computist scan 64

For The Serious User Of Personal Computers Issue 64 Febuary 1989 USA $3.75 Canada & Mexico $7.00 All Others $8.75 @ REX Featewees - Apple DuoDISK Modification — By Zorro The Bard's Dressing Room III — By Joe Montano EOADIS Adapter — By Bill Jetzer Merging Controllers into Super IOB — By Bill Jetzer The Product Monitor — By Jeff Hurlburt 6 DE Seftkeyo: 4th & Inches *Ace Reporter *Alphabet Express v2.1.5 Balance of Power *Bard’s Tale II GS *California Games *Crossbow *Crossword Magic 4.0 *Dataquest: Presidents Data Base *Dinosaurs *Dive Bomber *Elementary Social Studies Vol 3 Elementary Social Studies Vol 6 *Facemaker *Flight Simulator II v2.0 *Galaxian *The Games - Summer Edition *Grammar Gremlins *Kings Quest III *The Last Ninja *Math Shop *Microtype *Mini-Putt *New Oregon Trail *Notes ‘N’ Files Number Bowling *Paperboy *Path Tactics *PFS Write Principles of Economics *Reader Rabbit *Shadowgate *Shape Starship v2.1.5 1986 ¢Skate or Die *Starglider ¢Star Maze *Story Writer Super Sign Maker °Troll’s Shop Right *Ultima V ¢Zany Golf | IBM | BRIDE SE = softkey: wBalance of Power MEnable v1.10 Mean 18 Golf & Arch llMemory Shift v2.1 MPC Draw v1.4 M@Personal Communications Manager v1.0 Trivia Fever BULK RATE COMPUTIST U.S. Postage PO Box 110846-T PAID Tacoma, WA 98411 Tacoma, WA Permit No. 269 You have a LEGAL RIGHT to an unlocked backup copy of your commercial software Our editorial policy is that we do NOT condone software piracy, but we do believe that users are entitled to backup commercial disks they have purchased. In addition to the security of a backup disk, the removal of copy-protection gives the user the option of modifying programs to meet his or her needs. COMPUTIST a Editor: Charles R. Haight Circulation: Karen Fitzpatrick Advertising, call: (206) 474-5750 Publisher: SoftKey Publishing Printing: Valco Graphics & Printing @ Address all advertising inquiries to: COMPUTIST; Advertising Department; PO Box 110816; Tacoma, WA 98411 @ Mail all RDEX letters to: COMPUTIST Apple RDEX or —_IBM-RDEX PO Box 110846-K Tacoma, WA 98411 @ COMPUTIST does NOT purchase editorial material. The entire editorial content consists of information submitted to COMPUTIST for publication in the shared interests of all COMPUTISTs. @ Unsolicited material (manuscripts, letters to the editor, softkeys, A.P.T.s, playing tips, questions, etc.) are assumed to be submitted as letters-to-the-RDEX-editor for publication with all and exclusive rights belonging to COMPUTIST. @ Entire contents copyright 1989 by SoftKey Furthermore, the copyright laws guarantee your right to such a DEPROTECTED backup copy: «It is not an infringement for the owner of a copy of a computer program to make or authorize the making of another copy or adaptation of that computer program provided: 1) that such a new copy or adaptation is created as an essential step in the utilization of the computer program in conjunction with a machine and that it is used in no other manner, or 2) that such new copy or adaptation is for archival purposes only and that all archival copies are destroyed in the event that continued possession of the computer program should cease to be rightful. Any exact copies prepared in accordance with the provisions of this section may be leased, sold, or otherwise transferred, along with the copy from which such copies were prepared, only as part of the lease, sale, or other transfer of all rights in the program. Adaptations so prepared may be transferred only with the authorization of the copyright owner." United States Code title 17, §117 Publishing. All rights reserved. Copying done for other than personal or internal reference (without express written permission from the publisher) is prohibited. @ The volunteer and paid editorial staff assume no liability or responsibility for the products advertised in the magazine. Any opinions expressed by the authors are not necessarily those of COMPUTIST magazine, its staff or SoftKey Publishing. @ Apple® is a trademark of Apple Computers. IBM® is the IBM trademark. SUBSCRIPTIONS: Rates (for | issues): US.—$32 US. Ist Class—$45 Canada/Mex.—$45 Other Foreign—$75 @ Send subscription inquiries to: COMPUTIST; Subscription Department; PO Box | 10846-T; Tacoma, WA 98411 @ For Domestic Dealer rates: Call (206) 474-5750 for more information. © Change Of Address: Please allow 4 weeks for change of address to take effect. On postal form 3576 supply your new address and your most recent address label. © Issues missed due to non-receipt of change of address may be acquired at the regular back issue rate. ¢ We are not responsible for missing issues 90 days after mailing date. If you do not receive one issue each month, call or write. COMPUTIST #64 Writing to the RDEX editor RDEX stands for: Reader’s Data EXchange. We print what you write. When you send in articles, softkeys, APTs, etc., you are submitting them for FREE publication in this magazine. RDEX does NOT purchase submissions nor do we verify data submitted by readers. If you discover any errors, please let us know. © Remember that your letters or parts of them may be used in RDEX even if not addressed to the RDEX editor. Correspondence that gets published may be edited for clarity, grammar and space requirements. © Because of the great number of letters we receive and the ephemeral and unpredictable appearance of our part-time staff, any response to your queries will appear only in RDEX, so it would be more appropriate for you to present technical questions to the readers and ask for their responses which will then be placed in the Apple-RDEX. © Please include your name (or pseudonym) and address so we can forward your mail. @ Whenever possible, send your articles and letters on disk as standard text files. When we get your letter-article in a text file, it is immediately uploaded into the most current RDEX file. We will return your disks, whenever possible, with the current library disk copied onto it. Conventional letters must be typed in by us, with resultant delay and errors. @ When you send your material on disk, try to use a disk formatted for Apple DOS 3.3. It makes things a lot easier for us. @ When writing to request help, be sure to include ALL relevent information. The more information you include, the easier it is to figure out what is the matter. Our readers Privacy is important, so we will not print your address unless you specifically say too. @ When writing to one of the RDEX authors. Write your letter and seal it in an envelope. Put your return address, the authors name (as it appears in RDEX) and the correct postage on the envelope. Put this envelope into another and send it to RDEX. We will put the correct address on your letter and drop it into the mailbox. @ Address your letters, articles, to: COMPUTIST RDEX Editor PO Box 110846-K Tacoma, WA 98411 Attention Apple-users: Why type those I-o-n-g listings when you can just Upgrade your present subscription to a Magazine Plus 5%" Disk Combination subscription? You may upgrade your current subscription to a magazine & disk combination by sending $5.50 ($6.50 foreign) per remaining issue. Time to renew? 1 Check your mailing label to see if you need to renew your subscription. 1 Use the order form on this page to renew, and don’t forget to send your most current mailing label to help expedite your renewal Moving soon? @ If you're moving, let us know at least 30 days in advance. I Issues missed due to non-reciept of Change-of-Address may be acquired at the regular back issue rates. @ Remember, the Post Office does not forward third class mail unless requested. COMPUTIST is not responsible for replacing issues lost while forwarding order is in effect. fctees== Sete | @ Yes, I want to subscribe to COMPUTIST. Enclosed are funds H for a one year (12 issue) subscription. | am... A new subscriber C Renewing my current subscription Changing my address (please include last mail label) {have..C Apple! Olle C Ilgs 0 1BM~ CO IBM compatible O llc C Apple compatible © Transporter card Apple—IBM subscription rates. O US. - $32 G U.S./Canada/Mexico First Class - $45 C All other Foreign - $75 Apple mag-disk combination subscription... 0 U.S./Canada/Mexico First Class plus Library Disk - $100 C All other Foreign plus Library Disk - $140 Name ID# Address City State Zip Country bs) . . a Exp. Phone. Signature cP64 U.S. Funds drawn on U.S. bank. Allow 4—8 weeks for first issue. Mail to: 846-T Tacoma, WA 98411 (206) 474-5750 —— r February SGdaogedaaaodadad HOOPS! William W. eave a ot Many of you have already noticed the ‘‘1988’’ on your Fdwond ae January COMPUTIST. After a lot of finger pointing, it was Sunnie Dinnel . . 8 decided that I was the one who was supposed to keep track of Square the year. Boy are we in a lot of trouble. I’m one of those people who are still writing ‘‘1988’’ on their 1989 checks well into Tom s we March. And besides, I have a whole ‘nother year to forget to Diane Dan change the next January issue. For those of you who wondered what the question mark meant on the January cover next to Jeff Hurburt’s Product Monitor title, it means I’m a rotten typist and nobody checks the cover. The question mark is a ‘‘typo’’. i Hardware (Software) Hackers I’ve only gotten one response from a hardware hacker, so far. I’ll be calling him back next week. If there are any of you out there who can hear me, I’d really like to get in touch with you. I think we can do some neat things together. Also, when we get the hardware together, we’re going to need someone to work on the firmware. So if you’re interested, get your name to me ASAP (As Soon As Possible). I will keep you posted on our progress so you can get a prototype as soon as they are ready. Wilding . . Willems . COMPUTIST #59, pg 32. Appleworks and ImageWriter II, see page 8. COMPUTIST #60, pg 21. Ultima V, see page 21. COMPUTIST #60, pg 35. Appleworks Cursor, see page 7. COMPUTIST #61, pg 22. PFS Series, see page 8. 4 COMPUTIST #64 February COMPUTIST *64 Table Of Contents Febuary 1989 é Softkeyp: 4th & Inches Ace Reporter Alphabet Express v2.1.5 Balance of Power Bard’s Tale II GS California Games Crossbow 1.05 Crossword Magic 4.0 . Dataquest: Presidents Data Base Dinosaurs ... Dive Bomber Elementary Social Studies VOl'3 sisvessereesnseonsnonacen 14 Elementary Social Studies Vol 6 Facemaker Flight Simulator II v2.0 Galaxian . The Games - Summer Edition Grammar Gremlins . Kings Quest HI The Last Ninje Math Shop .. Microtype Mini-Putt . New Oregon Trail Notes ‘N’ Files Number Bowling Paperboy . Path Tactics PFS Write ... 8 Principles of Economics .......13 Reader Rabbit . 37 Shadowgate .. Shape Starship v2.1.5 1986 CAPT: Gauntlet... Into the Eagles Nest Moebius ..... Wings of Fury © Playing Tips: Alien Mind 00... 28 Bard’s Tale IT The Last Ninja 6 Hotes: A bit copy for Algeblaster. A bit copy for Alien Mind. a A bit copy for Homeworker......... 23 A bit copy for Where in the USA is Carmen SanDieg 25 A look at Alien Mind (igs) A look at GS/OS A look at Tomahawk (IIgs) . An alternate to COPYA? More on Appleworks and printer Playing Notes on-Thexder Super Index “‘Bugs’” The meaning of ‘‘M’ Saving Strip Poker II pictures .....27 Most Wanted Softkeys.........0.000+.37 @ Features: Apple DuoDISK Modification ........ 11 orro describes a step-by-step procedure to install a write protect override switch. The Bard’s Dressing Room Ill ....... 26 Joe Montano to the rescue with his character editor for Bard's Tale Ill. EOADIS Adapter .................. L5 Bill Jetzer finds another version of the EOA programming language and shows you how to get this one too. Merging Controllers into Super IOB .. 16 Bill Jetzer’s step-by-step guide to reduce frustration. The Product Monitor................20 Jeff Hurlburt look at the Apple lgs Toolbox Reference: volumes | and land mouse pads 45 kate or Die Sole . Enable vi.10.. 45 Star Maze Mean 18 Golf & Arch. 44 Story Writer Memory Shift v2. 44 Super Sign Maker PC Draw v1.4. 44 Troll’s Shop Right Personal Communications Ultima V .... Manager v1.0.0... 