computist scan 61

For The Serious User Of Personal Computers Issue 61 November 1988 USA $3.75 Canada & Mexico $7.00 All Others $8.75 @ REX FPeatevcoeo- @ Double DOS—sy Edward Teach @ Deprotection tips for DOS and ProDOS—By Gary Verbuch A Search Command for II's—By Bill Jetzer lf Zip Chip finally Ships—py Gary Verbuch & Nemoran Pierre @ The Product Monitor—sy Jeff Hurlburt @ Put Where in Europe is Carmen Sandiego on a 34/2” disk—by Jim S. Hart Bi A self-booting Thexder on a 342” disk—by Jim S. Hart i Capture protected RWTS with RWTS Worm sy Jim S. Hart @ REX Socftkeys: Adventures of Sinbad ¢ ARCHIVEmath ¢ Aztec ¢ Broadsides v2.0 ¢ Calculus Toolkit ¢ Cannonball Blitz ¢ Catalyst 3.0 ¢ Cofa Courseware ¢ Cross Clues ¢ Deathsword ¢ Defender of the Crown ¢ Dondra ¢ Gauntlet G.I. Joe ¢ King’s Quest I @ King's Quest II ¢ King’s Quest III ¢ Magical Myths ¢ Math Shop # Mathblaster ¢ Mathbusters ¢ Mavis Beacon Teaches Typing ¢Megabots ¢ Micro Addition/Subtraction # Microzine #25 ¢ Microzine #26 ¢ One-on-One ¢ PFS Computer Checkup «PFS File ¢PFS Graph @ PFS Report ¢ Pirates! ¢ Pirates! IIgs ¢ Presenter ¢ Rescue on Fractalus ¢ Science Toolkit ¢ Smart Eyes ¢ Softswitch ¢Spiderbot ¢ Tales from the Arabian Nights ¢Thinkware ¢ Tink’s Subtraction Fair ¢ Tower of Myraglen Ultima V ¢ Xevious EQ RDESE = sofiey: mprint shop wrest Drive You have a LEGAL RIGHT to an unlocked backup copy of your commercial software Our editorial policy is that we do NOT condone software piracy, but we do believe that users are entitled to backup commercial disks they have purchased. In addition to the security of a backup disk, the removal of copy-protection gives the user the option of modifying programs to meet his or her needs. Furthermore, the copyright laws guarantee your right to such a DEPROTECTED backup copy: .+.'It is not an infringement for the owner of a copy of a computer program to make or authorize the making of another copy or adaptation of that computer program provided: 1) that such a new copy or adaptation is created as an essential step in the utilization of the computer program in conjunction with a machine and that it is used in no other manner, or 2) that such new copy or adaptation is for archival purposes only and that all archival copies are destroyed in the event that continued possession of the computer program should cease to be rightful. Any exact copies prepared in accordance with the provisions of this section may be leased, sold, or otherwise transferred, along with the copy from which such copies were prepared, only as part of the lease, sale, or other transfer of all rights in the program. Adaptations so prepared may be transferred only with the authorization of the copyright owner.” United States Code title 17, §117 COMPUTIST | Editor: Charles R. Haight Circulation: Karen Fitzpatrick Advertising, call: (206) 474-5750 Publisher: SoftKey Publishing Printing: Valco Graphics & Printing @ Address all advertising inquiries to: COMPUTIST; Advertising Department; PO Box 110816; Tacoma, WA 98411 @ Mail all RDEX letters to: COMPUTIST Apple-RDEX or —_ IBM-RDEX PO Box 110846-K Tacoma, WA 98411 © COMPUTIST does NOT purchase editorial material. The entire editorial content consists of information submitted to COMPUTIST for publication in the shared interests of all COMPUTISTs. @ Unsolicited material (manuscripts, letters to the editor, softkeys, A.P.T.s, playing tips, questions, etc.) are assumed to be submitted as letters-to-the-RDEX-editor for publication with all and exclusive rights belonging to COMPUTIST. © Entire contents copyright 1988 by SoftKey Publishing. All rights reserved. Copying done for other than personal or internal reference (without express written permission from the publisher) is prohibited. @ The volunteer and paid editorial staff assume no liability or responsibility for the products advertised in the magazine. Any opinions expressed by the authors are not necessarily those of COMPUTIST magazine, its staff or SoftKey Publishing. @ Apple® is a trademark of Apple Computers. IBM® is the IBM trademark. SUBSCRIPTIONS: Rates (for | 2 issues): US.—$32 US. Ist Class—$45 Canada/Mex.—$45 Other Foreign—$75 © Send subscription inquiries to: COMPUTIST; Subscription Department; PO Box |10846-T; Tacoma, WA 98411 © For Domestic Dealer rates: Call (206) 474-5750 for more information. © Change Of Address: Please allow 4 weeks for change of address to take effect. On postal form 3576 supply your new address and your most recent address label. © Issues missed due to non-receipt of change of address may be acquired at the regular back issue rate. COMPUTIST #61 Attention Apple-users: Why type those |-0-n-g listings when you can just Upgrade your present sub. to a Mag/5%4”’Disk Combo subscription @ You may upgrade your current subscription to a magazine & disk combination by sending $5.50 ($6.50 foreign) per remaining issue. Time to renew? @ Check your mailing label to see if you need to renew your subscription. O Use the order form on this page to renew, and don’t forget to send your most current mailing label to help expedite your renewal Moving soon? i If you're moving, let us know at least 30 days in advance. @ Issues missed due to non-reciept of Change-of-Address may be acquired at the regular back issue rates. @ Remember, the Post Office does not forward third class mail unless requested. COMPUTIST is not responsible for replacing issues lost while forwarding order is in effect. prccesssssesse--== 1am... 1) A new subscriber O Renewing my current subscription Di Changing my address (please include last mail label) I have..0 an Apple lle, Iigs or Ile computer O an IBM computer Apple—IBM subscription... Ous. - $32 © US./Canada/Mexico First Class - $45 CO All other Foreign - $75 Apple mag-disk combination subscription... © ULS./Canada/Mexico First Class plus Library Disk - $100 (All other Foreign plus Library Disk - $140 U.S. Funds drawn on U.S. bank. Allow 4—8 weeks for first is Salads | Yes, I want to subscribe to COMPUTIST. Enclosed are funds for an annual (12 issue) subscription. Name ID#. Address City State Zip Country. Phone. Signature (206) 474.5750 & il to: COMPUTIST PO Box 110846-T Tacoma, WA 98411 COMPUTIST #61 3 | Jack Nemoran Authur Silicon Charles Edward Dr. Jean-Louis Brian A. Gary JL. John E. Mike Basford C.J. Blanchard Kevin Dobbins Neal Jhala vw it Notes ‘n things........: Hi Send your letters on disk I’ve been getting more and more of your letters, on disk and it’s great. I love it. A lot less editing and a lot less errors. Of course, if you’re one of the people who sent your letter as hardcopy (on paper), you are probably not to thrilled with my response time. (I’m about 2 months behind in my written correspondence.) I’m making a special effort and Ill have most of your letters typed and in the next COMPUTIST. (I hope.) I do want to say again and reemphasize, if your letter is more than half of a page, please send it on disk. I'm very good about returning disks. But I’m a rotten typist (die-hard two finger and a thumb type). I wish we had a real typist but they normally don’t work for free. In fact, I wish we had a few hundred more subscribers so I could also add another 16 pages for all the new stuff that has been coming in on disk. Hi Questions The following are some questions that got a chuckle out of Karen. She’s the person who answers the phone, processes and packs your orders, as well as entering new subscriptions and renewals into the computer. Be nice to her, she works a full day and only gets minimum wage. If she doesn’t Process your order, we would have too. (You wouldn’t want someone who types with two fingers to enter and pack your order, would you?) From a non-subscriber who ordered a back issue from an ad flyer: Q. Along with my order, do I get the ($32 value) free subscription? A. Nice try. The subscription is $32. The FREE software package ($32 value) comes with it. Gotta buy one to get the other. From a subscriber who was renewing: Q. Please send a list of currently available products (Disks & Books). A. We send you a new updated list every month. All our products are listed in the back of each issue, however, we have access to a number of wholesalers, If there is something you're looking for, write and ask, we'll tell you the best price we can find. From a new Foreign subscriber: Q. I would like to ask you, How come the back issues are more expensive then the subscription? A. Because we want you to subscribe... Sorry, just kidding. Regular subscriptions are handled automatically once a month by a mail fowarding service. All of the foreign orders are picked up here and flown to New York where they are sorted and flown to their respective countries. There they are put into the regular mail system. Back issue orders must be handled on an individual basis and sent by regular mail service (Ist Class Air). That means they cost more to send and take more time to process. Ii Starter Kit Woes! If your printer just spews paper when you try to print the DOC files, try this tip; when the program asks for the right margin (80), it really wants to know the right indent (normally @). Tell it zero and things should work fine. Just a syntax problem with the man who wrote the print routine. Mike say’s he’ll have it fixed in a jiffy. Hf Missed Issues? Issues are mailed at the end of each month and can take up to 4 weeks to get to you. (Depends ‘on where you are and what the US snail is doing about then.) Give the issue enough time to get to you. But, if you feel that too much time has gone by without a COMPUTIST appearing in your mail, write to Karen (or call). Don’t wait for 6 months before you say anything. Karen can be very unsympathetic to your tale of woe and will only replace the last issue or two. COMPUTIST #58, page 32. Computing for 1-3 year olds - In listing 1, there is an extra open parenthesis in line 220. It should read: 220. NN = INT (RND (1) * FC + 1) COMPUTIST #61 November | COMPUTIST *61 Table Of Contents November 1988 é Softkeys: Adventures of Sinbad. ARCHIVEmath. Catalyst 3.0... Cofa Courseware. Cross Clues... Deathsword.. Defender of the Crown. PFS File... PFS Graph PFS Repo: Pirates! . Pirates! Il Presenter... Rescue on Fractalus. Science Toolkit. Tink’s Subtraction Fair. Tower of Myraglen... Ultima V. Xevious. GAP.T.: Bard’s Tale Ill. Ultima V..... ¢ Playing Tipo: Ultima V.. Wasteland. IBM Softkeys: Print Shop Test Drive. IBM Playing Tipo: Leisure Suit Larry in the Land of the lounge Lizards. .44 Apple Most Wanted Softkeys........cccsccseseseesd7 IBM Most Wanted Softkeys.........cccseveseee 045 © Features: Double DOS........cccecceeeceeseeeceesereneeee An easier way to copy disks with multiple address and data mark changes. Deprotection tips for DOS and ProDOS............222 Important locations and places to poke. A Search Command for Il's.............s00e0064420 Copy the new search command from the enhanced lle and put it into your older Il Zip Chip finally Ships...........000cseseseeeeeeeQO A reader review of a long awaited product. The Product Monitor...........scssessessseseereQD Jeff Hurlburt takes a look at super-res graphics on the llgs and Chess on the MAC. Put a deprotected... Where in Europe is Carmen Sandiego on a 32” disk... 33 Get rid of that 54" disk and forget about flipping disks. A self-booting Thexder.......sccsesseeseeeeeeeseO Put ProDOS and Thexder on a 312" disk. Capture protected RWTS with... RWTS Worm......cccccccsesseseeessesssaeeese QD Here’s a neat way to extract the RWTS from a protected disk. Some notes on Mindscape .............0s008 seeeeeeeaeaeneees 16 Some notes on Scholastic ... Some notes on Hartley Software ............0eeeee ee veveeee AE ween 6 Some notes on CAI .......... beeen ee eeeeaeaeneaeeneneas 16 Some notes on CTW Series ...........ccecseeeeeceeeeeeaeeees 17 Some notes on Garfield .. [_ November COMPUTIST #61 6 | New COMPUTIST readers using Apple Is are advised to read this page carefully to avoid Srustration when attempting to follow a softkey or entering the programs printed in this issue. What is a softkey, anyway? Softkey is a term which we coined to describe a procedure that removes, or at least circumvents, any copy-protection on a particular disk. Once a softkey procedure has been performed, the resulting backup copy can usually be copied by the normal copy programs (for example: COPYA, on the DOS 3.3 System Master disk). Commands and control keys Commands which a reader is required to perform are set apart by being in boldface and on a separate line. The key must be pressed at the end of every such command unless otherwise specified. Control characters are specially boxed. An example of both is: 6 Ge) Press (6]. Next, place one finger on the key and then press (P]. Don’t forget to press Other special combination keypresses include GaESER) or GREED). Inthe former, press and hold down =) then press (RESET). In the latter, press and hold down both G) and (@) then press (RESET). Software recommendations The Starter Kit contains most of the programs that you need to ‘‘Get started’’. In addition, we recommend that you aquire the following: @ Applesoft program editor such as ‘*Global Program Line Editor (GPLE)’’. @ Assembler such as the ‘‘S-C Assembler” from S-C software or ‘‘Merlin/Big Mac’’. © Bit-copy program such as ‘‘Copy II Plus’’, “‘Locksmith’* or ‘Essential Data Duplicator (EDD)”. © Text-editor (that produces normal sequential text files) such as ‘‘Applewriter II’’, ‘‘Magic Window II” or ‘‘Screenwriter II’’. @ “COPYA”, ‘‘FID” and ‘‘MUFFIN”’ from the DOS 3.3 System Master disk are also useful. Super IOB and Controllers This powerful deprotection utility (in the Reset into the Monitor Softkeys occasionally require the user to stop the execution of a copy-protected program and directly enter the Apple’s system monitor. Check the following list to see what hardware you will need to obtain this ability. Apple II +, //e, compatibles: 1) Place an Integer BASIC ROM card in one of the Apple slots. 