a neat example of self-modifying code. The indirect jump on the disk is to $17E0 which gets changed to SBCEO during execution, The fix is to NOP the three bytes of the indirect jump so the next instruction (an RTS) is executed. The procedure for making a bootable copy can be summarized as follow 1) Make a copy of the original diskette. I used Copy JI Plus with the Print Shop All, 4 option, This copy won't boot 2) Using a sector editor program (I used ZAP from Bag of Tricks 2) find the indirect jump string S6CDBOE. | found it in track $19. sector 8. Continuing with ZAP I changed these three bytes to SEA (NOP) and wrote the sector back, 3) Using INIT (Bag of Tricks 2) I initialized (crased) track $22. This is optional but it does make it easer to “copy the copy.”* Ron Tipton Raymore, MO COMPUTIST No. 44 7 Operation Frog Jane T noticed in COMPUTIST No. 38, you had listed Operation Frog by Scholastic, on the most wanted Lis T have been successful in deprotecting this program Requirements: FID An initialized disk with no hello file Operation Frog 1) Initialize a disk and delete the hello. 2) Boot Operation Frog, After the boot is complete reset into the monitor. I do this with a Wildeard, but pressing CONTROL-RESET a couple of times und then typing CALL-151 will also work 3) Move a part of the protected RWTS to a safe area 4800<B800.BFFEM 4) Remove Operation Frog and replace it with the slave disk created earlier. Boot it by typing 6 OP), 5) Insert your Apple system master and BLOAD FID. 6) Enter the monitor. CALL -151 7) Move the protected DOS back into an area where it can be used B800<4800.4FFFM 8) Return to Applesoft 9) Activate FID CALL 2051 10) Put Operation Frog into drive | and your slave disk into drive 2 11) Choose copy files from the FID menu. Use the wildcard ““="" when asked for file name. Transfer all files from Operation Frog to the slave disk, When this is finished your new copy will be fully functional and COPY Aable. The back of Frog is unprotected and may be copied by any copy program. That is all there is to it. | hope I have been of help. R. A. Clark Jeffersonville, IN On my copy of Jane the disk can be copied with any copier if the following modifications are made: TRACK SECTOR BYTE TO 37 sc 58 00 $7 sc 98 00 $9 $4 80 00 $9 $4 38 00 $9 $F 18 008 $9 sc 46 08 Thank you for a very nice magazine that is most useful to all serious Computists in the world Judy Sui Chu Chanduloy North Point, Hong Kong Bank Street Reply In reply to Mr. Bancroft’s problem with the Bank Street Writer softkey (COMPUTIST No 25), he is quite correct that the softkey, as written, will not permit document toa data disk. Omitting the recommended sector edit to track $04, sector $07, will permit document saves but will no longer allow changes to the utility program. I determined that track $04, sector $07 loads into memory at $B700. The subroutine has two entry points. One at $B709 and one at $B70C. If entered at SB70C, DOS is modified to read the nonstandard prologs and epilogs on the protected BSW disk. If entered at $B709, DOS is returned to normal. The real problem actually resides on track $04, sector $06, which loads into $3600. When BSW attempts to do a document SAVE, the code at $3638 first calls the subroutine through $B70C. That is. DOS is modified to read the protected disk. If a data disk is in the drive, BSW expects its first read attempt to fail, and expects the carry flag to be set. BSW then calls the subroutine through $B7@9 and expects the second attempt to be successful. In the event that the first attempt is successful, BSW believes that the program disk is in the drive, and does not permit the SAVE. The routine must be altered to not set the carry flag on the first read attempt. and to not make the second attempt. The set carry flag instruction is at $B64D cleverly disguised in a BIT $38 instruction. The instruction can be 8 COMPUTIST No. 44 disabled in several ways. I chose to change byte $42 on track $04, sector $06 from a SOA toa $09. This accomplishes both objectives. Also. ‘on track $04. sector $07 instead of changing byte $37 to a $60 as recommended, I changed byte $39 to a $60 instead. This preserves both entry points to the subroutine. BSW will now work properly. Don Birdsall Fulton, NY JigSaw & Mychess II On my copy of JigSaw the disk can be copied with uny copier if the following modifications are made: TRACK SECTOR BYTE 10 $0 $9 AB 00 $0 $0 80 00 On my copy of Mychess II the disk can be copied with any copier if the following modifications are made: TRACK SECTOR BYTE TO $0 $4 EA 00 $0 $5 D5 00 Thank you for a very nice magazine that is most useful to all serious Computists in the world Judy Chanduloy North Point, Hong Kong Keyboard Repair Castle Wolfenstein Philip Goetz’s article on Keyhoard repair was great. I would like to add some comments with regards to it. My J Plus was purchased second hand and the original owner was taken to abusing the keyboard in the area of the RESET key, to the detriment of it and six other local buttons. I found a shop that repaired Apple ]{'s for school system and purchased second hand keys for $1.50 each. These keys can be refurbished casily cnough by carefully disassembling and retensioning the stainless spring contact within. Take a cue-tip. moistened with alcohol, and wipe over the surfaces of both the moving and stationary contacts. Re- assemble and install. A word about soldering equipment. To de- solder, use an iron with sufficient mass but low temperature. 1 use an Ungar 50W #4039 plugged into a Variac set to 90-95VAC. Use damp sponges and wipe the tip of the iron before every soldering or desoldering operation. (Note: Weller temperature controlled irons are excellent, but expensive). For soldering, I use an Ungar 25W iron with a “nib” tip, #6952 or #6962 When de-soldering use a solder sucker. such as ‘*Soldapult IIT" model PT209, to remove the bulk of the solder. Clean up with *Soder- Wick" #3, cutting off the used braid frequently with diagonal cutters. Finally, to break loose any remaining solder at a solder through hole, take a pair of tweezers and wiggle the component lead back and forth. The component should practically fall out by itself when the cuit board is turned upside-down. A different subject. My philosophy is to have programs, games, or otherwise, running out of a Hard disk or RAM-disk. To that end T have deprotected a couple of disk-intensive programs and made them usable with a RAM-disk. does require an old F8 ROM or similar RE: capability. Castle Wolfenstein 1) INITialize a slave disk. 2) Boot the protected game disk and press CTRL-RESET as soon as the title page appears. Once in the monitor, move RWTS to A$1900. Type 1900<B800.BFFFM 3) Now boot the slave disk. When the drive stops, insert your Super [OB v 1.5 and save the RWTS to it, BSAVE RWTS.WOLF,A$1900,LS800 4) Now write a Controller using Nick Galbraith’s. program “*Controller Writer" Specify the start track as $03, the end track as $22. Also the start sector as $00 and end sec as SOC. Specify RWTS.WOLF when asked os the program and 0 for sector edits. Use an original name like ““CASTLE STEIN™, when asked 5) To copy the Wolfenstein game disk insert your Super IOB/Controller/RWTS disk and type LOAD SUPER IOB EXEC CASTLE ST sCON 6) Now copy the game using your pre- INITialized slave disk and by following the sereen directions, When completed, copy the disk to your RAMdisk or Hard Disk. To play the game, run the “HELLO program. Two other programs were deprotected similarly. except the orginals are 16 sector disks. Modify the Controller accordingly, (Galactic Empire and Castles of Darkness) I would like some advice deprotecting an old 13-sector copy of Zork I and a 16-sector copy of AppleWriter Il. | would like to be able to run these programs from Hard Disk as well. COMPUTIST is the best