45 Trivia Fever....ssssscssseseseeee 44 c ] [February COMPUTIST #64 5 New COMPUTIST readers using Apple Hs are advised to read this page carefully to avoid Srustration when attempting to follow a softkey or entering the programs printed in this issue. What is a softkey, anyway? Softkey is a term which we coined to describe a procedure that removes, or at least circumvents, any copy-protection on a particular disk. Once a softkey procedure has been performed, the resulting backup copy can usually be copied by the normal copy programs (for example: COPYA, on the DOS 3.3 System Master disk). Commands and control keys Commands which a reader is required to perform are set apart by being in boldface and on a separate line. The key must be pressed at the end of every such command unless otherwise specified. Control characters are specially boxed. An example of both is: 6G) Press [6]. Next, place one finger on the G=) and then press (P]. Don’t forget to press or (GQRESET). In the former, press and hold down @= then press (RESET). In the latter, press and hold down both C=) and (@) then press (RESET). Software recommendations ‘The Starter Kit contains most of the programs that you need to ‘“‘Get started’’. In addition, we recommend that you aquire the following: © Applesoft program editor such as ‘Global Program Line Editor (GPLE)’’. @ Assembler such as the ‘‘S-C Assembler” from S-C software or ‘‘Merlin/Big Mac’’. © Bit-copy program such as ‘‘Copy II Plus’’, “*Locksmith’’ or ‘‘Essential Data Duplicator (EDD)”’. @ Text-editor (that produces normal sequential text files) such as ‘‘Applewriter II’’, ‘‘Magic Window II’ or ‘*Screenwriter II’’. @ “COPYA”, “FID” and “MUFFIN” from the DOS 3.3 System Master disk are also useful. Super IOB and Controllers This powerful deprotection utility (in the Reset into the Monitor Softkeys occasionally require the user to stop the execution of a copy-protected program and directly enter the Apple’s system monitor. Check the following list to see what hardware you will need to obtain this ability. Apple II +, //e, compatibles: 1) Place an Integer BASIC ROM card in one of the Apple slots. 2) Use a non-maskable interrupt (NMI) card such as Replay or Wildcard. Apple Il +, compatibles: 1) Install an F8 ROM with a modified reset-vector on the computer’s motherboard as detailed in the “Modified ROM’s”’ article (COMPUTIST #6 or Book Of Softkeys III) or the ‘‘Dual ROM’s”’ article (COMPUTIST #19). Apple //e, //c: Install a modified CD ROM ‘on the computer’s motherboard. Cutting Edge Ent. (Box 43234 Ren Cen Station-HC; Detroit, ‘MI 48243) sells a hardware device that will give you this important ability but it will void an Apple //c warranty. Apple //gs: If you have the 2.x ROM, there is a hidden classic desk accessory (CDA) that allows you to enter the monitor. In order to install the new CDA, you should enter the monitor before running any protected programs (CALL -151) and press ‘“# will turn on two hidden CDAs, Memory Peeker and Visit Monitor. ‘Thereaher press [2S ESC) to go to the Desk Accessories menu. Select “Visit Monitor” and there you are. Use (G¥) to exit. Recommended literature: © Apple II Reference Manual (or He or IIc) © DOS 3.3 manual © Beneath Apple DOS & Beneath Apple ProDOS, by Don Worth and Pieter Lechner, from Quality Software Keying in Applesoft programs: BASIC programs are printed in a format that is designed to minimize errors for readers who key in these programs. If you type: 10HOME:REMCLEAR SCREEN The LIST will look like: 1@ HOME : REM CLEAR SCREEN ..-because Applesoft inserts spaces into a program listing before and after every command word or mathematical operator. These spaces don’t pose a problem except when they are inside of quotes or after a DATA command. There are two types of spaces: those that have to be keyed and those that don’t. Spaces that checksums (See Computing checksums) to match up, only type spaces within quotes or after DATA statements if they are shown as delta (*) charactors. Keying In Hexdumps Machine language programs are printed in COMPUTIST as hexdumps, sometimes also as source code. Hexdumps are the shortest and easiest format to type in. You must first enter the monitor: CALL -151 Key in the hexdump exactly as it appears in the magazine, ignoring the four-digit checksum (G and four digits) at the end of each line. When finished, return to BASIC with: BSAVE the program with the filename, address and length parameters given in the article. The source code is printed to help explain a program’s operation. To enter it, you need an “Assembler’’. Most of the source code is in S-C Assembler format. If you use a different assembler, you will have to translate pieces of the source code into something your assembler will understand. Computing checksums Checksums are 4-digit hexadecimal numbers which tell if you typed a program correctly. ‘There are two types of checksums: one created by the CHECKBIN program (for machine language programs) and the other created by the CHECKSOFT program (for BASIC programs). Both are on the ‘‘Starter Kit’’. If your checksums do not match the published checksums then the line where the first checksum differs is incorrect. CHECKSOFT instructions: Install Checksoft (BRUN CHECKSOFT) then LOAD your program. Press [&] to get the checksums. Correct the program line where the checksums differ. CHECKBIN instructions: Enter the monitor (CALL -151), install Checkbin at some out of the way place (BRUN CHECKBIN, A$6000), and then LOAD your program. Get the checksums by typing the Starting address, a period and the Ending address of the file followed by a (G¥). COMPUTIST Starter Kit) and its various must be typed appear in COMPUTIST as delta SS85-EEKE ey Controllers are used in many softkeys. (It is also characters (*). All other spaces are there for Correct the lines at which the checksums on each Super IOB Collection disk.) easier reading. NOTE: If you want your differ. ..--...--+...0--+see0+ RDEXed Ls COMPUTIST #64 February | Playing Tips for... Bard's Tale IT Electronic Arts © The code for DREAMSPELL is ‘ZZGO’. * KATO’s BRACER if given to a monster, won’t turn against you (in some situations). © SPEEDBOATS aids in running from fights. MAGE STAFF regenerates spell points and boost AC by 2. © PIPES of PAN creates LIGHT. * SONG AXE does 64-256 damage and has a range of 80’ * AG’S ARROWS do 24-194 damage and have a range of 90’. * ELF BOOTS avoids Bad Spells, Thrown Weapons, Dragon Breath. * NOSPIN RING deactivates all SPINNERS. © THIEF DAGGER gives a thief an increased chance of hiding in shadows. ¢ WIZARD HELM casts WIZARD WAR. ¢ LUCK SHIELD helps avoid Bad Spells, Thrown Weapons and Dragon Breath. ¢ ARAM’S KNIFE can be thrown at any range and does 128-512. @® Does anyone know how to edit “Dino Eggs’’ and get more men? @® Where can I find character editors for: Deathlord (Electronic Arts) 2400 A.D.(Origin) Wasteland (Electronic Arts) Questron II (SSI) Times of Lore (Origin) Bard’s Tale I, I, 1 @® [have some problems with Bard’s Tale II: The Destiny Knight. Is there a way to prevent the loop which occurs when one of your characters or monsters turns against your party and keeps attacking even when everyone is dead? (ie. I had a dragon which became insane and began to breathe on the party, all my characters died. He began to attack itself but couldn’t kill himself because it’s armor class was to low. I turned off the computer, losing all gained experience, gold, and magic items. It just wouldn’t stop! Does anyone have a character/item editor for Bard’s Tale 01? Is there a way to modify the dungeons and monsters, by creating your own? Is there a way to list magic items and their Ppowers/effects for Bards Tale I,I,and III? Is there a way to print the layout of the cities or dungeons in Bards Tale I, It & I? Is there a way to print the character lists with their possessions and attributes from the character disks? Is there a way to print the monsters with their maximum hit points and powers? (Bards Tale I or I) How do you get the NIGHTSPEAR out of the TOWER in ARBORIA in Bards Tale III? Ge) Questions for Bard’s Tale I. What does Fins Flute do? What does a SORCERSTAFF or POWERSTAFF do? What does a TROLLRING do? What does a RING of POWER do? What does a HAWKBLADE do? What does a SOUL MACE do? What does a CONJURSTAFF do? How can you prevent energy drain from effecting your characters? Thank you! I hope you can help solve my problems and that you find my tips useful in your publication. Too much for me. How about a Bard's Tale fan answering this one? .......... RDEXed Softkey for... Bards Tale II GS Electronic Arts It is nice to know that some things stay consistent in our ever changing world. One of those things is the location of the copy protection on the Bards Tale series. It is once again in the file Burger, this time on the version for the Bards Tales II for the IIgs. The protection is similar to the earlier versions in that it checks the disk for a bad block. Of course, a few other things go on with the check, but the actual code which causes the disk too hang up is very simple. Below is the only snippet of code you need to worry about. ECS: BO 8 BCS ECF BEC7: AQ OL LDA #91 ECO: 8F 55200 STA GOA255 GECD: 18 cic GECE: 6B RTL GECF: A9 8 LDA #90 EDI: 8F55A2 80 STA OGA255 EDS: 38 SEC GED6: 6B RTL A comparison is done just before the branch on carry set (BCS). If this comparison fails, (not the original) the jump to $OECF stores a zero, sets the carry and returns. If the comparison is true, a one is stored, the carry is cleared and it returns. The easiest way to circumvent this appears to be to change the A9 #0 to A9 Ol and change the 38 to 18. This is only true because no other instructions were carried out when the comparison was good. Therefore we can simply make the outcome of either a good or bad comparison the same and defeat the check. For a cookbook: Search the disk for A900 8F 55 A2 00 38 and change the first 90 to 01 and the 38 to 18. This is in the file BURGER, so if you wish, you can copy that file to a 544" disk and do the correction there. Thave not encountered any problems with this method so far. However, I had already completed the first half of the game before I cracked the protection, so there may be a problem I don’t know about. If you encounter any difficulties, please let me know. Happy computing! The Appleworks cursor change by Jack R. Nissel (COMPUTIST #60) was incorrect for the Enhanced Apple computer. The Patch should be as follows: BLOAD APLWORKS.SYSTEM, TSYS, A$2000 POKE 11681,64 BSAVE APLWORKS.SYSTEM, TSYS, AS2000 The 64 in the poke line will give you the solid-apple cursor. A change to 65 will give you a open-apple, and 85 will give you a right- arrow. I hope you continue to put small patches in your magazine. I find them very interesting. ‘ob I’m in complete agreement with the praise that I see in the letters to COMPUTIST. The article “‘The Deprotection Game’’ by Gerald E. Myers in COMPUTIST #59 was worth an entire year’s subscription. I hope your readers will continue to send in articles of this type as beginners find some of the RDEXs quite formidable. @®) I need some help removing the copy protection from a program called Information Master by High Technology. I bought this program about five years ago and would like to put it on a hard disk. They do not make a version for the IIgs, and my 54” disks are getting worn out. I have spent years putting my entire home inventory on disks and do not want to risk losing this data. Any information you have on this would be appreciated. There is a softkey for Information Master in COMPUTIST #43. Try that first and if it doesn’t work we'll ask our readers for help February COMPUTIST #64 Notes on Thexder To beat the game, you have to go throughout all 17 levels 2 or 3 Times before you beat the master computer! With Paint Works Plus, 816 Paint (or with any other paint programs) you can change Credit-Pic, Title.Pic, and Thexder.Pic (which is from Fantavision GS) to whatever you want. On 816, do it in 320 mode and save it as a binary 320x200. On Paintworks, save as SCREEN format (I think). If you do otherwise you will get a black screen and if you are lucky there will be a few red dots. A good idea is to have 2 files: Thexder and Thexder 1, one of these having unlimited men. Then copy the normal file THEXDER from the original, first renaming the cheat version. However, this omits putting ProDOS on the disk due to space. ©@®> Help! I have MegaBots by UXB (Spinnaker) and I was filling out the softkey when I found an error. Before this, I knew there was an error, but all I had to do was renane the Hello file and get