2) Use a non-maskable interrupt (NMI) card such as Replay or Wildcard. Apple II +, compatibles: 1) Install an F8 ROM with a modified reset-vector on the computer's motherboard as detailed in the “Modified ROM’s” article (COMPUTIST #6 or Book Of Softkeys Il) or the ‘Dual ROM’s” article (COMPUTIST #19). Apple //e, //c: Install a modified CD ROM on the computer’s motherboard. Cutting Edge Ent. (Box 43234 Ren Cen Station-HC; Detroit, MI 48243) sells a hardware device that will give you this important ability but it will void an ‘Apple //c warranty. Apple //gs: If you have the 2.x ROM, there is a hidden classic desk accessory (CDA) that allows you.to enter the monitor. In order to install the new CDA, you should enter the monitor before running any protected programs (CALL -151) and press ‘‘# ”. This will turn on two hidden CDAs, Memory Peeker and Visit Monitor. Thereafter press to go to the Desk Accessories menu. Select “‘Visit Monitor’’ and there you are. Use to exit. Recommended literature: @ Apple II Reference Manual @ DOS 3.3 manual ©@ Beneath Apple DOS & Beneath Apple ProDOS, by Don Worth and Pieter Lechner, from Quality Software Keying in Applesoft programs: BASIC programs are printed in a format that is designed to minimize errors for readers who key in these programs. If you type: ‘1@HOME:REMCLEAR SCREEN The LIST will look like: 10 HOME : REM CLEAR SCREEN .--because Applesoft inserts spaces into a program listing before and after every command word or mathematical operator. These spaces don’t pose a problem except when they are must be typed appear in COMPUTIST as delta characters (*). All other spaces are there for easier reading. NOTE: If you want your checksums (See Computing checksums) to match up, only type spaces within quotes or after DATA statements if they are shown as delta (*) charactors. Keying In Hexdumps Machine language programs are printed in COMPUTIST as hexdumps, sometimes also as source code. Hexdumps are the shortest and easiest format to type in. You must first enter the monitor: CALL -151 Key in the hexdump exactly as it appears in the magazine, ignoring the four-digit checksum (G and four digits) at the end of each line. When finished, return to BASIC with: BSAVE the program with the filename, address and length parameters given in the article. The source code is printed to help explain a program's operation. To enter it, you need an ‘Assembler’’. Most of the source code is in S-C Assembler format. If you use a different assembler, you will have to translate pieces of the source code into something your assembler will understand. Computing checksums ‘Checksums are 4-digit hexadecimal numbers which tell if you typed a program correctly. There are two types of checksums: one created by the CHECKBIN program (for machine language programs) and the other created by the CHECKSOFT program (for BASIC programs). Both are on the ‘‘Starter Kit’. If your checksums do not match the published checksums then the line where the first checksum differs is incorrect. CHECKSOFT instructions: Install Checksoft (BRUN CHECKSOFT) then LOAD your program. Press [&] to get the checksums. Correct the program line where the checksums differ. CHECKBIN instructions: Enter the monitor (CALL -151), install Checkbin at some out of the way place (BRUN CHECKBIN, A$6000), and then LOAD your program. Get the checksums by typing the Starting address, a Period and the Ending address of the file followed by a (GY). COMPUTIST Starter Kit) and its various inside of quotes or after a DATA command, 5888.EEEE Controllers are used in many softkeys. (It is also There are two types of spaces: those that have Correct the lines at which the checksums on each Super IOB Collection disk.) to be keyed and those that don’t. Spaces that differ. 6.2... 0... 0c... 0ccee RDEXed 6 COMPUTIST #61 November | when writing a letter to the... RDEX editor RDEX stands for: Reader's Data EXchange That means that when you send in articles, softkeys, APTs, etc., you are submitting them for FREE publication in this magazine. RDEX does NOT purchase submissions nor do we verify data submitted by readers. We print what you write. If you discover any errors, please let us know. @ Remember that your letters or parts of them may be used in RDEX even if not addressed to the RDEX editor. Correspondence that gets published may be edited for clarity, grammar and space requirements . © Because of the great number of letters we receive and the ephemeral and unpredictable appearance of our part- time staff, any response to your queries will appear only in RDEX, so it would be more appropriate for you to present technical questions to the readers and ask for their responses which will then be placed in the Apple-RDEX. @ Whenever possible, send your articles and letters on disk as standard text files. When we get your letter-article in a text file, it is immediately uploaded into the most current RDEX file. We will return your disks, whenever possible, with the current library disk copied onto it. Conventional letters must be typed in by us... when we have the time. @ When you send your material on disk, try to use a disk formatted for Apple DOS 3.3. It makes things a lot easier for us. @ Address your letters, articles, to: COMPUTIST RDEX Editor PO Box 110846-K Tacoma, WA 98411 Softkey for... Xevious Mindscape @ Requirements O COPYA C1 Copy II Plus or FID This was too easy. [1] Use COPYA and the following pokes to disable the checksum verify: POKE 47405,24 POKE 47406,96 POKE 47497,24 POKE 47498,96 RUN COPYA ([27] Use Copy II Plus to copy a normal DOS over the first 3 tracks of the copy and change the boot file to HELLO. Optional: [21 Initialize a disk. INIT HELLO DELETE HELLO Insert the disk with FID and BRUN FID Copy all files from the COPYA copy of XEVIOUS to the initialized disk using the wildcard (=) character. Softkey for... Pirates! MicroProse @ Requirements © Apple Iigs with 2.x ROM upgrade or Apple Il w/128K & NMI card Ci Two (ProDOS) formatted double-sided disks CBASIC.SYSTEM from any ProDOS System Master O Copy I Plus (or a ProDOS file copier) I didn’t make a Cookbook at the end, because you may just as well read the whole article. It will take all of 3 minutes. I played the game for about 8 hours and nothing funny happened. It would appear that I got all the protection schemes. Previously, the bulk of MicroProse games were in normal format and the catalog track was moved. Sometimes not even that. You would only get so far, to then find that another protection scheme found you. With Pirates!, you don’t even start on square one. Some format that I am not at all familiar with popped up. Fortunately, I found a small hole in it, and that was all I needed. First, format one of your ProDOS disks with the volume name of /PIRATES.SIDE1. (Don’t type the period after the number 1.) Then copy BASIC.SYSTEM to that disk, and rename it to PIRATES.SYSTEM. Starting to get the point? Now, the fun part. For IIgs users, enter the monitor (CALL-151) and type a # sign at the monitor prompt. This will give you the CDA’s (Classic Desktop Accs.). Put Pirates! in drive 1 and type C6OOG at the prompt to boot the disk. Listen to the drive. After the arm of the disk clicks ONCE, Press (GG ESC Jor the NMI button if you have it. Select ‘Visit Monitor’’ from the Control Panel (IIgs users.) At the monitor prompt, type ADA: EAEAEA to kill the ‘ACCESS ERROR #1” message (didn’t that feel good, and on an original disk too!) and 9E7:4C 69 FF to replace the command to start ProDOS with a monitor bomb. Now, press and to return to the control panel. Select QUIT. Pirates! will go a little more and give you a monitor prompt. You now have their funny DOS in memory to do your bidding! Remove Pirates! and replace it with the ProDOS disk you made earlier with the renamed BASIC.SYSTEM. Type 2000G at the monitor prompt, and in a few seconds, you are in BASIC. You now have a DOS in memory that reads normal and abnormal (Pirates!) DOS. Use the ‘‘-’’ wildcard command to start Copy II Plus (PREFIX /COPYIIPLUS and - UTIL.SYSTEM) or a ProDOS file copier and copy all the files from both sides of Pirates over to a normal ProDOS disk. Make sure that you name the volumes as /PIRATES.SIDE1 and /PIRATES.SIDE2. Now the real fun part. If you boot up what you now have, the game will go a little past the title page and give you a (believe it or not) ‘ACCESS ERROR #1"*. But didn’t we just kill that? If you search the disk, you find one occurrence of this in the PIRATES.SYSTEM file, but that isn’t it. Search for “‘1# RORRE SSECCA”’ (ACCESS ERROR #1 spelled backwards) and lo and behold. This is what we want. We find some most curious looking code at $E51. Let's take a peek: November COMPUTIST #61 E51 EOR $8808,X E54 INX E55 CPX ASFC E57 BCC $0E51 (08) £59 TAX E5A BNE $0E61 E5C JSR $8863 ESF BEQ $8E90 ) E61... prints ACCESS ERROR #1 and lok wp At first, the above code didn’t make much sense. It looked harmless enough. But if you turn on double hi-res and type E61G, there we see the ACCESS ERROR #1. Here’s a little explanation. $E51-E59 verifies the code at $B800 to make sure that no one tampered with it, (it checks $FC bytes.) If it was tampered with, it branches to the bomb. If it was okay, it executes the code at $B863. It then checks the result, and if it was okay, branched to $E9O. No problem. Just patch up the branches a little and it works. Right? Wrong. Take sector editor out and search for D@ 05 20 63 B8 Fd 2F or as much as it as you can. Change the first 95 to 03, and change the FB to 89. You could NOP the JSR $B863, but it isn’t necessary. Boot up the disk and... nothing. It locks up, but why? Right about now, I was ready to give up, but I remembered the code that verified $B800. ‘Was there one to verify this as well? (Of course there is, but read on.) We trace the file PS3 (the ‘one we just edited) up to it’s point of origin and execution, PIRATES.SYSTEM. Here we find some similar code: E9B LDA #0 E9D TAX EQE EOR $0800 ,x EAL INX EA2 BNE $GE9E (6) EA4 EOR $8900, x EAT INK EAB CPX #BE EAA BNE $BEA4 (48) EAC TAX EAD BEQ $@EB9 (+04) EAF .... hang for etemity Here we have some similar code that verifies the verify. They’re a tidy bunch at MICROPROSE. So all we have to do here is make that BEQ a BRA. Use your sector editor to find D® F8 AA FQ GA A9 2C 8D 36 23 or as much as you can search for. Change the first F@ to 89. Write it back and you are done! Lastly, let's take a look at the catalog. Hmmm... We see a bunch of BASIC files. Actually, the bulk of the game that you play is in BASIC. No wonder it’s so slow. Somehow, if you could compile it, I think it would screw up the game something severe. And if you are bored, look at the locations in the LIFE file. They are the memory locations that store your