Hacker's magazine I've come across. keep up the good work. Hackers unite! Norman F. Hogarth Lomita, CA The Pirate Parade I would like to respond to the series of letters pro and con on software piracy. especially about pirates. lam a pirate. I go under the code name “The Enigma’’. My friends know I have a lot of software (right now, if | go with the list price of my stuff, it comes to over $50,000). My reasons for piracy are a bit different from some. but in other areas | am in agreement. One: I can’t usually afford to go and buy software. Face it, it is very expensive. If it wasn’t for my pirating or getting duplicates from friends, my computer is nothing more than a very expensive dust collector (and I have a lot of dust where I live). I need not go into the price variances from one region to another (ex. Far East vs. here). That has been covered by many people quite well in the past few letters Two: On some pieces of software, the protection scheme is better than the program itself. It is a very good way to learn some tricks in assembly language. I look at the protection scheme as a Jigsaw/Crossword puzzle. Face it. some games themselves are so bad you are almost embarrassed to let your friends know you bought it, and if you did, you find out you can’t return it to the store because of some wierd return policy (which is in some cases actually valid. More on this later). Tact as an information service for my friends. Lalso do private tutoring in Appleworks (This letter is being typed on a ‘pirated’ version of Appleworks by the way). Face it. A lot of salesmen do not know what the hell they are talking about, or know how a program will fit a customers’ needs. I work in a computer store. by the way, and I hear these complaints left and right on some local Apple dealers! Example: A friend of mine bought Appleworks for their business and was informed that Appleworks cannot do mailing labels (HA!). So they spent another $70 (?) on Habamerge because it(!) can do mailing labels. I could have saved them a lot of grief if they spoke to me first. My advice is free and | usually steer people in the right direction. My friends come to me and ask my advice on a particular program, and if I have a cracked version, I give them my unbiased advice. Based upon their needs, I recommend the program that they can handle. I believe 1 have saved hardware and software companies 3 times the amount that I currently have because 1 help them understand their equipment. Three: I do not believe in stealing programs. My views on copyright laws are this: Pirates cannot make money off of someone elses work. If person A has Appleworks and friend B says he wants a copy, it is up to person A whether he/she will let their friend have a copy. If he/she charges for copying it he deserves to have his butt kicked into jail and have the keys thrown away! Lets say you have the hottest album at your house, your friend finds out and asks if you can make a tape for him, You suy, ‘Sure, no problem, just give me a blank tape,’and I'll run it off.” Technically you just broke copyright laws, but that is not enforced, That is the view I take. Another thing that perturbes me, are the deadbeats who buy a program, take it home. copy it, and then try to return it for a different one in its place. That is why some places have such strict return policies. If you can’t get the program legitimately (copying from a cooperative friend, or buying it flat out), don’t get it at all. To wrap it up, all pirates are not the same Some of your better cracks are probably from pirates who are actually using their real names (WOW! What a concept!). There are a lot of pirates out there who give pirates like me a bad reputation, but some of them are cvolved hackers who break into MCI (phreaking), call long distance BBS systems that support downloads, getting pre-released software and doing all sorts of nasty stuff. Just look in your papers on those guys who ght and read on all the stuff they have. There is stuffin public domain software that can give the capabilites to a novice hacker that makes ““War Games"" look like a rank amateur. This (software piracy) is really just the tip of the iceberg in some cases. I apologize for the length of this letter, but this has been bothering me for a long time. I hope you publish this letter, either in part or as a whole. re. The Enigma COMPUTIST No. 44 9 readers’ softkey & copy exchange Steve Ellis’ softkey for... Microwave Requirements: Apple J[ series with at least 48K sector editor disk copier which can ignore errors blank disk Cavalier's Microwave disk Microwave from Cavalier Computer is one Of those increasingly rare releases - a one byte crack, The disk can be copied using any copy program which will ignore errors. It is encoded normally, with track $11 containing the data for a nibble count, Changing one byte disables this nibble count 1) Copy the entire disk, ignoring any errors on track $11 (or simply do not copy track $11) 2) Search the copied disk for the sequence: $FO 3 4C 32 8A. I found this at track $01, sector $0C. byte S4P. 3) With a sector editor, change the $4C in the sequence to a $2C. You now have a fully working copy. And here isa little cheat for the game, Track $01, sector $03, byte $46 contains a $03. Changing this number to a $00 gives you only one monster to worry about. This byte is found in memory at $8146, bg Charles Taylor's softkey for... Escape SubLogic 713 Edgebrook Drive Champaign, IL 61820 Requirements: A blank disk Super IOB DOS 3.3 System Master Escape is a hi-res strategy game that places you in an electronic prison. You must try to escape the prison by causing the guards to run into each other or into the electric posts in the prison. Sometimes you can just outrun them. Other devices to as you are an eight shot weapon, and the ability to transport within the cell. Transporting is a mixed blessing. to be used only when faced with certain death, 10 because frequently you transport into the guards oF posts Escape is copy-protected by altered data marks (D3 AA DA for the prologue instead of D5 AA AD, and ED AA for the cpilogue instead of DE AA), and by two odd DOS commands. In Escape’s DOS **B” will BLOAD « binary program. and **A** will run an Applesoft program. Procedure 1) Boot the system master and init a blank disk side INIT A 2) Merge the controller included below into Super IOB and copy the Escape program to your freshly INITed disk. This controller will read data prologues of DS AA DA and cpilogues of ED AA, copying tracks $3-$22. 3) You can now CATALOG the copy, but running the copy will pr a syntax error at line 200 of the file “*A you first remove the error code at the beginning of the file. (The first four line numbers.) Line 200, which appears to_read PRINT “BD”, is actually PRINT “{D)BD", and is supposed to BLOAD file **D**. Load and unlock files A and B, edit the following lines listed below, and save the files back to the copy. You now have a deprotected Escape. File "A" line from to 200 PRINT “BD" PRINT CHRS(4) “BLOAD 0° 220 PRINT "BE" PRINT CHRS(4) "BLOAD E” 410 PRINT “AB” PRINT CHRS(4) “RUN B” 450 PRINT "AC" PRINT CHRS(4) “RUN C" 7100 PRINT “BF” PRINT CHRS(4) “BLOAD F” File "BY line from to 760 PRINT "AC" PRINT CHRS(4) "RUN C” controller 1000 REM ESCAPE 1010 TK = 3 -LT = 35 “ST = 15 -LS=15 :CD=WR FAST = 1 1820 RESTORE . GOSUB 210 - GOSUB 170 ; GOSUB 490 : GOSUB 610 1030 GOSUB 230 : GOSUB 490 : GOSUB 610: IF PEEK (TRK ) = LT THEN 1050 1040 TK = PEEK (TRK ) :ST = PEEK (SCT) : GOTO 1020 1058 HOME - PRINT "COPYDONE” 5000 DATA 213 178 218 5018 DATA 222 170 .237 .170 END COMPUTIST No. 44 controller checksums 1000 - $3568 1040 - $B560 1010 - $2445 1050 - SD1B3 1020 SODAS 5000 $8249 1030 = $E83C 5010 —- $3290 Kevin Sartorelli’s softkey for... —— Catalyst 3.0 Requirement: A copier th: ignore read errors ProDOS User's Disk A DOS 3.3 slave disk Catalyst 3.0 original disk A blank disk Catalyst 3.0 is a ProDOS based disk that has a file that is unreadable by normal ProDOS: This file contains the Catalyst loader and some of the system setup parameters. In order to deprotect Catalyst this file is read by boot code g and the information saved as a SYS type 1) Copy the Copy or any alyst disk using Locksmith Fast pier that ignores errors, 2) Boot ProDOS and exit to BASIC 3) Insert your original Catalyst disk in the drive and load the SYSTEM file into memory BLOAD CATSTART.SYSTEM, A$2000,TSYS 4) Enter the Apple monitor and patch the SYSTEM file to enter the monitor after the load is completed. CALL-151 2175:4C 59 FF 5) Start the loader to read the protected tracks into memory 2000G 6) When the loader stops, disable the program’s check for the protected tracks, 40FS:EA EA EA 7) Boot a DOS 3.3 slave disk und save the protected tracks as a binary file. BSAVE BOOTS,AS4000,L.52100 8) Use ProDOS’ CONVERT or Copy II Plus 6.x to move the new file to ProDOS. 