another DOS from another disk. I then completed the deprotection and it worked. I wish I could say the same for the file DROIDS. There is an /O error in DROIDS and it cannot be fixed. I would deeply appreciate someone who has Megabots to send me a printout or the file on the disk. Square Eyes, 221 W. Sola St., Santa Barbara, CA 93101 Dr. Li Softkey for... er §. Cohen PFS. Write Software Publishing Corp COMPUTIST #61 gives de-protections for the PFS series of File, Report, and Graph. I tried it on PFS.Write and it works there too. Add to your instructions, that it is necessary to UNLOCK the .SYSTEM file before you can tun the program. This I did with Copy II Plus. I checked, and now all four of my disks can be copied. Thanks! COMPUTIST and have enjoyed every issue. M Todd I have two things for you today. First, I tried the APT for Thexder in COMPUTIST #60, pg.18. The read of block $586 was not the same on my copy of Thexder, which is another reason for giving the old hex bytes to be changed. I used COPY II + to search for the six bytes listed and found them in exactly the same position in block $OSFF. I changed the value, wrote it back to the disk and it worked perfectly. Now you can see what is happening. Secondly, I would like to add my vote for Gauntlet by Mindscape as the worst piece of software I have. The best one is COPY I+ by Central Point Software. Thaven’t tried the Pirates softkey yet, but Ihave been waiting to play it until I can make acopy. I’m also waiting on a softkey for Alien Mind. It appears to be heavily protected and I’m going to look at it before reading the answers in your magazine. I really like your articles and hope to be a contributor one day. Keep up the good work and keep the magazines coming. I try to spread the word at our computer club meetings. I would still like to see some hardware Projects. @®) What’s the point of going to ProDOS when Apple keep updating it? Imean, I get everything I want out of my II+ clone and DOS 3.3 that was available in 1984-5. The only reason to update is for programs written for the Te. @® The disk patch to ProDOS 1.0.1 that allows it to run on clones doesn’t work with newer versions. Please provide the new patches for other versions of ProDOS. G® Has anyone heard of ‘Maestro Videotex Software’’ v2.0 Modem Card? I can’t back it up. Softkey for... @D I would appreciate someone sending me a way to unlock Apple Writer I for the Apple I+. Since I’m not technically oriented, a cookbook approach would be a big help. In addition, I wonder if there is a way to combine the 80 column pre-boot disk and the Apple Writer II program disk on one disk. I have been a charter subscriber to The Games - Summer Edition EPYX This softkey is based on information by Scott Simon in COMPUTIST #60. Epyx, as well as several other software companies, have been using a new protection described earlier in COMPUTIST called PROLOK. I used this information and was able to produce an unprotected COPYA version. @ Requirements (1 COPYA O Sector Editor C 4 Blank Disks [4] Boot your DOS 3.3 system disk. [2] Tell DOS to ignore checksum and epilog errors and use COPYA to copy side A of disk one. Side B and disk two are not protected. POKE 47426,24 RUN COPYA [3] Sector edit the copy you just made. Trk Sct Byte(s) From To $08 $08 $4E-4F DOF4 EAEA $57-58 DO 4C EAEA $60-61 D843 EAEA $73-74 DB F4 EAEA $77-—-AQG7 BD 8CCB EA EA AQ FC 85 19 FB 99 FO 08 FO 85 F3 AD EE EA8810F4 85 F1 85 F2 [4] Make sure you write the changes back to your copy. For those of your readers who use E.D.D. I have found parameter preanalyze OO=90 will copy most of Epyx new releases and some of the other releases that use PROLOK protection. nie Dini In COMPUTIST #59, Dr. Frank Lowney wrote about fixing the Appleworks SEG.PR file to accumulate a few neat ideas. Since I don’t have my Imagewriter2 with me, I tried to fix the SEG.PR file for my Epson MX-8OFT w/GRAFTRSX +, but it didn’t want to work. says to change [@B) 1 to Gea) (eae) CD (cB) (esc) |F . Is there a error somewhere? Wouldn’t (8) (Ese) be the equivalent of the ‘‘Solitary Escape’ he refers to on pg. 33 in the “‘custom printer’’ column? A few other changes (errors) could be made: 1. Change BSAVE RAM TEMP, A$2000, E$2568 to BSAVE RAM TEMP, A$2000, E$24B9, else you will pick up the Scribe code too, 2. Change BSAVE SEG.PR, TSYS, AS2@00, ES4ES6 to BSAVE SEG.PR, TSYS, A$2000, E$2ES6, else you will get a disk full error. Thanks to all who write such interesting articles to benefit the rest of us. COMPUTIST #64 February | Gerald E Myers In COMPUTIST #60, pgs. 10-11, Bill Jetzer and RDEXed asked if anyone knew what the M_ stands for when you press in the monitor to get the present contents of the A,X, and Y registers and the stack contents. (IIc enhanced.) Most (all?) Apple monitors offer the control-E (for Examine) command to check the contents of the registers, the Laser 128 does not, but the Laser 128 techical manual does tell you where to look for these values, and in the process tells all about the mystical ‘‘M’’. For Laser 128 folks without the technical manual, and Apple people who always wondered where the Control E fetched the information from, it’s on the zero page, Memory locations $44 thru $49, and goes like this: $44 = M (memory configuration). Now you know what ‘M’ means. Each bit is a boolean value (1=True, O=False). © Bit 7 = Aux zero page, stack, & upper 16K switched in. * Bit 6 = Both 8O-col store and page 2 access switched in. © Bit 5 = Aux 48K RAM is switched in for reading. © Bit 4 = Aux 48K RAM is switched in for writing. * Bit 3 = Upper 16K is switched in for readi ling. _ © Bit2 = Bank 1 of the upper 16K is switched in. © Bit 1 = Bank 2 of the upper 16K is switched in. © Bit © = Internal $Cxxx ROM is switched in. © $45 = Accumulator value. © $46 = X-Register value. © $47 = Y-Register value. © $48 rocessor status Register value. © $49 = Stack pointer value. Hope this helps Bill Jetzer and perhaps others onward to bigger and better cracks. Softkey for... Balance of Power Mindscape i Requirements O Copy I Plus O RAM Card (not the 80 Column RAM) OA ProDOS block editor [7] Make a bit copy of the original. [22] Copy UTIL.SYSTEM (from Copy II Plus) and your block editor to the RAMX. [3] Boot the original. When the drive stop pres . You'll be in the monitor. 300:AD 8B CO 4C 03 BF N300G [74] Enter the prefix ““/RAMX”’, then the path name (the name of your block editor). Read block $E5. Search for BD 89 C0 AG 86 20 91 FF 88 and change BD to 69. Write the block back to the copy. Boot the copy. When the drive stops, press : 300:AD 8B CO 4C 03 BF N 300G [7] Enter the prefix /RAMX and “UTIL.SYSTEM”. [8] Copy all the files from Balance of Power to the RAM card. [9] Boot Copy II Plus and format a ProDOS disk with volume name /BOP. Copy the files from the RAM card to the disk. Copy a normal PRODOS instead /BOP PRODOS. The protection is in the PRODOS file. Note: Don’t try to search for the string with Copy II Plus sector editor and modify it. The disk will not boot. You must use the ProDOS M.L.I, using /BOP:PRODOS. Thanks to Gerald E.Myers for the article the deportection game on COMPUTIST #59, which help me to deprotect /BOP. Joseph Karwo! Softkey for... Crossbow Absolute Entertainment [2] Copy both sides of Crossbow. I used Copy II+ sector copy. [2] Rename the boot program to ““G.MAIN”’. I used Copy I+. Enjoy the game. Bit Copy for... Alien Mind PBI @ Requirements O Copy Il Plus (3%" version) In COMPUTIST #61 Dan Halfwit asked if anyone had any hints on how to crack or even copy Alien Mind. I have no idea how to crack this disk, however I have made a back-up of it. The disk is very well protected, and I’m glad to see that they also spent a lot of time on the game as well. The only hints that I have changed the address header to DSAAAA, along with all the others. I hope some of the “Wiz Kids’’ out there can soon crack this program, my method takes a lot of time. On to the important material, how did I get a back-up! Here is the cookbook method that I used: (J Get out your Copy + 3%” bit copier. [2] Copy TO to T1 - Keeping the track length (don’t worry about error #6 on side 2). [3] Copy T2 to T4F using the following Parameter changes. 91=09 PA=03 1D=AA 55292 Note: I got “‘5’’ errors on tracks 30 to 3F [4] Reset all the parameters to normal. I just bought Crossbow,and when I get a new piece of software, my first task is to make a back-up of it, I refuse to use any software without having a back-up. I first checked my issues of COMPUTIST to see if this program has been “‘cracked’’. Why re-invent the wheel? To my surprise, I could not find it, I was on my own. I first copied the disk with sector copy from Copy II Plus. It copied with “No Problem’? but when I booted the disk, it ““Bombed’’. I decided to catalog the disk to see if they were using ProDOS or DOS. When I saw that they were using DOS, I decided to check out the ““HELLO”’ program ( it’s a binary file called “XMGPRTTI”’. I decided to by-pass this program by changing the ‘‘HELLO”’ name to ““G.MAIN”’. My program works fine now. 5] Copy T30 to T3F using normal bit copy. [6_] Use the same method for disk #2. Enjoy the game, I don’t know how good this copy is because I have not solved the game yet. Edward Teach A.P.T. for... Into The Eagles Nest The high scores are stored in track $13, sector $OD. If you look at the last half of this sector you will find the credits for the programmers. (What is ‘“‘DINKY’ DOS | February COMPUTIST #64 anyway?). The last byte in this sector ($FF) is the flag to show if you have completed the first castle. To be able to access either castle change this byte from a period “‘.”’ ($AE) to an exclamation point ‘“!’” ($A1). Now when you boot the game it will ask which castle do you want? Allan Pearl Ever since I “‘discovered’’ the Visit Monitor option on the new Hgs control panel, T’ve found it to be quite useful. Some games like Broderbund’s Wings of Fury were extremely hard to read the sectors off of, in order to edit for bombs, rockets, etc. A.P.T. for... Wings of Fury Broderbund [4] Activate the hidden CDA’s (see Iigs/ Page 6). [2°] Boot the disk and start the game at any rank you wish. [3] Press Be very careful when you do this or the program may reboot. Select ‘‘Visit Monitor’ in the CDA. [©] Once in the monitor, you can start editing. Bombs are located at $01/A9AA, rockets are at $01/A9CE and torpedoes are at $O1/A9BD. For maximum of all three weapons type: O1/ASED:FF ASCE:FF ASAA:FF This only needs to be done once after the game has been booted. You can use this on just about any game. All you have to know is what to look for and what to change it to, when you find it. A.P.T. for... Gauntlet Mindscape Boot the disk on the back side and start the game. When the game starts enter the monitor. (Use the CDA.) To stop the one hit point countdown, change $681F from E991 toEAEA. And as for Ghosts and other monsters, I found a few of their damage points located near $8360-$83AF. I typed in 8360:08 N 8361< 8369. 