u u u u U tf.l .... ~ I: lQ ~ r:1' ~ ~ ~ ~ ~ ~ t ~ 0 ..... :1 "r1 () c: ~ ~ ." ~ ~ 8' In' 0 0 0 p..'1~~ :::t o [~J~ 0 0 C/) 00' 0 '1 ....."8!t Cl 8 .... ~ ~~c::tD ~ ::s el ~ ~ > Q ~ ~ ~ = () 0 In' I» • ; § ; ...... '" 0 '" OMonsters and Make Believe v1.1 20 :::D :::D Logo PLUS 4 How to SAVE hexdumps as CDA's .8 Pipe Dream 8 m ::Sol::l-- 0 N~ Thunderstick 4 Logging ProDOS Drives 6 Pipe Dreams 15 -t Fast Frames, Updates, Etc. The Basics of Kracking (part 7) 17 Rear Guard 17 0 ~ A Copy II Plus PLUS! 7 The Basics of Kracking (part 8) 18 Rendezvous with Rama 19 Z (X) :::D - Countdown: E-mail 6 Same or Different 20 c.o 0 m Bitkeys: Teacher's Tool Kit.. 19 0 (X) - Hole 19 Talk 5 c: Holey Megabytes! 6 Teacher's Tool Kit (lIe) 20 m eN Black Magic 16 t.n oI::l- Keeping the Wiz in Wiz III 6 Guild of Thieves 16 War of the Lance 10 -t oI::l- Logging ProDOS Drives 6 Where in the USA isCannen m I Gunslinger 16 c 0 Next 7 King's Quest Series 16 Sandiego? 9 N Platinum Yanked! 7 Leisure Suit Larry 16 Windwalker OS 15 oI::l- Program Writer 6 Windwalker lIe 15 N Man Hunter: New York 16 Salute! 7 Police Quest 16 APTs: XT-AT Handbook 7 Realms of Darkness 16 'Courses of 1990 5 Saracen 16 Space Rogue 16 'Unlimited Golf& Course Design .. 5 Sierra Boot Disks 16 Wizardry III. See Keeping the Wiz in Why Logo? 4 Silicon Dreams 16 Wiz III Vendors •••••••••••••••••.•_•••••••••••••••••••...7 Space Quest Series 16 Ultima V 16 Playing Tips: Questions: Wizardry Series 16 Countdown 6 i, 8, 16, 17,21,22 Xyphus 16 Space Rogue 16

Answers: Softkeys: mM Softkeys: c:m.C: Edison , 21 Ancient Art of War 9 Serve and Volley 22 Groucho , 21 ~~.... Battle Chess 10 Welltris 22 ...... 0" Ross A. Holmes ' 21 Bridge 6.0 10 - en :::D C -»I»-t E.N. Hondrick 21 Captain Blood GS 10 ~m Software recommendations "Assembler". Most of the source code in older sending source code files, and you are notusing issues is in S-C Assembler format. Ifyou use a the S-C Assembler, send them as normal text TheStarter Kitcontainsmostoftheprograms different assembler, you will have to translate files. COIVIPUTIST that you need to "Get started". In addition, we portions ofthe source code into something your recommend that you acquire the following: assembler will understand. When to include a printed letter Charles R. Haight Editor • Applesoft program editor such as "Global Don't include hardcopy (printout) unless: JeffHurlburt Reviews Program Une Editor (GPLE)". Computing checksums Dave Goforth BBS oAssembler such as "Merlin/Big Mac". a. You are writing about a bug orother printing Checksums are4-digithexadecimalnumbers oBit-copy program such as "Copy n Plus", error. which tell if you typed a program correctly and COMPUTIST is pubiished by SoftKey "Locksmith" or "Essential Data Duplicator". b. You are writing to ask for help. helpyoulocate any errors.Thereare two typesof Publishing. Address all inquiries to: ·Word-processor (such as AppleWorks). checksums: onecreated by the CHECKBINpro­ c. You are answering another readers help re­ COMPUTIST ·"COPYA", "FID" and "MUFFIN"from the gram (for machine language programs) and the quest. 33821 East OrvDle Road DOS 3.3 System Master disk. Eatonville, W A 98328·9590 othercreatedby the CHECKSOFTprogram (for d. You are writing about your subscription or (206) 832-3055 Super lOB and Controllers BASIC programs). Both are on the "Starter Kit". sending an order for back issues or software. oCOMPUTISTdoes NOTpurchase editorial Ifyourchecksumsdonotmatchthepublished Bugs, requests for help and answers to re­ This powerful deprolection utility (in the checksumsthen thelinewherethefirst checksum material.Theentire editorial contentconsists COMPUTIST Starter Kit) and its various Con­ quests for help arebumpedto the head,ofthe line of information submitted to COMPUTIST differs is incorrect. trollers are used in many softkeys. (It is also on and go in the verynext issue. All otherletters are for publication in the shared interests of ali each Super lOB Collection disk.) CHECKSOFT instructions: Install Check­ printed in the order that we receive them. COMPUTISTs. soft (BRUN CHECKSOFT) then LOAD your oUnsolicitedmaterial (manuscripts, letters to Reset into the Monitor program. Press & to get the checksums. Correct Writing to get help the editor, softkeys, A.P.T.s, playing tips, the program line where the checksums fIrst dif­ questions, etc.) are assumed to be submitted Softkeys occasionallyrequiretheuserto stop When writing to request help, be sure to fer. as letters-to-the-RDEX-editorforpublication the execution of a copy-protected program and include ALL relevent information. The more with all and exclusive rights belonging to directlyentertheApple'ssystem monitor. Check CHECKBIN instructions: Enter the monitor information you include, the easier it is to find a COMPUTIST. the following list to see what hardware you will (CALL -151), install Checkbin atsomeoutofthe solution. There's an old saying that goes "A oEntire contents copyright 1990 by SoftKey need to obtain this ability. way place (BRUN CHECKBIN, A$6000), and properly framed question includes 90% of the Publishing.Allrightsreserved.Copyingdone Laser 128: Your ROM includes a forced thenLOADyourprogram. Getthechecksumsby answer". for other than personal or internal reference jump to the monitor. Press ctrl return reset. typing the Starting address, a period and the (withoutexpress written permission from the How to get mail Applen+, lie, compatibles: 1) Place aninte­ Ending address ofthe fIle followed by a ctrl Y. publisher) is prohibited. ger BASIC ROM card in one of the Apple slots. SSSS.EEEE etrl Y If you are interested in receiving mail from •TheSoftKeyPublishing assumesnoliability or responsibility for the products advertised 2)Useanon-maskableinterrupt(NMI)cardsuch Correctthe lines where thechecksums differ. other readers, be sure that we have a current in this newsletter. Although we are usually as Replay or Wildcard. address. If you use a pen name and want to pretty much in agreement, any opinions Apple n+, compatibles: 1) Install an F8 Writing to the RDEX editor receivemail, weneed to have your address. Our ROM with a modified reset-vector on the com­ readers privacy is important, so we will notprint expressed by the authors are not necessarily RDEX (are-decks) stands for: Reader's Data those ofCOMPUTIST magazine or SoftKey puter'smotherboardas detailed in the"Modified your address unless you specifically say too. EXchange. We print what you write. When you Publishing. ROM's" article (COMPUTIST #6 or Book Of send in articles, softkeys, APTs, etc., you are Softkeysill)orthe"DuaIROM's"article(COM­ How to write to RDEX authors SUBSCRIPTIONS: Rates (for g issues): submittingthemforfreepublicationinthismaga­ PUTIST #19). U.S $24 Canada/Mexico .. $34 zine. RDEX does notpurchase submissions nor When writing to one of the RDEX authors. Apple /le,llc: Install a modifiedCDROM on U.S. 1st Class .. $34 Other Foreign ..... $54 do we verify data submitted bY readers. If you Write your letter and seal it in an envelope. Put the computer's motherboard that changes the discover anyerrors, pleaseletusknow so thatwe your return address, the authors name (as it oSubscriptions are sold by number of issues open-apple ctrl reset vector to point to the moni­ appearsinRDEX) andthecorrectpostageonthe and not by month or year. An 8 issue may inform our other readers. tor. (This will void an Apple lie warranty since envelope. Put this envelopeintoanother and send subscription means that you will recieve 8 Remember that your letters or parts of them you must open tM case to install it.) it to RDEX. We will put the correct address on issues before you need to renew. It's when maybeusedinRDEXevenifnotaddressedto the Apple Ilgs: Ifyou have the 2.x ROM, there is _you will receive each issue that we're a little RDEX editor. Correspondence that gets pub­ your letter and mail it for you. Check to the right a hidden Classic Desk Accessory (CDA) that erratic 'about. lished may be edited for clarity, grammar and ofthe authors name to seeifthe author is writing allows youtoenterthemonitor.Inorderto install from a foreign country and include the proper oDomesticDealerrates: Call(206) 832-3055 space requirements. the new CDA, you should enter the monitor postage. _ for more information. Because of the great number of letters we (CALL -151) before running any protected pro­ o Change Of Address: Let the U.S. Postal receive and the ephemeral and unpredictable grams and press # return.This will turn on two Service know thatyou aremoving. Tell them appearance of our volunteer staff, any response Help Line hidden CDAs, Memory Peeker and Visit Moni­ that you want your mail forwarded. If your to your queries will appear only in RDEX, so it tor. Thereafterpress openapple drl esc to go to These readers have volunteered their time to issue does not come to you in an envelope would be more appropriate for you to present theDeskAccessoriesmenu. SelectVisitMonitor help you. Please callonly within the given time thenyouhave a regular subscription andyou technical questions to the readers and ask for and there you are. Use ctrl Y to exit. frames (corrected for yourtime zone). No collect musttell theUSPStoforward yourthird class their responses which will then be placed in the mail. Notifyus assoonas youknowyournew calls. Apple-RDEX. address. When we receive your notice of Recommended literature Jack Nissel (Disk Protection, 7-lOPM EST) change of address, we will send you an oApple n Reference Manual (or ne, nc, etc.) How to get a free library disk (215) 365-8160 acknowledgementcard. Ifyoudonotreceive oOOS 3.3 & ProDOS manual the acknowledgement card after 2 weeks, Whenever possible, send everything on Ap­ oBeneath Apple OOS & Beneath Apple Pro­ TheBBS send another notice or call us direct ple format (5.25" - OOS/ProOOS or 3.5" - Pro­ OOS, by Don Worth and Pieter Lechner, from OOS) orIBM format (3.5") disks. Other formats (Bulletin Board System) Issuesmisseddue tonon-receiptofchange Quality Software of address mo.y be acquired at tM regular areacceptablebuttheremaybe somedelayas we Dave Goforth is the sysop for the Computist ba£k issue rate. Typing Applesoft programs lookfor someoneto translate itforus. (Jfyou use BBS. The number is: (206) 581-9292. If you We are notresponsibkformissing issues a 5.25" disk, when we print your letter,we will already have a User ID# and password, sign-on 90 days after mo.iling date. If you do not BASIC programs areprintedin a format that return your disk with tM current library disk using the User10#.Ifyou are anew user, itmay receiveanissueattMusualtimeeachmonth, is designed to minimize errors for readers who copiedonto it.) Usewhatevertexteditoryoulike, take a day or so to validate your new 10# and pkase call or write. key in these programs. Ifyou type: but tell us which one. Puta labelon the disk with password. AppIe4I> ... IrtdonwIt of ApPe Ccmpu...... IBM... !be IBM lOHOME:REMCLEAR SCREEN your name (or pseudonym) and address (if you Indemofk. want to receive mail). Don't reformat any pro­ The LIST will look like: grams or include them in the text ofyour letter. 10 HOME: REM CLEAR SCREEN Send Applesoft programs as normal Applesoft Readers Data EXchange Applesoft inserts spaces into a program list­ files and machine language programs as nonnal ing before and after every command word or binary files. We have programs to convert them New COMPUTIST readers using mathematical operator. These spaces don'tpose to the proper formal for printing. If you are Apple JIs are advised to read this page a problem except when they are inside ofquotes r carefully to avoid frustration when at­ or after a OATA command. There !lIe two types ofspaces: those that have to be keyed and those tempting tofollow a softkey or entering that don't. Spaces thai must be typed appear in You have a LEGAL RIGHT the programs printed in this issue. COMPUTISTasspecialcharacters(0). Allother spaces are there for easier reading. What is a softkey, anyway? NOTE:Ifyouwantyourchecksums to match, to an unlocked backup copy Softkeyisa term which wecoined to describe only type spaces within quotes or after DATA aprocedurethatremoves,oratleastcircumvents, statements if they are shown as (0) charactors. any copy-protection on a particulardisk. Once a SAVEtheprogramatperiodicintervals using the of your commercial software. softkey procedure has been performed, the re­ name given in the article. All characters after a sultingbackupcopycanusually becopiedby the REM are not checked by the checksum program normal copy programs (for example: COpyA, so typing them is optional. Our editorialpolicy is that we do NOT condone software piracy, but we do believe that users on the DOS 3.3 System Master disk). are entitled to backup commercial disks they have purchased. In addition to the security ofa Typing Hexdumps backup disk, tM removal ofcopy-protection gives the user fM option ofmodifying programs to Commands and control keys Mr Machine language programs are printed in meet his or needs. FurtMrmore, fM copyright laws guarantee your right to such a DEPROTECfED backup copy: Commands which a reader is required to COMPUTIST as hexdumps, sometimes also as performare setapart bybeing inboldfaceandon source code...... It is not an infringement for the owner ofa copy ofa computer program to make or authorize a separate line. The return key must be pressed Hexdumps are the shortest and easiestformat the making of another copy or adaptation of that computer program provided: at the end of every such commandunless other­ to type in. You must first enter the monitor: wise specified. Controlcharacters are preceeded CALL-151 1)thatsuchanewcopyoradaptationiscreated as anessentialstepintheutilizationofthecomputer by"ctrl". An example ofboth is: Key in the hexdump exactly as it appears in program in conjunction with a machine and thai it is used in no other manner, or Getrl P the magazine, ignoring the four-digit checksum Type6. Next, placeonefingeronthe ctrlkey ($ and four digits) at the end ofeach line. When 2) that suchnew copy or adaptation is for archival purposes only and that all archival copies are and thenpress P. Don'tforget topress thereturn fmished, return to BASIC with: destroyed in the event thatcontinued possession of the computer program should cease to be key. 3DOG rightful. Otherspecialcombinationkeypressesinclude BSAVE the program with the fIlename, ad­ drl reset and open-apple drl reset. In the dress and length parameters given in the article. Any exact copies prepared in accordance with the provisions ofthis section may be leased, sold, fonner, press and hold down the ctrl key then orotherwise transferred. along withthe copy from which suchcopies wereprepared, only as part press the reset key. In the latter, press and hold Typing Source Code of the lease, sale, or other transfer of all rights in the program. Adaptations so prepared may be downbothctrl andopen-apple thenpress reset. transferred only with the authorization ofthe copyright owner." The source code is printed to help explain a program's operation. To enter it, you need an United States Code title 17, §117