9) Boot ProDOS and exit to BASIC readers’ softkey & copy exchange 10) Load the SYSTEM file into memory again. BLOAD CATSTART,SYSTEM,A$2000, TSYS 11) Enter the monitor and add the following 5 hexdump to the .SYSTEM file. CALL -ISI 28EF:A9 18 8D 00 20 A9 90 8D 28F7:01 20 AQ 32 8D 02 20 AD 28FF:00 B9 00 4A 99 00 60 C8 2907:00 F7 CE 02 29 CE 05 29 290F AD @5 29 C9 3F DO EA 4C 2917:00 20 12) Patch the SYSTEM file to jump to our new and to call the code from the protected 2000:4C EF 28 20A9:4C 00 40 13) Load the data captured from the protected k into memory. BLOAD BOOTS,A$2A00 14) Save the resulting new .SYSTEM file to the copied Catalyst disk BSAVE CATSTART.SYSTEM,A$2000,LS2B00,TSYS, 15) Boot your deprotected copy of Catalyst 3.0. source code for patch (placed at end of CATSTART.SYSTEM) OR S28EF restore start of program 28EF: Ad 18 LOA -#S18 28F1: 80 00 20 STA $2000 28F4: Ad 90 LDA #590 28F6: 80 01 20 STA $2001 28F9: AQ 32 LDA #532 28FB: 80 02 20 STA $2002 loop to move protected track data 28FE; Ad 00 Loy #500 2900: B9 00 4A LOOP LDA $4A00.Y 2903: 99 00 60 STA $6000. 2906: €8 NY 2907; DO F7 BNE LOOP modify loop for another page 2909; CE 02 29 DEC LOOP+2 2900: CE 05 29 DEC LOOPs5 290F: AD 05 29 LDA LOOPs5 2912: C9 3F CNP AS3F 2914: DO EA BNE LOOP go start program when done 2916. 4¢ 00 20 IMP $2000 bg The Nipper’s softkey for... Number Farm and Alphabet Circus DLM 1 DLM Park Allen, TX 75002 Requirements: 48K Apple II Alphabet Circus or Number Farm COPYA, Sector Editor A blank disk DLM has begun to distribute a series of early childhood programs written by Neosoft. Since they are intended for use with small children it is very important to be able to back them up. Unfortunately the programs in this series, and their various versions. use a variety protection systems. The Protection Disks in this series using the protection present on these two programs have a standard prologues and epilogues (DS AA 96, DE AA, D5 AA AD, DE AA). This means they can be copied with COPYA. The usual form of protection on such disks is a Nibble Count, and these two are no exception, To explore the nibble count, first make a copy of your original disk using COPYA. Now boot up the copy. It will boot for a bit and then reboot again and again. The problem is a nibble count is done on Track 00. By stopping the boot just before it reboots and checking the program counter you will find the program was executing code on the $90 page. To be exact, the code responsible for the nibble count resides from $9058 to $90B3. A search of the disk for the first five bytes of the count code (BD 89 CO A9 56) shows you that this code is on the disk at Track $06, Sector SOD starting at byte SSC. All that you need to do is place a simple RTS (60) at the start of this routine to negate the nibble count By the way. the catalog on the disk starts on track $03 sector SOF and the nibble count is contained in a binary file called HELLO3. To make your backup catalogable change by on track $11 sector $00 from $11 to $ Step by Step Run COPYA from your DOS 3.3 System Master disk and copy you original disk. Now boot up a sector editor such as DiskEdit (Book of Softkeys Vol I) and make the following changes: Track 06 Sector Byte From To That's it. You now have a COPYAable version to let the children use. Enjoy! Tony Phalen’s softkey for... Joe Theisman’s Pro Football Avant Garde Creations P.O. Box 30160 Eugene, OR 97403 $39.95 Requirements: 48K Apple Il Super IOB Two blank disks (or one notched one) Joe Theisman’s Pro Football disk Joe Theisman’s Pro Football is a football simulation which teaches one the art of football. from both the offensive and defensive perspectives. It covers everything from equipment (such as how to take care of it, how to use it correctly, and why it's used) to the players (such as what each player's main “‘job"” is). It's a very educational program on the “how-to of football, and even comes equipped with its own version of “Pro Football’’. Being a program that uses a lot of disk access, it would only be right to make one or two backup copies of it, and then store the original away for safe keeping. The Protection I first wateched the boot process and listened for any abnormal noises. It appeared to have a modified DOS (since no prompt appeared). Also, the title page came on very quickly. so I figured some files were loaded right away. I then tried to copy it, first using COPY A, but it gave me an “unreadable” error. So out came Disk Muncher, and while watching each track*s status I noticed that track @ read O.K., but track 1 didn’t. Track 2 read O.K.. but track 3 didn’t! Hmmm... interesting. So I let Disk Muncher copy the rest of the disk, and I saw that every other track, starting with track |. gave me a read error. Well. there's the protection! | then booted CIA’s The Linguist and checked all the markers. The address headers had been changed to DS AA AD, from the normal DS AA 96, So, making these changes, I tried to read in the next track,but to no avail. Looking at a nibble dump of that track, I saw that the data field epilogs had been changed to FF FF, from the normal DE AA. I then changed the address headers back. and read in the next track, and it worked! COMPUTIST No. 44 11 readers’ softkey & copy exchange Knowing these changes, I set out to write a controller that would ignore the modified markers and write the correct markers back to the copy disk. Step by Step 1) Install the controller into Super IOB. 2) Run Super IOB. 3) Copy front AND hack 4) Boot and enjoy! The controller also does a sector edit on track Q. sector 3, This may not be needed with some versions, but with mine it only booted 3 out of 5 times without it. Joe Theisman’s Pro Football occupies almost all of the $22 tracks, and there is no nibble count, so there is no need to worry about that! After playing it for some time, you'll wonder if there is a way to make it harder! controller 1000 REM JOE THE |SMAN'S PRO FOOTBALL CONTROLLER 1010 TK = 0 :ST = 0 :LT = 35 :CD=WR 1020 T1 = TK : GOSUB 490 1030 POKE 47405 24 : POKE 47406 96 POKE 47497 24 . POKE 47498 96 1040 POKE 47445 213 : IFTK/2<> INT (TK/2 ) THEN POKE 47445 ,212 1050 GOSUB 430 . GOSUB 100 :ST=ST +1; IF ST < DOS THEN 1050 1060 |F BF THEN 1090 1070 ST = 0 :TK=TK+1 :22= 212 INT (TK 2.) THEN 22 = 213 1080 POKE 4744 22 : |F TK < LT THEN 1040 1090 GOSUB 490 -TK=T1 .ST =@ . GOSUB 230 1095 RESTORE : GOSUB 310 1100 POKE 47405 .208 : POKE 47406 19 : POKE 47497 208 . POKE 47498 , 183 1110 GOSUB 430 ; GOSUB 100 :ST=ST +1: IF ST < DOS THEN 1110 1120 ST =0 :TK=TK+1 THEN 1110 1130 |F TK <LT THEN 1020 1140 HOME : PRINT : PRINT "COPYDONE” : END. 5000 DATA 1* CHANGES ,0 ,3 66 ,24 IFTK/2= IF BF = 0 AND TH < LT controller checksums 1008 - $3568 1090 - SB7CO 1010 = $3266 1995 - $1652 1020 - $C1IA 