83AFM. This will not make you completely immortal, but it will elimate many menaces. G® What's the deal with Electronic Art’s Deathlord and Chuck Yeager’s? Is this new protection impossible? I remember when I thought Dino Eggs was impossible to even copy, not to mention deprotecting it. So I urge you all to take notice of this new protection. I’m sure someone out there is capable of deprotecting or even finding a parameter for copying this. I anxiously await the day when I see ‘‘Deathlord’”’ on the front of my next COMPUTIST magazine and off the Most Wanted list forever. Because the nibble count would access the disk drive, I used the Copy II Plus Sector Editor to search for 8CCB ($CO8C). I then marked each of these occurances on the hardcopy printout. I looked at the code for a JMP (4C) or a JSR (20) after each occurance on the hardcopy, as one of these often is associated with a nibble count. Only one JMP followed a LDA $CO8C. I NOP’d the JMP. The unprotected copy of Paperboy, with normal formatting, now boots and runs with no problems, Frank Thompson (42_] Boot your DOS 3.3 system disk. Softkey for... [72_] Tell DOS to ignore checksum and epilog errors and use COPYA to copy the disk. Paperboy PORE 47428,24 Mindscape RUN COPYA @ Requirements [13_] Make the following sector edits to the copy you just made. O COPYA I Copy I Plus Trk Sct Byte(s) From To O Blank disk $14 $01 $2F-31 4C 47 22 EAEAEA O Paperboy (ProDOS Ile version) Many people may not need to copy their game programs, but when my son, Mike, and his friends get together to play Paperboy, I have visions of them pretending they are paperboys and using the original disk as a pretend paper. Unfortunately, Mindscape switched to ProDOS for this program and the DOS 3.3 cracks, which have appeared many times in COMPUTIST, do not work. T'll go through a description of how the disk was deprotected as an aid to deprotecting similar ProDOS protection approaches. Copy II Plus would copy the disk, but it would stop running shortly after loading a HiRes screen with garbage. It looked like a nibble count at work. When I tried to read the disk with Copy II Plus Sector Editor, the sector editor wouldn’t read it. It obviously had a non- standard format. I then copied the orginal with COPYA after poking DOS to ignore the read errors. This copy also hung up at the garbage HiRes screen. I had to disable the nibble count next. The nibble counts in most of the ProDOS programs seem to be in the .SYSTEM files. I first had to find the location of the SYSTEM file, which in Paperboy, is called PBLOAD.SYSTEM. Using Copy II Plus ‘‘View Files’ Utility, I printed a hardcopy of this file. Using the Copy II Plus Sector Editor ‘‘Search’’ Utility, I searched for the hex bytes at the beginning of the PBLOAD.SYSTEM hardcopy. This gave me the track and sector numbers for the first portion of the file. Marking the end of the file ‘on the hardcopy, I then searched for the hex bytes at the top of the next portion of the program. In this way, I identified track $14, sectors $01, $04, $05 and $OF as the location of the file. The ProSel Block Warden program can find the track/sectors more easily. Softkey for... 4th & Inches Accolade @ Requirements O Block editor Make a fast copy of the master disk using your favorite copier. There are no errors. Then, using the block editor, read in block $C5. Make the following changes: Block Byte(s) From To $5 $02 2g7rit EAEAEA SDF ag777? EAEAEA $F3 ” 6 SFF 1 oO Write the block back out, and enjoy. Softkey for... Mini-Putt Accolade @ Requirements C Block editor OO Any 34" fast copier This was a little trickier than 4th & Inches, but a little more fun. Try this: make the edits shown below, but skip the ones at $1D6 and $1E3. Play with it. The results are unpredictable, and what you will see didn’t work for me. But if you NOP the JuMP and [10 COMPUTIST #64 February patch the branch, all will work nicely. First, make a fast copy of the disk. No errors will show because it uses a sync signature that is a !Q%@#% to copy. Then, make these edits: Block Byte(s) From To $3A— S1AD 22 AF $1B2 1 00 $1BD 22 AF $12 ” i] $106 min EAEAEA $1E3 an cy) S1E5 n a That’s all, folks. Sorry for the lack of explanation, I was just in a hurry to get these edits out. Later on, I am sure someone will send an explanation. If not, ll write one up. Apple DuoDISK Modification necessary. Now, use your standard screwdriver to unscrew the retaining screws which are holding the interface cable to the plug; then remove your interface cable and put it aside. Your unit is now disconnected, so you may move it to a clear worktable. Let’s start by removing the outer cover. ‘There are two screws holding the cover in place at the rear of the unit at the bottom-left and bottom-right corners; remove them and then remove the cover and put it aside. Put these Screws into your can. What we'll do now is open up drive 1 and disable its sensor. In Figure 1, remove screw #1 and #2 with your phillips screwdriver, and put them in the can also. Now, use you standard screwdriver to carefully pry the metal lid off. With the lid removed, you should be seeing the main circuit board. DO NOT TOUCH ITS SURFACE! Figure 1. REAR ‘Multicolor, multistrand Interface cable from D2 @ Requirements 1/4” diameter phillips-type screwdriver 1/8” standard screwdriver Surgical gloves About 3 feet of 18-gauge insulated wire Radio Shack ‘soft feel’ SPST push on/off switch (CAT NO. 275-1565) Soldering Pencil w/Solder Hand-Powered Drill with 4" bit Wire cutters Needlenose pliers ‘Small sardine can Heat shrink tubing, 3/8” dia. and about %-1 inch long A" to %" reamer A large, clean workspace Warning: many Apple dealers refuse to perform maintenance on modified equipment. This project will invalidate any warranties you may have. Perform this modification at your own risk. This project involves disabling the write Protect sensor in drive 1 and replacing it with a switch so that the user can have control of write protection at all times. If you positively HATE using disk notchers, you will want to perform this modification. With the switch installed, you will be able to write your data to notchless disks, while your friends stare in awe at the process. Before beginning the major surgery, we have to get inside our DuoDISK unit. If you have your monitor atop the drives (which is usually the case), then lift the monitor carefully and put it aside, disconnecting the cables if [setae Pug | sew fl Lid for Drive 1 0 Note: figure wot drawn to sale, FRONT In Figure 2, only the various jacks are shown in their approximate locations. Ignore the rest of the ciruitboard. Now, VERY CAREFULLY jiggle the designated jacks, DI#1, DI#2, DCI#1, DCI#2, until they are disconnected. Then remove screw #3 and #4 and put them in the can. Carefully pick up the board by its edges and turn it upside-down towards the right, so that the component side (side with the parts and integrated circuits) is face down atop DRIVE 2. Do not strain the other wires. If you do not wish to continue, you had better back out now, because the following steps will involve irrevocable changes to parts of the drive. Take your wire cutters (gasp) and cut the gray wires going to the sensor so they are as nal long as possible (see figure 3). Now, carefully strip the insulation to the wires, being careful not to pull them too hard. Now, take 2 lengths about 1 1/2’ long of your wire and strip its insulation at both ends. Solder one wire to each of the W.P. sensor’s gray wires, and insulate these connections with the heat shrink tubing. Figure 2. Multicolor, mutistrand Interface cable from D2 Drv 1 with ime id removed P sew f @|/ | @ Data Interface #2) screw #4] serew HT Clip Ss, ip Main crit board area Do not touch surface Handle by edges when removing ToD] A (ve text) Clip 3 strand wire, brown/hlue/vhite ip} Drive 2 Daca Inerface #1 Drive Control Interface ‘Note: Figure not drawn to scale Figure 3. (Note: Figure not drawn to scale) Drive Head Write Protect | February COMPUTIST #64 Now we’ll drill the holes for the switches. Follow the measurements in Figure 4. First drill a small pilot hole with the 4” bit, and then ream_ it out until the switch fits nicely within the hole. Then, to connect the switch, put the wires through the hole, and solder them to the switch. MAKE SURE THE WIRES ARE GOING THROUGH THE HOLE WHEN SOLDERING THEM TO THE SWITCH!! Otherwise, you’ll have to disconnect the wires and resolder. Now you can put the switch into the hole so it’s longer side is horizontal (Figure 4a). Tighten the nut with your pliers. Figure 4. (Note: Figure not drawn to scale) Donald McClellat Softkey for... Rings Quest IIT Sierra Online Some software companies continue to use the same protection scheme title after title. This was true with Kings Quest, & Kings Quest II. This is almost true with Kings Quest II. It is protected with two levels of protection, both from previously released titles. (Its good to keep your old issues of COMPUTIST!) |< 2 "rer >| Br [ean Ph" Drill 4” pilot holes and carefully ream until large enough. Figure 4a. L_] Switch That’s it! Now go backwards and replace all parts, screws, and jacks which were removed. Now, push the switch in (ON- position) to write enable, and push the switch out (OFF-position) to write protect. You may be wondering why there are two switch holes in Figure 4. On my DuoDISK, I installed switches on BOTH drives. If you wish to perform this modification on Drive 2, omit the steps concerning the circuitboard (since drive 2 doesn’t have one), and use the measurements in Figure 4 to accurately place the switches so that their nuts don’t jam each other up. The remainder of the instructions are the same. If you have any questions, PLEASE ask; address them to me and send them to the RDEX! [4~] Search the disk for C9 C9 Dd 8D and change the D8 @D to 29 69. On my disk this was found on track $OA, sector 01, bytes $2D-2E. [[27] Search the disk for 20 00 FF and change to EAEAEA. This sequence was found in more than one place on the disk. On my copy it was on track $B, sector $OC, byte $OD and on track $©2, sector $08, byte $12. Softkey for... Super Sign Maker Sunburst Communication This is a banner and sign creation program similar to Printshop that allows you to print your letters in colors and patterns. It is easily copied with Copy II Plus using the TRY HEADER option in the bit copier. Closer examination of the disk reveals that the track header information has a checksum byte in the address trailers. The program is CATALOG-able and uses ProDOS 8. Copy the files to your own work disk with Copy II Plus, be sure to include ProDOS from your system disk. The disk must be named SSM! Now we can start the deprotection. Upon booting the copied disk, enter the monitor via your favorite way after you get the error message ‘UNABLE TO LOAD SUPER SIGN MAKER’’. IIgs owners can use the Control Panel Entry. From the monitor, you’ll notice that at $2000 is the SSM.SYSTEM file. If you follow this code it sends you way up into the $BDC3 area of memory which will jump around for a bit then send you to $801. The Die Hards can follow that, but we'll cut it to the quick and start at $801. The code we’re interested in is at $80D and looks like this: @80D- AZ1E — LOX #$1E 980F- BD1AG8 LDA $081A,X @812- 9DAC G5 STA $A5AC,X What this code does is to move from $81A to $5AC, the Message “UNABLE TO LOAD SUPER SIGN MAKER.” So we’re real close. You should notice that the code at $818 is an endless loop. So EA the two bytes at $818. We list the code further on and we find a some strange looking stuff at $O86A that looks like this: "BB6A- 28 PLP 986B- 38 SEC O86C- 69 RTS 986D- 28 PLP O86E- 18 cLC O86F- 69 RTS This is pretty standard for checking routines where if there is an error you will jump to $86A and set the Carry Flag (SEC) and handle the error in another routine. Or if no error has occurred, you'll enter this routine at $086D and clear the Carry Flag (CLC). So if we change the $38 at $O86B to an $18, we'll tell the code that it will never have an error. Once you change the code, start the program with an 801G and you'll be up and running. So far, we’ve found the routines in memory but haven’t done anything with the disk. So we need to search the disk for the bytes we want to change plus a few extra on either side to ensure that we get the right code sequence. For the first sequence we’ll search for 10 F7 30 FE D5 CE and change the 30 FE to EA EA. Write the sector back to the disk. Then search for 28 38 60 28 18 60, change the 38 to 18 and again write the sector to the disk. That makes a deprotected copy of Super Sign Maker. [4] Copy the files with Copy I Plus or if you want copy the entire disk. [2] Search the disk for 10 F7 30 FE D5 CE and change the 30 FE to EA EA. [37] Search the disk for 28 38 60 28 18 69 and change the 38 to 18. Put your original away and use your deprotected copy. rent Spectum I love the new open format and feel that it was a good decision to open the RDEX to other computers. By doing so, you increase my knowledge of other computers. Though my knowledge consists of odds and ends about the Mac and Apple II series, I find it quite intriguing to see what copy protection is being used on other computers. Hopefully the end result of our battle will be the death of that intrepid monster called copy protection. Many thanks for a wonderful magazine. May it forever prosper. I have been unable to get the ALTERNATE REALITY character editor to 12 §815- CA DEX @816- 19F7 — BPL $080F 9818- 30FE BMI $0818 a81A- Start of ERROR Message COMPUTIST #64 February | work properly. What does the ‘#” in lines 760 and 1150 mean? It certainly is not a BASIC