2 Readers Data Exchange COMPUl1ST #180 U) them into "centerfolds" in Computist. Send the a guesswithoutasking youalotofquestions.The Editorial Notes info ondisk ifat all possible. Ifyou don'thave a doctorneedsmoreinformationand sodoI.Uyou ...... • r') chart but you do have an idea fur one then send are serious about getting an answer. you must ~ Bad GS Power Supplies that too. provide complete information. Which Apple are E-t I read a note in "Enhance" (Quality Comput­ you using? What other hardware is plugged into Postage Increases • ersinhousenewsletter andcatalog)thatsays that your Apple? What operating system are you en• Apple Computer Inc has determined that cenain You knew it was going to happen and here it using (OOS3.3. ProDOS. GSOS, GEOS. etc.) rIJ ~ GS power supplies may fail under low load is. I finally took some time to calculate the and what software is resident in your computer conditions. That means that the power supply postage increases from the US Postal Service and when theproblem appears. Everything is impor­ may fail ifitisn't loaded enough. How's that for add them to the subscription rates. Good news tant and almost anything might be the one bit of 1-1 illogical? and badnews.Theregular US and 1stClassrates info that we need to answer your question. Ifyour figs was manufactured after October are going upbyonedollar ($1). Foreignratesstay Anyway, when it comes to answering ques­ I:"" 1990 then you are OK. (That's manufacturedate the same since we use a mail forwarder and they tion, I'm a little burnt-out. Perhaps someone else * not date of purchase.) haven't raised their rates yet. So if you are com­ would like to answer these questions while I take E-t 0 To determine if your computer is affected, ing up on your renewal. do it now! As of the a break. Q open thecaseandtake a lookatthe powersupply mailing of issue #81 (the next issue) we will .~ Will Computist ever come out ON TIME? H (the box on the left). Ifthe case is a dull brushed begin charging the new rates. This is your last ~ metal, theserial numberbegins with theletter"I" chance to renew at the old rates. I don't know, maybe not, but I have a real ~ ~ goodexcusefor issue#80.I caught uponsubmis­ and there's no red dot on the case you may be in Help Questions need help! ~ for trouble. sions as ofissue # 79 and didn't have enough to I receive a lot ofhelprequest letters. Someof fill issue #80. could either wait a bit longer for ~ Apple has a repair extension program for the I 'tS affectedpowersupplies.They will replacefailed them will neverbeanswered. NotbecauseI don't YOU to send in more info or I could reduce the ~ power supplies thru January 31. 1993 but only havethe time. although timeis always shorthere, number ofpages in the issue. Since Computist is butbecause they are ofthe "open-ended" type of printed on a newspaper web. itis run as three (3) A.t ~ failed supplies. There's no way to get a function­ = question. They fall into two main categories. u ing but suspect supply "fixed". signatures ofeight(8) pages each for a total of24 Uyou already paid for an out-of-warranty The first one I call the "Whatis Life?" ques­ pages per issue. Reducing the page count would replacement supply, you may be eligible for a tions. TheonesIreeeivemostoftenare "Whatdo mean going to 16 pages. (Two - eight page refund. Contact yournearestAppledealerbefore I use my Apple fi for?" and "How can I make signatures.) I decided to wait a bit longer. You June30, 1991 orcall AppleCustomerAssistance some money using my Apple fi?" Otherpopular don't really mind, do you? II requests are"Canyouhelpme write a programto In any case. don't delay. send in your soft­ at 1-800-776-2333. do ...... "Ihavelots ofmemory. canyoumakemy keys. APTs. tips and informational articles IRS news copy of (program name) work with my copy of RIGHT NOW. I'm interested in any BASIC Wearestillnibbling away atthis one.Thanks (programname), inmemory. atthe same time?", programs (long or shon) that you have written 0 to all of you who sent a donation last month. I "HowcanI make myllecopyof(programname) and would like to share with the rest of us. I'm have a suggestion.Ifyou are considering sending use the super hires screen on my figs?", especially interested in any ampersand (&) util­ a donation, send itas a backissueorlibrarydisk Theothercategoryis"IncompleteQuestions". ities designed to make programming in BASIC order.That way you getsomething immediate in These are open-ended because ofthe lack of fu~ easier. Come· on! I lQlow most of you have 0 return. Kind oflike a thank you note. information about the system being used. They something that you have written and still use. are usually about software but hardware and Share it with us. Centerfolds? firmware questions do pop up. Examples are. While I was waiting for some more material "My system locks-up occasionally. why is this New Eamon Adventures to fill issue #80. I had a brainstorm. I was in the happening and whatcanI do to stopit?". "Some­ Therearetwo(2)newEamon scenarios. They process of making another "chan" for the wall times I can'tcatalog a disk andothertimes I can. are"UtterlyOutrageous#205" and"Curseofthe next tomy computer. You know. pasting togeth­ What's happening?". "My copy of (program Hellsblade #206". 0 er 8.5" x 11" sheets to make a larger chart. name) won'trun. how canI fix it?", "My copy of Oops! Anyway, I was thinking that if you pull out the (program name)runs on a friends Apple but not center pageofComputist, you would have a 17" on mine, why?". I forgot to merge the Help file with the main ex) x 22" sheetThat would make a nice sizedchart. Asking these kinds ofquestionsis likecalling texLThatmeans I'vegot6 annoyed readers who So how about it? Send me copies of all of the a doctor and saying that you feel bad and asking sent help requests which won't be printed 'till "charts" that you make for yourself and I'll tum what is wrong. The doctor is not going to hazard issue #81. Sorry...

Ross A. Holmes 21 Dinosaur Days v1.0 20 Table of Contents E.N. Hondrick 21 Empire 8 Jeff Hurlburt 21 Fahrenheit 451 19 Editorial Note 3 Bob Igo 21 Fay's Word Rally 20 ~][)E~ 4C;olltrilJutors ••..••••.•••.••••.••••••.• ~~ Blain Jolmson 21 GATO vl.3 21 Gary Wills 21 Greeting Card Maker 20 Most Wanted Softkeys ~~ Hostage 15 un4C;lassitieds 23 Features, Notes & such: KeefThe Thief 8 Add Copy II Plus file handling to your BASIC Magic Spells v2.0 19 The Product Monitor progr. See A Copy II Plus PLUS! 7 Magic Spells v2.1 19 Reviews Comments on the Beginner's Book 7 Mickey's Crossword Puzzle Maker 16 AT Bus I>esign 5 Fonnatting 720K disks as 1.44M HD. See Holey Monsters and Make Believe vl.l 20 Apple lIgs Hardware Reference, second Megabytes! 6 Pipe Dream 8 edition 5 How to SAVE hexdumps as CDNs 8 Pipe Dreams 15 Countdown 4 Logging ProDOS Drives 6 Rear Guard 17 Genius Mouse:GM-F3021303 5 The Basics ofKracking (part 7) 17 Rendezvous with Rama 19 Logo PLUS 4 The Basics ofKracking (part 8) 18 Same or Different 20 Thunderstick 4 Teacher's Tool Kit 19 Fast Frames, Updates, Etc. Bitkeys: Teacher's Tool Kit (lIc) 20 War of the Lance 10 A Copy II Plus PLUS! 7 Black Magic 16 Where in the USA isCannen Sandiego? 9 Countdown: E-mail 6 Guild ofThieves 16 Windwalker GS 15 Hole 19 Talk 5 Gunslinger 16 Windwalker lIe 15 Holey Megabytes! 6 King's Quest Series 16 Keeping the Wiz in Wiz III 6 Leisure Suit Larry 16 APTs: Logging ProDOS Drives 6 Man Hunter: New York 16 Next 7 Police Quest 16 Space Rogue 16 Platinum Yanked! 7 Realms ofDarkness 16 Wizardry III. See Keeping the Wiz in Wiz III Program Writer 6 Saracen 16 Salute! 7 Sierra Boot Disks 16 Playing Tips: XT-AT Handbook 7 Silicon Dreams 16 Countdown 6 'Courses of 1990 5 Space Quest Series 16 Space Rogue 16 'Unlimited Golf& Course Design 5 Ultima V 16 Why Logo? 4 Wizardry Series 16 IBM Softkeys: Vendors 7 Xyphus 16 serve and Volley 22 Welltris 22 Questions: Softkeys: i, 8, 16, 17,21,22 Ancient Art of War 9 Battle Chess 10 Answers: Bridge 6.0 10 Edison : 21 Captain Blood OS 10 Groucho , 21

COMPunST #80 Readers Data EXchange 3 detail top-down; astill lowerdetail view For two-stick games or games which do Why Logo? JeffHurlburt TX helps with navigating an underground not employ a throttle option there is a Logo (from the Greek word for maze. right-edge-mounted slide switch to dis­ ''thought'' or "word") is very good at T...... ···be:," ... ~ ~. ::.>~ Many importantclues (and somecrit­ connect the slide cO,ntroL handling text objects, allows users to ical items) are obtained in numerous I put Thunderstick through the usu­ defme new commands, and encourages face-to-face encounters with such per­ al driving and combat tests. These, in­ production of nicely structured pro­ PR,ODUCT· sonages as Lisa, an agency colleague, a cluding ''Test Drive II"/gs and "Elite"/ grams. Like BASIC, itis an interpreted, Russian agentnamed Boris, and Golden 11+ played (ahem) with acceleratorcard, highly interactive language (i.e. you can Desire(!), adead-ringer for Angie Dick­ revealed the anticipated flight readiness. write procedures and try them without .r.~., "O~R ensen-to name afew. In these the main (The tab-top X-Y slide adjusters have waiting for a compiler-linker). Unlike ···0·.a.••. =N:..": .::···ltT··::: / . challenge is.to select the opfimum dia­ plenty of range to pennit centering at BASIC and other popular languages, logue approach (e.g. "Frienllly", "Has­ accelerator speeds.) T'sticks hefty slot­ Logo exhibits amazing range interms of RATINGS sle", etc.) guided by charactercomments ted-bands mechanism delivers tight, 'abstraction': from "concrete" at lower and facial expll.:ssions. Other displays smooth response with enough 'center­ 'turtle moving' levels through abstruse Superb ***** include travel maps, city picture inserts, ing-bump' for good stick-position feed­ at its higher 'lists within lists' levels. Excellent **** and, for high-tech decoding and data back and almost no tendency to 'bot­ Full-featured versions (like Terrapin's) processing chores, you r handy Comput­ tom' (Le. you can 'feel' center withouta offer exceptional error reporting and Very Good *** er Access Device can do blow-ups of 'catch' in handle movement). Needless debugging, floating point math, and ca­ Good ** photos and messages. to say, I've seldom had an easier time pabilities for making machine language Countdown's best feature is that, potting "Elite'"sThargoid motherships. calls. It isfair to say you CAN do any­ Fair * having wowed the player with 'special As indicated inthe specs listing,"Cen­ thing in a good Logo implementation Poor (g) effects', it remembers to deliver ahigh­ tering Error" (the tendency to 'pull' X­ that you can do in BASIC, Pascal, orC; Bad (g)(g) ly-engaging, playable adventure. One Y center output in the direction of most but, almost always, itwill take longer. CAN win this game without the Hint recent stick movement) is almost non­ Defective Logo is very popular as a 1st pro­ If-- Book. (I did make one HELP! call to existent. Aside from being agood'qual­ gramming language for young children Access, before arrivalofthe Hint Book­ ity measure',low centering error makes because they can make concrete things and used the book to get around one for more accurate targeting and enhanc­ happen using commands that 'say what Countdown problem. Ineach case the 'answer' was es sUlVivability in high-action seat-of­ they do'. Invarious U.H. CFG projects, well within reach in the game.) I just the-pants combats. Tension is about I've encountered bothBASIC and Logo KNEW the mole's identity- "It HAS right; 150 grams is not at all high for a educational situations. BASIC is gener­ $59.95 for****VGA 640K PC to be ..."- so, there was no way this full-grip stick. As for the throttle, Ihave ally preferred for middle school grades. game was going on the back burner. not, so far, tried a product which em­ ($9.95 for Hint Book) Logo appears to work better as a starter Expect the promised "intrigue, espio­ ploys this option. Atesterprogram read­ language for youngerstudents forwhom Access Software nage, and suspense." Once the Count­ out showed smooth response over the BASIC's abstract, cryptive commands down starts, it's too late to back out! full, 0-255, range. pose problems. Mainly, adults'getinto' Your problem is that you do NOT The one spec likely to raise a few the language for one or more of four belong here. The old noodle may be full eyebrows is "Useful Range". For best reasons: A. to teach computer program­ ofmush- something about headlights, ml\lJOOlID(gOln~1l'D@1X control precision, 33 degrees (about +/­ ming to young children; B. to develop a car, a dingy nuthouse cell...- but, bll KRRFT 17 degrees from center) IS on the low Logo educational materials; C. to re­ you're bound to be one of the 'good side of 'ideal'. However, on a full-grip search artificial intelligence and "micro guys'. "Mason Powers", the labelonthe stick, a few degrees translates into a lot world" concepts; D. for fun! chart, SOUNDS like a'goodguy' name, more actual motion than is the case with doesn't it? Now, ifyou could justfigure asmall, thumb-and-forefinger-grip unit. Logo PLUS out where 'here' is and how to get out (In fact, beyond +/- 30 degrees, most (and WHO dumped you here, and why, full-grip stick users are likely to become and ...). Well, maybe you'd have a shot uncomfortable with the resulting large at finishing whatever it was this Mason movement swings.) Another plus factor $119.95 for***128K Apple n Powers person was doing. Like, maybe is that, with+/- 25 degrees oftotal move­ it was important? ment allowed, very little ofthe range is Terrapin It was; it IS! Somewhere, a terrorist inactive. Sticktravelend-points are good Afteryears ofdepending uponTerra­ group called "Black December" has Thunderstick 'signals' for minimax control outputs. pin's DOS 3.3 based "3.0"language for started a countdown to disaster. Bad Thunderstick must be placed on a my Logo computing, the arrival ofPro­ enough; evenworse is that 'December's surface at approximately elbow level DOS based Logo PLUS was a genuine string of recent 'minor' atrocities AND (Joystick for***Apple n series, (Le. about where one expects to find a 'event'. Now I could put loads ofLogo their planned master stroke may be the PC version available) flight console controller). Much higher programs on 800K diskettes, set up work of a mole at the heart of CIA's and you will find your hand repeatedly handy subdirectories, and REALLY get Middle East section. Safely stashed in a $25 (approx. retail) scrapping the centering adjusters. For organized! There are many new built-in 'company'-runTurkishsanatorium, you best results, allow space for your 'stick commands, too. Called "primitives" in are the sole remaining loyal CIA opera­ Kraft Systems arm' to rest and swap-in the optional Logoese, these include a set of com­ tive who believes the mole exists. The Size: 7.0"W x 6.5"D x 2.25"H x 5" suction cup-feet. Since much ofthe push mands to take advantage of ProDOS otherguy, Mc Bain, is supposed to have Handle on the unit is lateral, the nonnal rubber (e.g. MAKEDIR, ONLINE, ...), NOTE been blown away by (who else?) Mason Centering Tension: approx. 150 gm. feet may not supply enough grip on for playing music, some build-ins of Powers! Handedness: none (Right, ifusing slide some surfaces. A second caveat relates previously user-createdcommands (e.g. Countdown launches you on a con­ throttle) to the handle itself. Unlike most large­ WAIT), and severalimportantGraphics tinent-hoppingquest to shutdown Black Centering Error. 1.0%H, 1.2%V handle sticks, Kraft's unit is not de­ enhancements. Via DOT? SDon, and December, pull the plugon its operation Centering Defeat: none signed for a wrap-around grip-- the COLORUNDER your turtle can now Thunderbolt, and nail the mole known Movement Range (Horiz.): 50degrees trigger winds up under the middle of detect the presence and/or colorofdots. only as "Stonnbringer". Billed as "an Useful Range (XI Horiz.): 33 degrees your trigger finger. Instead, the smooth, FILL colors-in an enclosed area; you interactive movie", the game employs Centering Adjust: two 'slides' squarish handle favors a half-wrap grip can HFLIP and VH...IP the hires screen; real actors in several VCR-playback­ Connector: Apple DIN (16-pin adapter to place the trigger where it belongs and and ZOOM is for detailed hires editing. quality animated 'cut scenes' and en­ available) your thumb on one of the two PB-l To the above you can add PRINT­ counter close-ups- all in 256-color Case Access: five screws buttons. SCREEN for hires screen dumps plus VGA. Digitized voices and full-range It's easy to see why Baywoof has whole new sets ofcommands for Shape sound effects are available via AdLib, Done insteely flat-black, Kraft's new combat stick features a triangular-ish been so enthusiastic about his PC ver­ Editing and for placing TEXT on the Sound Blaster, and otherpopular adapt­ sion ofKraft's new entry in the perfor­ ers, sloped-frontcase topped by ala~e, full­ graphics screen! Among theon-diskutil­ mance-stick sweepstakes. Great looks ities you'll fmd GWRITE, a tool for To maintain its 'inthe movie' effect, grip handle. All buttons are positive and a solid, smooth feel add up to a for­ adding text (in various fonts and styles) Countdown's fonnats adjust to fit your click-action type switches. PB-O, the realcontender. Aslightly deeper, rounder to hires screens, EDSHAPE, a separate current activity. Except for the surprise 'fire button', is your trigger. PB.l is handle would be an improvement, par­ Shape Editor, a Font Editor, a 6502 ending, cutscenes serve as flashbacks to duplicated on the top-of-handle mini­ ticularly for large-handed users; and, as Assembler(!), and mes to enable color jogyour befogged memory. Most ofthe panel for convenient thumb activation noted above, placement is very impor­ and inverse hires printouts. time you will have a 3-D side view of byleftorright-handers. The "throttle"is tant. When you install a realistic flight With just a little diddling, all ofyour your Mason Powers figure in a room. aslide control mounted on the case'sleft controller, Kraft seems to be saying, favorite old-Logo stuffcan RUN under Here, using KB ormouse, you can move edge. Handle position controls outputs you've got to put it where it belongs. the new version. TheLogo PLUS CON­ around and GET, USE, etc. items. In the ofJ-Oand J-l (the normal '1st-player' X Does it belong in yourcockpit? Ifthe old VERT utility (or Copy II Plus) will sanatorium corridors, Black December and Y analog outputs). Throttle sets J-2 (nonnally, the '2nd-player' X output). 'console' checks out as under-equipped, move the DOS 3.3 files onto a ProDOS headquarters, etc. the view is lower- check out Thunderstick.