1100 - $6AB4 1030 - $6F2E 1119. = $5485 1040 - SFEDO 1120. - $65C7 1950 - $F907 1130 — $5688 1060 - $72A3 1140 - $851A 1070 - $21AA 5000 - $5048 1080 - $2460 & The Nipper’s softkey for... Black Cauldron Sierra On-Line Requirements: 48K Apple II The Black Cauldron COPYA Sector Editor The Black Cauldron is. an animated adventure game in the style of King’s Quest, from the people at the Disney studio and Sierra On-Line. It has state of the art graphics and movement, and is a real delight to play with commands in pull-up windows. Before Ulet the children at any new game, I set out to make a backup. The Protection The five sides that contain The Black Cauldron seem to contain no apparent protection and all of the sides can be copied with COPYA. When you try and boot it up, it runs fine until the first screen. After you center the joystick and press the button the **please wait™* appears and the disk drive turns off and the system freezes. During this last disk access there is a check of track, $00 which of course fails on our copy. After stopping the program, at the point it accesses track $0@, I checked the counter I found that the code in the $FFQ0 page was being executed. This is a nasty location because it is difficult to view the bank switched RAM. If you have some way of way of saving this memory, such as the Senior PROM or Wildcard IT, you will find that the code is loaded from Track $11 Sector SOF. This is the nibble count code. There are two ways of defeating this code. The first is to NOP (BA) the jump subroutine to the nibble count (20 00 FF) that is on Track $03 Sector SOB. Instead I choose to put a return subroutine (60) at the start of the nibble count. Unfortunately there is a checksum done on the nibble count code so we have to put the BD we replaced where the next 60 is so the checksum will be correct, Step by Step 1) Run COPYA and copy all five sides of The Black Cauldron. 2) Use your sector editor on the boot side only of the copied disk and perform the following modifications: 12 COMPUTIST No. 44 Track Sector Byte From To il OF 19 BD 60 u OF 48 8660 «BD That's it. You now have an unprotected backup. z Steve Ellis’ softkey for... International Granprix Requirements: Apple JI series with at least 48K blank disk Riverbank’s International Granprix disk International Granprix uses a protection scheme involving quarter tracks and a quick loader. This makes converting the entire disk to normal pretty tough, but since it is a single load game it can be placed into a normal DOS 3.3 binary file. Following are the steps needed to make Granprix into a file: 1) Format a slave disk and Delete the Hello program. INIT HELLO DELETE HELLO 2) Boot the Granprix disk and when the program starts, press CTRL-RESET. This will put you in the monitor. 3) Move the needed code so that it will not be erased by a boot. 1000<6000.A0BOM 6000<800.900M 4) Boot the blank slave disk and move the code back. 6(P) CALL -151 800<6000.6100M 5) Type in this short program to move the code to its final location. 50A3:A2 00 BD 00 10 50A8:9D 00 60 EB DO F7 EE A7 50B0:50 EE AA 50 AD AA 50 09 50B8-Al D0 EA AC 00 60 7FD:4C A350 6) BSAVE the program. BSAVE GRANPRIX,AS7FD,LS48C5 You now have an 74 sector cracked version of International Granprix, & Making DOSless Utilities Adam Levin Requirements: A blank disk DOS 3.3 An assembler (optional) Often in these pages | read about the handy utilities some deprotectionists have at their disposal. The ones which interest me the most are the utilities which exist on an EPROM (Eraseable Programmable Read Only Memory). since they can be used instantly and independently of DOS. There are, however, reasons why some people (myself included) don’t have one. My primary reason is that I refuse to commit myself to a final version of any of the utilities | use: I’m constantly re writing them, adding new ones and dropping unused ones. Whatever the reasons, | must admit that there are times when I'm trying to deprotect commercial software, and [wish L could do a search, or dump my RAM card's contents without disturbing what I'm working on by booting DOS. I have found a method which allows me to do all of these things and more. To explain how my system works, [IL have to discuss a bit about how DOS boots a standard 3.3 diskette. There is a machine language program stored in the ROM of the disk drive's controller card When a disk is to be booted, this program first calibrates the drive's read/write head by moving it as far out (to the edge of the diskette. track $00) us possible. The controller then reads in the 256 bytes on track $00, sector $00 and writes them into memory from $0800 to SO8FF. Since the controller card software cannot move the read/write head other than for the above- mentioned calibration, it is confined to the information on track $00. The byte which gets placed at $0800 (it came from track $00. sector $00, byte $00. and I call it the *number-of sectors’ byte) tells how many sectors the controller should read in. On a normal DOS diskette, the number-of- sectors byte is a $01, so after reading sector $00 to page $08 ($0800 - $O8FF), the controller program is done; it has read in one sector. If the number-of-sectors byte was anything from $02 to $10 ($10 being the maximum numb of sectors on a track), the controller program would still have to read some more sectors, Additional sectors are read into memory starting at $0900 and continuing up to $17FF (SOF pages). It should be noted that successive pages are not read from the diskette sequentially; the sectors are interleaved, to increase the speed of the boot In any case, when all required sectors have been read in, the controller program JMPs to $0801 to begin executing the code which was just read in; usually the second stage of the bootstrapping process. called ‘boot 1° I say ‘usually’ because I propose a change of events here. If we create a machine language program which originates at $0801, and write it onto the diskette starting at track SOW, sector $00 (not forgetting to precede it with an appropriate number-of-sectors byte), this program will load and run at boot- up! No DOS was needed. and only the memory where the program resides, and anything it alters, gets changed. Additionally. the text page ($0400 - $07FF) may or may not get clobbered, depending on how RESET is being handled at that moment. I prefer to send all output from my DOSless utilities to my 80 column card (Videx-style. having its own text memory). since this minimizes the chance that the text page will get changed. I also try to keep my routines under $FF bytes in length. Going over that by even a few bytes requires that another sector be reud in, overwriting an entire page in memory just for those bytes. The maximum length of the entire routine must be under 4,096 bytes, since this is the maximum number of bytes which will fit on a single track I've written a shell program (Listing 1) which you should type in with your assembler and save. Then, whenever you come up with a program which you could use as a DOSless utility, plop it into the shell and assemble it If you are keying in the hex code directly, you'll have to precede it with a number-of-sectors byte (included in the hexdump accompanying this article). You can calculate it using LP - FP + 1, where LP is the high byte of the last page of the program, and FP is the high byte of the first page of the program. So, for example, if your program extends from $0801 to SOA36 SOA - SO8 + $01 = $03. which would be the number-of-sectors value. If keying in by hand, or if your assembler doesn't do it for you, save the program with some memorable name. Next, run the Applesoft program, “BOOTMAKER™ (Listing 3) which will put your routine onto a diskette. Normally, tracks $01 and $02 of an initialized diskette are taken up by DOS. Since