command, that is, if I remember correctly. Is this a bug? I think it would be really helpful if people wrote in and reported bugs as soon as they found them. The number sign “#” should be a exponent sign "0" . -RDEXed Softkey for... Principles of Economics McGraw-Hill @ Requirements O Sector Editor O 10 Blank disks (or sides) C 64K (Required by Program) “Principles of Economics” is a ten disk series in Pascal that teaches its user the basic principles of economics. The only problem is that Mc-Graw Hill does not provide back-up copies. This is crazy considering the amount of disk access and the fact that students will be using it. The Protection The disk is standard DOS 3.3 format and can be easily copied with COPYA or any other copier for that matter. The only problem is that when the copied disk is booted it crashes and says ‘‘copy protected’’. My next step was to search the disk for $COEC (direct disk in Pascal). I found it two times on each disk. I Then examined the tracks where I had found the reference to $COEC and found the start of the nibble count on track $05, sector $00, byte $6E for disks 1, 4, 5, 6 and on track $04, sector $07, byte $6E on the others. By forcing the “‘protection check’’ to ignore the results I was able to produce working copies. For those of you who are interested, here is what the check looked like. AD CECB LDA $CAEC 19FB PL $2EAC COEF © CWP #SEF DBCE BNE 2E83 48 PHA 68 PLA ADECCA LDA $COEC C908 = CHP #08 BeC5 BCS $2683 The Softkey [47] Copy all the disks with any fastcopier (Preferably Locksmith 6.0 Fastcopy). for disks 1, 4,5 & 6 Trk Sct Byte(s) From To $05 $00 $B3-B4 Dd CE EAEA $BC-BD BO C5 EAEA for all others Trk Sct Byte(s) From To $04 $97 $B3-B4 DO CE EAEA $BC-BD BO C5 EAEA There, now you have ‘‘Principles of Economics’’ deprotected. Hopefully this or a method similar to this will work on other McGraw-Hill software written in Pascal. ALP.T. for... Moebius Origin Systems @ Requirements Q Sector Editor CO Disk search utility A. Evans had some interesting things in his APT for Moebius (COMPUTIST #57, pg 20), but he didn’t have the whole picture. Here is a somewhat more lengthy and verbose table of most of the possible effects in Moebius. As with A. Evans article there are a few steps to perform before one can procede with the APT. [1] Boot Moebius and write down your character(s) infomation i.e. Name(s) and Realm(s) of the character(s) ‘‘on adventure”’. [2_] Now search the appropriate disk(s), side C (earth/water) or side D (air/fire) for the name of your character(s). [3] Use the following information to develop the ultimate character to defeat the Warlord. Numbers are in hex. Experience is a two byte hex number in Io byte, hi byte order. Maximum values are $FF except for “‘*”’ items which are $O1 if you have it and $00 if you don’t. For ‘‘Equiped item’’ a $01 = sword while $00 = bare hands. Effect Byte(s): Notes: Name 00-OF Experience 12-13 High Byte Last Level 14 Maximum Body 15 Body 16 Maximum Mind 19 Mind 1A Location 1D-1E X,¥ Cordinates On the next consecutive sector: Torches 46 Whetstones 47 Body Elixers 48 Mind Elixers 49 Shovel 4A* Amulet 4B¥ Gauntlet 4Ce Orb 4D* Shurikens 4F Hammer 5O* Sword 51+ Map: Cisterns 584 Map: Shrines 59% Map: Buildings SA* Map: All Sites SB* Population Lens 5C* Terrain Lens SD* Artifact: Ventriloquism SE* Artifact: Teleport SF* Artifact: Paralysis 60% Artifact: Invisibility 61* Artifact: Were-Spell 62* Artifact: Spirit 63% Tiger Teeth 64 Beetle Pincer 65 Soil Sample 66 Fish Scales 67 Condor Feathers 68 Panda Hair 69 Note: Many of the ‘‘effects’’ have a maximum value of $FF, but are displayed as anumber from 0-100, water is a good example of this. When a value greater than 100 is used, strange characters appear in place of the numbers. Don’t worry, this has no ill effect on the game. Some of the “‘effects’’ will flip over. (ie. You have $FF of an item and you find one more, you will now have $00. Not good.) To solve this, just don’t get too greedy. I have not in any way found all the ‘‘effects’’, so if someone happens to find something interesting please write in and tell us about it. Jayne W, Irwin Softkey for... Notes ‘N' Files Notes ‘N’ Files is a graphics-oriented fixed data base for the Apple IIgs. Using it is a snap. It’s great for keeping track of names and addresses and printing form letters and labels. The first thing I do when I get a new disk is to make a backup using Copy II + copy disk, then I try out the copy. If it’s not copy protected, it’ll usually work, if it is it'll either ask you to insert the master disk, hang, or crash. Notes ‘N’ Files crashed. [2] Get out your sector editor and readin Equiped Item 42% Entering (RETURN), gives you the the correct track’ with the corresponding disk Food 44 location of the crash and the register values. My and perform these edits. Water 45 version crashed at $03/4B8B. [ February COMPUTIST #64 13 Figuring the beginning of bank 3 was as g00d a place as any to start looking, I found aJSL (jump subroutine long) at $0000 which sets up the program. The next possibility was a JMP (jump) at $0@OB. This sent me to $6525. This is what I found there. 6525 20916C JSR 6C91 6528 2005AA JSR AADS 6528 22069801 ISL 010806 652F 8D 7E65 STA G57E 6570 4C8B 4B JM 4888 The jump at $657D sent the to the crash location; therefore, the ‘‘STA 657E”’ at $652F was the culprit. The “ISL 010806” at $652B looked very suspicious. I knew I was on the right track, but when I checked out $1/86 there was nothing there but zeros. The protection code was erased before the program crashed. Sometimes, it’s not a bad thing to have a program crash, if it crashes where you want it to. L used Copy I+ to search for 26 91 6C 20 D5 AA 22, the code right before the JSL, then I replaced the 8D immediately following the JSL code with 09. This time the program crashed at $03/652F and the protection code was still at $©1/0806. I won’t include all of it but here’s the more important parts: 9821 22000061 JSL £19000 9825 22770093 JSL 900077 9829 8D 06 08 STA 9808 9820 Co9G00 © CPY #0000 982F FO 93 BEQ 0834 Change these bytes form F@ 03 to 88 52 (BRA ©883) to bypass the protection. 9831 4C AC@8 JMP @8AC Addr. changes when relocated 0834 ED 43.06 CPX A9643 Protection Begins here 887E 9.00.00 cuP 40900 Last compare 0881 0005 BNE 0888 0883 A9EB 65 LOA #65EB Branching here avoids 0886 80.06 BRA O8BE the protection checks 9888 AQ 7D65 LDA #657D Program hangs if $0888 and 9888 80 0698 STA 0806 S0B8B are executed Ose 48 PHA 087 6B SL Finally, to remove the copy protection, I used the sector editor on Copy I+ v8 and searched the disk for FO 03 4C AC 08 EG 43 06 90 93, but no luck. I decided to search just for EO 43 96 99 93 and found them in block $0374, beginning at byte $07A. The code preceding it was FO 93 4C AC 00. The 00 had changed to 08 when the program was relocated. (J Use a copy program that ignores errors and copy the disk. [27] Search for F803 4C ACOO ED 43 06 90.03 and replace the FQ 83 with 80 52. On my version it was in block $0374, byte $075. That’s it. Softkey for... Math Shop Scholastic Software @ Requirements OA blank disk with a notch on both sides or two blank disks © DOS 3.3 system master OA slave disk O Copy II Plus [47] Boot your DOS 3.3 system master and at the ‘‘]’” prompt enter: POKE 47426,24 RUN COPYA [2] Copy side 1 of your original disk to your slave disk. [3] Copy side 2 of your original disk to side 2 of your blank disk. [4] Use Copy II Plus to format side 1 of your blank disk as a ProDOS disk and give it any short volume name. [5] Use the copy files option from Copy TI Plus to copy all of the files from your slave disk to your ProDOS formatted disk and then change the volume name of the disk to the same name as your slave disk. Softkey for... CALL-151 BLOAD DEMUFFIN PLUS,A$803 FFS9G (if you hear a beep ignore it) 8800<6800.6FFFM AS5IG 203G (37 Put in side 1 of your original disk and copy all of the files to side 1 of your blank initialized disk. [6] Repeat steps 2-5 for side 2. Softkey for... Elementary Social Studies Volume 3 MECC Software @ Requirements O A blank initialized disk O A blank initialized slave disk O Super I0B v1.5 0 A way to reset into the monitor [1] Initialize your blank disk. INIT HELLO DELETE HELLO [2] Boot your original disk and at the Applesoft prompt reset into the monitor. [73] Move the RWTS to a safe place by entering: 1900<B800.BFFFM [4] Put in your slave disk and enter: Dataquest: Presidents Data Base MECC Software @ Requirements OA blank disk that has a notch on both sides or two blank disks O DEMUFFIN PLUS O DOS 3.3 system master 0 A way to reset into the monitor [7] INIrialize each side of your blank disk HELLO and delete the HELLO program. [2] Boot side 1 of your original disk and when the ‘‘]’” prompt comes on the screen reset into the monitor. [3] Move the RWTS to a safe place and boot your initialized disk. 6800<B8G0.BFFFM C600G ([4_] Put in your Demuffin Plus disk and enter: [3] After the disk boots and the Applesoft prompt appears, insert your Super IOB disk and save the RWTS to it by entering: BSAVE RWTS.ELEM VOL 3 SOCIAL STUDIES, A$1900, L$800 ([6_] Install the controller into Super IOB, Tun it and copy your original disk to your blank disk. Answer NO when asked if you want to initialize the blank disk. Controller 1000 REM ELEMENTARY ~ VOLUME 3 SOCIAL STUDIES 1918 TK = 3:ST = 8:LT = 35:CD = WR 1026 T1 = TK: GOSUB 490: GOSUB 360: ONERR GOTO 550 1938 GOSUB 439: GOSUB 109: ST =ST +1: IF ST<DOS THEN 1030 1040 IF BF THEN 1060 1950 ST = :TK = TK + 1: IF TK< LT THEN 1038 1968 GOSUB 499: TK = T1:ST = @: GOSUB 368 1970 GOSUB 438: GOSUB 100: ST =ST+1: IF ST<DOS THEN 1678 [144 COMPUTIST #64 February | 1980 ST =: TK=TK+1: IF BF=@ AND TK <LT THEN 1978 1990 IF TK < LT THEN 1028 1109 HOME : PRINT "COPY*DONE" : END 1040 IF BF THEN 1068 1950 ST =0:TK= TK +1: IF TK < LT THEN 1038 1966 GOSUB 490: TK = T1:ST = 0: GOSUB 369 1970 GOSUB 436: GOSUB 188: ST=ST+1: IF ST<DOS Bill Jetzer Softkey for... 16010 PRINT CHRS (4) “BLOAD*RNTS. ELEM" VOL" 3* a Meld 1Ke1: 1FBEe@ANO TK CLT THEN Sor. SOCIAL*STUDIES,“AS1900" =0:TK=TK+1: IF BF= < 5 1078 Microtype Checksums 1099 IF TK < LT THEN 1020 2 1108 HOME : PRINT "COPY*DONE" : END ion - go56p 1860. — $2008 10010 PRINT CHRS (4) "BLOAD'RWTS.ELewtvou'g Mf Requirements - - SOCIAL‘STUDIES,“A$1900" isk si 1920 - $6170 1088 = $6CA2 M Big blany cise sices 1030 - $7771 1098 - S9DCA 1040 - $6342 1108 - S9A4D Checksums )'Deamffin-+ 1950 — SABA3 10010 — $42FE 1000 - $3568 1968 - $20C0 Microtype uses a form of protection that 1919 - $3565 1970 - $28C5 I’ve never seen before. The address markers g 1928 - $6176 198 - $6CA2 have been changed from D5 AA 96 to D5 AA?. of fori 1930 - $771 1099 - S9DCA What follows next is a series of 8 “1” bits 5 5 1940 - $6342 1100 - $9A4D (SFF) followed by several more bits written to Elementary Social Studies 1050 - $ABA3 —«:1910 - $570C the disk, but not enough to make a byte. The Volume 6 read routine on the disk reads the 97 and then delays a while before it starts reading the track, MECC Software Softkey for... sector, and checksum values. Here are the cookbook instructions to M8 Renulrements Path Tactics completely deprotect Microtype: CA blank disk MECC Software [J Initialize two blank disks. C A empty initialized slave disk Fi 2] Patch the nd disk so that all the CO Super IOB v1.5 @ Requirements C2] secor so CA way to reset into the monitor [J Initialize your blank disk. INIT HELLO DELETE HELLO [22] Boot your original disk and at the Applesoft prompt reset into the monitor. [3] Move the RWTS to a safe place by entering: 1900<B800.BFFFM [47] Put in your slave disk and enter: ceoec ([5_] After the disk boots and the Applesoft prompt appears, insert your Super IOB disk and save the RWTS to it by entering: BSAVE RWTS.ELEM VOL 6 SOCIAL STUDIES, AS19080, 18800 [6] Install the controller into Super IOB, Tun it and copy your original disk to your blank disk. Answer NO when asked if you want to O A blank initialized disk O Super IOB v1.5 [LJ Initialize your blank disk. INIT HELLO DELETE HELLO [2] Install the controller listed below into Super IOB, run it and copy your original disk to your blank disk. Answer NO when asked if you want to initialize the blank disk. Controller 1990 REM PATH TACTICS WMO TNS SLT 28ST 15:LS = 15:CD = WR: FAST 1928 RESTORE : GOSUB 198: GOSUB 218 1925 GOSUB 499: GOSUB 610 1036 GOSUB 230: GOSUB 490: GOSUB 618 1035 IF PEEK (TRK) = LT THEN 1956 1940 TK = PEEK (TRK) :ST = PEEK (SCT) : GOTO 1828 1950 HOME : PRINT “COPY*DONE” : END files will fit onto it by making the following sector edit: Trk Sct Byte(s) From To $11 $80 $40 90 06 FF EO (J Load Demuffin+ into memory: BLOAD DEMUFFIN + [4] Make some changes to DOS so that it will look for only the AA 97, and then delay for a while until the track values pass under the R/W head. ‘B6FS:20 58 FF 4C 58 FF 8964:20 F8 B6 EA BO68:EA 26 O6 66 06 BOSS:AA ‘BOSF:97 (J Start Demuffin+. 