stats. And be sure to look in the PICK file. (+05) A parting note. If you don’t use their ProDOS file, the game re-boots as soon as it starts PIRATES.SYSTEM. Since this is no real problem, don't worry about it. Perhaps there is a reason other than copy-protection. And for Igs users with a UNIdrive, the disk access goes MUCH faster. *Llgs Softkey for... Pirates! Hgs MicroProse @ Requirements O Apple Lgs with ROM 01 O Copy II Plus or a ProDOS file copier O Two Formatted UNIdisks (one with BASIC.SYSTEM on it) ‘The technique to crack this was very similar to Pirates! Ie/IIc. In fact, with the exception of the graphics and sound, the program code is near identical. And still in BASIC. First, format 2 disks, one of them should have the volume name of /PIRATES and should have BASIC.SYSTEM on it. Re-name BASIC.SYSTEM to PIRATES.SYSTEM. Enter the monitor with CALL -151. At the monitor (*) prompt, type # to get the CDA Boot PIRATES! and listen to the drive. After 1 or 2 clicks, press (G@ ESC Jand select ‘*Visit Monitor’. Enter ‘‘\4C OO 20\<800.1FFFP” to scan for the JMP (4C 90 20) to start ProDOS. I found mine at $9CC. Replace it with 4C 69 FF to enter the monitor instead of starting. Press (G¥) and to quit and let the program execute further. In a moment, you will see the monitor prompt. Remove PIRATES! and insert the disk with the re-named BASIC.SYSTEM file on it. Type 2@OOG and you will have their ProDOS and your BASIC. Insert PIRATES! and type CATALOG to verify that this worked. If not, try again. Now, either start COPY II PLUS with the -UTIL.SYSTEM command or start a ProDOS file copier. Be careful not to boot another ProDOS in the process or what you just did will be destroyed. File copy all the files from the PIRATES! master disk onto your own blank disk. This will take quite a while as there are over 100 files to be copied. Lastly, whip out ye old block editor and search for 8D 20 B1 A2 8 and replace the 80 2081 with 69 EAEA. The EA’s aren’t necessary, but I like to be neat. If you don’t have a block editor, copy the file PS2 from the backup of PIRATES! you just made, edit it, and copy it back. Now you can enjoy a vastly improved version of PIRATES! Also, for the novice hacker, here are a few tips that I constantly use. This is the first piece of IIgs software I ever cracked and they were most helpful: 1. A 140K floppy or an 800K UNIdisk is a lot of info to search through. Try to determine where the protection ISN’T before trying to find where it is. This can be accomplished in many ways: A. If there are files, determine in what sequence that they are loaded. Look for text within the startup file to see what files it loads. (PS2_was a file loaded from PIRATES .SYSTEM). B. Plant ‘‘bombs”’ in key locations to see how far the code gets, if it ever gets there at all. Good ones are 4C 90 C6 (re-boot), 4¢ 69 FF (enter monitor) and 29 3A FF (beep). 2. Things to look for: 20 ED FD (print to the screen), AD OO CO (strobe keyboard), BD 8C CO (disk access), xx 30 CO (sound), xx 5@ CO (hi-res or double hi-res graphics), and xx 51 CO (text screen). Thope that these common things to look for are of some help to those new to hacking. C® Does anyone have any hints on how to crack or even copy ALIEN MIND for the Igs from PBI. Shelling out $57 for a game makes one a little uneasy thinking of all the nasty things that could happen to it. Kindly add it to the Wanted List. Also, if anyone can copy TOMAHAWK, or better yet, crack it, please let the rest of the uninformed world know of your marvel. Please add it to the Wanted List too. First of all I would like to say to the following people: Jack R. Nissel (COMPUTIST #56, page 20): Realm of Impossibility DOES work on the IIgs, it’s EA’s protection routine that does not. See COMPUTIST #50, page 20 and also COMPUTIST #49, page 16 for information on how this is done. A salesman friend has asked me to crack several EA programs for him because a customer couldn’t get them to run on a IIgs. However, the cracked versions run just fine. Keep in mind: there is a second disk check at $569 (and $5F8 or $SFE) that should be looked into. Some of the EA programs need the IMP $569 to shut the disk drive off at the end of a disk read, so I edit the calls to $5F8 (or S$SFE). Stephen J. Scalia (COMPUTIST #57, page 27): It’s too bad you feel your subscription wasn’t as informative as you were looking for. I started my subscription with COMPUTIST #6, at which time I only knew BASIC programing skills and didn’t know anything about cracking software. I still remember the excitement I felt when I cracked my first COMPUTIST #61 November | ALL BY MYSELF! It was PACMAN (and DIG DUG at the same time) and I used DEMUFFIN plus. Then I thought what I had done was simply tried one person’s steps for another program, with NO REAL effort on my part. Since then, I have learned so many different steps that I can adapt to most protection schemes to overcome them. Now I can write those nifty articles I used to read and think “‘Boy this guy is really smart, I wish I could do that!’’ That was about 4 years ago, it has taken a lot of work to get where I am today. Although I don’t think you (Stephen J. Scalia) will ever end up reading this, but I think COMPUTIST will give each reader exactly what they put into it. If you really want to learn about disk protection read ALL the articles making sure you try to understand the longer ones as they have lots of information in them. I have learned so much from reading COMPUTIST (and of course other mags), I am glad I’m able to return the favor and send in articles for other readers to learn from. Now on to the softkeys: Fix for EDD 4 For some odd reason there is a ‘‘lone byte” that seems to affect the way EDD 4 runs on a igs. Although I have not used EDD 4 in 2 or 3 years (softkeys do'a much better job!) I was able to find the bad byte. To fix your copy of EDD 4 try this: ‘CALL -151 BLOAD EDD 4 ‘AA6@.AA73 Write down the bytes found at $AA61 & $AA60 together and at $AA73 & $AA72 together in that order. These are the length and starting address for binary files under DOS 3.3 only. Now type: AF4E:EA BSAVE EDD 4,A$uxxx, LSyyyy Where xxxx is the two byte hex number you found at $AA73 & $AA72, and yyyy is the number from $AA61 & $AA6O. That should take care of any problems people are having with EDD 4 and my article from COMPUTIST #49. *IIgs Softkey for... or what ever you called it was 02 Softswitch Roger Wagner @ Requirements © Apple IIgs 512K 03%" disk copier 1D 3%" disk block editor The Softswitch (SS) program put out by Roger Wagner Publishing Inc (RWP) could be a very useful program if you worked with many non-IIgs specific programs. The program allows you capture up to three programs in your IIgs’s extra memory. Although I have not used the program that much, I could see where it might come in handy. However I found a few things about the program I didn’t like, and one thing that is FLAT OUT WRONG! First the program is supposed to be a classic desk accessory (CDA) that can be accessed from the control panel. RWP did not follow the correct format for CDAs, a CDA is type $B8 (not type $B6) and should be found in the DESK.ACCS subdirectory and not in the TOOL.SETUP subdirectory. Lastly the program is copy protected, but in a form that must be illegal in some way, if it’s not illegal it should be! The program disk has two unformatted tracks, leaving twenty-four blocks unusable, but that’s not that bad. The real problem occurs when the disk protection passes! The to alter a byte in the BATTERY BACKED UP RAM (BBR). RWP has NO RIGHT to physically alter anything in my computer that would not be changed back when the program is exited. The byte at E1/O3BB is changed from a FF to a FE, then the program checks for it like this: AQFB@S LDA #SQDFB $2CO+FB = 3BB DA PHX 48 PHA A2G30C LOX #$BCB3 Tool call +30C, read a byte from BBR 22 06 08 El JSL E1B00D Too! locaior cal 68 PLA 290300 AND #30003 rm LSR FOO2 —BEQ 402 Newr taten 9043 BOC +43 Clear carry = pas Since the Branch on EQual is never taken, I changed it to EA 18 (NOP and CLC) so the next branch is always taken. Let them mess up their own computers if they want, but leave mine alone! When Apple Inc. reserved this memory Thardly think they reserved it for RWP. What if 100 people wrote programs that did this? This type of protection only breeds incompatiblity down the line. Well I did find a way around this protection and a way to change your back to it’s original state. To unprotect the file “TOOL.SETUP.2” make the following block edit (on a copy only): Block Byte(s) From To $l $1C7 Fg 92 EA 18 Using the book “Inside the Apple IIgs” by Gary Bond I was able to look up all the values in the BBR and check for the altered byte. The book also gives the tool call number for reading and writing to the BBR. There is also a call that sets the BBR checksum if you change one of the bytes directly. So I searched the disk for each of these and found both parts of the protection, the part that changes the byte and the second part that checks for it. If you want your computer’s BBR in it’s original state enter the following (the back-slashes are very important): \O4 00 90 FF 60 FB OB 03\U This is a tool call to WriteBParam from the monitor, this call changes the byte back and updates the four byte checksum of the BBR. Now your IIgs should have the BBR in it’s original state and SS should still work. This is an INCOMPLETE softkey, the install feature will not work on a copy of the Softswitch disk without the error, if anyone has the fix for that part of SS please let us know about it by writing in. Although I had this incomplete crack about a year ago I didn’t want to send it in unless I had the whole thing. Well T have don’t have enough time to work with it so I am asking for help from some of the other readers that have this program. *IIgs Softkey for... Mavis Beacon Teaches Typing Software Toolworks @ Requirements D 512K Apple Igs 0 3%" disk copier O 3%" disk editor 0 2 blank disks Mavis Beacon Teaches Typing (MBTT) is a typing tutor with a very neat race car typing game. The program comes on two 3%" disk with the program disk having an unformatted track (track $4F, side 2) which leaves blocks $63A through $63F unusable. Below I will explain the (long) way I tracked everything down, First I started by making a copy of both disks using Copy II Plus v8. The program disk gave read errors for blocks $63A through $63F, while the data disk would copy without any errors, Going to the 314" bitcopy portion of Copy II Plus I used the sector editor to scan the disk for 22 A8 89 E1 22 which is the code for a ProDOS 16 block read. I found this string once on block $3E7. Once I located this code I checked it out and found it gets some information, makes the block read, stores a value at $A15, then returned. I traced back to the first RTL (68) before the code and changed the three bytes after that to 68 FA 99; which is PLA, PLX, BRK (this is what I call hitting the BRAKES). I wrote the block back to the disk and booted it, when the program crashes (press to get to the text page/mode) you can see where the program jumped from. The Accumulator will hold the address (less the length of the instruction) and November COMPUTIST #61 the X-register (lo byte) will hold the memory block. Using this method it’s easy to tell the call was made from $03/O3EE. When checking this new code you will notice the following things: The routine runs from $03/03A® thru $03/04B9. The call made to $03/DSFB (made once) is to a routine that gets the device number to use in checking for the bad blocks. The calls made to $03/D5BB (made three times) is to the actual block read routines. After each call is something like (found on block $37F): LDA @A15 CMP #8088 No error (cither device number or block read) BEQ CONTINUE LDA #8000 Load Accum with failed value BRL FAILED CONTINUE code LDA #8081 Load Accum with passed value TAY This is where the ‘BRL FAILED’ comes to RTL Finally retwmn to sender I made the following changes: 6CAS: AB TAY 6CAG: DB 12 BNE 6CBA (+12) Not zero, then continue 6CA8:F4 17 00 PEA 0017 9106 PEA 0001 5 64 PEA 64C5 6CB1:22 4C 3A 84 JSL B43A4C Goto insert master rowtine 6CB5:7A PLY PLY 6CB7:7A PLY 6CB8: 86 DF BRA 6C99 (-21) Go back and do check again 6CBA:7B TDC Must be an original 6CBC:18 cLC 6CBD:69 FB 80 ADC #00FB 6CBF:1B Tes 6CCB: 2B PLD 6CC1: 6B RTL