the DOSless boot program cun't use them. BOOTMAKER"™ will add them to the VTOC. giving you 8.192 extra bytes of storage space I've included a sample DOSIess utility to get you started, “COPYDOWN" (Listing 2). When run, it copies all ofa 16K RAM card into main memory, ready to be examined. To use a DOSless utility, simply boot the diskette. This can be accomplished in a number of ways, depending upon what software is running. Some protected programs re-boot if you press RESET. Unfortunately, many of them clear memory before doing so; maybe you'll get lucky. If not, you'll need a way to drop into the monitor, where you can use C600G to boot COMPUTIST No. 44 13 BootMaker 10 REM BOOTMAKER 20 REM BY ADAM LEVIN 30 REM COPYRIGHT 1987 COMPUT IST 49 REM TURNS A MACHINE LANGUAGE PROGRAM | NTO A SELF-RUNVING DISKETTE 50 REM 60 DS = CHRS (4) 70 ONERR GOTO 360 ; ERR = 0 80 REM CLEAR PROGRAM BUFFER (HGR ) AND LOAD PROGRAM 90 HGR : TEXT : HOME » PRINT "* * * * BOOT* WAKER® FOR® DOSLESS* UTILITIES" 100 PRINT : PRINT "ENTER® F| LENANE* OF DOSLESS* PROGRAM" ; INPUT ":" ;F$: IF FS ="" ORFS ="?" ORFS = "CATALOG" THEN PRINT DS "CATALOG" — GOTO 100 110 PRINT DS "BLOAD* " F$",A8192" ; REM BLOAD To $200 120 REN INSURE THAT PROGRAM |S UNDER (4 ,096 BYTES ) IN LENGTH 130 NOS = PEEK (8192 ) 140 PRINT » [NOS > 16 THEN PRINT "NUMBER-OF-SECTORS* MUST* BE* LESS* THAN® 17!" ;ERR= 1; GOTO 360 150 REM READ IN BOOTMAKER"S SUBROUTINES AND DATA 160 FOR LOC = 768 TO 819 : READ BYTE : POKE LOC BYTE : NEXT 170 REM INTERLEAVE PAGES OF PROGRAM BEFORE WRITING THEM TO DISKETTE. THEN . WHEN LOADED FROM DISKETTE AT BOOT , PROGRAM WILL BE CONTIGUOUS 180 FOR LOC = 0 TO NOS - 1 ; REM USE MONI TOR’S -MOVE- ROUTINE TO SHIFT EACH PAGE. COPY PAGES FROM $2000-S2FFF TO $3000-S3FFF 190 POKE 60 .0 : POKE 61 .LOC + 32 : REM ‘FROM’ ADDRESS 200 POKE 62 .265 ; POKE 63 ,LOC + 32 . REM END’ ADDRESS 210 POKE 66 .0 : POKE 67 . PEEK (LOC + 804 ) + 48. REM 'TO' ADDRESS 220. CALL 799 : NEXT : REM MUST USE MACHINE LANGUAGE TO CALL -MOVE 230 REM GET VOLUME NUMBER FOR DISKETTE. THIS 1S IMPORTANT SINCE F|LES CAN ST|LL BE SAVE ON TRACKS 1 T0 36 240 PRINT : PRINT “ENTER” VOLUME* NUMBER® OR* <RETURN>* FOR* #254" INPUT “:" :V$ IF V§ = "" THEN V§ = "254" 250 V=VAL (VS) : IF V > 254 THEN 240 260 POKE 42347 96 ; REM DISABLE SAVING OF A -HELLO- PROGRAM YOU'RE NOT 00D ENOUGH * DOSLESS UTILITIES - PROGRAM SHELL * BY ADAM LEVIN ALLOWS EASY CREATION OF SELF-BOOTING PROGRAMS WITHOUT DOS OR $0800 MUST ORIGINATE HERE! TF FILENAME 0800: 61 DA /LAST-*+S0100 NUMBER OF SECTORS BYTE 9801: BD 88 CO START LDA $C088,X TURN OFF DISK DRIVE 0804- LAST EQ * LABEL TO MARK END 276 POKE 44723 4 — REM ADD TRACKS 1 & 2 TO OBA AQ AD AD Al AD AD AD AD $3675 vToc OBA8 AQ AD AD AD AL AD AD AD $56E0 280 POKE 46922 ,76 : POKE 46923 0: POKE 0880. AD AD AO AD AQ AL 8D AQ S7FAF 469243 : REM PATCH -INIT- TO JMP TO 0888: AO AV D6 AQ AO AO AD AQ $0469 BOOTMAKER’S ROUTINE 9800: AO AD AO D6 AO AD AD AQ $525E 290 PRINT - PRINT "|NSERT* A* BLANK* O8C8: AD AB AG AD DG 8D A4 B1 © $BB26. DISKETTE, * PRESS* A* KEY." . WAIT 0800. BO AD AS B1 C6 AD AQ Ad SFE7C 16384 , 128» POKE - 16368 .0 0808: B2 BO AD AM B2 C6 AD AD $6270 300 REM INIT DISKETTE , WRITING PAGES AT O8E0. A4 83 BO AD A4 B4 C6 8D $CB2F $3000 - $2F FF TO TRACK INSTEAD OF DOS O8E8: 00 seF48 310 PRINT - PRINT OS "INIT" FS ",V" :V 320 REM RESTORE PATCHES TO THEIR ORIGINAL VALUES checksums 330 POKE 42347 ,76 : POKE 44723 , 12 : POKE 46922 ,173 » POKE 46923 .231 : POKE 46924 183 10 = $BADD = 210. - sacaz TIF "ALL® DONE.” 20 - $9813 «220 - S00E8 340 sa NOT ERR THEN PRINT “ALL* DONE 0 ~ §4p38 230 $6286 350 PRINT "PROGRAM* ABORTED." : END 49. — SADS2 240 - SCCDF 360 ERR = 1 - GOTO 330 50 - $c899 «250 - $1200 370 REM DATA FOR MACHINE LANGUAGE ROUTINES 6H = SEBEL. 260 — $6421 380 DATA 169 16 ,141 224,183 141 ,225 , 183 eal Soft (oi sl i eae aka 169 ,64 ,141 ,231 ,183 ,169 .0 141 ,236 BOERS SBIED SS = 2502 = ‘$4815 183 169 15 141, 237 183 169 ,63 99°» = $0919 290 - $0F06 141,241 183,76 | 147.183 |160 .0 ,76 Rp SALTB BO oe $609 44 354 10 - SALlL «—-310.—- $D8BE 390 REM DATA FOR SECTOR DE-|NTERLEAVE TABLE APR SLELE SatSeh) «SSDRS, 400 DATAG.7.14,6 135.12 4,119 10 190, — $7183 330, > $8CBC saplaca 48 140 - SAFLL «340 - ‘S7BIF 150 - SC7BF 350 - S90F9 160 - $7585 360 - SQIAE CopyDown Hexdump 176 - $D313 370 - SEGAC 180 - SCLOE 380 - $28A8 0800: 01 BD 88 CO AD 88 CO AD S1A58 190 - $6428 390 - SEQUF 9808; D0 85 03 A 10 85 01 A SOBRE 200 — S44E3 400 - $F294 O810; EO 85 04 20 3E 08 AD 80 «$3708 0818; CO AD DO 85 83 AO 20 85 $6216 0820: 01 AS OB 85 G4 20 3E 0B $0389 0828: AD 82 CO 20 58 FC A2 00 $3040 0830: BD 56 08 10 66 28 ED FD $F82C 0838; £8 DO FS 4C 69 FF AO OD © SFOFF 0840: 84 62 84 00 B1 0291 00 SFB8B 0848: C8 DO F9 £6 01 £6 03 AS $0594 0850: 03 C5 04 DO EF 60 AD AO = S04BA 0858. C4 CF D3 CC C5 03 D3 AD $204F 0860: Bl B6 CB AB C3 CF D0 D9 s5E22 9868; C4 CF D7 CE 8D AD C2 Cl = SABDB 0870: CE CB AD Bl AD AG AD C2 S99CE 0878: C1 CE CB AG B2 AD AG AD «= S43EF 0880: Ad CD Ci C9 CE 8D A4.C4 = $4038 0888: BO AD A4 C4 C6 AD AD AS = SCOFB 0890: C4 BO AD A4 C4 C6 AD AD = SCOE4 0898; A4-C5 BO AD Ad C6.C6 8D © S5BED 14 COMPUTIST No. 44 %* DOSLESS COPYDOWN * * ~ BY ADAM LEVIN * * COPYRIGHT 1987 COMPUTIST * s COPIES THE CONTENTS OF A 16K RAM CARD TO MAIN MEMORY. OR $0800 — MUST ORIGINATE HERE! * THE NEXT LINE SAVES THE OBJECT CODE AS 'COPYDOWN’ * TF COPYDONN: 0300: OL DA /LAST-* +$0100 NO. OF SECTORS 0801: BD 88 CO LDA $CO88.X TURNS OFF DISK DRIVE 5 ae be eae es — 7 a INSERT YOUR PROGRAM AFTER THIS LINE * 000- RAMSLT EQ 0 16K RAM CARD SLOT Q000- MAIN EQ $00,$01 MOTHERBOARD RAM POINTER 0002- CARD EQ $02.$03 RAM-CARD RAM POINTER 0004- END EQ $04 HIGH BYTE OF LAST PAGE +1 CO88- BIRAM £Q $10%RAMSLT+$C088 BANK 1/RAM READ/WRITE PROT C080- B2RAN EQ $10%*RAMSLT+$C080 BANK 2/RAM READ/WRITE PROT CO82- B2ROM EQ. $10%RAWSLT+SCO82 BANK 2/ROM READ/WRITE PROT oa = * COPY BANK | $D800-SDFFI * BANK1 10. DFFF 0804. AD 86 CO LOA BIRAM SET RAM CARD TO READ BANK 1 0807: AQ DO LDA #SD0 STARTING ADDRESS (HIGH BYTE) IS $00 0809; 85 03 STA CARD+1 SAVE IT IN PTR TO RAM CARD O80B: AQ 10 LDA #810 STARTING ADORESS (HIGH) OF MAIN IS $10 0800: 85 OL STA MAINtL — SAVE IT INPTRTOMAIN MEMORY O80F Ad EO LDA #SE0 ENDING ADDR OF BANK 1 (+1) 0811; 85 04 STA END SAVE IT IN ‘END’ LOCATION 0813: 20 3E 08 JSR CPYDWN CALL THE CPYOWN ROUTINE WW ----- nnn nnn nnn nnn nnn nn nnn bs bad COPY BANK 2 SD000-SDFFF TO $2000 * BANK2. 10. FFFF 0816: AD 80 CO LDA B2RAM SET CARD TO READ BANK 2 0819: A9 DO LOA #$00 SAME FORMAT AS ABOVE Q81B: 85 03 STA CARD+1 0810; Ad 20 LDA #820 O81F; 85 Ot STA MAINEL 0821: A9 00 LOA #$00 0823: 85 04 ‘STA END ENDING ADDRESS PLUS 1 0825; 20 3E 08 JSR CPYDWN 0828: AD 82 CO LDA B2ROM SET RAM CARD T0 READ ROM 0828. 20 58 FC JSR $FC58 HOME CURSOR & CLR SCREEN Q82E: A2 00 LDX #300 PRINT DIAGRAM SHOW|NG THE 0830. BD 56 08 1 LDA MSG, X MEMORY MOVES 0833: 10 06 BPL .2 0835; 20 ED FD JSR SFDED 0838° EB INX 0839. 00 F5 BNE 1 O83B: 4C 69 FF 2 IMP $FF69 JUMP TO THE MONITOR O83E: Ad 00 CPYDWN LOY #00 COP {ES MEM FROM CARD TO MAIN 0840. 