4 Readers Data Exchange COMPU11ST#80 diskette. They willtransferas .BINtype to obtain full-screen (horiz.) cursor AT Bus Design new 'Ugs Hardware Reference (for files, whichmay cause someconcern, if .sweep: BOTH earli.er and 1MB IIgs) presents you CAT a directory ofLogo Plus pro­ Low- O.75"/screen beautifully laid-out charts, tables, and grams- they are all TEXT files! No Medium- 1.50"/screen easy-reading explanations inlarge, S.5" problem. The new Logosaves programs High- 3.50"/screen $69.95·203***pages x 11" softcover fonnat. Ten indexed as .TXT type files; but it can load both Connectors: DB 9-pin (on mouse ca­ Annabooks chapters coverMemory space, Shadow­ .BIN and .TXT program files. ble) plus 25-pin serial adapter; 6-pin ing, the Mega II and FPI subsystems, Once transferred, it will usually be PS/2 adaptercable included in 'F303 True, as a typical Apple II user/ex­ Sound, Peripheral Slots, Connectors, necessaryto removeormodifyanyuser­ package perimenter, IHAVEfound myselfthink­ Desktop Bus, Video displays, I/O ports, created procedures having the same Buttons: Three keys, including stan­ ingaboutpossible hardwaremodstoour Battery RAM, Disk interface, Power name as new primitives (WAIT is an dard Left and Right plus Center PC/AT. (Justadd a leadhere; runittoan supply, 65CS16 processor, and much example). Finally, you will need to be Switches: Bottom-of-case slide switch op-amp in slot two; ... etc., etc.) One more. "Cover" means just that, includ­ sure that file names mentioned in pro­ to setSerialorPS/2 mode and toggle­ thing's for sure, when you are serious ing timing diagrams, pages of Soft grams matchthose shortened inthe Pro­ in resolution settings aboutconstructinganIATplug-in, you'll switches, Registerdescriptions, Instruc­ DOS move. As before, program names Size: 4.0"L x 2.25"W x 1.2"H want Annabooks' 'Bus Design manual tion sets, AND nine pages of fold-out must still end with".LOGO". Too bad. KYE's new mouse is called"genius" (by E. Solari) close at hand. Incorporat­ Schematics! With only fifteen characters allowed by because the user can switch resolution ing recent Intel and IEEE standards re­ 'Productionvalue' is very good, with ProDOS for file names, Terrapin really 'on-the-fly' right on-the-mouse. For leases, the book focuses upon ISA and ample white space and effective use of should scrap this requirement. Going to example to switch from "Nonnal" to extended ISA ("E-ISA") S/16-bit bus font styles andlight-darkhighlighting. I the .TXT filetype, however, is a good "High" speed (Le. lowest resolution), designs. do,justa bit, miss the coloremployed in idea. For heavy-duty editing/convert­ you hold down the Leftkey andtoggle a Though technical references are sel­ the first edition; but, overall, the up­ ing, you can bring any Logo PLUS­ slide on the case bottom. When you're dom as 'dry' as is commonly supposed, date'scharts and pictorials are probably saved or "Apple Logo" program into in the middle of a graphics design task it was still something of a surprise to clearer and easier to use. Of course, your favorite word processor and save and need a delicate touch, a Right key­ open a text crammed with timing dia­ along withmost IIgs users, I continue to the results in ready-to-go Logo PLUS press plus toggle and ZAPPO your grams (tables, charts, ...) and find high­ believe that the hardware and finnware fonn. mouse is in high resolution! There's no ly-readable discussions ofdesign ideas references belong in a single, integrated Terrapin's new Logo is a major 'up­ needto callupa specialmenu display or and considerations. Beginning with a volume. (See, one really canfmd some­ grade; it is not the long awaited "IIgs maintaina"Config",etc. utility inmem­ background and overview of the /AT thing to pick at in ANY product.) Own­ Logo". Super-res and IIgs sound are ory. bus, the book covers Memory and I/O ers of pre-1MB IIgs machines who both ignored; and, while Logo PLUS Rendered in off-white, Genius address space,Genericbus cycles, Add­ rushed out and purchased the original supports larger programs, 12SK is a Mouse is an attractive unit which fits on card interaction (including slaves 'HardwareReferenceare already ingood 'drop in the bucket' of what IIgs could neatly into a matching pocketfor conve­ and bus masters), DMA transfers, Re­ shape. 1MB version owners and early­ handle. The absence of SO-column text nient storage. While it perfonned 'as fresh, and much more. One chapter de­ IIgs hold-outs (if any) need to rush out is only mildly surprising. Of course, advertised',threedesignfeatures inpar­ scribes each of the bus signal lines in and grab the 'Second Edition. LogoPLUSSHOULDsupportthe dens­ ticular explain the rating: detail. er fonnat, if only because many pro­ 1. The three keys are identical in size. Organization is very good, withgood Fast Frames, Updates, Etc. spectiveusers find itdifficulttotake 40­ This leaves the frequently clicked use ofshaded'extra infonnation' boxes column fonnat seriously. As, chiefly, a Left key too small. In extended trials to supply handy details. The most nota­ Hole 19 Talk list/text-processing language, Logo ble deficit is the absence of an index. I oftenfound myfmgerresting onthe When I first reviewed Accolade's should beable to display as muchtextas One or two design examples would be dividing space betweenLeftandmid­ JNG, the IIgs version got good marks the host machine allows. On the other welcome, too; but there's no denying die keys. for overall challenge realism but lost hand, an SO-column display is not as that the book perfonns as promised and 2. Themousecasefeatures apronounced points on screen-update speed, putting critical to ease of program editing in beyond. Better yet, as someone who 'cupcake' style rim alongthree sides. .challenge, and the absence of a course Logo as in other languages. Logo pro­ 'knows his stuff the author doesn't try Side-gripping fingers must rest un­ construction utility. A year has not gram lines are seldom very long; and, in to 'snow' the reader with arcane tenni­ comfortably on the rim or below it changed this evaluation. Indeed, for IIgs, schools,easy-to-see4Q-columndisplays nology. AT Bus Design is a text which, and scrapping the pad. Mean 18 (also from Accolade) looks are preferred for use by the younger for someone with a little experience in 3. 'Click' action is poor. The sample better than ever vis-a-vis the competi­ students who make up the bulkofclass­ hardware design, can be a real help in receivedexhibited approximately 2.5 tion (including EA's "World Tour room users. developing a PC plug-in design that mm of space between key and stop. Golf'). Constructing your own procedures, Toclickyou mustexertforce through works. fine-tuning them, and fitting everything the entire distance against the unit's 'Courses of 1990 *** together IS entertaining; Logo is one of 96gramtension. Theresultis aslightly Apple IIgs Whether you enjoy Jack Nicklaus' the few languages people actually use mushy feel, missed clicks, and click­ Hardware Reference, Golfon the IIgs orPC, you will want to justforthe amusementofprogramming. ing-fmgerfatigue. Itookthe unitapart, add the latest "Add-on Course Disk" No doubt much of the fun comes from sliced into the plastic key supports to second edition ($21.95) courses to your collection. 'building stuff' and watching it work; reduce tension and glued-in shims to These include Oak Hill, Royal Troon, butalotcomes in anon-goingprocessof pull the keys downcloserto the case. and KemperLakes. Based upon an hour discovery. Logo PLUS starts you fast This produced a 1mm stroke, 75 gm $26.95****• 323 pages orsoofsamplingthe holes, you canlook with the dauntless Turtle, extensive tu­ of tension and a vastly easier, more forward to some ofthe best, most inter­ torials, references, and examp1es­ positive action. Addison-Wesley Publishing esting challenges yet. there's even an "Instant Logo" option Ithas beena couple ofyears since PC for younger children- but, with over As PC computists know all too well, 'Unlimited Golf users depended upon mouse suppliers 200commands,exploringthelanguage's there's a good reason why third party & Course Design for their painter software. After using ** full potential can be as engaging as any publishers are so critical to users of EA's "Deluxe Paint II: Enhanced", a Thisnew Accolade package ($59.95, role-play adventure. Supplied on both 'generic' /AT's: when you buy one, the little experience with KYE's "Dr. Ge­ for CGA-VGA 640K PC) significantly 5.25" and 3.5" media, the best of the documentation you get is strictly 'bare nius" utility makes it clear why. Old enhances Jack Nicklaus' golfing by Apple II Logos comes with Terrapin's bones' stuff. Meanwhile, Applearid Mac DocGenius'sretirementisLONGover­ offering both the game AND a fine standard enonnousloose-leafmanual, a users continue to baskina steadystream due; the GM package would look better course designer utility. The game sup­ handy Quick Reference Card, and the of quality, in-depth publications from without it. Oddly, you'llhave to catalog plies realistic on-the-course views and spiral bound Getting Acquainted with Big Green via Addison-Wesley. The the diskettes to unearth one ofthe better Logo PLUS- not a bad idea! software features included. On diskette is a large documentation file packed Genius Mouse: with valuable details about implement­ GM-F302/303 ing Genius Mouse (or ANY mouse) in your programs. @ Supplied in an attractive plastic case, Genius Mouse comes with manual, $99.95 for PC XT/AT and PS/2 connector(s), software (including .SYS KYE International and .COMversions ofthe driver), pock­ et, and a smallplastic-coatedmousepad. Interface: PCserial orPS/2 mouse port Everyonecanappreciategoodlooks and (using PS/2 adapter) smarts; but in mouseville the bottom Encoding: Standard opto-mechanical line has to beusercomfort. You useonly Resolution: Threemodes. Expressed in one mouse; and you use it a lot! Genius tenns of mouse movement required Mouse has too many rough edges.

COMPunST #80 Readers Data Exchange 5 Accolade'strademark 'power-bar' golf­ couple formatted to at least 1.3MB­ (current & max), plus any mage and the PF$O array. Ifno disk is located at swingsimulatorplussuchexpectednice­ still a BIG improvement over 720K. priest spell counts (e.g. "919191919n/5 the slot/drive accessed, an erroroccurs. ties as computer players. practice set­ Unless you own a rather special .. .") and current AnnorOass. As shown The ONERR routine checks to see ifthe ups. on-disk record-keeping. and stroke punch, the best way to 'HD' a 3.5" DD in Rob Hall's "Wizardry" character error occurred in the LOG' routine or skins scoring for 1-4 players. Wind floppy is with a pointy-tipped soldering block break-down(Computist#40, page (SS=4); and. if so. sends you back to and Course Condition variables assure iron. Drilling maylook neater, butthere 25-anotherinvaluable Wizresource!). continue the search without an error many challenging rounds even if you is a chance bits of plastic may get into these numbers appearinthe latterpartof message. Otherwise. ON ERR displays never construct additional courses of the case. The iron is fast; and it leaves the block. Level is at $84. $85; Hit the error # and the error's line #, does a your own. round. shard-free 'collars' which are Points at$86,$87 (current) and $88. $89 get-key call. and hops back to yourpro­ 'Unlimited Golf is unlimited by easily sliced off using a pocket knife. (max); Mage spells at $92-$9F (2-byte gram. (You can set any additional error speed. TheAdLibmusicis nice. too; but counts for each spell level 1-7); Priest handling options. set yourown 'back to Countdown: E-mail sound effects are minimal. (Actually. I spells at $AO-$AD; and current Armor program' address, etc..) do not remember hearing any. They Greetings. Mason. If you're reading Oass at $BO. $B1. LOG' also keeps track ofassociated may be non-existent.) Putting has been this. it means you have activated the After exiting "Wiz' 11'''. we booted Slot and Drive #'s in SLO and DRO. embellished via addition of a pre-shot hidden "Computist" key combination "Copy II Plus", hopped to the Sector ProDOS. of course. aims to free users 'wire-frame' overlayshowingcontours. on your Computer Access Device. Ex­ Editor. and used these numbers to track from any need to worry about slots and Holing a putt is. definitely. NOT the cellent. We. too, are interested in stop­ down the second parts of split blocks. drives. I ended up deleting the slot/ give-away shot it is in the IIgs JNG ping Black December's plot. For example. suppose Rev Gun's block drive-saving instructions from my ap­ version. Good. On the other hand. your What I've done is run a Gamma 5 shows up as starting at byte $BO on the plication. They are included herejustin view is still at 'fairway resolution'­ simulation of your mission based upon Sector Editor display for Track $IA. case your application can make use of not bad; butnot adequate for planning a probable contacts. locales. and situa­ Sector $00. (You see "REV GUN" in slot/drive information. putt In as much as Accolade seems tional trends. The result wasjusta 0.009 flashing letters.) Each "block" is $00 Line 130'is not part of the LOG' determined to 'get it right'. they might probability of predicting specific en­ bytes long; so, you know $50 bytes are routine. It is used to illustrate how the as well finish the job. Unlimited Golf counter dynamics. but 0.773 of accu­ here and the last $80 bytes ofthe block PF$(O) location can be used to remem­ needs AdLib sound effects- be sure rately listing Items of Special Interest are somewhere else. IfRev Gun ended ber the prefix of the program diskette. and include "Mean 18"'s PFfLOOP! Since the simulation indicates that you "Wiz'11''' with283 HitPoints. then(ifhe (PF$(O) is not updated by the LOG' watershotsound-and a separate.close­ will visit many places packed with ob­ left with current HP= max HP). you routine.) Sometimesthere is specialstuff up putting green display. jects of no relevance to your mission. might SCANforhexbytes IB 01 lB 01. on the program diskette which the pro­ the listing may be of real assistance. Track $19, Sector $00 is a safe place to gram will want to access long after the Holey Megabytes! Good luck! start. sincecharacterblockstorageseems diskette has beenswapped out. With the Everyoneknowsthat you'resupposed Gamma MK5// SD.MISSION to beginaroundTrack$1 A. When"Copy prefix saved in PF$(O). your program to use 3.5" HD diskettes if you want to .SIM\ISI ».DUMP Acct: TURDNIL II'" finds the numbers, you can use other can detect a NOT FOUND error and get 1.4MB of storage; it says so right +0.001 sec numbers to verify that. for sure. this is request that the user"Please Insert Disk· there in the MEl catalog. The HD jobs cup bug various keys the rest ofRev Gun'sblock. Some'good .. ." by name. Similarly. lines 520-540 have littler particles than the DD types; flashlght crowbar boots try' places to look for block continua­ and 1900are includedsothat you cando so you canfit-in lots more bits. Logical. rag wine q:Ydummy tions include Track!Sectors $IN$OF. a RUN and see LOG' at work. One One can almost see thousands of tiny knffe scissors passpJrt $lB/$OO. $IB/$OB. $lB/$OC, $IBIOE. embellishment not shown is a routine to brownHDmarbles. eachcrisplystamped cash OOssier expbsives The creators of"Wizardry III: Lega­ pennit user addition of subdirectory with a 1or0 vs. a few hundred gross DD CAD toolbox priest's garb cy ofLlylgamyn" were concerned with names to the volume names. I maintain marbles with crowded. smudged mark­ wallet screwdriver wire a.rtters the problem of designing a challenge these user-created pathnames in an en­ ings. blueprints rod< cat~karm appropriate for heroes which may come larged PF$O array at PF$(8)-PF$(14). Gorbash and Baywoofwere waiting nae statbnery blari