8036 (B_) Copy all the files. tnmlalize tie\tank:disk 5000 DATA ‘170,213, 173,213, 150,170 enamine EOADIS Adapter Controller Checksums . @ Requirements 1609 REM ELEMENTARY ~ VOLUME 6 SOCIAL STUDIES ggg _ $3568 1035 — $FDBB = O:LT = 35:00 = WR 1010 - $2445 1040 - SF6SE 0 EOADIS (COMPUTIST #57) + GOSUB 498: GOSUB 360: ONERR GOTO = 1929 - $288C 1050 - $7098 CO CAPTURE (Starter Kit) 1025 - $FAC7 5000 - $2460 1038 GOSUB 430: GOSUB 180: ST =ST +1: IFST<DOS 1030 - $6686 While snooping around Marble Madness, THEN 1030 I found two versions of EOAPL, each different | February COMPUTIST #64 15 from the version Phil Goetz described in his EOAPL article (COMPUTIST #57, pg 10). Since there was quite a bit of it, I decided write a program to modify EOADIS instead of disassembling it by hand. But first, some of the code had to be moved around so that extra commands would fit. Here are the instructions: [1] Load EOADIS into memory. CALL -151 BLOAD EOADIS (277 Ifyou have a Ic, fix it so that it prints the proper characters (#,$,etc.). ‘858:B9 was B3 85E:B3 was B9 [37] Move the “INSDS1” code up in memory. 89C<8F0.911M [4] Inform EOADIS of the new locations of INSDS1 and the tables. 820:9C was FO 83F:) was B8 8B2:BE was 9C 8B7:CC was AA [5_] Replace the tables (can be skipped if your version doesn’t have the original commands). BBE:02 02 8C0:02 01 @2 02 02 01 00 02 8CB:02 0 @2 00 80 80 80 20 8D0:80 80 80 20 0 80 80 00 8D8:80 ©@ C7 CF D4 CF CA D3 8EO:D2 Dé C7 CF CE C5 CC C4 8E8:B5 B6 CC C4 BS BG C7 D3 8F0:D5 C2 D3 D4 BS BG D3 BS 8F8:B6 AD D2 D4 D2 CE CA D3 900:D2 A@ C9 CE C3 A@ D2 D4 908:D3 AQ D3 BS B6 AB BF BF 910:BF BF [6] Save the file. BSAVE EOADIS, A$8@@, L$112 (J Type in the listing at the end of the article and save it. SAVE EOADIS.ADAPTER [8_] Now you need to make an exec file with your command data in it. The advanced version of EOAPL on Marble Madness has the following commands: GOTO addr JSRV addr 6502 JSR. On entry, A<- Pseudo Acc (PA). On exit, PA<-A. GOEQ addr Go to addr if PA=0 LDPA num LDPA addr GSUB addr STPA addr SUBT num PA <- PA - num JUP addr 6582 JMP; exits EOAPL RTRN Return from subroutine LD,A addr PA<- addr PA DUBL PA <- PA+PA INCR addr INC addr: PA <~ addr ADD addr PA <- addr + PA EXOR ($4C) <- ($4C) XOR PA: INC ($4C) : INC ($4C) : PA <- $4D XOR #$68 GONE addr Go to addr if PA>® SUBT addr PA <- PA - addr MOVE ($4E) <~ ($4C To put these commands into EOADIS, type this program in and use CAPTURE from the starter disk to save it as a text file with the name PL.MARBLE MADNESS1. Line 20 contains the length in bytes, minus one, of each command. Line 3® contains the text of the commands. Each command must be 4 characters long: 10 PRINT CHR$ (4)"BLOAD EOADIS, A$800" 20 L$ = "222122212026220220" 30 T$ = "GOTOJSRVGOEQLDPALDPAGSUBSTPASUBTJMP* RTRNLD, ADUBL INCRADD* EXORGONESUBTMOVE” SAVE PL.MARBLE MADNESS1 ((9_] Run the adapter program. It will re- run itself at a higher memory location so that it doesn’t interfere with EOADIS: RUN EOADIS.ADAPTER 40] You will be prompted for the file to execute. Trace over the letters and then type PL.MARBLE MADNESS1. Then run the resulting program. After a few seconds, you will be shown the length, in decimal, of the new EOADIS file in case you want to save it. Finding the Commands Finding out what the commands are is tricky. First, search search memory for the following series of bytes: C8D902E6. Youmay find them in several places. They should disassemble something like this: AA45 Bl 46 LDA ($46) ,Y AAA7 C8 INY AA48 D002 BNE $AAAC AASA E6 47 INC $47 AAMC AA TAX AA4D BD 60 AA LDA $AA69,X AASO 18 cLe AASL 6972 © ADC #$72 AAS3 8D 5EAA STA $AASE AAS6 AQAA == LDA #$AA AAS8 6990 © ADC #$00 AASA 8D 5F AA STA $AASF AASD AC xx xx JMP $xxxx Find the table of lo bytes (LDA $AA60,X) and write them all down. Calculate the addresses of the commands and start disassembling. It may take a while to figure out what all the commands are, but this is the only way to do it. Once you have all the commands written down, go back up to step 8 to modify EOADIS. EOADIS.ADAPTER 1 IF PEEK (184) < > 32 THEN POKE 104,32: POKE 8192,0: PRINT CHR$ (4) "RUNEOADIS. ADAPTER" 2G NORWAL : TEXT ; HOME : PRINT CHR$ (21): VTAB 12: PRINT "EXEC" : VTAB 11 SOLS=L$+ "0" :T$=T$+ i = LEN (T$) :F(Q) =9:F( 2F(2) =128:TA = 2111:C1 = 2217:C2 = 2221:FA = 2231:LS = 2238:FS=LS+L:TS=FS+L 60 POKE FA, FS- INT (FS / 256) * 256: POKE FA + 1,FS / 256 70 POKE TA, TS - INT (TS / 256) * 256: POKE TA + 1,18 / 256 8B POKE C1,L- 1: POKEC2,L-1 98 FORX=OTOL-1 190 POKE LS +X, VAL ( MIDS (L$,X+1,1)): POKE FS+X,F(VAL ( MID$ (L$,X+1,1))) 119 NEXT 126 FORX=@TOT-1 130 POKE TS +X, ASC ( MID$ (T$,X+1,1)) +128 149 NEXT 15 PRINT "]BSAVE“EOADIS , A$800,L" TS +7: VTAB PEEK (37) - 1 Checksums a) - $AB4C 1098 - $5F9C 20 - $7774 119 - $2EB1 50 - $AEF9 126 - $DF46 60 - $BC96 130 - $E657 70 - $44F9 149 - $89CF 80 - $FB11 150 - $FFIC 96 - $6BD2 Merging Controllers (into Super IOB) Requirements 0 COMPUTIST Starter Kit There seems to be some confusion among some of the newer COMPUTIST readers about how to merge controllers with Super IOB. Paul Dillon described one method using CSAVER in the October issue, but not everyone has that program. Here is the procedure for using CAPTURE, which every subscriber has: {((1_] Type in the controller as it appears in the magazine. To make sure you typed it in correctly, use CHECKSOFT to compute the checksums (the instructions appear on one of the first pages of every issue). [ 16 COMPUTIST #64 February | [227] Now you must save it as a text file. Insert the disk with the capture program on it and type: EXEC CAPTURE {(3_] Insert the disk where you keep all of your Super IOB data. CAPTURE will ask you for the name of the file you wish to save. Type the name of the program that this controller is for then add ‘‘.CON’’. (Remember, Applesoft controllers have the prefix ‘‘CON.’’ and text file controllers have the suffix ‘‘.CON’’.) The disk will whir as the file is saved, and you will be left in BASIC. [4] To use this controller, load Super 1OB into memory, execute (merge) the controller and run the result. LOAD SUPER I0B EXEC program.CON RUN If you are using a swap controller, be sure that the proper RWTS is present on the disk or you will get a “FILE NOT FOUND” error: [(3_] Follow the prompts and copy the disk. Some of the confusion probably arose when beginners came across controllers from the COMPUTIST library disks. These are stored as Applesoft files. To use one of them, just LOAD it and go to step 2. Softey for... Troll’s Shop Right @ Requirements O Super IOB 1.5 I recently deprotected Troll’s Shop Right for a school and thought I’d pass on the softkey to you. The protection is simple: altered epilogues and address markers that are changed to D4 AA 96 on the odd tracks. Type in the controller and save it. Merge it with Super IOB 1.5 and run it. If you want to get the disk into a completely normal format, you can put a normal DOS onto the copy. This controller also works for Garde’s Blue Powder Grey Smoke and SSI’s Colonial Conquest. Controller 1908 REM TROLL SHOP RIGHT 1919 TK=8:LT=35:ST=15:LS=15:CD=WR: FAST =1 1920 POKE 47426, 24: POKE 47447,0: GOSUB 490: GOSUB 619 1030 POKE 47426 , 56: POKE 47447 , 249: GOSUB 490: GOSUB 610: IF PEEK (TRK) = LT THEN 1058 1040 TK = PEEK (TRK) :ST = PEEK (SCT) : GOTO 1028 195@ HOME : PRINT "COPY*DONE” : END Checksums 1900 - $356B 1930 - $F043 1918 - $2544 1940 - $0686 1920 - $CAB6 1958 - $7261 Softkey for... New Oregon Trail MECC @ Requirements C Super IOB 1.5 O Sector Editor The address markers have been changed to AADS AD and the data markers have been changed to D5 96 AA. Type in the controller and save it. Merge it with Super IOB 1.5 and copy both sides of the disk. Make the following sector edits to the front side: Softkey for... Starglider Rainbird/Firebird Software @ Requirements O Any fast copier O One disk OA sector editor This softkey was prompted by the softkey for Star Fleet I in COMPUTIST #60. Starglider by Rainbird/Firebird software is also copyable, but to use the program you must look up in the manual a certain word in a specified paragraph, line, etc. This is really a pain to do. Not to mention what happens if the manual is lost. (Have you ever seen a hacker/gamers computer nest?!) So not to be out done by Mr Dan Halfwit (I hope that isn’t your real name.), I set out to get rid of this pestilent protection. As in the case of Star Fleet I, Starglider also had a lot of encrypted pieces of code on the disk. (Was I suprised?) I tried to use Mr Halfwit’s article as a reference, but, alas, I ended up on my own. So after dumping a few K to the printer and carefully looking over the code (for hours) to see just what was happening, I decided my best course of action was a educated guess. And as you see, plain dumb luck won out. [47] Use your fast copier to Copy Trk Sct Byte(s) From To $00 $07 $8696 A $8B AA AD $08 SIF 96 A S2A AA AD $83 A 5 $8005 A $98 AD 96 SOB SAB AA 05 SAD 05 A see AD 96 Controller Starglider onto the blank disk. 1909 REM NEW OREGON TRAIL 1910 ST = 15: Ls :CD = WR:FAST = 1 5 : GOSUB 490: GOSUB 619: GOSUB 499: GOSUB 619 1912 TK = 1:LT = 35 1928 POKE 47445,178: POKE 47455,213: POKE 47466,173: POKE 47345,150: POKE 47356, 170: GOSUB 498: GOSUB 618 1938 GOSUB 230: GOSUB 490: GOSUB 610: IF PEEK (TRK) = LT THEN 1858 1940 TK = PEEK (TRK) :ST = PEEK (SCT) : GOTO 1828 195 HOME : PRINT "COPY*DONE" : END (2 ] Sector edit the copy. Trk Sct Byte(s) From To $18 SOF $2A-2B 90 0D 18 60 That’s it. The program will now accept any word when you are prompted to enter it. Perhaps someone can make it so it doesn't COED BK? wc saan wires eae RDEXed I just bought Pirates GS from Microprose (which is a GREAT game), guess what!! Not only do you have to enter a code from the manual, but the darn disk is protected as well (So that you can’t get it on a hard-disk or back it up). And to top it off my disk crashed two days after I got it!! Also, just to prove someone has a sense of humor, Pirates happens to be one of those games that is virtually worthless without the documentation! So here I sit, out my money while I wait for a new disk to show, that really didn’t need to have ANY protection on it at all! February Checksums 1980 - $356B 1920 - $OAGE 1910 - $88AA 1930 - $3F97 1911 - $5264 1946 - $BAAD 1912 - $3C2D 1950 - $6832 COMPUTIST #64 17 | I don’t know about you people, but I sure would be interested in a response from Microprose (and a few others) about their type of thinking. Many other software companies have reduced (and in a lot of cases have eliminated) protection on their newest software. I have read letters in the past in COMPUTIST about pirating and I really didn’t intend to get into the subject, but since this came up I may as well. (If the editor has room.) So here is how I came to get ‘‘into’” pirating. After using a ‘‘cassette’’ drive for a year I finally acquired my first disk drive. Naturally as soon as I could afford it I started buying the latest disks. One of which would boot one out of twelve times on my Apple II. Another of the disks died a horrible death and left many mourners behind. And still a third was not worth the disk the bytes were embedded on. All of this was at the height of the pirate controversy. A certain well known head of a software company (that used a penguin) was quoted as saying that nobody’s business was going to fold if a piece of game software, that couldn’t be backed up, had to be sent back to be replaced. ‘Well to be honest he was almost right, it didn’t affect my business, on the other hand Sirius and a couple of others may have had second thoughts on this. Anyway, here I was paying good money for disks that quite frankly weren’t doing the job. Then I discovered the pirate software world, disks that would boot with no problem (and usally