Return to sender To bypass this step I changed the JSL $03/03AO to LDA $03/03A0 and the BNE $6CBA to BRA $6CBA. The edits to the disk are: Block Byte(s) From To $3B3 $93 22 AF $9A oO 80 The above edit will produce a completely cracked version of MBTT as did the first edit *Ilgs Softkey for... Magical Myths Unicorn Inc. @ Requirements O 768K Apple Igs 0 3%" disk copier O 3%” disk editor O Two blanks 3%” disks Magical Myths (MM) is an educational program that teaches Greek mythology along with teaching basic reading and reading comprehension skills. The program makes use of limited speech and good graphics with mouse control. The program comes on two 314” disks and uses nibble counting (on tracks $20 and $21) on the program disk for copy protection. Magical myths is published by the same company that puts out Aesop’s Fables and uses almost the exact same protection routine. Like the other Unicorn program if you search for A2 26 AB 81 you would find the copy protection. The code is on block $1EE and it looks like: 14B:£2 38 SEP #30 8 bit Accum 14D:A2 21 LOX #21 Track $21 14F:A0 61 LDY #01 on side one Block Byte(s) From To I showed. The routine at $03/6C8E seemed 151:20.3F 6A JSR GA3F Chec or the orignal aC ae re very short and didn’t return any special values 154:80.38 BCS 191 (438) On eror goo 11 $33 (900.00 F006 EAEAEAEAEA sol tried the BRAKE trick one more time and 156:E0 BO CPX #80 A988 Ag G1 was rewarded with the following (at 158:98 TYA $78 22 AF $04/957C): ‘SBC #1D Compare to 1DBO $84 CQ.0000FOO6 EAEAEAEAEA 570.7, pLy BCC 189 (+2C) Too low?, goo 189 AO 08 Ao BL 9570:8E 7989 STK 9979 : Gy .t8 “sR Lal 9580:80 7789 STA 9977 15F:98 YA $82 09.00 09985 EAEAEAEAEA — 9583'99 aF 6C.O3 JSL O36CBE Goto the start of he «ODED TE = SBC ALE Compare to 1E78 49 08 49g protection 162:B0 29 BCS 18D (+29) Too high, goo 18D 6 2 x 9587:F40000 PEA 0000 164:A2 28 LOX #20 Track 20 SOF C900 00 FOGE EAEAEAEAEA — g59n:29 F1 6803 JSL O36BF1 166:A001 LOY 401 on side one MOSH 998 ENEAEAENEA i ' 168:20 3F 6A JSR GABF Check or original - ‘There you have it, three different ways to : for orignal This works fine (producing a cracked crack MBTT at three different levels. Once 168: BO 24 BCS 191 (424) On error goto 191 version), but I thought there was a better way _again this is an example that shows-there are 16D:E0 49 CPX #40 using less edits. Again applying the BRAKE — many ways to do the same thing. To softkey 16F:98 TYA trick I was able to back-trace the protection one © MBTT simply follow these easy steps: 170:E9 LF SBC #1F Compare to 1F40 more step and came up with the following code Make copies of both disks (ignore 172:9815 BCC 189 (+15) Teo low?, goo 189 at $03/6C8E thru SO3/6CCI: ervorson blocks 963A-S63F on the program 174:€008 OPK #08 PHD disk) 176:98 YA TSC Siow 177:E928 SBC #20 Compare o 2008 SEC [2] Make the following change to the 1595 12 CS 18D (+12) Too ig, go 18D copied program disk: SBC HOOFB 17B:A9 08 LOA #08 Everything posed Block Byte(s) From To 17D:48 PHA ADC AOE $459 $197 22 AF 17E:22 0A 6B 00 JSL OO6BOA Prin’ ‘PLEASE WAIT 1 182:A90 LDA #00 6C99:F4 3.06 PEA 63A First bd Blok to ook NOTE: You could also apply the other 14.48 a ecs0-F40 PEA S01 SSRs SY BES BS 185:68 PLA 6C9F:22 ABG303 ISL 0303AD Call 1th code [3_] Write the block back to the copy. 186:28 PLP described above Store the originals in a safe place. 187:AB PLB 60A3:7A PLY Optional: Upload the program to a hard 188: 68 RTL. Rewrn to sender 6CAA:7A PLY dive ee “Pail code san here” 10 COMPUTIST #61 November | If you change the LDX #21 (A221) at$14D to BRA $17B (88 2C) then MM no longer checks for the original and continues to load. The only thing left is to make the change permanent. Try these easy steps: [J Copy the 3%" disk [27] Make the following edits to the copy: Block Byte(s) From To $IEE $140 A221 80 2C [37] Write the block back the copy. *LIgs Softkey for... Tales from the Arabian Nights Unicom Inc. 1E7:E9 26 SBC #20 Conpare o 2008 1E9:B0 12 BCS FD (+12) Too high?, goto 1FD TEB:A9 GO LDA HO Everything passed 1ED:48 PHA 1EE:22 76 68 0 JSL 906876 Prin ‘PLEASE WAIT 1F2:A900 LOA #00 1F4:EB XBA 1F5:68 PLA 16:28 PLP 17:08 PLB RTL Return to sender velees “Fal code is here” If you change the LDX #21 (A2 21) at $IBD to BRA $1EB (89 2C) then TAN no longer checks for the original and continues to load. The only thing left is to make the change permanent. Try these easy steps: [47] Copy the 3%” disk. @ Requirements O 768K Apple Hgs 0 3%" disk copier O 3%" disk editor D Two blank 3%” disks Tales From the Arabian Nights (TAN) is an educational program that teaches old tales from the middle east along with teaching basic reading and reading comprehension skills. The program makes use of limited speech and nice graphics with mouse control. The program comes on two 3%” disks and uses nibble counting (on tracks $20 and $21) on the program disk for copy protection. TAN is published by the same company that puts out Aesop's Fables and Magical Myths and also two Unicorn programs, if you search for A2 20 [2] Bait the copy. Block Byte(s) From To $553 $1BD A221 89 2C [227] Write the block back the copy. *Ilgs Softkey for... King's Quest J & If Sierra On Line @ Requirements O 512K Apple gs 1 3%" disk copier 0 3%” disk editor with search ability King’s Quest I and II (KQ) have been re- released in a gs format, with the same type However when the patch is used (on block $2ED) for KQ2, the program would load about 80% then bomb into the monitor. Now you must go back and trace the actual block read code and look for some type of flag. After searching for 34 96(the number of the bad block) I found it twice on block $2C4. Checking this code revealed two values (0082 27 8) are stored in consecutive memory. The value 9927 is the code returned for a block read error by the protocol converter and ProDOS 16. So searching for C927 would reveal the this ‘“‘check of the disk check"’ on block $267. If the 82 27 wasn’t found then a JSL was made to some subroutine, changing this to a LDA results in a cracked version of KQ2!. If you use Copy II Plus v8 to search for 90 FO 04 22 80 8 88 22, when the sequence is found, the cursor will be on the byte the needs to be changed. The same exact sequence is on the four (4) forementioned programs and the same change will work for each, however King’s Quest II does require an addition patch. ‘When checking a copy of Police Quest (also by Sierra) I cound not find the above code or any protection routine for that matter. The softkey for both KQ is as follows: (J Make a copy of all the disks, ignore errors on block $634. [2] Make the following change (on the copy of disk one only): For King’s Quest - Quest for the Crown: Block Byte(s) From To SAD $88 22 AF For King’s Quest II - Romancing the Throne: A® 01 you would find the copy ion. The GE cancon. : i i graphics as the 128K Apple I Block Byte(s) From To code is on block $553 and it looks like: versions. Itis sad that Sierra has overlooked jog ae a z= 18B:E2 30 SEP #36 8 bit Accum the potential of the IIgs, they should have put ry) gar 2 AF 1BD:A2 21 LDX #21 Truck $21 some efor ito the raps ‘Well, Soe, IBF:ABO1 LY #1 onside one protection is the same as on Space Quest ' 1C1:26 ABGA JSR GAAB Check forthe original and Leisure Suit Larry. The program comeson [3_] Write the block back to the copy. 14:38 3B BCS 1FF (+3B) On error goto 1FF two 3%" disk, with both disks having an error Optional: Upload the whole program to a 1C6:E6 BO CPX #80 over block $634. After checking the code on _hard disk. Store the Original in a safe place. 1€8:98 TVA both KQ disks, and that of the other two Sierra 1€9:E9 1D SBC #1D Compare to 1DBO programs I found a common section of code Softkey for... 1€B:96 2C BCC 1F9 (+2C) Too ow?, goo 1F9 along with the edit to crack them). All four 1CD: £6 78 CPX 478 disks have this same code (on the disk it looks Defender of the Crown 1CF:98 TYA like): ; 108:E9.1E SBC HIE Caparo 1E78 Cisemavare loc: 102:BB 29 BES 1FD (+29) Too hight, gto 1tD 2208.00.08 SL 00000 aR 1D4:A226 LOK #20 Tua 20 onl ae ane eruiements 106:ABB1 LDV #01 onside one 108:28 ABGA JSR GAAB Check for criginl 22.0000.08 JSl 060608 . aera 108:8824 BCS LFF (+24) On erorgoo ler 22 9800.00 JSL 090000 °22 MUSTbe ced war” (7 3147 disk copier 100:048 «CPX #49 AEG OD LOX 0060 10F:98 YA Rie Ut oon Defender of the Crown (DOTC) is a 1E9:E9 1F SBC #1F Compare to IF40 ‘ PHK GREAT new program from Cinemaware. This 1£2:90 15 BCC 1F9 (+15) Too low?, goto IF) 8 PHA is the first program in a whole line of ‘‘Playable 16466 08 CPX #08 These bytes can be found on block $A Movies’ (Cinemaware even calls the disks 1E6:98 1YA for KQI. The patch makes a cracked copy. “‘reels”) ported from the Amiga and the Mac. November COMPUTIST #61 11 | While these programs are memory hungry due to the amount of graphics and sound used, these new programs set a new level of quality and hopefully a new standard for the IIgs. The object of the game in DOTC is to gain control of the whole region by waging war in the eleven hundreds. DOTC does live up to it’s reputation with great graphics and music, the game also uses the mouse for control which makes for easy playablity. The program comes on two 3%" disks and uses nibble counting on tracks $2@ and $21 of disk/reel one. So again, we encounter that same “old” comercial disk protection scheme. If you get out your disk utility and search for A2 20 AG @1 or A2 21 AQ 81 you will find the offending code (on block $258). The code should look like this (as it is on the disk): 03:F40000 PEA 9000 06:F40000 PEA 9000 @9:A2@C 22 LOX #228 OC:22 89001 JSL £19008 19:68 PLA 11:9CE117 STZ 17E1 Store a pass value in the flag 14:20£317 JSR _17E3 Go to the protection routine 17:ADEL17 LDA 17E1 Load the flag 1A: FO 93 BEQ 1F (+03) If zero then continue 1C:4C. 64.17 JMP_ 1764 Goto INSERT MASTER msg 1F:22729C 68 JSL 989C72 23:4C 2618 IMP 1826 Go tothe start of the program 26:00 06 9008 This is 17E] when loaded in 28:08 PHP Start ofthe provection routine 29:62 38 SEP #30 8 bit Accumulator 2B:A2 20 LDX #20 Track $20 20:A0 81 LOY #01 2F:20FF 17 © JSR 17FF Count them up 32:30 OB BCS 3F (+8B) carry set = failed 34:A2 21 LOX #21 Track $21 36:A0 OL LOY #01 38:20 FF 17 © JSR 17FF Count them up 3B:BB 82 BCS 3F (+82) Carry set = failed 30:28 PLP 3E:60 RTS Return to sender 3F:EEEL17 — INC 17E1 Failed so mess up the flag 42:28 PLP 43:60 RTS ‘And return to sender 44:86 1E 18 — STX 181E Start of ‘Count them up‘ 47:8C 1F 18 STY 181F 4A:5A PHY 4B:DA PHX Push track number 4C:F40000 PEA 9000 4F:F42118 — PEA 1821 Push more data. 52:22 8F 9C OB JSL OB9C8F To actual count routine, 56:80 2018 — STA 1828 Store retumed value 59:68 PLA 5A:68 PLA 5B:68 PLA 5C:68 PLA 5D:68 PLA 5E:68 PLA Pull all extra values 5F:AD 20.18 — LDA 1820 Get the returned value 62:60 RTS Return to sender This one seems real easy to crack, just think about it. First the code stores a zero in the flag and goes to the nibble count, then when it returns checks the flag for a zero. If you change the JSR (28) at 14 toa LDA (AD) the code stores zero in the flag, loads a value and then checks the flag for a zero! You could also change the BEQ (F8) at 1A toa BRA (89) just for the sake . of completeness, although it’s NOT needed. If for some reason you cannot find the above code ‘on block $258 you could search your disk for 9CE1 17 2063 17 ADE1 17 and change the 26 to AD. To crack Defender of the Crown follow these easy steps: [4] Make copies of both DOTC disks. [2] Make the following edits on a copy of disk 1. Block Byte(s) From To $258 $14 a) AD [37] Write the block back to the disk. Optional: Upload the whole program to a hard disk. Softkey for... Adventures of Sinbad Unicorn Inc. @ Requirements CO 768K Apple Igs 0 314" disk copier C1 3%" disk editor 0 Two blanks 3%” disks Adventures of Sinbad (AOS) is an educational program that uses Sinbad’s adventures to teach basic reading and reading comprehension skills. The program comes on. two 3%” disks and uses nibble counting (on tracks $20 and $21) on the program disk for copy protection. Like the other Unicorn program if you search for A221 A991 you would find the copy protection. The actual disassembly is so close to other Unicorn products I didn’t think it would be worth repeating. If you change the LDX #21 (A221) at 103 to BRA 131 (88 2C) then AOS no longer checks for the original and continues to load. The only thing left is to