6 Readers Data Exchange COMPUTlST #80 530 PRINT : PRINT "Volumes fused to place text onsome portionofan Quit CopyII' to Applesoft and write Ad Lib On-Line": PRINT opened, active work space. Other de­ a one-line program: atten: Jill Carette 540 FOR I = 1 TO ZC: PRINT tected glitches include... 10 PRINT CHR$(4) "PREFIX/": 220 Grand-Allee East, Suite 960 PF$ (I) iTAB (20) i" (Slot Occasions when PP's printer inter­ PRINT CHR$ (4) "-FLOOTE" Quebec, QC "iSL(I)i " Drive face refused output to a connected Im­ "iDR(I)i")": NEXT I Save the program as STARTUP in Canada GIR 2Jl 1000 REM ..a place where agewriter II. the GO.FLOOTE subdirectory. (800-463-2686) program normally resumes Failure to importvalid hires and dou­ LoadFLOOTEand add a new item to Annabooks after an error (see line ble-hires pictures: PP insists that hires yourMainMenu: "GoCopy II"(or"File atten: Chris Choisser 3040) pics be $200010ng and thatdouble-hires Handling", etc.). Fix your program so 12145 Alta Cannel Ct., Suite 250-262 1900 END pics be $4000 long. that when "Go Copy II" is selected you San Diego, CA 92128 1990 REM ..About LOG DRIVES: Of course, virtually every popular execute PRINT CHR$(4)"-UTIL.C2" (800-462-1042) NV value assumes no more hires and double-hires utility (and ev­ Viola! Now when you're running Apple Computer than 7 drives will be on­ eryone else) automatically whacks off FLOOTE and want to move a bunch of atten: mailstop 361 line the last eight bytes ofsuch blocks when 1991 REM ..Volume names are files into a new PIANO.MUS subdirec­ 20525 Mariani Avenue doing a SAYE. (i.e. Hires pics are nor­ in PF$ (x) . tory, selecting "Go Copy II" zips you Cupertino, CA 95014 mally $IFF8 long, NOT $2000.) The 1992 REM ..For each Volume, into Copy D Plus's powerful utilities. (405-996-1010) lasteightbytes arenotpartofthedisplay Slot is in SL(X)i Drive is When you've finished, selecting and cutting them conserves a full sector Beagle Bros. in DR (x) FLOOTE from the Applications direc­ 1993 REM ..Sub returns with of DOS 3.3 storage per picture. atten: Bevey Minarovich tory zips you back into FLOOTE. De­ ZC= number of volumes Failure to allow access to entire work 6215 Ferris Square, Suite 100 lays are short enough so that Copy D"s detected area in 640 mode: To reach the last few San Diego, CA 92121 functions seemto be, very nearly, partof 1994 REM .. SS is var used by right-most pixels, the user must go to a (800-345-1750) FLOOTE! ONERR routine to get you full-screen (no windows, tool bar, etc.) Center for Gifted and Talented Ifthe above seems excessively easy, back to LOG DRIVES display. atten: Robert Houston 1999 REM .. LOG DRIVES then the 'really good news' is that it's Beagle is aware ofthe problems and, University ofHouston!University Park 2000 PRINT CHR$ close to being a worse-case scenario. with typical Beagle class, has promised Farrish Hall #123 (4)"FRE(0)":ZC = O:SS =.4: Since Copy II' will launch only SYS to supply purchasers ofany buggy ver­ Houston, TX 77004 FOR I = 1 TO 7:PF$(I) type applications, you had to getbackto sions with FREE update fixes as they "": NEXT I FLOOTE via the BASIC.SYSTEM­ Central Point Software become available. There will be a small 2010 FOR I = 1 TO 7 plus-STARTUP route. Also you did not atten: Apple II Products mktg. 2020 FOR TT = 1 TO 2 charge if an update also adds a signifi­ interferewith/NEAT.PROGS'snonnal 15220 N.W. Greenbrier Parkway #200 2030 PRINT CHR$ cant new feature. STARTUP (which might be a favorite Beaverton, OR 97006-9937 (4)"PREFIX,S"iIi",d"iTT (503-690-8090) 2040 PRINT CHR$ (4) "PREFIX": A Copy IT Plus PLUS! launcher for the other programs on the INPUT ""iQ$:ZC = ZC + No, Central Point has not, as far as I diskette). This meant that a BASIC­ Club Apple l:PF$(ZC) = Q$: 5L(ZC) = know, fixed the RAM disk problems in .sYSTEM copy and a one-line STAR­ atten: Glynn Tolar I:DR(ZC) = TT its Copy D Plus 9.1 bit copy routines. TUP had to be placed in a separate P.O. Box 5338 2050 NEXT TT (I'lllet you know when I get anupdate.) subdirectory to obtain the 'part-of-the­ Pasadena, TX 77508-5338 2060 NEXT I This does not, however, prevent the on­ program' effect. In short, hooking-up (713-478-9998) 2070 58 = 0: RETURN Copy II"s file handling smarts is, at Electronic Arts 2999 REM ..ONERR going discovery of neato applications worst, moderately easy. Give your BA­ 3000 TEXT : HOME :ER = PEEK for the utility. One you may not have atten: Lisa Higgins SIC application its own diskette and the (222) :EL = PEEK (218) + considered is incorporating Copy D's 1820 Gateway Drive 256 * PEEK (219) powerful file-handling capabilities as utilities practically fall into place by San Mateo, CA 94404 3010 CALL - 3288 l2art of your ProDOS programs! themselves! (415-571-7171/orders: 800-245-4525» 3020 IF 55 = 4 THEN GOTO On the principle that one specific Salute! Kraft Systems 2050 example is worth a hundred generaliza­ atten: Madalyn Rutlidge 3030 PRINT "Error f"iERi" in Even,as the world sleeps, a few hearty tions, suppose you've written most ofa 450 W. California Avenue Line "iEL: CALL -756 men and women maintain a network of BASIC program named FLOOTE to Vista, CA 92083 3040 GOTO 1000 bulletin boards dedicated to the infor­ edit and playmusic. (FLOOTE is one of (619-724-7146) mation and enjoyment ofcomputer us­ several BASIC programs in the main XT-AT Handbook **** ers everywhere. These are the SysOps! Kye International directory of an 800K ProDOS 1.4 dis­ Measuringjust6" x 3.5", the 89-page They provide an invaluable service, al­ atten: Jennifer kette named/NEAT.PROGS.)You want 'Handbook "for Engineers, Program­ most always, at their own cost. So, the 12675 Colony to be able to Rename, Copy, Delete, etc. . mers, and Other Serious PC ... Users" next time you log-in for a freebee ses­ Chino, CA 91710 yourmusic files whilerunningFLOOTE. (by Choisser& Foster) is available from sion, take note of any hints that a little (800-456-7593) Writing the routines yourself is a possi­ Annabooks for $9.95. When it arrived 'extra support' would be greatly appre­ Product Monitor bility; but you are concerned about con­ my first thought was "Aha, this is a ciated. PM is proud to declare June as atten: Jeff Hurlburt servingprogram and variablespace; and, 'phony price' item designed to be an "Be Kind to SysOps Month"! 7814 Santa Elena besides, you want to do music stuff, 'extra' to entice purchasers ofmore ex­ Houston, TX 77061 NOW! This is where Copy D's Appli­ Next pensive products." (e.g. "Call now and (713-645-8680) get the 'Handbook free!") Maybe; but, cations launching function comes to the In time forplanning Summertimeen­ Sir-Tech afternumerous productive, time-saving rescue: tertainments expect Data East's Con­ atten: Sheri Mitchell references to this pocket-sized wonder, Copy UTIL.SYSTEM, UTIL.MORE, tinuum, Sir-Tech's 'Fuzzballs, Stunt P.O. Box 245 I'mnotso sure. Among the56tables and UTIL.APPS, and UTIL.CONFIG from Driver from Access, Something from Charlestown Mall lists you'll find an I/O map, Hardware your Copy D Plus 9.1 diskette to 1 Accolade, SSI, and Disney, Dark De­ Ogdensburg, NY 13669 intenupt addresses with functions, Bios NEJ\T.PROGS signs from SoftDisk, and Lucasfilm's (800-447-1230/315-393-6633) entrypoints, Bios data area addresses by Rename UTIL.SYSTEM to some­ 'Secret of Monkey Island (including Terrapin function, Diagnostic beep and error thing else, like UTIL.C2 to avoid any hand-drawn Treasure Map!). Count on atten: Dave McOees codes,/ATCMOS bat-RAM addresses, chance of interfering with the usual some SERIOUS stuff, too; plus, as usu­ 400 Riverside St. Screen codes, Line drawing character BASIC.SYSTEM startup upon booting al, 'whatever'. codes, DOS commands summary, Pi­ Portland, ME 04103 Do a ·UTIL.C2to start your CopyD' nouts for Slots, Game control adapter, (207-878-8200) utilities copy and use it to create a sub­ Vendors RS-232C, Display cable, Parallel print­ directory named GO.FLOOTE. Copy Access Software er, .... Wow! And all in a booklet you David R. Hopkins co BASIC.SYSTEM to the new subdirec­ atten: Susan Dunn cancarryina shirtpockettoshow every­ tory. one you're a SERIOUS PC user!! 545 West 500 South, Suite 130 Comments on the Now, still in Copy II', select Bountiful, Utah 84010 "Small" really is beautiful. The 'Hand­ Beginner's Book book is a fantastic bargain. Edit.Applications and respond to the (800-800-4880) prompts to enter a NEW application in Accolade To the RDEX editor and all read­ Platinum Yanked! the list... atten: Melinda Mongelluzzo ers: I have a suggestion for the "Begin­ Right. Though I've been using, test­ Name: FLOOTE 550 S. Winchester Blvd., Suite 200 ner's book." There are many readers ing, and liking Beagle Bros's multi­ Command Letter: F San Jose, CA 95128 knowledgeable about softkeying on the window PlatinumPaint (PP) since it's Application Prefix: /NEAT.PROGSI (408-985-1700) Apple (you know who you are), but no arrival, the brutal truth is that the 1.0.3 GO.FLOOTE Addison-Wesley Publishing oneable totakeonthe full responsibility versionis buggy enoughto meritpulling Application pathname: BASIC.SYS­ atten: Abigail Genuth of writing an entire book. How about the announced review pending receipt TEM Route 128 each person contributing a single chap­ of a 1.0.5 update. The 'last straw' was select SAVE; and exit Reading, MA 01867 ter on the topic they know best? They encountering several instances where Edit.Applica-tions (617-944-3700) can write about anything they want, as the new super-res painter simply re- long as itis detailed enough for all ofus

COMPunST #80 Readers Data Exchange 7 'novices,' and itfits a topic you want the 2030:2E 43 44 41 20 20 41 4C $BE26 22C8:A9 B8 8F EE 71 01 A9 OB $BC15 code from the code wheel. To find the book to cover. It does not have to be 2038:4F 59 2E 43 44 41 20 20 $B728 2200:8F EF 71 01 4C C1 02 20 $2B9C secretcode, youlookatthelarge symbol grammatically perfect or even format­ 2040:F2 79 03 00 00 OC 41 4C $5238 2208:40 03 80 09 EF F5 AO E1 $941F on the screen and find the matching ted in an exact manner, just complete 2048:4C 4F 59 20 45 64 69 74 $8B2C 22EO:EC F2 E5 E1 E4 F9 AO E8 $C045 symbol onthe outside edge ofthe wheel. enough to be fully understood (with no 2050:6F 72 15 00 00 00 E1 01 $C7F4 22E8:E1 F6 E5 AO B3 AC BO BO $F085 If you keep pressing the return key or steps left out and nothing assumed as 2058:00 00 8B 4B AB 04 EO 04 $9207 22FO:BO AO C7 EF EC E4 AO FO $21F7 joystick button, the drive will tum on already known). 2060:E2 64 E2 E2 30 20 40 03 $AB13 22F8:E3 F3 AO EF F2 AO EO EF $04AC then load the game. After about 3 at­ All we need to do is determine the tempts to play the game or if you get a 2068:8C 80 00 AO 50 A9 OF 20 $507E 2300:F2 E5 AE 80 80 00 20 40 $2451 topics and chapter order and what each high score. A message comes up saying 2070:66 03 88 00 F8 20 40 03 $F95C 2308:03 AO C3 E8 E1 F2 E1 E3 $6F1B person can contribute, then have some­ you entered the wrong code three times 2078 :AO AO AO AO AO AO AO AO $A99C 2310:F4 E5 F2 AO E9 F3 AO E8 $0437 one organize and editthe contributions. in a row when you started and the pro­ 2080:AO AO AO 04 E8 E5 AO C1 $4096 2318:E5 E1 EC E5 E4 AO F4 EF $8739 If we break the project into digestible gram locks up. This patch bypasses the 2088:EE E3 E9 E5 EE F4 AO CC $BB76 modules(likestructuredprogramming), 2320:AO EE EF F2 ED E1 EC AO $1003 input from the secret code wheel. The 2090:E1 EE E4 AO EF E6 AO 09 $4BFA we cangetthis accomplished. When we 2328:C8 E9 F4 AO DO EF E9 EE $3FB6 other patch removes the music from the 2098:A7 F3 80 80 00 20 40 03 $377E have a 'beta' edition ready, we could 2330:F4 F3 AO E1 EE E4 AO 00 $7AE7 Pipe Dream logo which will remove it send copies (text files on disk) to our 20AO:AO AO AO AO AO AO AO AO $071E 2338:20 40 03 EE EF F7 AO E8 $4167 from the start ofthe game. 'professional' contributors for review 20A8:AO AO AO C3 E8 E1 F2 E1 $5063 2340:E1 F3 AO B3 AC BO BO BO $41E8 IIt .Stt.Bne. Emm 12 and suggestions, then to you for final 20BO:E3 F4 E5 F2 AO 02 E5 F6 $08F7 2348:AO C7 CF CC C4 AO FO E3 $5870 OC 00 00 4AFS EAEA editing and printing. It will take some 20B8:E9 F6 E1 EC AO F6 B1 AE $CED7 2350:F3 AO EF F2 AO ED EF F2 $B8CO 09 20 EF B4 EA EA EA time, butITIS WORTHTHEEFFORT! 20CO:BO 80 80 00 20 40 03 AO $04C9 2358:E5 AE AO 80 80 00 20 40 $C505 10 4CAAB3 EAEAEA Since I am a 'relative' beginner my­ 20C8:AO AO AO AO AO AO AO AO $9499 2360: 03 80 AD 00 F2 E5 F3 F3 $A102 OC OE 8C 4C4A55 EAEAEA self, I might not be able to contribute 2000:E2 F9 AO 06 E9 EE E3 E5 $C41F 2368:AO E1 EE F9 AO EB E5 F9 $A680 FF 4C EA very much substance to the book, but I 2008:EE F4 AO C1 EE E4 F2 E5 $753F 2370:AO F4 EF AO E3 EF EE F4 $lC61 To remove the music from Pipe would gladly volunteer my time and 20EO:F7 F3 AO B9 AO CO C1 02 $0745 2378:E9 EE F5 E5 AE 80 00 20 $CF60 Dream logo. efforts towards organizing and editing 20E8:AO B9 BO 80 80 80 00 AO $C404 2380:57 03 4C 08 01 08 C2 21 $8711 IIt.Stt.Bne. Emm 12 the material. 20FO:50 A9 OF 20 66 03 88 00 $66A6 2388:A3 02 1A 83 02 E2 30 AO $097B OCOC83 203686 EAEAEA 4COC86 EAEAEA THIS BOOKIS NEEDED, ANDWE 20F8:F8 20 40 03 80 C1 EE E3 $5643 2390:00 B3 02 FO 05 20 66 03 $A738 203086 EAEAEA ARE THE ONLY ONES THAT CAN 2100:E9 E5 EE F4 AO CC E1 EE $DCC6 2398:80 EC 28 60 C2 30 AF 00 $5F29 DO IT! LET'S DO IT NOW! 2108:E4 AO EF E6 AO 09 A7 F3 $3662 23AO:CO EO 10 F8 8F 10 CO EO $lCFO How about it readers? Can we 2110:AO CO F5 F3 F4 AO E2 E5 $8A92 finallyget startedon the Beginners 2118:AO FO F2 E5 F3 E5 EE F4 $206B Book? Do you have some time to sit 2120:AO E9 EE 00 20 40 03 AO $OCFO down and write a list ofsuggested 2128:EO E5 EO EF F2 F9 AC AO $6201 topics that you would like to see 2130:E9 E6 AO E9 F4 AO E9 F3 $BC9F covered in the book? Maybe you 2138:AO EE EF F4 AC 00 2040 $03F1 couldeven write some words on one of the topics. We can do it ifyou 2140:03 80 C9 AO E1 EO AO CE $8607 help! RDEXed 2148:CF 04 AO F2 E5 F3 FO EF $lBDC 2150:EE F3 E9 E2 EC E5 AO E6 $0494 2158:EF F2 AO F4 E8 E5 AO F2 $F4FF Bob Feigenblatt CA 2160:E5 F3 F5 EC F4 F3 AO F4 $F8EF ® How do I translate/convert 2168:EF AO F9 EF F5 F2 00 20 $E8B8 'SpringboardPublisherClip Art' so that 2170:40 03 AO F3 F9 F3 F4 E5 $F012 itcan be used with a GS word processor 2178:EO Al 80 80 00 20 40 03 $49EF or paint program? I have tried Roger 2180:AD 04 E8 E9 F3 AO C3 C4 $A6EO Wagner's "Graphic Exchange" to no 2188:C1 AO F7 E9 EC EC AO F2 $EED4 avail. 23A8:E2 30 60 48 SA OA 08 C2 $F2A4 2190:E5 F3 F4 EF F2 E5 AO C8 $OC90 23S0:30 48 A2 OC 18 22 00 00 $7349 Terry Waskowich 2198:00 AO F4 EF AO E9 F4 F3 $3191 23B8:E1 28 FA 7A 68 60 F5 02 $72FB Nonnan Dodge MIA 21AO:AO EO E1 F8 E9 EO F5 EO $EEC6 Softkey for... 21A8:80 00 20 40 03 AO E1 EE $397C 23CO:00 51 03 66 03 F5 02 00 $8866 How to SAVE hexdumps as 21BO:E4 AO E3 E8 E1 EE E7 E5 $08E4 23C8:3E 03 08 01 F5 02 00 3B $8568 Keef The Thief Desk Accessories (CDA's) 21B8:AO F9 EF F5 F2 AO C7 CF $6263 2300:03 57 03 F5 02 00 1A 03 $680E ? 21CO:CC C4 AO F4 EF AO B3 AC $E08B 2308:40 03 F5 02 00 F4 02 40 $06C9 Requirements: If you don't have a ProDOS 16 as­ 21C8:BO BO BO AO FO E3 F3 AO $6A57 23EO:03 F5 02 00 C2 02 40 03 $390E Blank Disk 3.5" sembler (MERLIN.16, ORCA/M, or 2100:EF F2 AD ED EF F2 E5 AE $6968 23E8:F5 02 00 93 02 40 03 F5 $F31A Fasteopier 3.5" APW), you can still enjoy ALOY.CDA 2108:80 00 AO 50 A9 OF 20 66 $1805 23FO:02 00 90 02 C1 02 F5 02 $CA4B Blockwarden/Block Editor (Ancient Land of Y's classic desk ac­ 23F8:00 60 02 40 03 F5 02 00 $B616 21EO:03 88 00 F8 20 40 03 80 $8339 With KeefofThief, I discovered that cessory). 2400:1E 02 40 03 F5 02 00 E3 $2FDB 21E8:80 00 20 40 03 AO C4 EF $1016 it had a word protection right after it From the Monitor or other favorite 2408:01 40 03 F5 02 00 CE 01 $2291 binary editor, type in the hex codes 21FO:AO F9 EF F5 AO F7 E1 EE $594A showedthe gamepicture. Thefollowing 2410:57 03 F5 02 00 A6 01 40 $88E9 listed for ALOY.BIN. Save the file to 21F8:F4 AO F4 EF AO E3 EF EE $4872 will show you a quick way to be able to 2418:03 F5 02 00 AO 01 40 03 $EF71 disk withthe following commands after 2200:F4 E9 EE F5 E5 BF AO A8 $72BO choose any answer and the program 2420:F5 02 00 9A 01 66 03 F5 $508B makingsure youhave anerrorfree copy. 2208:F9 AO EF F2 AO CE A9 80 $7A33 with thick it was correct and play the 2428:02 00 66 01 40 03 F5 02 $F506 From the Monitororfrom BASIC enter 2210:80 00 20 57 03 C9 09 FO $0907 game. 2430:00 39 01 40 03 F5 02 00 $1882 the following commands. 2218:0E C9 F9 FO OA C2 30 AB $9BBC Step-by-step CREATE */SYSTEMlDESK.ACCSlALLOY 2220:68 85 E2 68 85 EO 6B 20 $2684 2438:2B 01 40 03 F5 02 00 FA $6091 .CDA, T$B9 2228:40 03 8C 80 80 AO 02 E5 $5648 2440:00 40 03 F5 02 00 EO 00 $9704 1. Make a copy ofthe game disk. 2448:40 03 F5 02 00 B5 00 40 $1913 BSAVE */SYSTEMIDESK.ACCS/ALLOY 2230:F3 F4 EF F2 E9 EE E7 AO $E1EC 2. Editthecopy(BlockWarden [F]ollow 2450:03 F5 02 00 AF 00 66 03 $1732 .CDA, A$2000, L$xxx, T$B9 2238:C8 E9 F4 AO 00 EF E9 EE $8369 /KEEF1/KEEF.SYS16 on REL 2458:F5 02 00 80 00 40 03 F5 $8F8B Replace the * with the name of the 2240:F4 F3 AO F4 EF AO EE EF $8B14 BLOCK 2(0). volume you wish to store your CDA in. 2248:F2 EO E1 EC AE AE AE 80 $3880 2460:02 00 59 00 40 03 F5 02 $9FC5 ~ .Bne. Emm 12 Replace the xxx with the length of the 2250:80 00 AF E4 71 01 8F E6 $152B 2468:00 31 00 40 03 F5 02 00 $F300 $3BB $167 FO 03 82 80 03 82 file ALLOY.CDA in hexadecimal 2258:71 01 AF E5 71 01 8F E7 $735A 2470:2B 00 66 03 F5 02 00 21 $615A $175 000022 8000 22 ($48A). 2260:71 01 20 40 03 AO C4 EF $22A7 2478:00 40 03 F5 03 00 11 00 $04CB 3. Write the edits back to the copy. 2480:E1 01 F5 03 00 00 00 15 $OA62 Ihopethisexplanationwillhelpread­ 2268:AO F9 EF F5 AO F7 E1 EE $062B This patch allows any answer for the 2488:00 00 $F656 ers who do not have a ProDOS assem­ 2270:F4 AO F4 EF AO E3 EF EE $77C3 word protection to be correct. Thegame bler. Here are the hex listing: 2278:F4 E9 EE F5 E5 BF AO A8 $F001 will play just like the original. 2280:F9 AO EF F2 AO CE A9 80 $4582 Big Al MD ALOY.BIN 2288:80 00 E2 30 AF EF 71 01 $77AC Softkey for... CALL·151 2290:C9 OB 90 10 FO 02 BO 3F $7008 Softkey for... Empire 2000:03 00 00 00 00 00 00 00 $01F1 2298:AF EE 71 01 C9 B8 90 04 $B538 Pipe Dream Interstel 22AO:FO 35 BO 33 20 40 03 C3 $4737 2008:79 03 00 00 20 OA 04 01 $OF96 Lucasjilm Requirements: 2010:00 00 01 00 00 00 00 00 $COE3 22A8:E8 E1 EE E7 E9 EE E7 AO $OF65 Blank Disks (5.25") 22BO:C7 EF EC E4 AO F4 EF AO $860A Pipe Dream by Lucasfilm has a man­ 2018:00 00 00 00 00 00 00 00 $0093 ual protection scheme. The player must Sector Editor 22B8:B3 AC BO BO BO AO FO E3 $44C4 2020:00 00 01 00 00 00 00 00 $EFF6 use the large symbol to get the secret Fastdisk Copier (5.25") 2028:2C 00 40 00 41 4C 4F 59 $710E 22CO:F3 AE AE AE 80 80 80 00 $5B63