84 02 STY CARD SET LOW BYTE OF RAM CARD POINTER TO 0 0842; 84 00 STY MAIN DITTO FOR MAIN MEM PTR 0844. Bl 02 0 LDA (CARD),Y TAKE A BYTE FROM RAM CARD. 0846: 91 00 STA (MAIN). ¥ AND STORE IT INMAIN MEMORY 0848. C8 NY POINT TO NEXT BYTE 0849; DO F9 BNE 0 LOOP |F STILL JN'SAME PAGE. 0848. E6 01 INC MAIN+L INC HIGH BYTES |F NOT 0840; £6 03 INC CARD+1 O84F: AS 03 LDA CARD+1 COMPARE CURRENT PAGE WITH ENDING PAGE 0851. C5 04 0853: DO EF 0855: 66 9856: AG AG C4 9859: CF D3 CC O85C: C5 03 03 O85F: AO Bl BE 0862. CB AG C3 0865: CF DO D9 0868: C4 CF D7 0868: CE MSG 086C: 8D 0860: AO C2 CL 0870: CE CB AG 0873: Bi AO AO 0876: AO C2 CL 0879: CE CB AQ 0870: B2 AQ AD 087F: AD AQ CD 0882: C1 C9 CE 0885: 8D 0886: A4 C4 BO 9889: AD Ad C4 088C: C6 AD AD O88F; Ad C4 BO 0892; AD A4 C4 9895. C6 Ad AG 9898: A4 C5 BO 0898: AD A4 C6 O89E: Cé O89F: 8D O8A0. AD AD AD O8A3: Al AO AD OBAG: AD AD AD OBA9: AO AD AD OBAC. Al AO AO O8AF: AO AB A 0882: AQ AD AQ 0885: Al 0886: 8D 0887. AD Ad Ad 08BA. D6 AD AD @8BD: AO AD Ad O8CO: AG AG AO @8C3: 06 AD AO 9806. AO AD AO 08C9. AG AD AD O8cc: 06 8c: 8D OBCE: A4 Bl BO O8D1: AD AS BL 0804. C6 AD AD 0807: A4 B2 80 GDA: AD A4 B2 @8DD: C6 AO AD Q8E0: A4 B3 BO O8E3. AD A4 B4 O8E7; 8D anaes CMP END BNE 0 RIS AS -/ HS 8D LOOP IF NOT THERE YET. RETURN |F DONE DOSLESS 16K COPYDOWN/ AS -/ BANK 1 BANK 2 MAIN/ HS 8D AS -/$D0-SDF $D0-SDF $E0-SFF/ HS 8D AS -/ HS 8D AS -/ HS 80 AS -/S10-SIF $20-$2F $30-S4F/ vHS 80 HS 00 Q8E9- LAST £Q * COMPUTIST No. 44 15 an owner's review of... Applied Engineering's by Jerry D. Greer Applied Engineering P.O, Box 798 Carrollton, TX 75066 (214) 241-6060 prices; 256K $329; 512K $389; 768K $449; 1 meg $599 What is a Z-RAM? Applied Engineering's Z-RAM board is a combination memory expansion and Z-80 microprocessor add-on for the Apple //c computer. It is available with 256K, 512K, 768K, or 1M of additional memory and fits inside the //e case. The //¢ computer is still the //c; the board does not change that. It does give you more opportunities to use it! The card is apparently 100% compatible with all software on the market that will run in the 65C02 microprocessor. All peripherals such as the mouse, external disks, modem, and printers are compatible with the card. The gang at AE has put most of their effort into making the Z-RAM areal aid to users of Apple's best selling and easy to use Appleworks. The Z-RAM is also a very high speed solid state disk drive. It gives you the ability to load programs completely into memory. The result is a fantastic increase in speed. This RAM disk is compatible with ProDOS, DOS 3.3, Pascal, and CP/M. The ability to run CP/M operating system software is one of the super features of the 7- RAM. With the onboard Z-80 microprocessor, you can run CP/M programs like Wordstar, dBase II, Turbo Pascal, Microsoft Basic, and more than 3000 other commercially available programs. There is a whole world of CP/M users groups out there and they have many public domain programs that are yours for the cost of a disk, Two kinds of Z-RAM boards for the //e When Applied Engineering first released the board for the //c, it was limited to 512K of memory. With the 128K onboard the motherboard. that gave you 640K of memory, That board is now loosely referred to as the Z. RAM I by the Applied Engineering group. ‘Today, you can buy the Z-RAM II board that has a maximum of 1 meg (again in addition to the 128 already onboard). The Z-RAM II can be purchased with as little as 256K of memory and it can be upgraded in 256K increments to the 1 meg maximum, The Z-RAM II comes with a completely revised manual that should eliminate many of my criticisms of their very poor *‘first edition. The only difference between the Z-RAM 1 and the Z-RAM II is in the total memory on the board. In other ways, they are based on nearly identical technologies. Keep in mind that Applied Engineering has discontinued their production of the Z-RAM I. They have assured me that they will continue to support purchasers who own it. T would guess that you will start to see some very attractive discounts on the Z-RAM I as supplies are sold out. You may sce many used ones available as owners choose to move up to the new | meg board. The Z-RAM 1 is a fine board and will be worth any discounted price. Applied Engineering says that they do not have any upgrade policy for owners of the now discontinued I's. However, they did state to me that registered owners will be given a 20 percent discount if they purchase the new Z-RAM IL. Check it out; if you can do this, the 1 meg board will cost you $480. plus shipping. If you buy aused one, make sure that you get the software and the manual that go with it. Why choose the Z-RAM? Who knows? Maybe it was Steve Wozniak’s smiling face in all the advertisements that helped me settle on the Applied Enfineering board. Really, would the Woz put anything in his Apple that was not good for it? What really counts though is the way the product works 16 COMPUTIST No. 44 when you get it all plugged in, That smiling face won't save you from a disaster if the product does not live up to its claims. Whatever my reasons, an Applied Engineering 512K Z-RAM. ended up in my Apple //c and since then, 1 haven't been able to do without it. The expanded memory and CP/M really sold me on the Z-RAM. While I looked around for the right board, the price continued to drop a little each month and finally, I made my move. Will it drop more? Very likely, yes. But you must determine when it is right for you and then make your move. What’s in the box? When you buy a Z-RAM board, you get the printed circuit board with chips, the Z-RAM User Manual and the software, One of the disks is the CP/M software and the second is the Super Appleworks Desktop Expander. Hidden “‘inside’’ the Expander disk are the RAMdrive programs for DOS 3.3 and ProDOS. The Z- RAM II has a five year warranty. How much memory do you actually get? Easy to answer! Just add the basic //c’s 128K of memory to that memory on the board. That gives you the total. However, there is a difference between the total memory and the usable memory. That difference is caused by differences in the Expander, ProDrive or RAMdrive software that is supplied by the manufacturer. Software revisions have required small amounts of additional memory. The available memory may go down but the ease of use of the software will probably go up. For example, with Appleworks. some early advertisements stated that you would have 425K of usable memory with the 512K board. Later, this dropped to 413K. Now it is at 394K. The benefit offsetting this reduction of memory is that the programmers have improved. the software for Appleworks. You can now load Appleworks entirely into memory and work about two or three times as fast. | Z-RAM Memory Expansion Installation I gota kick out of the advertisements that told me that I could install the board in ten minutes using only a screwdriver, and that it took “slightly longer without’’. This is probably true after you have done it 10 times! My advice is to allow about an hour if you are very cautious about opening the case. The popping and cracking of plastic made me wonder what I had got myself into, but encouraged by the manual, T went on. Once the case was off and the disk drive was laying safely aside, things went better. Part of the procedure is to pull out the 65C02 and the MMU from the //c motherboard and replace them into two new sockets in the Z-RAM board. Prying out those chips gave me another excuse to pause, I wandered around my Hackin’ Shack a few more minutes before I found the courage to proceed. Again. though, it proved to be easy and finally, the chips took up their new places on the Z-RAM board. The next step requires the most care. The pins on the Z-RAM board are lined up with the now empty CPU and MMU sockets on the //e motherboard. The Z-RAM assembly is gently pushed down, Because pin alignment is critical, it pays to take it easy here. None of my pins were bent in the process and the new board easily took its place in the case. The Apple //c i mbled with a supporting truss assembly under the keyboard. Clearance is very close and the truss had to come out before I could fit the Z-RAM board and the keyboard back into the case. The truss is held in place with two tiny expansion pins and easily comes off. If you use your keyboard with a gentle touch, this should never cause a problem. The Z-RAM board comes with a jumper wire that must be attached to a chip on the motherboard, right under the built-in drive. The attaching hook is a spring loaded device that fits a little too tight between the drive and the motherboard. so