faster), that sometimes had mutiple files on a single disk, disks that could be inspected, copied and modified with no problem. Hey, this is great, so I got my hands on anything that would teach me about de- protection. Because you see, in the pirate community, you have to have pirated disks to trade if you wish to get pirated disks. The only other option was to try to break every disk I bought, and I just don’t have enough time for this (even if the protection wasn’t beyond my ability). So its sort of a vicious circle. (I did try to break out by buying a couple of disks later on, but one disk had to be sent back because it crashed and couldn’t be backed up.) Then came the Woz machine, the IIgs. At first everything seemed like it was going to be Protected too, then for some reason software companies seemed to be removing a lot or all of their protection, even on some of the GAMES! I went back to buying my [gs software, for now, because on the negative side of pirating there are long hours cracking disks, big phone bills (if your up/downloading), lack of documentation and its just plain illegal. (In other words, I would rather buy my software.) But this latest incident with Microprose has given me second thoughts. I hope most companies give some thought to removing Protection from their products because it comes down to your hand in my pocket or my hand in yours. ‘nuff said. David R. Hopkins Super Index Bugs? For those readers who ordered my Super Index (COMPUTIST #57), the following are some points that need clarification: ° Computist’s first issue, HARDCORE COMPUTING, volume 1, number 1, was printed in 1981 (not 1983). The Computist Super Index includes every issue. © Each monthly ‘‘UPDATE”” consists of the entire data base, including the current month’s shipping & handling. * “Shipping Desired”” is only required for deliveries out of the U.S. Shipping in the U.S. is always first class. © Disk format can be in DOS 3.3, if desired. © PFS File can not access this data base. HELP WANTED! My intention, in creating the Computist Super Index, is to make this the most comprehensive index-data base offered for COMPUTIST subscribers. The best way I know to accomplish this is to find out what is wanted from the people this data base is created for. I would welcome recommendations from COMPUTIST subscribers, the staff of COMPUTIST, and the people that have purchased the Computist Super Index. Let me know what YOU would like to see in this data base by making an ‘‘input’’ to COMPUTIST or sending a postcard or letter to: David R. Hopkins, 3495 W. Hoye Place, Denver CO 80219. Michael R. Smith Softkey for... Oltima V Origin Systems Inc. @ Requirements Ci Super IOB v1.5 O Blank Disk @ COMPUTIST #60 (Recommended Reading) The Ultima V softkey by Ron Dippold in COMPUTIST #60 (page #21) was very helpful, but did not quite do the job with my original. So, using a similar controller and the same modifed RWTS, I was able to make a backup of my original Ultima V diskette. Examination of my original disk reveals that tracks $00 thru $02 have been protected with the address field epilogues being altered from the normal DE AA to AB FF and by modified checksums. As for tracks $03 onward, the same altered address field epilogues and altered checksums as well as sectors strangly numbered. from $11 (17) to $20 (32) instead of $00 (0) to $F (15). [47] Boot Dos 3.3. [27] Copy and modify the RWTS. CALL -151 1900<B800.BFFFM 1A2D:18 60 1A88:A0 @@ 38 AS 2D E9 11 85 2D A9 AA 18 6 [237] Save modifed RWTS for use with Super IOB. BSAVE ULTIMA V.RWTS, A$1900, L$800 [4] Use this controller with the Super IOB to copy the ‘‘Program"’ disk side. Use Copy I Plus or another fast copy program to copy all the other sides. Controller 1000 REW ULTIMA V CONTROLLER 1619 TK=9:LT=3:ST=15:LS=15:CD=WR: FAST =1 1820 RESTORE : GOSUB 170: GOSUB 270: GOSUB 499: GOSUB 619 1038 GOSUB 238: GOSUB 498: GOSUB 619: IF PEEK (TRK) = LT THEN 1058 1949 TK = PEEK (TRK) :ST = PEEK (SCT) : GOTO 1820 1950 TK = 3:LT = 35:ST = 15:CD = WR 1068 GOSUB 360: GOSUB 499: GOSUB 610 1070 GOSUB 360: GOSUB 490: GOSUB 618 1975 IF PEEK (TRK) = LT THEN 1100 1980 TK = PEEK (TRK) : ST = PEEK (SCT) : GOTO 1960 1100 HOME : PRINT "COPY*DONE" : END 5000 DATA 171,255,222, 178 19618 PRINT CHR$ (4) “BLOAD* ULTIMA‘ V.RATS, AS19908" Checksums 1900 ~ $356B 1070 - $024 1918 - $FF63 1875 - $C8C4 1028 - $9D8F 1980 - $8730 1938 - $A816 1199 - $1C83 1048 - $9734 5808 - $1173 1950 - $074E 19018 - $2EA9 1966 - $8702 oe PS. Here is some code to read/write Track $03 Sectors $05 down to $01 of Ultima V’s “‘Britannia’’ disk, for anyone writing a character editor. * Ultima V Reader Source % by Michael Smith * 8/27/88 * ORG $9000 * [a8 COMPUTIST #64 February | LOA #$03 Track 3 STA $B7EC LOA #$05 Starting sector 5 STA $B7ED LDA #508 STA $B7EB 9 = Match a// volumes STA $B7F@ Pointer to user data buffer LOA #$68 STA $B7F1 Hi-byte of data buffer LDA #$01 STA $B7F4 1 = Read, 02 =Write LOOP LOY #$E8 RATS Parm list LOA #$B7 JSR $B7B5 Disable interrupts and cal! RATS DEC $B7ED Dec current sector number INC $B7F1 /nc data buffer address LDA $B7ED Load current sector number Rename GG.CODE to SYSTEM. STARTUP on the copy. It appears to be important that the disk name on the copy be the same as the original (GREMLIN). Softkey for... Facemaker Spinnaker I couldn’t use Edward Teach’s method in COMPUTIST #50 or Michael Paterno’s in COMPUTIST #58 to deprotect this one. There were no catalogable files on my original and the Kids on Keys method didn’t work. I used the Story Machine softkey from COMPUTIST #22 on page 4. It was Trk Sct Byte(s) From To $00 $05 $68-6A DOFLAD 18 60 EA Softkey for... Story Writer Learning Well/Mindscape (77 INT? a blank with a fast DOS INIT HELLO DELETE HELLO (J Tell DOS to ignore checksum and epilog errors and use FID from the DOS 3.3 System Master to copy all files from the original to the INITed disk. POKE 47426,24 BRUN FID Side two of this program is already in COPYA format. A look at GS/OS CUP #$00 erroneously titled Deprotecting Storymaker. BNE LOOP [97] Copy the original with any fast copier RTS or COPYA. [2] Using a sector editor on the copy, ULTIMA V.READER make these changes. 9000: AO 03 8D EC B7 A9 05 8D $4280 iso PAU ud 9908: ED B7 A9 0B 8D EB B7 8D sanzF $00 $03 $0465, 1A5 JE Are 9810: FO B7 A9 60 80 Fl B7 A9 $2097 fi 9918: 61 8D F4.B7 AB E8 AQ B7 SEQIF Softkey for: 9920: 20 BS B7 CE ED B7 EE Fl $9EA9 9628: B7 AD EDB7 C9 00 DA EC $6809 Ace Reporter 9030: 60 $BFDB Mindplay Softkey for... Grammar Gremlins Davidson & Associates, Inc. Grammar Gremlins is a comprehensive grammar program for third, fourth, fifth, and sixth grade students. The software includes a program disk and a data disk. Most attempts at copying the program disk with standard copy programs failed. It seemed that track $22, sector $00 was unreadable. I made a copy using COPY A with the DOS error checksum disabled. The program disk is in Pascal, so I searched in vain for the $CO8C nibble count routine that was keeping my copy from booting. Then I got lucky when I renamed the SYSTEM.STARTUP file. {4_] Use the Apple System Utilities v 2.1.1 or similar program and format a disk in Pascal with the name GREMLIN. [27] Copy all the files except SYSTEM.STARTUP from the original Grammar Gremlin disk to the newly formatted disk. Thanks to Jack Nissel’s softkey for Cat’n Mouse in COMPUTIST #56, I was able to softkey Ace Reporter. [4] Copy the disk with a copy program that will ignore errors. I used Locksmith 6.0. [2] Make this sector edit. Trk Sct Byte(s) From To $01 $01 $00 AZ 68 Softkey for... Star Maze Number Bowling Scott Foresman (Mindscape) Even though these two math programs were. published by Scott Foresman, they were distributed by Mindscape and have a protection scheme similar to the Perfect Score. {4_] Boot a DOS 3.3 disk. [2] Tell DOS to ignore checksum and epilog errors and use COPYA to copy the disk. POKE 47426,24 RUN COPYA ([] Make the following sector edits to the copy you just made. ProDOS 16 is the current DOS for use with the IIgs. Among other things it is slow and is written in 65C@2 machine language. It uses almost none of the IIgs’s expanded 16 bit instructions, and is really just a 16 bit shell wrapped around an 8 bit program. Well, all that has just changed. Apple released version 4.0 of its IIgs System Disk at AppleFest, and with that came a brand new, fully functional DOS called GS/OS. GS/OS is ProDOS 16 rewritten. It is faster (check out the chart below), can handle more files, and is a pleasure to use. The System Disk also came with a brand new Finder, rewritten for faster operation and expanded in its functions. Along with this is a second disk called System Tools. These include an advanced disk utility (at this stage, it’s nothing more than a file copy program), and an Installer, which allows a user to install all the system files necessary for operation on a particular disk with no hassle. The Installer has a whole list of things it can install, such as printer drivers, system files, etc. It conveniently eliminates the problems of remembering which files do what, and enables you to create a working disk without touching a subdirectory. But back to GS/OS. This DOS is fast! It won’t set any records, but GS/OS manages to load a system disk which is full of new tool code, a Finder which is 15.5K bigger than it’s predecessor, and the GS/OS program plus startup file which, combined, is 17K bigger than P16, all in 15 seconds less than | February COMPUTIST #64 19 | ProDOS 16 can get itself up and running. That may not sound like much, but it now makes using the Finder for disk maintenance a real possibility. GS/OS gets Finder up and running in 5O seconds flat. Compare that to a minute and five seconds for ProDOS 16. That’s almost Tespectable. ‘The Finder has been expanded and polished extensively. A thermometer displays how much of an operation has been completed, and fills up when it’s done. Several formatting options have been included, two of which format a disk so that it cannot be read by the Igs itself. I think that these are MacIntosh formats. File copying is the Finder's biggest strength. Unlike Copy TI Plus, the Finder reads in about 20 files at once and then writes them out all at once. The more memory you've got, the more files it can read. I noticed that the windows seemed a bit slower, but it’s possible I’m just impatient. The IIgs now has a very slick DOS all to itself. Never again will you have to look at that ProDOS 16 v1.3 display in the beginning and wait for years for something to load. Now you see a more appealing message on bootup and only have to wait a few months for something to load. ProD0S 16 GS/OS_—_—Diff Mul tiScribe 3.0 2:19 1:25 45 sec DeluxePaint Ii 1:33 35 sec TUL Pascal 1:14 26 sec Launcher 356 138 18 sec Finder 1:05 :50 15 sec Note: Times will be significantly shorter if you don’t count the time it takes for GS/OS to load. Subtract 32 seconds if you only want to count application load times. MultiScribe, DeluxePaint, and TML Pascal were all made self-booting under ProDOS 16 by deleting Start from the System folder, and renaming their main program with a suffix of ‘SYS.16’. They were made self-booting under GS/OS by deleting Start from the System folder, moving the main program to the System folder, and renaming it as Start. A look at Alien Mind (IIgs) Alien Mind is the most recent game introduced by PBI Software. PBI designs only Ils software, and they seem to put a lot of work into their programs. Alien Mind is an outstanding example of both PBI’s work ethic and the capabilities of the IIgs. This game is a blend of so many different things that it is hard to classify it as an arcade game, a shoot ‘em up or a thinking game. ‘Well, whatever the authors did, they sure did it well. Alien Mind has got outstanding sound (it utilizes the MDIdeas SuperSonic stereo card if you’ve got it, and sounds terrific even without one), superb animation, a beautiful, crisp display, which smoothly scrolls in any direction, and game play which is VERY addicting. The premise of the game is that in a future time, man has expanded his frontiers and discovered many planets with other life forms on them. On one particular planet, Herzgod IV, two unhatched alien eggs are discovered and brought aboard the newly completed Zekford Space Station for examination. One