8 Readers Data Exchange COMPunST #80 After booting Empire I found that it Quote #4: "Sorry, your promotion is Figure 1. Listing from address $04/29E2 had a word protection. Instead of the denied because you did not unravel the nonnal word protection, this one also final clue." 29E2:F4 03 00 PEA 0003 32 bit address pointer to address allows you to type in DEMO to see a Quote #5: "Good job, ..." 29E5:F4 8E 20 PEA 208E 031208E, or the location of Quote #1. demo of the game. After finding the Well, now you know the words that 29E8:22 Fo 40 04 JSL 0440FO prints it up to screen. protection on the boot disk, I decided to the CP uses, get into your desk accesso­ 29EC:7A PLY see the demo. After exiting the demo ries menu (control panel) by hitting 29EO:7A PLY If you push, you have to pull game, Empire reloaded the word protec­ Control-OpenApple-ESC and select 29EE:22 EA 4B 04 JSL 044BEA tion offthe program disk and you had to Visit Monitor and press return. It'll say 29F2:F4 03 00 PEA 0003 Another address pointer. this time to find it once again. "Welcome... Control-Y Return exits" 29F5:F4 CA 20 PEA 20CA 03120CA, the location of Quote #2. Step-by-step and you are now in the machine moni­ 29F8:22 FO 40 04 JSL 0440FO print to screen. tor. 29FC:7A PLY the following is more code 1. Make acopy ofthe three Disks: Boot, To find which bank the program is in, Program, and Maps. 29FO:7A PLY of the (WP).. look from bank 03/ to 06/ at address 2. Make the following edits: $0000 and look for a $48 (PHA), once Figure 2. Listing from address $04/2AB8 On the boot disk: you find it, you know which bank the program is loaded in. 04/0000 return 2AB8:48 PLY IQ Ilk.sa.BWl.Emm will show you the byte at that location. 2AB9:F4 03 00 PEA 0003 bank 03 $10 $)9 $80 20 OE lA FO 20 OE lA80 2B 2B In this case, it was 04I000O:48 and so 2ABC:F4 70 64 PEA 6470 address 6470, entry stored. bank 04/ has the main program. To be 2ABF:22 6B A2 04 JSL 04A26B I think this gets the correct word. On the program disk: able to find the wording ofquote #1 you 2AC3:7A PLY Ilk .sa.BWl.Emm IQ have to use some ofthe features the IIGS 2AC4:7A PLY $l6 $)9 $80 200E lAFO 200E 1A80 has builtin.The word "Before"in Quote 2AC5:7A PLY 2B 2B #1 converts to 42 65 66 6F 72 65 in 2AC6:7A PLY You're Finished! Now you can enter HEX. Using the P (search pattern) com­ 2AC7:A8 PHA in anything for the word protection to mand we'll search bank 3 from 0000 to 2AC8:00 09 BNE 2A03 {+09} word & WP entry not equal play the game and stillbeable to enterin FFFF (every byte in the bank). Type: 2ACA:A9 AO 05 LOA #05AO (this area is if the password was). DEMO to run the demo. \42 65 66 6F 72 65\<03/0000.03/FFFFP 2ACO:80 3F 00 STA 003F (entered correctly ....) You should see a"03/208E:" appear, Softkey for... 2AOO:82 8B 00 BRL 2B5E {+008B}Answer is Corred!, now goto 041285E. this shows where the pattern begins. 2A03:AO 63 00 LOA 0063 loads Attempt number (1 attempt =100) Where in the USA is Type: 03/208D and hitreturn acouple of 2A06:18 CLC (2 attempts = 200 & 3 attempts =300) Carmen Sandiego? times, you will notice the words used in 2A07:69 00 01 ADC #0100 Adds 100 to itself(attempts). Broderbund. the CP. Keep hitting return to see the rest ofthe text used for the CPo Afterlooking 2AOA:80 63 00 STA OD63 stores attempts. Requirements: at that area I discovered at: 2AOO:AD 63 00 LOA 0063 loads the attempts. 512K Apple IIGS 2AEO:C9 00 03 CMP #0300 compares attempts to 300. 03/208E: is Quote #1 3.5" disk copier 2AE3:FO 21 BEQ 2B06 {+21}not equal goto 0412B06 = quote #3. 03/2OCA: is Quote #2 3.5" disk editor 2AE5:90 1F BCC 2B06 {+1F} less then 300 goto 0412B06 3.5" blank disk 03/2164: is Quote #3 03/2117: is Quote #4 2AE7:F4 03 00 PEA 0003 bank 03/ (on 3rd attempt is wrong). First off, Cannen USA is really neat 03/218A: is Quote #5 2AEA:F41721 PEA 2117 address 2117. Same as Quote #4. top1ay,justwait'tilyou getto the higher 2AED:22 Fo 40 04 JSL 0440FO print to screen. cases. The Cannen Sandiego series are Now we need to look for references to 8E 20 ($208E), do this by typing: 2AF1:7A PLY the rest you don't need to know known as an educational programs, but 2AF2:7A PLY it denies his promotion. they are fun for all. Broderbund's pro­ \BE 20\<04/0000.04/FFFFP You will see a "29E6:" pop up, this grammers took a lot oftime in making Figure 3. Listing from address $04/2B06 the pictures and background sounds and address is where the bytes were found. if you have played a case, you would So type 04/29E2L to list the code found 2B06:F403 00 PEA 0003 bank 031 already know that.The program is atwo there. (see figure 1.) 2B09:F4 64 21 PEA 2164 address 2164. Same as Quote #3. disk set, however disk one will hold all 04l29E2L 2BOC:22 Fo 40 04 JSL 0440FO prints to screen. the edits you need to do to take out the From this you get a feel ofofhow the 2B10:7A PLY the rest you don't need to know CP. program gets its words from bank 03. 2B11 :7A PLY it goes back and asking the question again. The following readings willhelp you Now just keep on Listing locations fur­ tounderstand howthis protectionworks. ther on, I did, and when I got to this Figure 4. Listing from address $04/2B5E Make a copies ofboth disks, you can location 04/2AB8 it looked interesting. use any 3.5" disk copier. Make sure you (See figure 2.) 2B5E:82 13 06 BRL 3174 (+0613)uses what 2ACA did, and comes back. have a 3.5" disk editor handy. Before 04/2AB8L 2B61 :F4 03 00 PEA 0003 bank 03/ bootingtheprogram you should getinto Lets take a look at 04/2B06. (See 2B64:F4 8A 21 PEA 218A address 218A. Same as Quote #5. ProDOS BASIC and type: figure 3.) 2B67:F4 00 00 PEA 0000 the rest you don't need to know CALL-151 Enter the monitor 04l2B06L 286A:7B TOC it goes on as if you have entered # BringsuptwohiddenCDAs:Visit The code in figure 4 is where WP 287B:18 CLC the (WP) question correctly. Monitor & Memory Peeker entry and WP correct word is equal. ed the case(s) for a promotion the pro­ inal disk, it will show a title page, play YoucanhitControl-OpenApple-ESC 04/2B5EL to make sure they are there, now quit gram jumps right to the "GoodJob,"text music and then runs the program. Make Now I hope this helped you under­ back to the monitor. Put the Cannen and continues as though there was never a copy of the AAW boot disk, using a USA boot disk inthe drive and launch it stand how this protection worked. There any WP in the first place. 5.25" fast diskcopier orany simple disk are at least two different ways oftaking copier. Now boot the copied AAWboot (C500G, PR#5, system restart, which Step-by-step ever you prefer). out the (WP) on it. First: at address $04/ disk, you will notice as soon as it shows Enter your name when asked so you 2AC8 change from 0009to EA EA, this 1. Make a copy of both Cannen USA the hi-res screen it will reboot. This is can start a new case. Alright, GUMS­ allows any entry to be correct. Second: disks. something to keep in mind. We could at Address $04/29E8 change from 22 FO HOE, finish your first case. Once you 2. Make the edit to the copy ofdisk 1. look for a section of code that turns on 4D04 to 22 CA 2A 04. Then right before have finished yourcase, the wording for the hi-res screen and the protection it prints Quote #1, this new JSL to 04/ aIK 1h1l1 Enm IQ the CP will be discovered. The CP $223 $17 A99605 A9NJOO shouldn't be to far away. doesn'tcome up until you have solved a 2ACA will bypass the asking ofthe WP It's time to stan working with the question and then proceed as ifthe WP 3. Write the edit back to the copy. case orearned a promotion to be exact. copy, so get out your favorite sector Answering the question correctly will question was answered correctly. editor. Now since we know it shows a However, after talking with Brian A. Softkey for... enable you to receive the promotion. hi-res page, scan the disk for HEX 50 Troha, we concluded that the game uses The following quotes are used by the Ancient Art ofWar CO. I found it on track 05, sector 00, at ajump table for most ofthe routines. If WP. Broderbund byte $16. We couldputa$00 atbyte $15 you look atthe code from 4!2ACA where Requirements: to bomb it out when the screen comes Quote #1: "Before you are promoted it does the LDA #$05AO, STA OD3F, Fast Disk Copier 5.25" up. However, I decided to look at the you have one more clue to unravel." this is where the program sets up to go to Sector Editor whole sector and found a $4C (JUMP) Quote #2: "Use the Fodor's USA the "Good Job," section of code. After 1 Blank Disk routine at byte $00. So change byte $00 travel guide to help you answer the some study, we found the actual point from 4C to 00 and write it back to the following question:" where the program would store the WP Making a deprotected backup copy of Ancient Art of War (AAW) can be disk. When the program gets to that Quote #3: '''That is incorrect. Please (A9 96 OA - LDA #$OA96 value and simple if you know a little about the location, it will crash and tell us where try again." changed ittothe "Good Job,"value. The the routine begins. It's now time to boot results areas soon as you have complet- copy protection. When bootingthe orig-