make the change permanent. Try these easy steps: [1] Copy the 3%" disk. [[2] Make the following edits to the copy: Block Byte(s) From To $47A_ $103 A221 88 2C [72] Write the block back the copy. Edward Teach While I’ve got your attention, I’ve got ing to say. In issue #56 (page 29) the RDEXed states that there are about 6000 subscribers to COMPUTIST. My question is, What are the rest of you doing? I have been a subscriber since last September. In the past year have submitted several articles. My first article ‘was one entire page on how to find a jump to $C6OO. It wasn’t the best work that I have ever done, but at least I contributed. But what really bothers me, are the people who give 38 softkeys by saying change byte A to B and don’t give any indication how they found what to change. If you want to know how to write, look at the articles by Brian Troha, Jim Hart and Charles Taylor. Even on the simple cracks they all still found something “‘extra’’ to say about the disk. L also got a friend to subscribe and he got another friend to subscribe. This is why I can’t understand why we have a MOST WANTED LIST. With 6,000 people, out there, why can’t we get together and overcome a few protected disks? And boost the number of subscribers in the process, I hope I did not offend the regulars, and to the other 5S00@+ it won't matter... you never write anyway. DOUBLE DOS I was working on a softkey for a disk that has already appeared in several past issues of COMPUTIST. The other cracks all poked an 18 into $B942 and copied the disk. A few sector edits later the COPYA disk was finished. On my version there were 11 different address prologues and two different data prologues. Simply poking $B942 wasn’t going to work. My first attempt was to write 11 different controllers and at least get a COPYA version for experimentation. I did manage to make the copy, but a large amount of the code was ‘junk’. Apparently the disk was encoded. After some searching I discovered that the read translate table was altered. Copying the copy, using their read table, produced a disk with good code that died horribly during booting. You have probably noticed that there are not 11 controllers at the end of this article. Filling the pages of COMPUTIST with all of these did not seem to be the best way to present my program. While trying to get around this problem I remembered several other items that I have worked on. (Broderbund and Electronic Arts releases). These disks are all protected in the same way. A table of header bytes is constructed then when a ‘‘read”’ is performed the headers are located in the table and placed in DOS. Using this theory all I had to do (ALL?) was rewrite the DOS read routine, construct header tables and place the header [42 COMPUTIST #61 November | information in the new read code. The premise of the code is to read drive 1 with the protected DOS and drive 2 with DOS 3.3. This is my first attempt at writing assembly code, so if it appears a bit cryptic, bear with me. The heart of the code is DOUBLE.OBJ: 8008: LDA #$18 — POKE normal 8002: STA $8989 DOS to 8805: STA $B992 ignore 8008: STA $B99C errors. 8008: LDA #$60 800D: STA $B98A 8810: STA $8993 8013: STA $B99D 8016: LOX #380 Move $B944 8018: LDA $B944,X to 8B1B: STA $809A,X $809A SO1E: INX 8B1F: CPX #$5C 8021: BNE $8618 8023: JMP $8055 8026: STY $9008 8829: STA $9001 882C: STX $9002 802F: LDA $35 8031: AND #$80 8033: BM! $8052 8035: LDA #$05 8037: STA $B8E7 883A: STA $8BAB 803D: LOA #$AA 803F; STA $B8F1 8042: STA $8085 8045: LOA #$96 8047: STA $80C0 8B4A: LDA #$AD 84C: STA $BBFC 8O4F: JP $898C 8952: JMP $8865 8055: LOX #300 8057: LDA $8826,X Move code from BB5A: STA $B944,X $8026 805D: INX BOSE: CPX #$30 = to 8068; BNE $8057 $8944 : NOP 8063: NOP Jump to next move Store X,Y,A Get drive # turn off bits DR=1?/then jump store normal values in DOS * DOS * % DIVERTER * normal read protected read RTS 8965: LDX $8478 get track number 8068: LDA $80F6,X (D5) table 1 868: STA $8GAB new read code 806E: LDA $811F,X (AA) table 2 8071: STA $80B5 new read code 8074: LDA $8148,X (96) table 3 8077: STA $80C0 new read code 8Q7A: LDA $8171,X (D5) table 4 807D: STA $B7E7 normal DOS 8080: LDA: $819A,X (AA) table 5 8983: STA $B8F1 normal DOS 8886: LDA $81C3,X (AD) table 6 8089: STA $B8FC normal DOS 88C: LOY $9008 restore 808F: LOA $9901 restoreA 8092: LOX $9002 restoreX 9095: JMP $809A 9098: CLC 8099: 68 jump to new read This code modifies the normal DOS read routine ($B944-$B99F) then relocates it to $8@9A. Next the diverter section is moved (from $8026-$8052) to replace the $B944 code. Finally six tables are created (or at least identified) that will hold the header information. Now when DOS tries to read the disk our diverter will determine the drive being accessed and route the code to either the ‘normal read” or the ‘protected’ read. The new $B944 code saves all the registers, and reads memory location $35. The current drive number is stored as the high bit of that memory location. If the bit is not set (1) then drive one was the last accessed, if set (O) then drive two was the last disk accessed. This would appear to be backwards. (1 = not set, @ = set). Anyway, the code either jumps to the read table code at $8065, or pokes the normal “DSAA96/DSAAAD’ into DOS and then jumps to our relocated read routine. Just in case I lost the beginners, what all this means is the code'will now read whatever headers you tell it to on drive one (D4AA96 for example, or even 9796EB). DOUBLE DOS can handle up to eighty different headers on a 5.25’ disk. Also, if you had any trouble writing controllers, now the simplist controller will function without problem. No more trying to write controllers that read one track with one header and the next track with a different header. The tables relate to the six header bytes: Table # Byte Start of Table 1 $80F6 2 a LIF 3 96 = $8148 4 D5 $8171 5 AA $B19A 6 AD $81C3 Each table is forty bytes long to accomodate 40 tracks per disk. If the disk has only 35 tracks the program will still function. It just ignores the last few tracks. The Applesoft part of Double DOS serves as an easy method to input the tables. The majority of the code is for input. The code builds six strings J$(X) (X=1 to 6), converts the strings to hex bytes and pokes them into memory. I tried to make this as painless as possible. However, writing a full screen editor is less than fun. Other than the four arrow keys for cursor movement the only other keys that thet = tet aidend to exit the editor, and (GW) to write the new tables to memory. After entering all the tables (you can skip the ‘ones you don’t need) and pressing (Sw) , drive one will no longer be able to read DOS 3.3. Any program that you need to load MUST be loaded from drive two. Do not forget to remove the disk from drive two. A write protect tab is also a good idea. As a final note we need to modify SUPER. IOB 1.5 so only 5 tracks are read at one time. Reading more overwrites the code we just entered. Do the following to the SUPER IOB: LOAD SUPER I0B 1.5 10075 IF PEEE(47428) = 14@ THEN MB = 110: GOTO 10085 10080 MB = 151 10085 HOME: DOS = 16: HX$ = "00010203040 506@70800101112131415161718191A1B1C a ‘1D1E1F202122' SAVE SUPER IOB 1.5 This change will peek in memory to see if Double DOS has been installed. If it has then the MB parameter is lowered to copy only five tracks, if not then the normal seven tracks will be copied as usual. This change is completely transparent to you when running the program and once entered will automatically handle my program when ever it is in memory. To find the proper bytes to store in the tables you will need a pencil, paper and a nibble reader. (I use the ‘N’ function of Locksmith 6.0). Nibble read track $0@ and write down the Address and Data prologue bytes. Then repeat the process for the entire disk. Now, run Double DOS and enter any changes into the correct tables. If, for instance, all the first bytes of the Address are the normal ‘‘D5‘*’s then skip table one and goon to table two, if the second bytes are all “‘AA‘’s then table three... know that this is a lot to key in, however I find it a useful tool in deprotecting programs. DOUBLE DOS 19 REM SET UP VARIABLES 20 DIM H$ (48) 30 F$(1) = "DS" :F§(2) = anon = "D5" :F§(5 “AA" :F§(3) = "96" 'AA” :F$(6) = "AD" "D5‘AA‘96" :BS (3) a i 'AA*AD" :B$(6) = 5OX=1 60 J$(1) = "D5" :J$(3) = "96" :J$(6) = "AD" 7H S$ (1) = J$(1) +"D5" : IF LEN (J$(1)) < 80 THEN 70 SEG) = Ita) +°96" : IFLEN (J$(3)) <8 THEN SAE tH) + "AD": IFLEN (J$(6)) < 80 THEN WOH) -8@) + "AA": IFLEN (J$(2)) <80 THEN I 118 J$(4) = J$(1):J$(5) = J$ (2) 120 POKE 47426, 24 139 REM BLOAD DOUBLE .0BJ AND CREATE SIX TABLES 149 PRINT CHRS (4) "BLOAD*DOUBLE OBJ" 150 CALL 32768 160 FOR X = 33814 TO 33054: POKE X,213: NEXT 170 FOR X = 33855 TO 33095: POKE X, 178: NEXT 189 FOR X = 33096 TO 33136: POKE X, 150: NEXT 199 FOR X = 33137 TO 33177; POKE X,213: NEXT [_ November COMPUTIST #61 13 | 208 FOR X = 39178 1039218: OME X,178: NEXT 610 IF A= CARS (11) AND ((H= 18) 0 (H= 18) OR 100 - $1908 «6 SFEIC 216 FOR X = 33219 TO 33259: POKE X, 173: NEXT (H= 26) OR (H= 34) THEN H=H~ 1: 119 - $F2CB «618 - ‘$50A3 220X=1 620 IF AS = CHRS (11) THEN =V~ 1: 120 - $8C74 «=—«628.- S7LIA 230 CALL - 936 Vc STHENV=14:C=C+ 26 136 - $7ECB. 639 - $4090 240) REM SET UP INPUT SCREEN MASK 630 IF AS = CHRS (11) THEN 670 146 - SBBED = 649. - ‘$8380 256VTAB 1: HTAB 14: INVERSE : PRINT "-DOUBLE*D0S* 640 IF AS = CHRS (10) AND ((H= 10) OR (H= 18) OR 150 - SAEA3 650. - ($2488 NORMAL (H= 26) OR (H=34)) THENH=H-1:C=C~1 165 - SEFE2 669. - $F088 268 VTAB 3: HTAB G9: PRINT “WRITTEN*BY*EDHARD* 650 IF AS = CHRS (1) THENV=V+1:C=C+2: IF 175 - $0548 «= 678 SFBIC TEACH" V> 14 THEN V = 5:C=C- 26 183 - SEAS «= 680 $6668 270 VTAB 5: HTAB 6: PRINT "OD-"****@A-"***414-" 660 IF AS = CHRS (10) THEN 670 193 - $19B_ «690. - ‘SFFCB see 678 IFAS =CHRS (08) ORAS = CHRS (21) OR AS = CHRS 203 - $8D7F «= 780 $F353 280 VTAB 6: HTAB 6: PRINT “Bl~"****9B~"****15-* (18) OR AS = CHRS (11) THEN 738 219 - $3548 716 - $C914 ae a 680 IF AS = CHRS (27) THEN 438 220 - $1888 726 - $5968 290 VTAB 7: HTAB 6: PRINT "@2-"***40C-44#416-* 690 HTAB H: VTABV: PRINT AS 230 - $0730 «738 - $47C2 seg 700 \F C= 1 THEN J$(X) = AS + RIGHTS (J8(X), LEN 249 - SBAIA = 743 - $736E 300 VTAB 8: HTAB 6: PRINT "B3-"****gD-"#"4*17—* (J$(X)) ~ 1) : GOTO 728 256 - $2154 750 ~ SBCHF nay 71O J$(X) = LEFTS (J$(X), (C= 1) + AS + MIDS 266 - S4BFF 766 - $0130 319 VTAB 9: HTAB 6: PRINT "@4~*****9E-***4*18-* (J$(X), (C+ 1)) 276 - SISBF 778 - $9088 aeaeng_# 720 GOSUB 768 280 - $AG84 786 - $E3BD 320 VTAB 10: HTAB 6: PRINT "Q5-"****0F—"****19-* 736 GOTO 520 299 -- $BBAS 79 - $3493 ' sees _ 746 X= X41: IPX> 6 THEN X= 1 AH eh or et 4 VTAB 11 HTAB 6: PRINT "O6-"****10-""1A-* : if 220 VTAB LL: HTABG: PRINT "06" 0-""1A-* 789 GOTO 438 oe sa nan aaa RS 336 - $D96E «830 — $589 OVI 2: HBG: PRINT "O7="**4411-"*844 18 x “ke ut “ne PR WQQ Asaeagy adaanre & 1) - $i 390 VTAB 13: HTAB 6: PRINT "@B~"***412-"****1C~ 78 WT FN ne 260 VTA 1: HTAB6: PRINT "B9-"*4**13-"****1D-" 810 H§(P) = MIDS (J8(X),R,2) 370 - $8926 87H STEBA 97 B20R=R+2 380 - $5070 «88 — $SFBB sami ie HTAB 15: PRINT BS (X) 830 NEXT 399 - $9188 898 - $7024 380 VIAB 18: HTAB 15: PRINT *TABLE->" X 849 REM CONVERT DEC TO HEX 40 - $8035 9 - $3816 398 U = 5:1 =69 850R=1 41d - $AW28 910 - $FO59 MOR«1 Beg FORE = 1 10.48 420 - $978 928 $4176 416 FOR Q = 1 70 1: VTABU: HTAB I: PRINT MIDS 870.S§ =LEFTS (HS(E) ,1) :TS = RIGHTS (HS(E) 1) ee (JS(X),R,2):U= U4 L:R=R+ 2: NEXT 880 IF S§ => "A" AND S$ <= "F* THENH = ASC (S$) pee me emer 420U=5:1 = 148: IF | < 35 THEN 41 ~ 55: GOTO 908 eae ae 430 VIAB 20: HTAB 5: PRINT "DO*YOU'HANT*TO* 890 H = VAL (S$) lane CHANGE® THE! " ; INVERSE : PRINT F§(X): 900 IF TS => "AT ANDTS <= "F" THENM = ASC (TS) ie a TES: GOTO 920 - $1889 988 $631C glow: VAL (18) 495 = $59FF = 990 - $8847 seneanny/Ne™ 5: GET AS S20NU=H# 16 + 2 460 IF AS =°N" THENX=X+1: IFX>6THENX=1 939 POKE Z+ (E- 1) NU 470 IF AS = "Y" THEN 519 949 NEXT UBLE. 480 IF AS = CHRS (23) THEN 780 9802=2441:R=1 DOUBLE. OBJ 499 GOTO 370 960 VTAB 23: HTAB 5: PRINT "“INSTALLING'TABLE* 800: AQ 18 80 89 B9 8D 92 B9 $082F 500 REM SCREEN EDITOR "* 8808: 8D 9C B9 AO 60 8D BA B9 $8008 51QH=9:V =5:C=1:F(X) =1 970.X =X 41: IF X< 7 THEN 790 810: 8D 93 B9 8D 9D B9 Ad 00 $7871 520 HTABH: VIABV: GET AS 980 HOME : PRINT "DRIVE* ONE* WILL* NOH* READ 8018: BD 44 B9 9D 9A 80 EB EO S2F71 530 IFAS = CHRS (21) AND ((H=09) OR (H= 17) OR PROTECTED‘ DOS" : PRINT "DRIVE*TWOWILL 8020: 5C DO F5 4C 55 80 8C 09 SBIAF (H= 25) OR (H=33)) THENH=H+1:C=C+1: NOWREAD‘DOS‘3.3" : PRINT "RUN'SUPER*10B* 8928: 9 8D 01 90 BE 02 90 AS $4499 GoT0 678 1. 