of the eggs hatches into a super-intelligent alien which, bent on the destruction of everything alive, has reprogrammed all the robots of the station to kill people, and mind-controlled all other creatures to do the same. You, unsuspecting biologist Timothy Hunter, have boarded the station just after the annhilation of the whole station’s staff and crew, and you soon discover that your fellow biologist and long-time friend Aaron Avery is the only remaining person alive in the Zekford Space Station. Communicating through computer terminals, you and Aaron must devise a weapon which will kill the Alien. Aaron provides clues to the passwords for certain terminals which you and he will communicate through, and let me tell you, some of these passwords are really TOUGH TO GET! Oh, that’s not all though, because you are constantly being attacked by the mutant robots and hypnotized monsters which are bent on your destruction, you always find yourself fighting, moving, fighting, logging on, fighting, moving, fighting, getting lost, fighting, etc. The action never stops! In addition to all that, you must pick up key cards, energy tablets, clips of bullets, shields, floating disks, and conductors, Although many games claim to be action packed, Alien Mind is THE definition of the ultimate action-packed game. Playing Tips for... Alien Mind PBI This game is not easy. There are two disks, and I haven’t gotten to the second one yet. However, I have discovered quite a few passwords. The clues are always the same (unless PBI changes them from package to package, which I doubt). Here they are (remember to log on to the terminals in the correct sequence): WARNING! The first bunch are easy - you shouldn’t have to look at them here. Try all your guesses, and then if you really give up, look at the list. Half the challenge is trying to get the passwords and it’s also the most frustrating part, that’s why I listed them here. Level I Telegram Aqua Hammock (Be sure you're on the right terminal - if you’re on the Zekford Community Workstation then you are not where you want to be) Radiation Level II Elevator Judy Siren (Thanks to my grandmother (!) for getting this password) Level HI Biologist Ho! (Log onto Aaron’s Terminal - he’s not on this level - really!) @®) And now I'm stuck. What’s “A scale"? When you get it, send it in! The Protection (this is not a crack) With Alien Mind, IIgs protection finally approaches the insaneness of 514” protection. Instead of looking for a bad block or bad track, or nibble counting, or looking for disk signatures, PBI went about 6 steps further, the whole disk is unreadable. It is possible that it is unreadable as a consequence of the fast-load format it uses, and is not a direct attempt at protecting the disk. A sectorless format would indeed make it very difficult to read by normal means. Copy II Plus can almost make a working bit copy of it while synchronizing and keeping track length, but it’s not too reliable. Alien Mind doesn’t use ProDOS at all. Without looking at the screen, you can tell that it doesn’t use ProDOS because the title screen loads faster than ProDOS itself! This program Teally hustles disk access along. You can be up and playing in about 30 seconds. Character disk creation takes two seconds because it only seems to format about one track - only what it needs to store a few attributes. PBI advertises this game for $54.95. Even if you actually pay this much, it is still definitely worth it. However, I've seen it around $30 from mail order places. If you possibly can, get this game! This is the one which you’ve been saving and waiting for. Don’t Miss It! A look at Tomahawk (IIgs) Tomahawk is one of Datasoft’s most recent releases, and it’s a doozy. In this game you are the pilot of the AH-64 Apache Attack [ 20 COMPUTIST #64 February ] Helicopter, affectionately known as the Tomahawk. With laser-locking Hellfire missiles, autostabilization, and the TADS target aquisition and tracking system, you are in control of the skies for as long as you can stay in the air. Select flying conditions such as cloud base, turbulence and crosswinds, day and night flying, and pilot rating, and take to the skies. Hear the boom of the engines as they fire up, then watch the RPM’s increase as you try to lift off. Listen to the rotors as they sweep the air above you and haul you off the ground. Then the tough part comes in. Flying this beast is no piece of cake! Unlike an airplane, which is pushed forward by engine thrust, helicopters are pulled up by the thrust of the rotors. To go forward, the whole helicopter must be tilted forward. But, forward tilt equals downward plunge. So, it takes a very smooth touch and a lot of practice to fly the Tomahawk. This game has a very interesting feature which has to do with a map. You can choose to be on the allied side of an imaginary war, in which case you try to capture squares on the map by destoying all the enemies in a sector. No easy task is this, either. The game instantly grabs your attention at boot-up with some neat army-band music and itized picture of the Apache. Then, you’re hit by somewhat of a let down. The graphics are just a bit on the hurting side. Like F-15 and so many other flight simulators, wire-frame graphics are the best that you get outside the cockpit. Mountains are triangles, and helicopters are a bunch of lines glued together at bad angles. Below 500 fect you can see the “‘terrain’’ - a few randomly placed dots which supposedly give a realistic view of the ground. Truthfully, the game is much more enjoyable when you’re cruising around at 4000 feet and obliterating enemies with your Hellfire missiles before they can get close enough to spoil the effect. Despite the complexity of Tomahawk, it really needs improvement to become a complete game. This is not the game that you show off to friends who are thinking about buying a IIgs. The title sequence, yes, but then you turn it off before the actual game begins. As many Apple Tle games are, Tomahawk is a great ‘‘concept”” game, but doesn’t have the graphic elements necessary to make it a standout. Protection Oh no! I booted this game up and immediately turned green. If you read the review of Alien Mind, then you can reread the protection section of that review again for this article. The two protections are THE SAME. Someone is making a lot of money off this scheme. Both are characterized by a 15 to 30 block file which is the only entry on the disk. ‘What is going to make Tomahawk even tougher to crack than Alien Mind is that it performs disk access while it is playing the title music. The timing cannot be disturbed at all. Trickier and trickier. The person who solves this protection scheme will indeed be one of the elite hackers in the galaxy. Philip G. Romine Appleworks and printer codes Dr. Frank Lowney’s article in COMPUTIST #59 was very helpful to me. I have Version 2.1 of Appleworks, however, and his memory listings for the locations in the SEG.PR file no longer apply. Also, in my case, modifying the Imagewriter II file would not work on my Epson as it sent other codes in addition to the control-D codes, and that caused my Epson LX to use condensed print. The following comments should help others to modify their files, so they may use some of the other printers listed in the Appleworks printer selection and/or other versions of Appleworks. My printer has a dump mode which allows the codes and letters to be printed out on the printer; this characteristic is necessary for the procedure to be carried out. Now to the specifics: Use the Appleworks word processor to write a short sentence. Place a control-D before the sentence and another after it; then print it, with the printer in the dump mode. Check the printout and determine what code the printer (selected from the menu) sends to your printer for control-D and the hex number after. In the case of the Epson-LX the numbers sent were 1B followed by 47 (escape “‘/”” for the first control-D and escape ‘‘O’’ for the next one.) The entire sequence was in Hex: 02 1847 92 1B 48. The 82 apparently represents, in the program, the number of numbers to follow (ie. 1B and 47); the next @2 in the series is the same for the next set of numbers (ie. 1B and 48). My Apple IIgs has a search function in memory. One goes into BASIC and loads SEG.PR at $2000. “‘BLOAD SEG.PR, $2000, TBIN” or whatever type it is (maybe type system, TSYS) and search for the string (listed above in my case), or whatever string applies for the printer one is using in Appleworks. I found four such strings located at $28FF, $29DC, $2A7C and $2B34. I assumed that all four Epsons listed in the Appleworks printer selection menu used the same codes for control-D. By trial and error, I found that the first set of numbers was the one for the Epson FX, which was the last listed printer in the Epson series in Appleworks. In the series of Hex numers the first (82 in my case) would be changed to the number of numbers one would follow with, and the next numbers to whatever one wanted them to be. Thus, if one wanted the first contrl-D to send an escape only, the first number would be changed to ‘‘1’’ and the next number to 1B. Then if one wanted the second contrl-D to send a ‘‘2’’, one would leave the next §2 the same and change the next two numbers to 1B and 82. After the changes BSAVE the file back to disk or Ram-disk. CAUTION: Use only disk copies - never an original - for this exercise. Original String 02 18 47 02 1B 48 Modified String 91 1B 47 82 1B 32 The only numbers one need change are the first and last in the string. The first change, 02 to 01, apparently tells the computer to send one number to the printer, the 1B or escape; the 47 is not used; the following 02 tells the computer to send the following two numbers, 1B and 32, to the printer. If your computer does not have a search function in the moniter as the IIgs does, search your disk with one of the programs listed in the original article and make the necessary changes. If you have an Epson printer, then use the memory locations I have listed for the 2.1 Version of Appleworks. Ronald Mundell I have tried the Ultima V softkey (COMPUTIST #60, pg 21) over and over, every way I can think of; no results except Drive Error. I cannot read the disk past track $02 with any version of Copy II plus from 5.2 to 8.3. I would like to know how Ron Dippold managed that. Also the line 104@ in the controller refers to GOTO 1015. If I am not mistaken there is no line 1015. So, if anyone knows how to fix this softkey, there are a lot of us who would be extremely happy about it. Thank you. The "GOTO 1015” should be "GOTO 1020”. Good customer relations? RE: Ultima V music, the IIgs and Mockingboard. The patch from Origin is as follows: 10 REM ULTIMA V MUSIC PATCH FOR THE APPLE 11GS 20 FOR | = 768 TO 802: READ A: POKE | ,A: NEXT : CALL 768 30 DATA 24,251, 194,48, 244,11,0,162,3,35,34, G9, 225, 244,4,0 February COMPUTIST #64 4 DATA 244,0,0,244 0,3, 162,3,16,34,0,0,225, 56,251,226,48, Checksums 19 - $BADD 300 - $3BF1 20 -- $9AE2 4 $835F 21 The newer issues of the disk have this built in. This, of course, means that those of us stuck with the Mockingboard after upgrading to the Tigs, will have at least one use for the board. So far, only Origin Systems has responded to my requests for information that will allow the Mockingboard to be used in the IIgs. Poor customer relations? Sweet Micro Systems failed to respond to my inquiry about upgrading their program that ‘comes with the Mockingboard so the thing will work with the IIgs. Nothin’ personal, Just business? Also, I have written to Origin Systems regarding a rumored upgrade of Ultima V for the IIgs. The response from ‘‘Lord British’’ is that the conversion has not been put into the works yet; no suitable company to do the conversion?; any way, the IIgs version I was told, will be available for $59.95, and not as an upgrade from the 54” version. If anyone has heard anything more recent, maybe you could write in. This information is a few months old. rald E, Myers Bit Copy for... Algeblaster Davidson & Associates @ Requirements CO Any whole disk copier that will ignore read errors CO Bit copier O Blank disk formated DOS 3.3 Davidson and Associates publishes a number (10 in the last catalog I received from them) of educational software titles