COMPUTlST #180 Readers Data Exchange 9 the disk, it should have crashed at ad­ Figure 5. Listing from address $4000 Howto takethewordprotectioncom­ dress $4000. (See figure 5.) pletelyoutofWaroftheLance(WOTL) 4000:4C put back the $4C 4000:4C 06 40 JMP 4006 jumps to the routine, to show hi-res. from SSI. To start off we need to make 4000L to list the code at $4000 4003:4C 63 40 JMP 4063 plays music and is executed at $801 E. a copy of WOTL boot disk. So lets getback into oursectoreditor. 4006:80 lOCO STA COlO Bootthe disk and wait until the credit NowreadTrack05,SectorOO andchange 4009:20 03 42 JSR 4203 page for the game is shown. Hit CTRL­ byte $00 back to 4C (from a 00) and 400C:80 54 CO STA C054 switch to Page 1. RESET and WOTL will reset into SSI's DOS, which is called RDOS. What I write it. Now scan the disk for a JSR 400F:80 52 CO STA C052 show a full screen. did, was to see ifWOTL was running a 4000 (20 00 40) starting at Track 00, 4012:80 57 CO STA C057 to show the hi-res page. basic file to launch the game, by typing Sector 00. You should find it on Track 4015:8050 CO STA COSO switch to graphic mode. LIST at the prompt and I found the 00, Sector 01, at $9D. Looking at the ... following: sector starting at byte $8C we have the 4062:60 RTS ends the routine & returns to $80AO following. (See figure 6.) 1 HIMEM: 38655 2 HOME:CALL 3528:A = The call from $80AO is to the copy Figure 6. Listing from address $808C PEEK(9) :C=16384:B=1:0NERR protection routine and can be bypassed 808C:A904 LOA #04 GOTO 20 by NOP'ing out the call, but keep in 3 IF A = 21 THEN & RUN"U", 808E:A040 LOY $40 mind the carry flag has to be cleared to 16384 8090:200088 JSR 8800 skip over the reboot call. Now to make 4 IF A = 26 THEN & RECALL AAW think the nibble counthas passed 8093:2085 81 JSR 8185 "AP", 17000:& RECALL and always continue, do the following: 8096:A905 LOA #05 "NAT.DAT",58501 : & RECALL 8098:A050 LOA #50 "Q1.DAT",25600 :& RECALL Step-by-step 809A:20 00 88 JSR 8800 "Q2 .DA'r", 32600 5 IF A = 16 THEN & RECALL 1. Make a copy ofthe AAW. 8090:20 00 40 JSR 4000 routine to show title and play music. "P" + STR$(56138),18000: 80AO:20 08 82 2. Edit the copy. JSR 8208 routine to check for a nibble count. C=19100 Ir.K ~.6Yta Erml IQ 80A3:90 03 8CC' 80A8 {+03}if nibble count is found branch to $80A8 9 & RECALL CHR$(A+64),C $00 $01 $AO 200882 EAEA 18 80A5:4C 91 81 JMP 8191 reboots Slot 6. 10 CALL C:B=2 3. Write the sector back to the copy 80A8:A2 05 LOX #05 start of the program. 15 & RUN "V1",38000 You should now have a completely There where other lines in the pro­ deprotected backup of Ancient Art of Figure 7. Listing from address $47IC gram, but nothing that would help us in deprotecting it. Atthis pointI was won­ War! 471 C:20 58 FC JSR FC58 clears the screen for the question. dering what value were returned from 471 F:20 C8 00 JSR 00C8 Softkey for... the PEEK(9) statement and stored in A. 4722:2048 44 JSR 4448 So at the Applesoft prompt I typed Battle Chess 4725:2060 A9 JSR A960 PRINTPEEK(9),the computerreturned Interplay a value of26, Knowing A equals 26, and Requirements: Figure 8. Listing from address $47Al bylooking atthebasicprogram, youcan 5.25" disk copier see that lines 3 and 5 will not be used; 47Al :2067 AE JSR AE67 5.25" sector editor yet. Continuing, looking at line 10 we 47A4:A590 LOA 90 1 Blank Disk see a CALL C which will launch the 47A6:00 03 8NE 47A8 {+03} if answer is correct branch to $47A8. program. To see what the value ofCis, Finally a really neat animated chess 47A8:4C C2 47 JMP 47C2 re-run word-protection. game for the Apple lie: Battle Chess. look at line 2 where C is set to 16348. 47A8:20 58 FC JSR FC58 clears the screen when answer is right. This is a great game ifyou like to have Converting 16384 from decimal to a 47AE:20 C8 00 JSR 00C8 yourQueen eaten alive, orifyou like to HEX, we end up with a value of$4000. 4781 :203044 JSR 4430 see some very creative fighting tech­ Now we need to enterthe monitorso we 4784:2010 A8 JSR A81'b niques. You can also play 3-d, 2-d and can do some code snooping, to do this even over the modem. Other features 4787:A9CF LOA #CF type CALL-151 include: save and load games, change 4789:A043 LOY #43 You should start listing code from levelofexperience,andtakebackmoves! 4768:20 F9 EA JSR EAF9 $4000However, sinceI ran the program There is one problem with the game, 478E:20 1A A8 JSR A81A with the word protection still intact, I and that is its copy protection, which is 47Cl :60 RTS remembered the program cleared the word protection. The words are in the text screen just before the word protec­ back of the manual and are actually the quick steps to deprotect the program protectioncomesup rightbeforeyou are tion came up. So I searched for 2058 opening moves from chess games. Be­ using COpyA: allowed to play the game. FC, which is the machine language ver­ sion ofthe Applesoft BASIC "HOME" fore you can play yourfirst game (getto Step-by-step Step-by-step side b) youmustanswera question from statement. I found the string at memory the CP, but no more! 1. Boot your DOS 3.3 system disk. 1. Make a Copy of Captain Blood OS location $471C. (See figure 7.) After doing some checking around, I 2. Tell DOS to ignore epilogs and use with any disk copier. Step-by-step realized thateverything seems to runs in COpyA to copy the disk. 2. Use a disk editor like Block Warden order starting from $4000. We are get­ 1. Boot up your original Battle Chess, LOADCOPYA or Copy 11+ to edit the copy. (Note: ting closer, now it's time to look for when the menu comes up it will ask if CALL-151 Block Warden [F]ollow ICAPTAIN­ some kind ofconditional branch in this you want to play or make a copy, 8925:1860 BLOOD/BLOOD.SYSI6 on REL areaahdI finally found a BNEat$47A6. Make a Copy.... 8988:1860 BLOCK 167.) (See figure 8.) 2. After you have made a copy, load up 3DOG 6! .em Erml I.a. From here you can see that $47AB is your favorite sector editor, and make RUN $AE $87 22 F6 0506 AF F605 06 the location where the program comes if the following changes to bypass the $C3 22 2D 06 06 AF 2D 06 06 3. Edit the copy. the answer was right, and eventually $CF 22 F6 05 06 AF F6 05 06 word protection and go straight into ~.6Yta Ir.K Erml I.a. $D9 22 AD 04 06 AF AD 04 06 returns to the Basic program so it can Side B. $00 $03 $35 FF OE $E4 22 F6 0506 AF F6 05 06 continue running the game. ~.6Yta $3F FF AA Ir.K Erml 12 $FO 22 20 06 06 AF 20 06 06 Now it's time to make the patch to $19 $05 $40 20 00 SO AD 00 SO $91 FF OE $FC 22 F6 0506 AF F6 05 06 disk, so let's getouta sectoreditor. Scan $98 FF AA 3. Write the sector back to the copy. $106 22 AD 04 06 AFAD0406 the disk for 20 58 FC 20 C8 00 20 4B, That's it. 4. Write the sector back to the disk. $120 22 E300 00 AF E3 00 00 I found itin two places, changethe 2058 You should now have a deprotected $142 22480308 AF480308 FC to 4C AB 47 to remove the copy Softkey for... version of Bridge 6.0. $160 22 070208 AF 070208 protection. $189 F003825A EA EA82 SA Bridge 6.0 Softkey for... 3. Write the block back to the copy. Step-by-step Artworx. Captain Blood GS 1. Makea copyoftheWOTLgamedisk. Requirements: Softkey for... Mindscape. 2. Make the following edits: Apple II w/64K War of the Lance 1 Blank Disk Requirements: Ir.K ~ ~ Emm I2 SSIITSR $lC $07 $lC 2058FC 4CAB47 Sector Editor 512K Apple IIgs $10 $OE $lC 2058FC 4CAB47 COPYA 3.5" disk copier Requirements: Apple II w164K 3. Write the edits back to the copy. Deprotecting Bridge6.0is somewhat 3.5" disk editor 5.25" disk copier simple after some inspection. The copy . Here is a quick way of taking the Now when booting the newly made 5.25" disk editor protection was an altered DOS with the wordprotectionoffthis game. The word copy, it will show the credit page and epilogues changed to FF FF. Below are after hitting the space bar it will auto

10 Readers Data Exchange COMPunST #80 The Book of Softkeys (volume 1-3) for only $1 each* *plus postage & handling PIUS H : DeMuffi PI (A d' k k' t I) Book of Softkeys"I (Compiledfrom issues 1-5) ow to create In us IS crac mg 00 You getallofthesesoftkeys:-Akalabeth -Amper-Magic oAppleGaiaxian -Aztec oBag ofTricks Super lOB v1.5 -Bill Budge's Trilogy of Games oBuzzard Bait -Cannonball Blitz -Casino -Data Reporter Using ProDOS on a Franklin Ace oDeadline -Disk Organizer II -Egbert II oHard Hat Mack -Home Accountant oHomeword Crunchlist II oLancaster -Magic Window II ·Multi-Disk Catalog ·Multiplan -Pest Patrol·Prisoner II oSammy The Controller Saver

Lightfoot oScreenwriter II -Sneakers oSpy's Demise ·Starcross -Suspended oUitima II 0 Yisiflle Making Liberated Backups That Retain Their Copy Protection ·Yisiplot -Yisitrend ·Witness -Wizardry oZork I oZork II -Zork ill Examining Protected Applesoft BASIC Programs Plus: GameCheats for: CastleWolfenstein, Miner 204ger, Serpentine, StarMaze, UltimaII, Wizard How to crack Applesoft program disks and the Princess, Wizardry: Proving Grounds of the Mad Overlord, Zaxxon Introduction to Boot Code Tracing How to create DeMuffm (A disk cracking tool) Book of Softkeys nI (Compiledfrom issues 11-15) Diskedit (Make changes directly on your disks) Diskview (Examine protected disks) You get all of these softkeys:AIien Addition -Alien Munchies ·AIigator Mix ·Computer Getting on the Right Track (Fix your Apple drive so it tells you what track it is on.) Preparation SAT °Cut and Paste oDemolition Division ·DLM Software ·Einstein Compiler v5.3 Hidden Locations on your Apple Revealed ·Electronic Arts Software ·Escape from Rungistan ·Financial Cookbook -Flip Out ·Hi-Res Fix your Rana drive so you can Boot Code Trace Computer Golf II ·Knoware -Laf Pale ·Last Gladiator ·Learning With Leeper oLion's Share ·Mastertype -MatheMagic ·Minus Mission ·Millionaire ·Music Construction Set -One on One Neat tricks and bombs that you can put in your programs ·PFS Software -Penguin Software -The Quest -Rocky's Boots -Sabotage -Seadragon -Sensible Speller -SnooperTroops (Case 2) ·SoftPom Adventure ·StickybearBOP ·Suicide ·TellStar ·Tic Book of Softkeys n (Compiledfrom issues 6-10) Tac Show ·Tune is Money -Transylvania -Type Attack -Ultima ill-Exodus -Zoom Graphix You get allofthese softkeys: -Apple CiderSpider·Apple LOGO •Arcade Machine oThe Artist Plus: -Bank Street Writer -Cannonball Blitz oCanyon Climber -Caverns ofFreitag -Crush, Crumble & Putting Locksmith 5.0 Fast Copy Into a Normal Binary File Chomp-DataFactoryv5.0-DBMasteroEssentiaiDataDuplicatorl-EssentialDataDuplicatorill CSaver: The Advanced Way to Store Super lOB Controllers -Gold Rush -Krell LOGO -Legacy of Llylgamyn -Mask of the Sun -Minit Man -Mouskanack The CORE Disk Searcher -Music Construction Set oQil's Well-Pandora'sBox -Robotron -Sammy Lightfoot oScreenwriter Modified ROMs II v2.2 -Sensible Speller IV -Sensible Speller 4.Oc/4.1c -Spy Strikes Back -Time Zone -Visible The Armonitor Computer 6502 -Visidex -Visiterm -:z;axxon -Hayden Software -Sierra OnLine Software

The Hacker's Ultimate Copy &Deprotection Utility: The Super lOB Collection! ALL four volumes of Super lOB controllers (through issue #65) in "ONE' package! COMPUTIST developed the ultimate copy program to remove The Super lOB Collection 2400 A.D. ·Memate Reality: The Dungeon ·Address Book oAmerican copy protection from software: Challenge oApple Gradebook V2.6 0 Arcade Abum #1 0 Arcade Boot Camp Volume 1 of the Super lOB collection covers all the controllers from oAztec ·Bard's Tale II oBeachhead oBeyond Castle Wollenstein oBlack The Super lOB program. COMPUTIST No. 9 through No. 26. Also induded are the newswap and Magic -Blue Powder/Grey Smoke ·Borrowed Time -Castle Wollenstein fast controllers from COMPUTIST No. 32. The following controllers are on oCat-N-Mouse oCatalyst 2.0 & 3.0 oCentipede ·Championship Goll Since the introduction of Super lOB, COMPUTIST has used volume 1: oChampionship Wrestling -Charlie Brown 123'S oColonial Conquest this flexible program to deprotect (or partially deprotect) dozens of oComprehension Skills oComputer Preparation for the SAT V3 -Coveted Advanced Blackjack ·Alphabet Zoo ·Arcade Machine oArchon 1I 0 Archon commercial programs with far ranging protection schemes. Mirror ·Coveted Mirror RWlS Capture ·CPU68000NV.402 oCranston oArtsci Software oBank Street Writer oBarrons SAT oBeyond Castle Manor oCrime Stopper oDam Busters ·Decimals oDestroyer oDino Dig Super lOB deprotects disks by using a modified RWTS (the Wollenstein oSSWIIc LoaderoCastle WoRenstein oComputer Preparation: oEarth Orbn Station oEncyclopedia Britannica oEscape oFish Scales subroutine in DOS which is responsible for the reading and writing SAT oDazzle Draw oDB Master 4Plus -Death in the Carribean oDino Eggs oFoundation Course in Spanish -Frog oGFL Football oGoonies -Great of disk sectors) for reading from the protected disk and then using oDLM Software oElectronic Arts ·F-15 Strike Eagle oFast Controller American Cross-Country Road Race ·Handlers ·H.E.R.O ·Infemo oFathoms 40 -Financial Cookbook oGessler Software -Grandma's House a normal RWTS for writing to the c1eprotected disk. -Information Master oJ-Bird ·Jenny's Journeys ·Joe Theisman Football -The Heist oln search olthe Most Amazing Thing olnstant RecaR oKidwriter oKindercomp -Kung Fu oLight Simulator oManuscript Manager oMaster This package contains: oLions Share ·Lode Runner ·Mastertype oMatch Maker ·Miner 204ger Diagnostics lie ·Mastering Math oMECC ·MECC Software oMECC Swap _ ·Minn Man -Mufplot ·Newsroom oNewswap controller ·Penguin Software oThree disks (supplied in DOS 3.3). Each disk contains at least oMECC Without RWlS oMissing Links oNo Error Check &No DOS oOgre oPrint ShopGraphic Library ·Print ShopoRendezvous wnh Rama ·Rockys' oOne On One oOregon TraiioPenguin Software ·PFS ProDOS oPitfall1l 60 Super lOB Controllers including the standard, swap, newswap Boots oSargon IlIoSea Dragon oShielaoSkyfox oSnooper Troops oStandard oPuzzles&Posters ·Racter ·Randamn ·Reading Style Inventory oRing and fast controllers. Also included is version 1.5 of Super lOB, the controileroSloneware Software oSummer Games oSuper Controller oSuper Csaver program from COMPUTIST No. 13, and a Menu Hello Quest oScience Toolkn ·SCience Toolkit Rev1 -Skyfox -Snooper Troops Zaxxon oSwap Controller oTAC oUhina I &II-WOld Challenge oXyphus oSpeed Reader II oSpy's Adventure oStarcross oSuper Bunny oTempie ozaxxon Program that Usts the available controllers and, when you select Apshai Trilogy-TheArnericanChallenge-Translyvania-Troll Courseware one, automatically installs nin Super lOB and RUNs the resulting VokJme 2 of the SUper lOB coIlec1ion covers all the controllers from oUltima IoUlima IV -Wizard's Crown -WOld Attack -Word Maze -World program.* COMPUTIST No. 27 through No. 38. The foIbwlng controllers are on Karate Championship -Rings of Zilfin oZorro *A reprint of Disk Inspection and the Use of Super lOB, from volume 2: Volume 4of the Super lOB coIlec1ion covers all the controllers from COMPUTIST No. 17. This article explains how to write your own A1iceinWonderIandoA~icKeyboarding-AIIemateReality-Autoduei COMPUTIST No. 54 through No. 65. The following controllers are on Super lOB controllers. oCheckers oChipwits oCoIor Me -Conan.data oConan.prog oCopyDOS volume 4: -COMPUTIST No. 32, which contains an extensive article oCrisis Mountain -Disk Director oDragotIWOrId -Early Games -Easy as Abracadat9IDesin Home oAlgebra 3&4oAmerican Challenge oAnimate ABC of·15 Slrike Eagle -Fantavision oFast controler oFight detailing the hows and whys of Super lOB v1.5 and at least 5 -Fishies side (A) oAnimate side (B) oApplewrler Preboot oAztecoCastle WoIfensiein articles using the new Super lOB program. Simulator oHailey Project -Hartley Software (a) -Hartley Software (b) oChampionship Wrestling oCrossword Magic 4.0 oCrypt of Medea oDam -Jenny of the Prarie oJingle Disk oKidwriter oKracking Vol II -Lode Runner Busters oDazzle Draw oDeath Sword oDeathlord Scenario -Digital several of the controllers deprotect the software completely -LOGO II (a) -LOGO II (b) oMasquerade -Mastering the SAT -Microtype: Paintbrush Sys oDondra oDr Ruth -Dreadnoughts oElem Social Studies #3 with no further steps. This means that some programs are only The Wonderful World of Paws oMicrozines 1 oMicrozines 2-5 oMiner o oBern Social Studies #6 °EOSIArctic Fox oEstimation ·Fraction Factory minutes away from deprotection (with virtually no typing). 204ger Mist&View to aKiD oMurderon the ZindemeufoMusicConstruction oFractions oGeneral Chemistry #8 oGI Joe oHardballoLords of Conquest Set ·Newswap controller -Olympic Decathlon oQIher Side ·Phi Beta Filer The issue of COMPUTIST in which each controller appeared oMatchmaker WGF oMath Blaster oMaxwell Manor oMECC (Apr 89) ·pnstop II ·Print Shop Companion ·RDOS ·Robot War oSpy VS Spy oMicrozine #26 oMind Over Matter (1984) -Nightmare Gallery oOne on is indicated in case further steps are reqUired to deprotect a -Standard controner -Sundog V2 ·Swap controller ·Sword of Kadash o One (new) oPath Tactics oPenguin oPitfall II oPool 1.5 oPrint Shop Data particular program" ·Synergistic Software·Tawala's Last Redoubt 0 Terripin Logo 0 Threshold Disk ·Project Space Station oPSAT Word Attack Skills -Realm of oTime is Money'Time Zone 0 Tink! Tonk! oTroll's TaIe oUttima IV-Wilderness *Requires at least 64K of memory. Impossibility oRoadwar 2000 ·Science Prof ·Science Toolkit Modules "Although some controllers will completely deprotect the oWord Attack &Classmate oWorld's Greatest BaseballoWorld's Greatest oScience Toolkit oSeaspeller oSongwriter oSpace Station oSpell It oSpy Football program they were designed for, some will not, and therefore Hunter oSunburst oSuper SuniGen Manager oSuper Sunday 0 Teachers require their corresponding issue of COMPUTIST to complete the Volume 3 of the Super lOB collection covers all the controllers from Rae Book·Tellstar 11 0 Test Maker -The New Oregon Trail·Troll Shop Right COMPUTIST No. 39 through No. 53. The following controllers are on oUttima V (a) ·Uttima V(b) oUttima V (c) ·Vocabulary Adv I 0 Zilfin 0 deprotection procedure. volume 3: ~...... ~ : Book of S6ftkeys 0 volume I 0 volume II 0 volume ill N..... : • Check the box(s) for the book(s) you want then: •