5*FROM*DRIVE'THO" 8030: 35 29 80 30 1D Ad D5 8D $29F6 540 IF AS = CHRS (21) AND ((H= 18) OR (H=18) OR 99 END 8038: E7 BB 8D AB 80 A9 AA 8D $0831 (H=26) OR (H=34)) THENH=H-1:C=C+19 8040: F1 B8 8D BS 80 A9 96 8D $1AB9 556 IFAS =CHRS (21) THENH=H+8: IFH>34 THEN Checksums 8048: C 80 A9 AD 8D FC BB 4C $335F H=9:C=C-80 850: 8C 80 4C 65 88 A2 08 BD $67BA 560 IF A$ = CHRS (21) THEN 670 16 - SBD «S10 - $BCOA 8058: 26 89 9D 44 B9 £8 ED 30 SFBAI 570 1F AS = CHRS (8) AND ((H= 18) OR (H= 18) OR 2H - $2807 «= 528 - $6595 8060: Dd F5 EAEA 6 AE 78 04 $6592 (H=26) OR (H=34)) THENH=H-1:C=C~1: 30 $3E0A = 530. $57A2 8068: BO F6 80 8D AB 80 BD 1F $4881 GoTo 678 49 = SCASA 549 $603 8070: 81 8D B5 89 BO 48 81 8D $0343 580 |F AS = CHRS (8) AND ((H= 09) OR (H= 17) OR 50 © - $8028 «580 - $40FF 8078: CO 89 BD 71 81 8D E7 B7 SCDAF (H= 25) OR (H=33)) THENH=H+1:C=C-19 66 - $5371 «569 $7436 8089: BD 9A 81 8D Fl B8 BD C3 SCFES 590 IF AS = CHR$ (08) THENH=H-8: IFH <9 THEN 7 = - $BAI5. «570 - $AOCT 8088: 81 8D FC BB AC 00 98 AD $6306 H=33:C=C+79 80 - $5378 «= 58H - $0708 8090: 01 90 AE G2 96 4C 9A 80 $F780 601 IF A$ = CHRS (08) THEN 670 99 © - SAFD2 «598 $4493 8998: 18 68 00 00 $2708 [14 COMPUTIST #61 November | Softkey for... Mathblaster Davidson and Assoc. This disk has had a few softkeys published over the last months. None of these would work on my disk. My copy had 11 different address prologues and two different data prologues. My first attempt at disk inspection is always to make aCOPYA version. Making the copy will be alot easier if you enter these tables into Double DOs: Table 1 00-05 OA-DF 14-05 1E-DF 01-D5 QB-DF 15-D5 1F-DF 02-07 9C-DD 16-07 20-F5 93-D7 90-00 17-07 21-F5 04-D5 GE-DF 18-DD 22-F7 05-D5 OF-DF 19-DD 23-D5 06-D7 10-D5 1A-DF 24-D5 07-07 11-05 18-DF 25-D5 98-DD 12-07 1C-DD 26-D5 99-DD 13-07 10-DD 27-05 Table 3 00-96 QA-SE 14-96 1E-9E 91-97 OB-9F 15-97 1F-9F 92-96 @C-SE 16-96 20-B6 93-97 9D-9F 17-97 21-87 04-96 QE-9E 18-9E 22-B6 95-97 OF-SF 19-9F 23-96 96-96 10-96 1A-9E 24-96 07-97 11-97 1B-9F 25-96 98-9E 12-96 1C-9E 26-96 99-9F 13-97 1D-9F 27-96 Table 6 08-AD QA-B5 14-B5 1E-B5 91-AD 9B-B5 15-B5 1F-B5 @2-AD 8C-B5 16-B5 20-B5 93-B5 @D-B5 17-B5 21-85 94-B5 QE-B5 18-B5 22-B5 95-B5 OF-BS 19-B5 23-AD 96-B5 10-85 1A-B5 24-AD 97-B5 11-85 1B-B5 25-AD 98-B5 12-85 1C-B5 26-AD 99-B5 13-B5 1D-B5 27-AD As an example, these tables tell the read routine to read track $OF with DFAA9F-D5AAB5, instead of D5AA96-D5AAAD. After the tables have been entered, place Super IOB 1.5 in drive 2 and run it. Then EXEC the simplest controller you have (CON.STANDARD). Be sure to remove the disk from drive 2. Place a formatted blank in drive two, alter the read translate table (CALL-151/ BAD5:03) and copy away. You could also try cataloging both drives. The Mathblaster will now catalog in drive | as will the DOS 3.3 in drive 2. The copy does not need their DOS. But for the novices it is important that you know what a protected DOS looks like. From here on I am relying on the softkey from Fred Long (COMPUTIST #53). Davidson and Assoc. checks their disks with the use of ‘‘PEEK(40324)"’. Where this shows up in the code we must change the code. Reboot and load a normal DOS, then: RENAME H(@z)ELLO, HELLO LOAD HELLO POKE104,32 Change the = to <> and the <> to POKE104,8 SAVE HELLO Change the = to <>. LIST4OO Change the = to <> and the <> to SAVE M(O2)ATH BLASTER The disk is now COPYAble. Enjoy Notes: Whoever placed: ALGEBLASTER and WORD ATTACK on the MOST WANTED LIST, try DOUBLE DOS to softkey it. Has anyone else noticed that the list is getting long? I don’t understand why some of the items are on the list. Certificate library volume one for instance. The softkey in COMPUTIST #43 for CERTIFICATE MAKER worked for me. The library disks can be copied with COPYA with a few changes. RUN COPYA nr CALL-151 1B942:18 3A1:18 RUN The drive will grind over track 21, but this is alright. If the program disk is deprotected then the library disks will also work. Next, my Wheel of Fortune was NOT protected. I don’t think that Sharedata uses any protection on their disks. The MECC Puzzles and Posters can be copied by capturing their RWTS and using the SWAP controller. Jim Bancroft Softkey for... Cross Clues SRA Well I finally got into Cross Clues by SRA. You just have to keep on peeling off the layers of protection. First the disk format is in DOS 3.2 with epilog modification. Second all file names have 8 control-H’s at their ends making them impossible to type at the keyboard. Third the graphics controller file is encoded on the disk and counts on SRA’s DOS to do part of the decoding. Fourth the usual control-D DOS commands are replaced by really strange control-D control-various one letter entry commands. In combination with the control characters appended to the file names, this makes really odd disk access routines in the BASIC programs. This job would not have been done without the Senior Prom, the Zap editor from Bag of Tricks and the disk utilities of Copy II Plus. With all the protection uncovered however, you can now survive with just the Copy II Plus utilities if you don’t mind a lot of extra effort. (J Capture the RWTS and use it to copy the disk to a normally initialized DOS 3.3 or fast DOS disk. The startup program should be called ‘*A’’. I used the Senior Prom and COPY B which is on its utility disk for this job. It takes approximately 2 minutes to get your normalized copy. ([2-] Use Copy II Plus to “RENAME” the “*FILES’’ on the disk. Remove the control characters from each name. This will give you files A, B, C, and D in BASIC; file G, which is the picture of the Sherlock Holmes hat; file F which is the ASCII data file; and file E, which looks like garbage but is the encoded graphics controller file that I’m certain has stopped deprotection of this program up until now. ([3—] Capture file E in decoded form. Obviously the file must be decoded if it is operating throughout the program. Since Copy TI Plus just gave us the address (16384) and length (2559) of file E on our normalized disk, we simply have to stop program execution get normal DOS booted and BSAVE it. Again the Senior Prom or the Fingerprint+ printer interface makes this a cinch; but given the file’s location in memory, its quite likely that a to normal DOS should allow a clean save. I did not try that however. Why take a chance on losing code when you have two of the best memory capture devices ever made for the Apple. [2] Normalize the DOS commands and the names of files which are called by the programs. Check the BASIC lines which do this job. They show how putting in protection must drive programmers up a wall. The simple job of opening, positioning, reading and closing a text file becomes a one of kind code set, useless ‘on any other disk, While you're altering the DOS calls, eliminate the decoding of file E after its BLOAD in programs B, C, and D. Their command set: CTRL-D; CTRL-Q = RUN (used on B, C & D) CTRL-D; CTRL-B = BLOAD (used on E & G) CTRL-D; CTRL-O = OPEN (used on F) CTRL-D; CTRL-P = POSITION (used on F) [November COMPUTIST #61 15 | CTRL-D;CTRL-R = READ (used on F) CTRL-D;CTRL-C = CLOSE (used on F) You will notice that before any DOS operation, there is a for-next loop which adds CHR{$(8) to the name of the file to call. That is how they add the control-H’s to the file name, You will of course eliminate that loop since you have normalized the names. It would be impossible to save such names to disk from the keyboard. In program A: make line 16 REM and normalize the command in line 20 In Program B: make line 10 PRINT CHR$(4)""BLOAD BE”. Do not call the decode routine. You will have an already decoded E file on your disk. Eliminate the file name loop and normalize the DOS commands in lines 108 and 294. In Program C: make line 3 PRINT CHR$(4)’"BLOAD E’’:GOTO 10. In line 154@ and 11400 normalize the file names and the DOS commands. In the routine running from 13028 to 13040, REM line 13028 to kill the name change loop and alter the DOS commands in lines 13030 and 13040. In Program D: make line 3 PRINT CHRS$(4)""BLOAD E”’:GOTO 10 and change the DOS command in line 32020 A note regarding the decoding of file E: File E is BLOADed by file B and also by file C and file D. In all three programs immediately after the BLOAD of E there is a call to a location inside E which does the ing. The answer is simple take out the call. To make life a little more interesting most calls within the BASIC programs are done as interdependent variables (P1 = = P2 + Sete.) After extensive code following within E, I found that only the call immediately after the BLOAD will execute a decode. There is no alternate entry methods used. It was unnecessary to place any RTS within file E to disable the decode routine. Softkey for... Thinkware SRA Search the disk for BD 8C C# 10 FB C9 xx 0B 1 (where xx is a strange byte like E7) and replace the 61 with 1D. What you just did was bypass the check for funny sync bytes and branch to the check for the normal data header. This set contains many nice Science Simulations such as The Village Fish Farmer and The Town Energy Planner. Some notes on Mindscape Mindscape uses protections. Be sure to check COMPUTIST #28 page 22 for some of them but here are a few more. several different On their disks using FORTH as the operating system, check track $00, sector $03. It contains a jump to reboot make any BNE a DA 09 before the reboot (4C 9 C6) in this sector. Now read track $00, sector $05 and what you find is the code that Spinnaker and Designware use all the time on their track $00, sector $3. Referring to COMPUTIST #22 page 4 “‘deprotecting Storymaker’’ we find that changing byte $71 from 82 to 0@ eliminates the protection. On their disks using Dinky DOS changing the 4C 06 C6 on track $00, sector $OB to 4C 06 17 (which appeared a few bytes previous) took care of that protection. In their LEARNING WELL series modifying DOS 3.3 to ignore the first byte of the data header (B8E6:29 OO) allowed COPYA to handle this set. Then replace their DOS with a normal or fast DOS and your all set. Their Pascal is simple. Use the Zap editor of Bag of Tricks to take block $0@ from a normal Pascal disk and put it onto a copy of their program made with COPYA. This same method works for Scholastic’s new ProDOS protection if you take block $00 from a normal ProDOS disk Some notes on Scholastic Speaking of Scholastic they have released a version of Newsroom writ provection Sightly different from Springboard’s original. On $00, sector $03, jie ergata 18. On Track $©2, sector $OF their are two JSRs followed by BCS (20 24 LF BCS xx or 2027 IF BCS xx). They check the ID of the disk. Change them to EAEAEAEAEA. Elsewhere, onthe disk, you will find a disk check (BD 8C C8) which looks for some funny bytes like E9 and F7. make the first four BNE’s of the sector D@ @@ and you're set. This routine was on the disks I checked at track $12, sector $03 and again at track $17, sector $@E, so you should check the entire disk. Some notes on Hartley software Hartley normally copies by turning off error checking (6942: 18) and using COPYA. However if an IO error comes up after the DOS prompt appears, check your Hello program for acall to DOS (up in the 40000’s), this checks to see if track $23 contains certain code. Remove the call and you should be set. The Voyage of the Mimi uses this same protection. Softkey for... Megabots Spinaker (UXB) Spinnaker (under the company name UXB) has a little adventure game called Megabots. Dropping the CALL 4001 in the Hello program eliminates the protection check. Notice that 4001 is actually part of the Hello in memory so you should not drop the line since that would relocate or lose the attached binary code at the end of the Hello. Change the CALL4@01 to REM4001 and you will not create that problem. Softkey for... ‘Smart Eyes Addison Wesley Addison Wesley has Smart Eyes which contains disk check code (86 BD 8C CA) in a file called SMART.OBJ on track $21, sector $03. ‘You must load the accumulator and set the carry flag before returning so change the code to 9D 88 CB 38 60 and you are set. Some notes on Prentice Hall Prentice