I used a razor blade to trim the tabs on this hook. That made it fit much better. Trimming should eliminate all possibility of a broken trace on the motherboard. Otherwise, careless placement of the hook device between the drive and the motherboard could cause serious problems. Problems and Distractions Applied Engineering has a very fine product and it is too bad that their first manual left so much to be desired. Their first edition looked cheap and was very incomplete. While it was irritating, it was not a serious problem for users. It should not discourage anyone from accepting a Z-RAM I board. Applied Engineering has issued a completely revised manual for their new Z-RAM II, which will go far in improving their image! The CP/M that comes in the package is actually CP/AM, a version modified by Applied Engineering for their use. Anyone who has used CP/M very much will see that there are differences between it and the original CP/M. There is, or was, an obscure bug in one file transfer routine that I discovered. The AE representative with whom I spoke was genuinely interested in the problem and took notes for their programming staff. My experience with their service staff makes me believe that the problem will be corrected in the next update. And speaking of updates! I don’t like to have to purchase software updates! The cost of a disk and mailing (maybe $2) doesn't get to me but paying $12 for a corrected copy of something that T have purchased just doesn’t seem fair. You also need to keep in mind that Applied Engineering has no formal method of informing, individual customers about updates in their software. Dealers are advised and you can get current information from your dealer. Direct purchasers can call the company periodically to see what the status is. What good is it? The Z-RAM board is basically designed to improve your ability to use Appleworks. With 512K on the Z-RAM board, I have a desktop that will hold 394K of files. Because Appleworks is now completely loaded into memory, it will run much faster than one ed from the disk drive. With the Z-RAM, you can work faster with only the built-in //c disk drive than others can using two disk drives, With this much memory on the des is easy to make files that exceed the capacity of a single floppy disk (about 143K.) The software that comes with the board will segment large files for Appleworks and. will automatically save them off to multiple disks Your maximum file size is limited only by the size of your desktop memory, When using Appleworks, the software will create a print spooler in/RAM. That is a real time saver and allows you to continue work while your files slowly run out on your printer Versions 5.2 or later of the Expander software permits you to purge the spooler if you want to abort a print run. Earlier versions of the Expander software would not let you abort printing a document without bringing down your entire system and starting it all over again. My move into CP/M has been gradual. ‘The potential is exciting and I am starting to see more that can be done in that area. The CP/M system is fast and being different from our regular Apple systems, is fun and challenging to use, The software provided is enough to get you interested. In my opinion, Ramdrive (for DOS 3.3) and Prodrive (for ProDOS) are the “hidden jewels** in the deal. This software permits you to set up very fast electronic “‘drives’’ in RAM and use them for increased speed and ease of operation with practically any program. I'm glad I did it My experience with the 512K Z-RAM has been excellent, The bourd has worked perfectly and the software has delivered what it is supposed to. The response to me by Applied Engineering has been extremely prompt and courteous. The board layout and construction appear to be very well engineered. If you choose the Applied Engineering Z-RAM board for your //c, you won't go wrong. They have got me hooked. What is next you ask? Why, a 1 meg board of course! z COMPUTIST No. 44 17 a routine investigation of... The Joystick by R. Wideman The joystick is a popular input device used in many programs. Whether it be a game or an application program, the joystick gives a user flexibility in control of images and icons, or selection of items from a menu. The joystick frees the user from the oftentimes cumbersome aspects of the keyboard-keys to remember, typing errors to overcome, and a dependence on the keyboard's rather permanent location As programmers, you may wish to consider adding to your programs the option of using a joystick for input. There are a number of ways to access the benefits of ick, and a few will be discussed here that are implemented with assembly language, The first place most beginning programmers use their joystick resources is with BASIC. This is accomplished through the use of the PDL(x) command, where x stands for either paddle 0 or paddle 1, This 1s quite an easy command to include in a BASIC program and there is not much to be said of it. The routine that actually accomplishes this task for BASIC is in Apple ROM at $FBIE. A look at this routine will reveal some basics of joystick programming FBIE,AD 70 CO LDA $C070 FB21:A0 00 LOY #800 FB23;EA NOP Delay FB24: EA NOP Delay FB25,8D 64 CO LDA $C064,X Read pd! O or 1 trigger joystick Reset counter FB28:10 04 BPL SFB2E if +, all done FB2A:C8 INY Update counter FB2B;D0 FB BNE $FB25 Keep reading FB2D:88 DEY Over 255, fix FB2E: 60 RTS Return to caller This routine is implemented by loading the X register with 00 for paddle zero or 01 for paddle one, and then executing a JSR $FBIE. The value of the paddle will be returned in the Y register. The routine works by first setting the joystick trigger to prepare the joystick hardware, and then clearing the Y register counter for a new reading. After a small delay. which allows the hardware to catch up, the selected paddle is read until the values go positive (<128). The number of times a negative value is read (>=128) is counted in the Y register. This number can range from @ to 255 Once a positive value is read or the Y register counts beyond 255, the routine terminates and returns to the calling program. For some programs. this routine will be sufficient for intended purposes. By using it, you could save 17 bytes of memory. But there are drawbacks to using this routine. You can only read one paddle at a time. To read both paddies would require re-loading the X register and calling the routine again, And neither of the paddle buttons are read. To do that requires polling $C061 and $C062 for negative values, for buttons zero and one respectively. And there is yet a more subtle problem with the routine, Its execution time By R * Joystick Routine * Joystick Reader Source Code Wideman * OR $300 TF OBJ. JOYSTICK READER 95- PADD .EQ $05 Paddle zero Q6- PADI EQ $06 Paddle one 07- BUTO EQ $07 Button zero 98- BUT! EQ $08 Button one 9300: A 00 PREAD LDA #$00 Clear out previous values 0302: 85 05 STA PADD 9304: 85 06 STA PADL 0306: 85 07 STA BUTO 0308: 85 08 STA BUT1 Q30A; A2 7F LOX #$7F Highest maximum value = 127 930C: AD 70 CO LDA $C070 Reset trigger Q30F: AD 64 CO LOOP LDA $C064 Read paddle zero 9312: 29 80 AND #886 High-bit set? 0314: OA ASL Put high-bit into carry 9315: 2A ROL Make 00 or O1 0316: 65 05 ADC PADO Update paddle value 9318: 85 05 STA PADO Store new value O31A: AD 65 CO LDA $0065 Read paddle one 0310: 29 80 AND #$80 High-bit set? O31F; OA ASL High-bit into carry 0320: 24 ROL Make 00 or O1 9321; 65 06 ADC PADL Update value 9323; 85 06 STA PADL Store new value 9325: CA DEX Have we timed out yet? 9326: DO E7 BNE LOOP No, keep reading 9328: AD 61 CO LDA $C#61 Timed out, read button zero 0328: 10 02 BPL NXBT Positive value=not pushed 032D: £6 07 INC BUTO \t was pushed, set flag 032F: AD 62 CO NXBT LOA $C062 Button one pushed? 