• US/Mexico Canada Foreign add $1 per book AdAbu • • postage postage postage plus $.65 handling & • • One Book $1.85 $2.28 $5.55 plus the correct postage • Two Books $2.40 $3.70 9.19 • • • Three Books $2.40 $4.32 12.83 to get final cost.. $ City Statl:: Zip •

• The Super lOB Collection: Includes all four disks with Super lOB version 1.5, Cowmy Phono • • COMPUTIST #32, PLUS a reprint of "Disk Inspection and the Use of Super lOB". VISA •

: 0 US/Canada/Mexico - All four volumes $30.00 $ MC &po :

• 0 Other Foreign - All four volumes $35.00 $ Siananuc • • 0 US/Canada/Mexico - Volume #4 only $8.00 $ *Send US funds drawn on US bank. _We ship by UPS so we need a street address.• • 0 Other Foreign - Volume #4 only $10,00 $ Otherwise, we ship by 1st Class mail which gets there but takes a little longer. - Call. • (206) 832-3055 to use a credit card or send check/money order to: • • Total enclosed... $ COMPUTIST 33821 E Orville Rd Eatonville WA 98328-9590 • ~ ••••••••••••••••••••••••••••••••••••••••••••••••••••* COMPUllST #80 Readers Data Exchange 11 SOFT SWITCHES SOFT SWITCHES SOFT SWITCHES SOFT SWITCHES SOFT SWITCHES SOFT SWITCHES

Address Name Purpose

COOO KBD Read keyboard. A read to this location returns with the value of the last key pressed. Bit 7 = 1 if value is valid. CLR80COL Disable 80 column store

C001 SET80COL Enable 80-column store

C002 RDMAINRAM Read from main 48K RAM

C003 REDCARDRAM Read from alternate 48K RAM (auxiliary card memory)

C004 WRMAINRAM Write to main 48K RAM

COOS WRCARDRAM Write to alternate 48K RAM (auxiliary card memory)

C006 SETSLOTCXROM Use ROM on cards

C007 SETINTCXROM Use internal ROM

C008 SETSTDZP Use main zero page/stack

C009 SETALTZP Use alternate zero page/stack

COOA SETINTC3ROM Enable internal slot 3 ROM

COOB SETSLOTC3ROM Enable external slot 3 ROM

COOC CLR80VID Disable 80 column hardware

COOD SET80VID Enabel 80 column hardware

COOE CLRALTCHAR Normal LC, flashing UC

COOF SETALTCHAR Normal inverse, LC; no flash

C010 KBDSTRB Turn off keypressed flag

C011 RDLCBNK2 Bit 7 = 1 if LC bank 2 in enabled

C012 RDLCRAM Bit 7 = 1 if LC RAM read enabled

C013 RDRAMRD Bit 7 = 1 if reading alternate 48K

C014 RDRAMWRT Bit 7 = 1 if writing alternate 48K

C015 RECXROM Bit 7 = 1 if using internal ROM

C016 RDALTZP Bit 7 = 1 if slot zero page enabled

C017 RDC3ROM Bit 7 = 1if slot 3 ($C300) space enabled

C018 RD80COL Bit 7 = 1 if 80 column store

12 Readers Data Exchange COMPunST #80 SOFT SWITCHES SOFT SWITCHES 80FT SWITCHES SOFT SWITCHES SOFT SWITCHES SOFT SWITCHES

Address Name Purpose

C019 RDVBlBAR Bit 7 = 1 if not VBl

C01A RDTEXT Bit 7 = 1 if text (not graphics)

C01B RDMIX Bit 7 = 1 if mixed mode on

C01C RDPAGE2 Bit 7 = 1 if txtpage2 switched in

C01D RDHIRES Bit 7 = 1 if hires in on

C01E AlTCHARSET Bit 7 = 1 if alt char set in use

C01F RD80VID Bit 7 = 1 if 80 col hardware on

C020 reserved

C021 MONOCOlOR monochrome/color selection byte. MONOCOlOR bits defined as follows: bit 7 = 0 enables color, 1 disables color. Bits 6, 5, 4, 3, 2, 1, 0 must be o. C022 TBCOlOR Text/background color selection register. TBCOlOR bits defined as follows: Bits 7, 6, 5, 4 = text color num­ ber. Bits 3, 2, 1, 0 = background color number. Colors are: $0 = black $1 = deep red $2 = dark blue $3 = purple $4 = dark green $5 =dark gray $6 = medium blue $7 = light blue $8 = brown $9 = orange $A = light gray $B = pink $C = green $D =yellow' $E =aquamarine $F = white

C023 VGCINT VGC interrupt register. VGCINT bits defined as follows: Bit 7 = 1 if interrupt generated by VGC. Bit 6 = 1 if 1­ second timer interrupt. Bit 5 = 1 if scan-line interrupt. Bit 4 = 1 if external interrupt (forced low in Apple IIgs). Bit 3 must be o. Bit 2 = 1-seconf timer interrupt enable. Bit 1 = scan-line interrupt enable. Bit 0 = external interrupt enable (can't cause an interrupt in Apple II gs).

C024 MOUSEDATA x or y mouse data register. MOUSEDATA bits defined as follows: Bit 7 = button 1 status if reading x data. Bit 7 = button 0 status if reading y data. Bit 6 = sign of delta o= '+' - 1 = '-'. Bits 5,4, 3,2, 1, 0 = delat movement.

C025 KEYMODREG Key modifier register. KEYMODREG bits defined as follows: Bit 7 = openapple key active. Bit 6 = closed apple key active. Bit 5 = updated modifier latch without keypress. Bit 4 =keypad key active. Bit 3 = repeat ac­ tive. Bit 2 = caps lock active. Bit 1 = control key active. Bit 0 =shift key active

COMPUllST #80 Readers Data Exchange 13 Hail and well met, Eamon adventurer. The "'Guild" is printed quarterly. A 1 year subscription is: COMPUTISThas news ofgreat importfor loyal US & Canada: $7.00 Foreign: $12.00 (U.S. funds) supporters of Eamon and members in good The Eamon Adventurer's Guild standing at the Main Hall. There is a newsletter 7625 Hawkhaven Dr. for Eamon Adventure Buffs. Clemmons, NC 27012 (919) 766·7490 ~~1ltbt Q{;amOtt ~1Jttt tuttt'g QButl~" , , Tom Zuchowski is the editor and driving force behind it. • Yes! I want to support Eamon I also want to order some back issues at • The newsletter is printed on 8 1/ "X 11" bond, double sided • adventure and encourage new $2 each: • 2 • adventures to be written. Sign me up • with dot matrix type. It is non-profit (it's his hobby) and • for a one year subscrition. 0 Jun'88 0 Sep'88 0 Dec'88 • Tom's avowedpurpose is to maintaina singlepointcollection • 0 US & Canada'. $7.00 0 Mar'89 0 Jun'89 0 Sep'89 • • 0 Dec'89 0 Mar'90 0 Jun'90 • and clearinghouse for EamonAdventures. He also intends to 0 Sep'90 0 Dec'9Q 0 Mar'91 • fix all known bugs in these adventures. • o Foreign: $12.00 (U.S. funds) This is a grand concept worthy of support. We highly • Total enclosed • recommend that you subscribe. Thisnewsletterwill help you keep in touch with other Eamon adventurers. But more .•~ .• important, it will improve the state ofEamon adventures and • Address • encourage new adventures to be written. Tom has • • accomplished a great deal along these lines already, not only • • fixing bugsbutalso improving the EamonMainprogramand •City State Zip • authoring the version 7.0 Dungeon Designer Disk. •, ••••••••••••••••••••••••1•

~ ~ • Eamon Adventure for only $ 1 (or less) each • •AdventureGamingdoesn'thave tocosta lot. TheEamon AdventureGamingsystem wascreatedby DonaldBrown andplaced into the public domain.•• • Since then it has been updated and improved by game players all over the world. Take a look at what $1 will buy. (Get free games too.) Note: Some • : Adventures are multi-part and take more than one disk. Be sure you have selected all o/the disks. :

• 0 1Main Hall & Beginnen Cave 042 Alternate Beginnen Cave 083 The Twin Castles 0 122 The Valley of Death 0 151 Pathetic Hideout ofMr R. • 0 2 The Lair of the Minotaur 0 43 Priests ofXim! 0 84 Castle of Riveneta 0 123 Wizard of the Spheres 0 158 The Lair of Mr Ed • • o 3 The Cave of the Mind 0 44 Escape from the Orc Lair 0 85 The Time Portal 0 124 Assault on Dolni Keep 0 159 The Bridge of Catzad-Dum • 0 4 The Zyphur Riverventure 0 45 SwordQuest 0 86 Castle Mantru 0 125 The Mattimoe Palace 0 160 Monty Python & Holy Grail • • 05 Castle of Doom 046 Lifequest 081 Caves ofHollow Mountain 0 126 The Pyramid of Anharos 0 161A Operation Endgame • o 6 The Death Star 0 41 FutureQuest 0 88 The Shopping Mall 0 121 The Hunt for the Ring 0 1618 Operation Endgame • 01 The Devil's Tomb 048 Picnic in Paradise 089 Super Fortress of Lin Wang 0 128 Quest of Erebor 0 161C Operation Endgame • • 0 8 The Abductor's Quanen 0 49 The Castle Kophinos 0 90 The Doomsday Oock 0 129A Return to Moria 0 162 Eamon 1.0 Demo Adventure • 09 Assault on the OOllemaster 050 Behind the Sealed Door 091 FutureQuest IT 0 129B Return to Moria 0 163 The Sands ofMars • • o 10 The Magic Kingdom 051 The Caves of Eamon Bluff 092 The Fugitive 0 130 Haradwaith 0 164 A Real Cliffhanger • 0 11 The Tomb ofMolinar 052 The Devil's Dungeon 093 Flying Circus 0 131 Nucleus of the Ruby 0 165A Animal Farm • • 0 12 The Quest for Trezore 053 Feast of Carroll 094 Blood Feud. 0 132 Rhadshur Warrior 0 1658 Animal Farm • 013 Caves ofTreasure Island 054 Crystal Mountain 095 The Maze of Quasequeton 0133 The FInal Frontier 0 166A Storm Breaker • • 014 Furioso. 055 The Master's Dungeon 096 The Chamber of the Dragons 0134 Pyramid ofthe Ancients 0 166B Storm Breaker • 0 IS Heroes Castle 056 The Lost Adventure 091 The House of Secrets 0 135 The Tomb of Evron 0 166C Storm Breaker • • 0 16 The Caves ofMondamen 051 The Manxome Foe 098 Slave Pits of Kzorland 0 136 The Mountain Fontess 0 161 Expedition to the Darkwoods • 017Merlin's Castle 0 S8 The Land of Death 099 In the OUlches ofTorrik 0131 The Ruins ofIvory Castle 0168 The High School. ofHorron • o 18 Hogarth Castle 0 S9 Jungles of Vietnam 0 100 Sorceror's Spire 0 138 Starfire 0169 The Black Phoemx • • 0 19 Death Trap 060 The Sewen of Chicago 0 101 Ground Zero 0 139 Peg's Place 0110Ragnarok Revisited • 0 20 The Black Death 0 61 The Harpy Cloud 0 102 The Eamon Railroad 0 140 Beginner's Forest 0 111 The Pyramid ofCheops • • 021 The Quest for Marron 062 The Caverns of Doorn 0103 Top Secret 0141 The Infested Fortress 0112 The Mountain ofthe Master • 022 The Senator's Chamben 063 Valkenburg Castle 0 104 The Lost World 0 142 The Beermeister's Brewery 0113 The House that Jack Built • • 023 The Temple of Ngurct 064 Modem Problems 0 lOS The Strange Resort 0143 The Alternate Zone 0114 Escape from Granite Hall • o 24 Black Mountain 0 6S The School of Death 0 106 Camp Eamon 0 144 Gartin Manor 0 115 Anatomy ofthe Body • 025 Nuclear Nightmare 066 Dungeons of Xenon 0101 The Last Dragon 0 145A Buccaneer! 0116 Dirtie Trix's Mad Maze • • 0 26 Assault on the Mole Mail ' 0 61 Chaosium Caves 0 108 The Mines of Moria 0 145B Buccaneer! 0 111 Shippe of Fooles • • 0 21 Revenge of the Mole Man 0 68 The Smith's Stronghold 0 109 The Forest of Fear 0 146 The House of Horron 0 118 The Alien Intruder • 028 The Tower of London 069 The Black Castle of NaGog 0110 Fire Island 0 141A The Dark Brotherhood 0119 The Wizard's Tower • 029 The Lost Island of Apple 010 The Tomb of Y'Golonac 0 III A Vacation in Europe 0 141B The Dark Brotherhood 0180 Gamma I • • 0 30 The Underground City 0 11 Operation Crab Key 0 112 Hills of History 0 148 Journey to Jotunheim 0 .l81 The Eamon Sewer System • • 031 The Gauntlet 012 House on Eamon Ridge 0113 The Life-Orb of Mevtrelek 0 149A Elemental Apocalypse 0182 Farmer Brown's Woods • 032 House of mRepute 013 The Deep Canyon 0 114 Thror's Ring 0 149B Elemental Apocalypse 0183 The Boy and the Bard • 033 The Orb of Polaris 014 DharmaQuest 0115 The Ring of Doom 0 149C Elemental Apocalypse 0184 Quest for Orion • • 034 Death's Gateway 015 Temple of the Guild 0 116 The Iron Prison 01490 Elemental Apocalypse 0185 The Body Revisited • 035 The Lair ofMutants 016 The Search for Younelf 0 111 Dungeon of Doom (40 col) 0150 Walled City of Darkness 0186 Beginnen Cave IT • 0 36 The Citadel of Blood 011 Temple of the Trolls 0111 Dungeon of Doom (80 col) 0151 EamonS.A.R.-I(Deneb Raid) 0181 Batman! • • 0 31 Quest for the Holy Grail 0 18 The Prince's Tavern 0 118 Pittfall 0 152 The Computer Club of Fear 0 188 Encounter: The Bookworm • • 038 City in the Oouds 019 The Castle of Count Fuey 0 119A Grunewalde 0153 Lost! 0189 The Ruins of Belfast • 039 Museum of Unnatural History 0 80 The Search for the Key 0 119B Grunewalde 0 154 A Trip to Fort Scon 0 190 Shift Change at Grimmwax • o 40 Daemon's Playground 081 The Rescue Mission 0 120 Orb of My Life 0155 Tomb of the Vampire 0191 Enhanced Beginnen's Cave • • 041 Caverns of Lanst 082 Escape from Mansi Island 0121 Wrenhold's Secret Vigil 0156 The Lake 0192 Mean Streets • ------o 193 The Creature ofRhyl • 0 Send me the Complete set of Eamon (all adventures & utilities) for: $125'()() Fre·e 0194 Attack ofthe Kretons • • # of disks at $1 # of Free disks 0 195 The Training Grounds • • Total number of Adventure disks . x $1 each = 1-9 0 0 196 The House of Horron • 10-19 2 DI91StarWan-TempestOne • • Iftotal # of disks ordered is less than 10, add $4 for postage & handling. Adventures 20-29 5 0 198 Revenge of the Bookworm • Washington State residents add 7.8% sales tax. Use the total numberof 30-39 9 o0 199 Quest of the Crystal Wand • • adventures ordered to 40-49 14 200 The Lost Isle • N determine how many free 50-59 20 0201 The Caverns of Vanavara • arne adventures you get. 60-69 27 0 202 The Plain of Srevi • • Address 70-79 35 0203 Lotto's Masterpiece • Be sure and check the 80-89 44 0 204A Sanctuary • • boxes of your free disks 90-99 5402MB Sanctuary • that you want but do not 100-109 65 0205 Utterly Outrageous • • City State __Zip include free disks when 110-119 77 0206 Cune of the Hellsblade • figuring total number of 120-129 90 • • Country Phone disks ordered. 0 Dungeon Designer Diskette v1.0 • Visa 0 Multi-Disk Supplement (0001.0) • • MC Exp Complete set of Eamon 0 Dungeon Designer Diskette v6.2 • o Eamon Utilities Diskette • Signature All 225 disks (includes all adventures plus 0 Graphics Main Hall • • COMPUTIST, 33821 OrviUe Rd. E, Eatonville WA 98328-9590 (206) 832-3055 designer and utility disks.) $125 • ~ ~