Hall has a series of normal format software that gives nasty messages when you ‘copy it and run it. A disk map shows track $05 sector $03 in use but no file using the sector. Byte $52 of the sector has disk access (BD 8C CB) code. At byte $61 there is a 4 66 4B, at byte $64 there is a AJQ00D 88 CB 60, at byte $25 there is a BEQ (F@ xx) which lands at byte $64. Decreasing the value of xx by 3 will land you at byte $61 and you will have passed the disk check successfully. Some notes on CAI CAI (Computer Academic Ideas) has a variety of game show style quiz programs. You will find the usual BD 8C Cf followed by many C9 E7’s in their protection. Finally there will be a BEQ (Fé xx) to some location. If the code at that location is 18 98 3E change it to EA EA EA. If it isn’t, study the code in front of your location. If it is a JMP then change the code at your location to the same JMP. Things should then work fine. Softkey for... PFS Computer Checkup XPS Diagnostics is now PFS Computer Checkup but the protection remains the same. Copy with Locksmith fast back-up ignoring errors on track $03 and also on tracks $1D-22. They are nibble count and unused tracks. Look for 20 47 17 on the copy change it to Ad 29 A9 BC 69. This loads Y with 29 and A with OC and then returns to the protection check call without checking. These values are then stored at $3A and $3B to be used later by code at $1742. The Senior Prom told me this and it didn’t lie. The copy boots much faster without the extensive and precise nibble count. [ 16 COMPUTIST #61 November Some notes on CTW Series In COMPUTIST #28 page 23 there was a softkey for Alphabetic Keyboarding by Southwestern Publishing. Personally I didn’t use that method, I used insertion of a pretty long routine into normal DOS 3.3 to read the disk. ‘What I noticed though, was that my modified DOS could read Alphabetic Keyboarding and the entire Apple Presents CTW Series (an old set of Integer BASIC classics). My guess is that the softkey in COMPUTIST for the keyboarding set will take care of the CTW set too. Some notes on Garfield In COMPUTIST #55 Jerry Stevens softkeyed Create With Garfield Deluxe Edition perfectly. Thanks Jerry I lost my notes on that one but we did exactly the same thing to exactly the same code. You figured out though what the heck we were doing. You found the translation of the 1F to C@ which read the disk. For the life of me I had no idea where the working value was coming from, but I do know what the program did with it. Look at the code from $6DD6 to $6DDB. It has done all kinds of AND’s and OR’s then stored the value at $6E67. It then compares the final value to $5C. If carry is set, it clears, shuts off the drive and returns. If carry is clear it sets shuts off the drive and returns. The change of 38 to 18 we made means no matter what ends up at $6E67 it does the same thing. Jerry mentioned an unused signature on track $23. DLM also publishes a twin program called Teddy Bearells of Fun. The protection is exactly the same as Jerry described for Garfield, but this program uses every sector from track $@2 on for data; so, its nibble count is done with track $23. They obviously format hundreds of disks then put the programs onto them. Garfield did not overwrite track $22, Teddy did. Big, fat, hairy deal! Finally let’s give credit where credit is due. The Create With Garfield softkey by Robert Brown in COMPUTIST #44 has been called many things, none of which are kind, since it was first published. The softkey was brilliant. It accomplished with A2 00 60 what took me 36 EA’s. Refer to Mark Harris in COMPUTIST #55 for a complete list of the sectors you will need to work in if you don’t want to search. Search for 8D 9E B8. This code stores the epilog byte into DOS as Garfield changes from Program disk to Data disk. Naturally since your program is now the same as the data disk, you don’t want to do that anymore. You still have to tell the program that you did it though. So, 3 bytes in front of the 8D 9E B8 put A2 89 68 to load the X- register with 00 and return to the caller. You are going to have one minor problem with your normalized copy. When it is time to initialize, if the disk you want to initialize has Garfield epilogs, it will not initialize it. Since Garfield epilogs are now normal epilogs, that means any disk which has been previously formatted can not be reinitialized. Solution open the drive door until it reads two IO errors (that awful growling sound) then close the door. The IO error sets the carry flag just as if it found no epilogs at all, and it initializes the “‘unformatted”’ disk. John E, Wanner Playing Tips for... Wasteland Electronic Arts Wasteland is a fascinating role-playing adventure game which uses Uzis and Laser weapons instead of the usual swords and magic. As with many such games, much of the fun is found in exploring the extremely large world scenario and solving its puzzles, but much of the frustration is in trying to obtain a set of survivable characters with enough offensive and defensive weaponry to handle nearly anything in the game. This tip will help you get the strongest armor and most useful weapons in a fairly efficient manner. 1, First, there are four sides to the game disks. Make several copies of each; especially at least 6 copies of disk 2. The fastest way to do this is to let the game disk copy one of each and then copy each of these sides using a fast copy program (like Locksmith Fast Copy.) Be sure to have at least 2 copies of side 1 at all times and reserve one of these. Then anytime you want to do something foolish (like try for the ‘‘big bucks’’ or enter a very difficult area) back your characters up to both. Each save only takes 10 seconds or so. 2. Start with the 4 players you get on disk until, you know what you want. Those characters will survive and you can always add skills as you go through the game. 3. Make your way to the village of Needles, in the central part of the map, just across the river. Enter from the N and you'll be near a police ammo dump. One of your stock characters can probably (save off and keep trying) disarm the booby traps. (Stay away from the old TNT!!) Get more ammo and explosives. Go to the police station, pass the desk sergeant and go to the first room on the right. Have a character with the appropriate skills (keep trying!) pick the lock, search the right wall for the alarm and set it to @. Raid the now disarmed armory. Do not mess with the cells in the jail! This is fatal! 4. Head S to town. You'll have some spare weapons and equipment (I found grenades were next to useless) and find LeRoy’s (2nd building East of the edge of town) and sell your extra gear. I found it convenient to have uniform ammo so I could trade when one person ran low, soI stuck with all 9mm equipment. In any case, you may find LeRoy has some useful goodies you can now afford, but a/ways have a few extra inventory slots for each character. 4, Leaving LeRoy’s you'll probably be confronted with ‘‘jerks‘; if not, go to the alley just W and you certainly will. Kill everyone there except the woman. Hire her. Her name is Christina and she comes equipped with an armor class 5 radiation suit and Uzi. Pick up all the goodies you find and sell them back to LeRoy. You can repeat this and get 2 non- player characters (NPC) named Christina, a fairly powerful combination. Don’t get a third NPC yet! 5. At this point, you may need medical attention. The cheapest place you can get this is the town of Highland, the closest to Ranger Central. If a player is in serious (or worse) condition have your best medic (or doctor if you have one) stabilize to unconscious. Keep trying! The more you use these skills, the better you get. If you can’t cure a disease or condition, go to Highpool and pay for exam and cure, but not for healing. To heal cheaply, repeatedly press . (Set something on it if you’ve got a Ile or Ic.) Make a snack, pop some popcorn, get a soda. In 5 minutes or so, they should have all their hit points back. (Be sure that they're at least UNC first, however. Worse condition will kill them!) 6. Now you're ready for the big bucks. Go to Quartz, just on the E side of the river and S of Needles. Enter from the NE and go S. There you will find a building at the N end of a road. Go S. You will find a building on the corner. With both Christinas in the lead, fight your way in (if you don’t encounter a door guard, it’s the wrong place), get to the back room where Felicia is held captive by Ugly. Save off. Kill Ugly and the guards and either crack the safe or disarm the bomb and blow it with the plastic explosive. There’s about $1000 there. Search the SW of the hideout and find and blow the other safe, getting another $50 or so. 7. Find the courthouse (1 building S$ and E of the hideout) and blast your way in. Go to the second floor and free Danny Citrine and hire him. Go to the 3rd floor and open the SE cell (pick or TNT) where Danny will get you $1000 more. (The BED!!) 8. Disband Danny permanently, save off and repeat 6 & 7 until you have $25000 or so. In so doing, you will fight other bad guys, get more ammo, money and even an occasional sub-machine gun or so and earn experience, too. As your characters gain experience, add only IQ points for a while. Enter the libraries (there’s one near the police ammo dump, for instance) and add skills. Absolutely necessary in the long haul will be assault rifle, doctor and November COMPUTIST #61 17 energy weapon skills. Make sure all your characters (even NPCs) have them. You should also have a couple of players with anti-tank weapon capabilities. Finally, when these are developed, add strength points to one character until they’re at least at 20. 9. Now, go back and get another Christina (unless you've got another strong NPC already.) Pool all your $ to one, disband (Non- permanently) your Christinas and go NE to Darwin. The fastest way to enter is from the SW, but make sure you have radiation suits! The building in the SW corner is the black market. Blast your way in, sell off everything but the canteens and radiation suits and buy 4 more radiation suits, 7 NATO rifles, at least 28 clips of ammo and as many Sabot rockets as you can afford. You'll also need some TNT or plastic explosive if you don’t have any. Go back and distribute the goodies. You’re now ready for the REALLY good stuff. 10. Enter the Citadel. (This is in the mountains to the NW of Ranger Central and N of the Agricultural station.) Save off to both disks! Get as close as possible, then blast anything that moves. Have your AT weapon characters alternate shots with Sabot rockets, LAW rockets or RPG-7s if you have any. Keep blasting. You may have to leave and heal your characters occasionally, but the Citadel characters you kill stay dead, so it eventually gets easier. In the Citadel, you’ll find all kinds of energy weapons and power packs. In the NW section of the second chamber, there is a library where you can get energy weapon capability if you don’t already have it. As soon as possible, equip and start using them. Fight your way straight to the back of the hall near the steps and portcullis. Enter the door at the left of the steps, fight your way to the control wheel and get your strongest character to use strength on it. Enter the steps and open the safe to the E. The combination is ‘‘rosebud’’. This will give you more power packs and more importantly 5 suits of power armor, AC 14, Of course, you can repeat this with as many disks as you need to equip all your troops. If you always sell your extra goodies to LeRoy on the same disk, you can then buy extra power packs, weapons or armor if you mun out or accidentally lose them. With these goodies, you will be able to withstand most any of the nasties you encounter in Wasteland and be able to concentrate on exploration of the world and its puzzles. Ihave been a subscriber to your magazine for several years now and have found it to be of immeasurable value for backing up my valuable software. I recently switched from an Apple Ile to an Apple IIgs and, in doing so, purchased the IIgs version of Springboard’s Certificate Maker. This is a slightly different version of the program than that which was initially introduced about 2 years ago for the Tle. Although the original version would boot and allow one to create a certificate on the IIgs, it failed as