9332: 10 62 BPL PONE Positive value=not pushed 0334: £6 08 INC BUTL It was pushed, set fiag 0336: 60 PONE RTS All done, return to caller 18 COMPUTIST No. 44 varies with the value of the paddle read. The larger the value read, the longer the time needed. for the routine to execute. It is actually sometimes possible to tell if a program, such as a game, is using the ROM paddle routine because joystick controlled images will move faster or slower depending upon the joystick values. This can be a very undesirable side effect in crucial situations! To eliminate these drawbacks, a joystick routine should meet the following criteria: 1) Execute in a constant amount of time, independent of the readings 2) Read both paddle zero and paddle one at the same time. 3) Read both buttons, although this could be optional ‘The joystick routine presented along side (as source code) and at the end (as a hexdump) of this article will satisfy these requirements. The routine is shown as starting at $300 but is completely relocatable and therefore will work anywhere in memory that you care to put it. After calling this routine, the joystick values will be in the zero page locations indicated at the beginning of the listing. Zero page addresses were used because they speed up the execution. Tt should also be noted that any time a branch (BNE, BPL, etc.) hus to cross a page boundary in memory, execution time will be increased A routine, such as this one for the joystick, should be placed entirely within a single memory page to avoid such delays. For each call, the routine will take exactly the same amount of time to execute, unless a button is pressed. This consistency is provided by the main loop which is controlled by the X register. X is loaded with 127 and decremented to 0 cach time to ensure the constant execution time. However, since both paddles are being read, their maximum value is approximately cut in half. This maximum value is reflected in the value that X is loaded with. Any higher value for X would be superfluous since no more worthwhile values would be read from the paddles. This could be a drawback if your program requires more specific readings. Most programs, though, use the joystick values to indicate a change in direction rather than specific positions. Again, a counter is used to indicate the final paddle values. It counts the number of negative values read and will range from @ to approximately 127 Joystick Reader Hexdump 0300: AQ OO 85 05 85 06 85 87 SBaCD 0308: 85 8 A2 7F AD 70 CO AD $3304 0310: 64 CO 29 80 BA 2A 65 05 $8339. 0318: 85 05 AD 65 CO 29 80 0A SSADD 0320: 2A 65 06 85 06 CA DO E7 $34AE 328: AD 61 CO 10 02 E6 07 AD $403 0330: 62 CO 16 02 E6 08 60 $7ACE ee softkey for... Arcade Boot am by Jim S. Hart Penguin Software $30 4th Ave. P.O. Box 31] Geneva, IL 60134 (312) 232-1984 $19.95 Requirements: Arcade Boot Camp original disk Super 10B A blank disk A fast DOS (optional) Browsing around in one of the local computer stores recently, I came upon a program by the name of **Arcade Boot Camp”’. Noting that the publisher was Penguin software (which meant high quality programs at an affordable price) I decided to buy it and try it out. It turns out that it is really not a single game but several mini-arcade style games that are meant to increase your arcading abilities. Among the different scenarios are car driving, target shooting, maze navigating, and chopper flying. Everything about this disk is to my liking except that old bugaboo - copy protection. My EDD III could copy it, but that also copied the protection. It was time for a round of deprotecting this disk. Upon booting. the good ol’ familiar Applesoft prompt came up and then the game loaded in. If you see the prompt when booting it usually means that a somewhat normal DOS is in operation and you may be able to use a regular DOS on the deprotected disk. The Swap Controller has a good chance of working too (with the hope that there weren’t any nasty nibble counts hiding on the disk). Sometimes, however, there is more work to be done such as taking out a nibble count. Or maybe you have to use their DOS because the programs on disk use non standard routines built into it. This is just food for thought. For those who are more interested in the protection scheme, the disk has data headers of DE AA AB and address and data epilogues of DA AA. On top of this, the address headers alternate between DS AA 96 on even tracks (0, 2, 4...) and D4 AA 96 on odd tracks. This is a typical trick on Penguin programs. Itturns out that Arcade Boot Camp is easily deprotected using the controller below or the Swap controller. Follow the steps below to get your original into normal format: 1) Initialize the blank disk and delete the hello program. If you have a fast DOS, use it ta initialize the blank. INIT HELLO DELETE HELLO 2) Install the controller below into Super 1OB, The controller will skip the DOS tracks, leaving the normal DOS on your INITialized disk alone. 3) RUN Super IOB and copy the original to the blank. When the copying process is done, the copy will he deprotected and you'll be able to put away your original in a safe place. controller 1000 REM ARCADE BOOT CAMP 1010 TK =3 :LT=4 :ST=15 :LS=15 :CD=WR FAST =1 1020 GOSUB 490 :T1 = TK :LT=TK+1 GOSUB 170 : GOSUB 2000 1025 GOSUB 610 : |FsPEEK (BUF ) <MB AND LT < > 35 THEN LT =LT+1:TK=1K+1; GOSUB 2000 : GOTO 1025 1036 GOSUB 230 :TK =T1 LT = 35 » GOSUB 490 GOSUB 610 ; IF PEEK (TRK ) =LT THEN 1050 1040 TK = PEEK (TRK ) :ST = PEEK (SCT ) : GOTO 1020 1050 HOME . PRINT "COPYDONE" ; END 2000 POKE 47445 212+ (TK / 2= INT (TK/2)) RETURN 5000 DATA 218 ,170 218 170 RESTORE controller checksums 1008 - $3568 1040 - SE594 1010 ~ $E357 1050 - $85E3 1020 - $6306 2000 - $3863 1925 - S51FF 5000 - $AE83 1038 - $2C8C & COMPUTIST No. 44 19 20 by Kevin Sartorelli Requirements; Pixit disk One blank disk Below is a method of deprotecting Pixit, followed by a method of modifying the interface drivers to work with any ‘funny’ interface card you may have Deprotecting Pixit ‘The Pixit disk is protected by having its shape tables and other data on protected tracks 1 to $B. Once this data is in memory it i imple matter to save it out to a normal disk as binary files. Initialize a blank disk with the following greeting program: 10 ONERR GOTO 40 20 TEXT ; HOME ; POKE 230 .64 ; HCOLOR= 0 HPLOT 1 1: CALL 62450 : HGR2 : PRINT CHRS (4 ) "MAXFILES1” > PRINT CHRS (4) "BLOADTITLE,PIC” 30 PRINT CHRS (4 ) "BLOADTABLE* 8A00" ; PRINT CHR$ (4 ) “BLOADTABLE* 3C00" . PRINT CHR$ (4 ) “RUNSTART”™ 40 TEXT : HOME : POKE 216 ,0 : NEW INIT PIXIT . boot up the original Pixit disk and press when the title picture has appeared. The computer will continue to work for a while and then stop with a beep. The wanted tables are now in memory. Type TEXT so you can see what you are typing. To saye the tables insert your initialized disk (don't boot it!) and type BSAVE TITLE.PIC,A$4000,LSIFF8 BSAVE TABLE 3C06,A$3C00,L$400 BSAVE TABLE 8A00,AS8A00,LSE00 BSAVE DEMO TABLE,A$6000,L$2A00 Now copy all the files from the original disk to your copy. This can be done with FID, Copy I[ Plus or any file copy program. COMPUTIST No. 44 P rinter Lastly we need to modify the demo program to load in the demo table when the demo is run (if we load the demo table each time the disk is booted it takes longer - the file is 44 sectors - and the demo is not run very often), Unlock the demo file and load it into memory with UNLOCK DEMO1 LOAD DEMO1 Type in the following line PRINT CHR$ (4)"*BLOAD DEMO TABLE” Save the modified file and lock it SAVE DEMO1 LOCK DEMOIL Your deprotected copy of Pixit is now ready to use. Modifying the interface driver When Pixit is booting, pressing ‘*P' will bring up a printer configuration menu. However, Pixit has a very limited choice of printers (9 of them) and interfaces (14 possible ca