soon as you tried to print your creation. The new version recognizes the capability of printing from the printer port of the Unfortunately, when Springboard modified the program to work on the IIgs they also apparently changed the copy protection scheme. At least it appears that way, since neither the softkey in COMPUTIST #39, page 6 nor that in COMPUTIST #43, page 24 works on the new version. In fact, track $22 is now easily readable (this was the track that previously caused problems in making a routine copy) but track $2 cannot be read by a sector editor. G@® Perhaps there is an easy fix to the previous softkeys that will work on the new IIgs version. Not being expert in this area, I would appreciate if someone could take the time to figure one out and offer me a solution. Certificate Maker is a very popular program and no doubt many other readers with IIgs’s will be interested in such a softkey. Softkey for... Rescue on Fractalus Epyx / Lucasfilm @ Requirements C Apple II computer O Original disk © Blank disk C Copy program that ignores errors O Beneath Apple ProDOS (optional) , In Rescue on Fractalus, the player must fly a jet through alien terrain searching for downed pilots. The ship is fitted with antimatter cannons and shields, and the enemy consists of mountain-top gun emplacements and flying saucers. The most striking feature of this program is the terrain. As suggested by the title, it is made up of 3-D fractal mountains. Naturally it is protected, and the protection is extremely difficult to bit-copy. Bit-copies usually died at track $00. The Protection As usual, the first thing I did was watch and listen to the boot sequence. On booting, the disk seems to load all or most of tracks $00 through $07 in order, give the title screens and music, and then loaded tracks $08 through $12 the same way. In a normal boot, the computer reads DOS from the first three tracks and then moves the head way over to track $11. eeu the programmers were not using S. Next I tried to copy the disk. It copied correctly, indicating that Fractalus probably had anormal RWTS. This also meant that I could easily sector edit it. However, there was a read error on track $00 sector $OB. At first I was afraid that my original was already going bad, but as it turned out this bad sector was a beacon signaling the method of protection. Since the protection was on track $00, boot code tracing sounded viable. Examination of track $0@, sector $00 showed that it was completely normal for a slave disk. This meant that RWTS would be loaded from sectors $@@ through $09 into memory from $B60O through $BFFF, and execution of RWTS would begin at $B700. The RWTS, on the other hand, had obviously been modified. The first line, at $B700, had been from “‘STX $B7E9”” to ‘ISR $BBOO’’. $BBOO-$BCS55 is RWTS’s buffer, where sectors are moved during disk access, So it is usually filled with garbage. In Fractalus it contains the protection code. The actual protection code resides at $BB34-$BBCB. First the routine uses the normal ‘Read Address’’ subroutine to find physical sector $08, which is logical sector $OB. On finding the sector, it locates the address header and begins reading bytes at $BB63. Below is a partial listing: BB63- BD 8C CB BB66- 10 FB BB68- BD 8C CB BB6B- 39 FB BB6D- BD 8C CB BB70- 19 FB BPL $BB6D BB72- BD8CCB STA $CB8D,X BB75- 19 FB NOP BB76- BD8C-CB LDA $CA8C, x BB79- 30 FB BMI $BB76 BB7B- BD 8CCB LDA $CO8C,X BB7E- 16 FB BPL $BB7B BB8g- BD 8C CH LDA $CO8C,X BB83- 30 FB BMI $8880 BB85- BD 8CCH LDA $CB8C,X BB88- 19 FB BPL $BB85 There were a few things in this code that looked strange to me. The first, a minor one, was that the branches were alternately BPL and BML. A BPL in this situation indicates invalid data, and why would they want to read that? In the past, I recalled seeing only BMI’s. The answer, of course, is to make sure the program didn’t read the same byte off the disk twice, before the hardware could begin reading the next one. An it ing side-effect is that it also disables Locksmith’s Automatic Boot-Tracer. LDA $C88C,X BPL $BB63 LDA $C98C,X BMI $BB68 LDA $CB8C, x COMPUTIST #61 November | The second thing that was strange was the bytes the program was apparently reading in while it was running. I would boot-code trace a bit further and look at the bytes it would read and store. When I tried to find them on the disk, they were completely different. For example, where the program read ‘EB B6 EF 9A...”, I would find “FD ED BB E6...’”. The third thing that puzzled me was the STA $CO8D,X. This location is usually only accessed during writing or sensing whether or not a disk is write-protected. Actually, I didn’t figure it out until after I had kracked it. The thing that helped me get it was Beneath Apple ProDOS, by the authors of Beneath Apple DOS. In the back of the book there is a section on the ‘‘state-sequence ROM”’. If $CO8E,X and $CO8D,X are accessed, as they are here, the ROM goes to sequence #@ and stays there until the state is changed, as it is in this case by the command LDA $C@8C,X. This command comes 6 machine cycles later. So the effect this routine has is to extend the time used to read the byte by 6 cycles, or about 1.5 disk- bits (each disk-bit takes about 4 cycles to be read in). To understand the significance of this, we will have to examine the disk-bits on a binary level. Below are the bits immediately following the Address Header (DS AA AD) of sector SOB: VLL11111191911111010111110012110111... Normally, the bits are divided into groups of 8 by the hardware as follows: ULLULL1 19101111 10191111 19011119 111... Most nibble-editors display this bit stream in hexadecimal: FF CF CF 9E ay This is what you see when you read the disk normally with a nibble-editor. Remember, though, that Fractalus adds 6 cycles to the third byte, giving us: TLULLL1 19101111 181011111 60 11110111 ... ‘The two zeros are because all disk- bytes must begin with a ‘‘1”’. The hardware treats the third byte as a sync-byte. This gives us, in hexadecimal: FF CF Xx 7 Pao The third byte is uncertain, since shifting states in the middle of a read tends to destroy the read byte. Notice that normally there are 3 binary ones left over, which become part of the fifth byte. In the Fractalus read, these bits have been used up. This will change the next group of bytes completely, just as it changed the fourth byte here! Normally they would be ‘FD ED BB £6..."", butnow they are “EB B6 EF 9A...””, which is what Fractalus looks for! In short, this is a way to hide protection information from hackers’ prying eyes. In addition, bit copiers have trouble reading the ‘‘sync bytes’’ perfectly, so bit copies usually fail. Now, after Fractalus reads in the next $10 bytes, it goes through a mess of adds, eXclusive-ORs, and logical ‘‘and’’s in an attempt to confuse any would-be krackist. It then stores the results at $3F@ and $3F1 and zeroes locations $7 and $71. This is to keep us from simply bypassing the protection routine. I found the needed results easily by boot- tracing. $3FO and $3F1 should be D7 and F9. Incidently, it is possible to boot-trace on a IIc, but it is a little more tricky, as critical bytes can change mysteriously. To softkey Fractalus, I simply overwrote part of the protection code with code to change the 4 above locations and continue. Below is a disassembly: BB34:LDA #$07 STA $03F0 LDA #SF9 STA $03F1 SMP $BBC5 Address $BB34 is on disk at track $00, sector $05, byte $34. Step by Step [2] Copy with any whole-disk copier that can ignore errors. Copy II Plus’s “‘copy disk” option is fine. Don’t use an unmodified COPYA, as it will die on pseudo-sector $0B of track $00. (J Make the following sector edit to the copy: POKE 47426,24 RON COPYA [23] Make the following sector edits to the copy you just made. Trk Sct Byte(s) From To $08 SOE $4A-4B DO F4 EAEA $53-54 0046 EAEA $5C-5D D8 3D EAEA $6F-70 DOF4 EAEA $71-7E AQ 7 BD 8C.CO EA EA A9 FC 85 19 FB D1 F6 DB FO 85 F3 A9 EE 1F8819F4 85 F185 F2 Softkey for... Gauntlet Mindscape Gauntlet is deprotected by a scheme identical to The Twit’s “Infiltrator”’ Softkey on page 8 of COMPUTIST #56. [47] Boot your DOS 3.3 system disk. [2] Tell DOS to ignore checksum and epilog errors and use COPYA to copy the disk. POKE 47426,24 RUN COPYA [3] Make the following sector edits to the copy you just made. Te Trk Sct Byte(s) From To im a ee. = . $00 $05 $34-S40 AQ 10 85 FF C6 AQ D7 8D FO 03 $08 SEA-EC 200002 EAEAEA FF DO 83 4C C6 AQ F9 8D Fl 03 B6 28 44 4C C5 BB Softkey for... [7] (Optional) Change skewing to 4-descending. This will greatly reduce Cofa Courseware loading-time. Emtech W Kequremens Softkey for... Deathsword Epyx @ Requirements 0 COPYA O Sector Editor O 128K Apple Deathsword can be cracked using an adaptation of Mr. Nissel’s ‘‘Arctic Antics” procedure on page 25 of COMPUTIST #56. [4] Boot your DOS 3.3 system disk. [22] Tell DOS to ignore checksum and epilog errors and use COPYA to copy the disk. O SREAD/SWRITE (from COMPUTIST #24) O Fast copy program O 10 blank disk sides O Method of copying DOS to disk (optional) Cofa Courseware is a series of 5 double- sided math disks aimed at senior high school students. The disks all are normal format (COPYA-able), but the copies don’t run. At first the simple protection on these disks had me stumped, since the scheme hasn’t been used in a number of years. Many thanks to Bluebeard for reacquainting me with this protection scheme. The reason the COPYA copies don’t work is that the catalog track has been moved from its normal track $11 to $23. COPYA only copies through $22. The deprotection is simple also. It involves moving the catalog back to November COMPUTIST #61 19 | track $11, sector editing all of the track $11 sectors so that byte $01 is 11 instead of 23, then copying a new DOS from the system master to the copy. I used SREAD/SWRITE to read in track $23 from the original and write back to track $11 of copy, sector by sector. This laborious process might be OK for one side, but ten sides? I then wrote a BASIC program to normalize the catalog track, including the correction of the catalog track numbers. (POKE D,17) {7_] Copy all ten sides with a fast copy program. [2] Type in the BASIC program and SAVE COFACOPY on a disk containing SREAD/SWRITE. Be aware of the typo in COMPUTIST #24. The line ‘‘BSAVE SREAD/SWRITE,A$300,L$3A4"" should read ‘““BSAVE SREAD/SWRITE, A$300, LSA4”" [[37] Run COFACOPY. COFACOPY will prompt you to insert the originals and copies. Be sure to write protect the originals. [4] Copy a normal DOS to the copies. Lacking a method to copy DOS, copy all files to an initialized disk. Softkey for... Mathbusters Spinnaker @ Requirements O copy program O sector editor (optional) Mathbusters can be copied with COPYA, but the copy won’t run until the protection is defeated. Here’s how I found the copy protection: A catalog of the disk shows several programs with either Ie or Ic in the title. I reasoned that the first useful function of the program is to determine whether it was running on a Ile or Ic. A program can do this by checking the bytes at $FBB3 and $FBCO and comparing with the following table: FBB FBCB Type 06 wo He 06 EA Ile 96 Eg enhanced Ile 206 tor I+ A sector editor found the $FBB3 and $FBCO references on track $1E, sector $07. A catalog of the disk showed this sector to be part of BOOTER.OBJ, which loads in at $92DO and is $2BE in length. The first instruction in BOOTER.OBJ is a JMP to $93B7. The FBB3 was located at $9402. (At this point I had bloaded BOOTER.OBJ from DOS, rather than using the sector editor so that I could Jook at the actual memory locations.) I made my non-working copy into a working copy by changing the $93B7 to $9400. (4_] Copy Mathbusters with a fast copy Program. (21 Sector edit Trk Sct Byte(s) From To SIE $08 $05-06 87 93 00 94 [2] OPTIONAL method BLOAD BOOTER.OBJ CALL-151 9201:00 94 BSAVE BOOTER.OBJ, A$92D0, L$2BE Bill Jetz I would like to comment about your back issue section. How about different sections for 5%" disks, 3%” disks, and Igs software? It would make things less confusing, and if someone orders a back issue for a particular piece of software, he can be sure that he won’t get a softkey for the wrong type of disk or computer. That's a good idea but it would be almost impossible to do. Many readers do not send the requirements list with their softkeys. And they often do not mentio