14 Readers Data Exchange COMPunST #80 matically load the rest ofthe program. Step-by-step 128K Apple II series setting up some other parameters for This edit totally bypasses the asking of calling the windowing routine. Back­ 1. Make aCopy ofWindwalkerGS Disk (proDOS block $62) the CP question. tracking through the code, I found a A with any disk copier. IrI1 .sa ~ E/:Qm I.Q. ~C ~B $1C 208982 NJ89B2 RTL ($6B) at byte $53F4, so taking a 2. Use Block Warden or your favorite guess, I figured that the routine started at Terry Waskowich & $04 2060M ADOOM block editor to edit the copy. (Block $02/53F5. Doing anotherpatternsearch: 3. Write the edits back to the copy. Jay Kitaguchi Warden [F]ollow /WINDWALKER \F553\<1/0.FFFFP .A/WIND.sYS16 on REL BLOCK 01/B740: Softkey for... 97) Safaa Abdulla & Here was the reference (hopefully) to Windwalker lIe ~ ~.Erm1 .I2 Brian A. Troha the routine that I wanted... $190 $X7 22 84 28 03 /IF 84 28 03 Origin 011873F: JSL 0253F5 Jump to our windowing ~D9 22812503 /lF812506 Softkey for... Requirements: $103 2212tE03 /lF121E03 routine! 2 Blank Disks $114 22E31803 /lFE31803 Hostage JSL 029F95 Hmmm ... Could this be Copy II Plus $11A 228FDAoo /lF8FDAoo Mindscape Inc. related? We'll see later. Sector Editor $11E 22792603 /lF79 2603 Requirements: Looking at the code before ourjump, $122 22792603 /lF792603 COPYA Ifound some branchesthat would notbe $17F F0028023 EAEA8023 512K Apple IIgs Windwalker is a really neat game. 3.5" disk copier changed by ProDOS 16 orGS/OS upon 3. Write the block back to the copy. The main idea behind this game is to 3.5" Disk editor load time ($F4 01 00 AE) and searched become a Windwalker yourself, and Now the word protection won't even Recently, Ipurchased the game Hos­ for that on the disk. I found it on block advancing your stats to a point where show up and Moebius will automatical­ tage from Mindscape, Inc., and although $01 B6, and saw afterwards atbyte $0057 Moebius will grant you the new status. ly enhance your character. the gameplay is excellent, the off-disk a $22 (JSL). I changed this to a $AF But before Moebius can grant you the copy protection (documentation check) (LDAL) and wrote it back out to disk. I new status you have to answer a ques­ Brian A. Troha & is far from it. So I decided that I would booted the disk again, and this time, tion. The following will tell you how to have to do something about it. after the Mindscape page, I saw our backup Windwalker Magnetic Scroll Safaa Abdulla & When I booted the disk, it showed the "Start Next Program" requester. Side 1-4 and take out the question. Terry Waskowich good ole' ProDOS 16 loader, then it "Hmmm..." (Yes, I said it again) After I saw this, I checked out my good old IIgs Step-by-step Softkey for... went to aSHR picture ofthe Mindscape logo. When disk access stopped, a win­ reference books, and found this to be 1. RUN COpyA and when it has fin- Pipe Dreams dow opened up in the middle of the call $0029 from the ProDOS 16 MLI. ished loading hit ctrl-reset. Lucasfilm screen asking to "Please, enter word X SOOO From here, I hit reset again 2. At the Applesoft prompt (]) type in: Requirements: on line Yofpage Z:"'Hmmm ", I said (twice ) and got back to the monitor to 70 REM 512K Apple IIgs or 12SK Apple II series (Yes, I actually said "Hmmm ") as I search for a $22 AS 00 E1 29 00, which CALL·151 Disk copier (5.25" or 3.5") grabbed a piece of paper to scribble properly formatted is; B96D:BD 8C CO Disk editor (5.25" or 3.5") down the text "Please, enter". Next, I \22 A800 E1 2900\<210.FFFFP B970:10 FB 2A 85 26 BO 8C CO 02/9FBA: The program package comes with copied the program onto another disk B978:10 FB 25 26 99 2C 00 88 ~FBA: both the GS and lIe versions in the same (NEVER work with your originals). JSL E100A8 B980:10 EB BD 8C CO 10 FB C9 box. The game is very good, however Then I booted up my good friend Block 0029 B988:DE FO OF EA BO 8C CO C9 before you can play the first game you Warden and let him search for the text ooo206B9 ;we won't worry w~h B990:AB DO DB 38 A5 20 E9 11 will have to look up something from a on the disk. Sure enough, there was the this stuff... B998:85 20 18 60 EA EA 18 60 code-wheel. I didn't like the idea of text on block $019A at byte $OOOB. In And, if you remember, this is right 3DOG having to use the code-wheel so we hex, it was: $50 6C 65 61 73 65 2C 20... after the SECOND jump that we found RUN decided to take it out. After following I figured that this was enough to find the before... My first guess was to take this Copy Windwalker's Magnetic Scroll the code with a couple of friends, we text in memory... jump out all together. So, remembering L,Use COPYA like you would normal­ found how to bypass the copy protection . Next, .~ booted the new disk. This that the jump was $04 bytes after the ly: After you have done that, make a completely. By searching for C9 SO time, when it got to the protection, Ijust first jump we edited on disk, I blindly backup of Windwalker's Magnetic (CMP#$SD-thevalueofthereturnkey, entered garbage...It returned with aloud changed the $22 at byte $005B to an Scroll 2 to 4 with any copier orfast disk for the lIe version also try searching for >BOOM< (Oops...I had booted Modu­ $AF.. WRONG! Well, the program DID oopier. AO 00 CO or LDA $COOO, which is the lae earlier...sorry Mom!) After I turned load, but'??????'s were scrolling onthe 3. At this point, put your original disks keyboard location) we found the rou­ off the stereo, I entered more garbage. screen, as well as other funky stuff...so away. Edit the copies of Magnetic tine, tracing forwards and backwards After the third attempt, the program I promptly changed this back...So, I Scroll 1 to 4. we found asimple call to the CP. Chang­ bailed into the "Start Next Program" went back to the MLI call that we had ing the JSR to LDA gets rid ofthe entire selector. Unfortunately, the controlpan­ Disk #1 earlier... The code looked something requestor screen. el was locked out...I hit CONTROL­ like this: RESET, and it went to the $0602 UN­ Il!s~~ .Ealm .I2 After playing the game for awhile a CMP#OOO1 01 04 $89 FOOE FOOF ABLE TO RESET screen with the "demo" screen came up and said some­ BEQ 9FC6 {+OC} bouncing apple. I hit reset again and Disk #2 thing about "We here at LucusFilms 02l9F95 JSL E100A8 The call to the MLI voila! I was in the monitor! Using the hope you are enjoying.." So, Lucus­ 0029 The code for the 'Start IrI1~~ Emm .I2 Films has put some kind of flag in the IIgs built-in pattern search commands, I ~E 00020689 Next Program" 10 05 203843 DO A9011890 program and if not set it will go to the was able to locate the text in bank $02 at 00 00 byte $02A6. BRK 0000 above described screen. So we searched PEA 0002 This is where the BEQ for references to the text and uncovered \50 6C 65 61 73 65 2C 20\<210.FFFFP Disk #4 above branches too... the routine responsible for checking the 02/02A6: IrI1 ~ ~ ErQm I.Q. PEA 3073 flag. The routine checks the high bit of Next, I searched for references to 07 00 ~E 203843 DO A9011890 and the code continues... 00 00 a location on the zero page then checks , $02A6, hoping it would be that easy... a location fora value and ifit's a certain \A602\<02l0.FFFFP So, can you see where the check is After you have written those patches value orhigher then goes to the "demo" 02/541£ : made to see if the word was entered to the correct disks, you will then have a screen. Tracing it back to the original 02/8BD3: correctly? Good. So let's try changing complete backup of your original and JSR and changing it to a LOA results in 02/8£ 6A : the BEQ 9FC6 to a BRA 9FC6 (Block Moebius will not ask the question be­ $OlED, byte $016F, from $FO to $SO) fore he enhances your character. atotallydeprotectedcopyofPipedreams. Great! There were my references... . .The same information applied to both After further examination, the second and see what happens. It works. You the GS and lIe versions so cracking the and third references were not what I was now have a fully unprotected copy of Softkey for... Hostage for the IIgs! lIe version went very fast. With the edits looking 11Cor, so Iprocee de d to examine Windwalker GS installed, you will neversee any signs of the code around $541E to see what ithad These edits change the JSL 5/1241 to Origin the requestor screens. Follow these in- LDA 5/1241, in effect killing the jump structions: to offer. The code at $541A looked to the manual check. Then we change Requirements: something like this: the BEQ (Branch on EQual) to BRA Blank Disk (3.5") Step-by-step 021541 A: PEA 0002 The bank where the text is (BRanch Always) to force the program Fasteopier (3.5") PEA 02A6 The address of the text 1. Make a copy ofthe game disks (both to continue no matter what value the CP Blockwarden/Block Editor LOA OBD6 the GS & lIe versions). flag holds Here is a quick way of taking the PHA Push some other stuff on word protectionoffthis game. The word 2. Make the following edits by comput­ the stack Step-by-step erversion: protection will come up when Moebius LOA OBCA 1. Make a copy of the Hostage game is ready to enhance your character dur­ S12K Apple llgs PHA More stuff pushed disk. ing the game. and ncontinues .6!k ~.Erm1 .I2 2. Make the follow edits to the copy $190 $1F6 20 C647 AD C647 It looks like, to me, that it's pushing only: $19E $C5 20 AS 37 AD AS 37 the address ofthe textonto the stack, and

COMPunST #80 Readers Data Exchange 15 .eh am Er2m I2 01 pesky $186 $57 224112~ AF411205 02 fierce $lED $16F FOOC BOOC 03 deadly 3. Write the edits back to the copy. 04 ace 05 INVINCIBLE Softkey for... 2B Status: Pirates Mickey's Crossword Puzzle Maker 2C Status: Guild Disney 2D Status: Imperium Values are: 00 neutral Requirements: 01 liked 64K Apple II series FF disliked 3.5" disk copier FE hated 3.5" disk editor 2F Missiles: # of SM-1 missiles Like the name implies, Mickey's 30 Missiles: # of NOVA missiles CrosswordPuzzleMakerwill make and 31 Missiles: # of PLASMA mis- play crossword puzzles. This game is siles designed for younger children and as 32-33 Armor: hex backwards (E8 03 = such demands an unprotected backup. 1000) *ArmorRemaining 2008 The copy protection was in the form of lA IB hex backwards William Degelmann CO For the Scenario side: select copy a a wordprotectionwhere youhadto look 34 ECM: value 4B = 75% ECM disk, and run down the menu, until you up a crossword puzzle in the back and 35 Installed: avalueof3F"installs" Bitkey for... canchoose a numberofcopyingchoices givethe answerto X uporY across. This the ECM & shield options Black Magic and press #5. Use essential dup. is very annoying for adults, let alone 36 Laser: types are: ? Warning! Make sure you insert the children so we decided to remove the 01 garnet main original disk in drive 2, and the Requirements: entire routine. After a little code snoop- 02 beryl copy in drive 1. ing we found an edit that would totally 03 sapphire Copy 11+ 9.0 For the Boot side: find the program skip the requestor screen. Then after 04 particle beam (This is the Use the Parm Bit-Copy. under the parm entries on the disk, and trying to bootthe disk ondifferentcom­ one you want!) copy with a Biteopy. Use Copy II. puters we found a routine that seemed to 37 Shields: fore/aft, a value of33 = Bitkey for... Warning! Make sure you puta write­ cause crashes on some machines. We Fore 3/Aft 3 Ultima V tracked it down and took out the call to 74 Cargo pods: 08 max protecttab onthe bootside, oritwill not so the program would run on all ma­ ? run! chines. Item List (01 unless otherwise Requirements: noted) Copiers: LS 6.0 and Copy II 9.0 Bitkey for... Step-by-step 3A Stealth Box For the Boot Side: Use LS 6.0, Bit­ Xypbus 1. Make a copy of the program disk. 3B Beam Lock copy, and copy tracks 11 to 22. Thenuse ? Turbo Thruster 2. Make the following edits to the disk. 3C Copy 119.0 to copy tracks 00 to 11. Requirements: Repair Droid For the Towne side: Use Copy II 9.0 .aIk am Er2m I2 3D Locksmith 5.0 $2A $119 201063 EAEAEA 3E Null Damper to copy the disk using 'Disk w/Format'. For the Boot side; use Bitcopy, and $2F $08 20 75 EO 1890 4C 3F Key Card: Forall otherdisks: use Ultima V copy press these: 3. Write the edit back to the disk. 01 fits locks at: Hiathra under Normal Bitcopy. Cantina; Micon I; &? SYNCRONIZE: NO 4. Give the newly deprotected copy to 02 ?? Bitkey for... TRACK LENG: M your kids to use! ERROR RETR: YES 03 fits locks at:Bassruti, Realms of Darkness Gut's office; Koth Carri­ Copy Tracks 00 to 06, and 08, 10, 11 ? Kilroy OR er; Zed N27 storeroom Fortracks07 and 09 ontheBootdisk, Requirements: (crew's quarters); Con­ use the Bitcopy again, and press return Echo 1.0, Copy 11+ 9.0 Advanced Playing Technique for... Vec East, Omas Tyran's until it says to insert the disks. room First; For the Boot, use Echo 1.0 and Space Rogue For the Back side: use the Bitcopy, 40 ManchiEgg press return to default all the values Origin and again, press return until it says to 41 CRC-07Form correctly. You will see errors on the insert the disks. Space Rogue is a new game from 42 Transmutation Coil disk, but these are empty tracks. When Origin (see ProductMonitor, issue #74) 43 NS Booster the copy is done, recopy track 08 over Bitkey for... that looks a little like Autodue1. You 44 Statuette and over until it copies. Sierra Boot Disks have to build up your spaceship, follow 45 Malir Artifact Second; With your partially created the clues and unravel the evil plot, and 46 Ruby Cube Boot disk, load it in the drive, and use Sierra OnLine then save the galaxy. No problem! That 47 Tiwa's Letter the "Repair Disks" option to see if you Requirements: is ifyou don'tmind a SLOWpace at the 48 Psionic Shield have any errors. Ifyou do, the program Copy 11+ 9.0 beginning while you earn the money 49 Microchip will fix them. Using the Bit-Copier, look for the . needed to build up your spaceship. 4A Pilot's License Third; Forthe Scenario disks, use the parm: "Leisure Suit Larry (Alt 1)", and All ofthe attributes are stored in the 4B Forged Cargo Papers Copy 11+ 9.0 sector copy on both sides load it up. This will copy these Games: SAVE file ofthe side B (/DATA) disk. 4C Amoebic Lenses of the disk. When you are done, again; Man Hunter: New York .The following edits are all in track 20, 4D Blog Globe check it on the Boot disk for any errors. Leisure Suit Larry sector 04 unless otherwise noted: 4E Dilithium Gem Police Quest On track 20, sector 04 Bitkey for... Playing Tip for... King's Quest Series Saracen Space Quest Series OE-19 Name: end with 00 (12 charac­ Space Rogue ters max) Gunslinger Who knows what else it will copy lE-20 Date: Day/Month(1-12)/Year Origin Guild ofTbieves from Sierra? I'll fmd out soon.. lA-1C Location: Quadrant/Sector Look for messages while "charting". Police Quest If you would like a bitkey done for . (00,00 is the lower LH comer Make your first stop at the Micon I Silicon Dreams you, contact me through the Computist RDEX editor. I will be glad to help you and 31,00 is the lower LH cor­ mining station and see Sir Eld. Your ? ner). Quadrants: second stop should then be at the Hiath­ find a solution quickly. Requirements: 00 Karonus ra station and the Imperial representa­ ® Does anyone have an MODEM Echo 1.0 bit copier 01 Deneb tive Orellian. You'll need to pass your that they are no longer using and would 02 Gryphon pilot's exam: 3.26, type 0, F=ma, and For all these Programs: Press return like to sell? I am looking to buy a 1200 03 Arcturus Imperium. As long as you're there, ask until you see 'Insert Disks' and press or 2400 baud MODEM for under$100. 04 Nar'see for a CRC-07 form. You'll need it later. return to start copymg. I preferaninternal(fora lie)butI'lltake 05 Bassruti Search outside the Ross Mining Sta­ an externalifitcomeswith a serial card. Bitkey for... 06 Sigure tion. Again, I can be reached thru the RDEX 07 Zed N27 Wizardry Series Searchthe storeroomintheFreeGuild editor. 09 Ja-Karn outpost, but watchoutfor an alarm plate Sir Tech 23-24 Bounty: hex backwards on the right side. Requirements: Carl D. Purdy 25-26 Money: hex backwards(57 OE = IA Copiers: EssentialDataDup. II and Copy 3671) In reading the most wanted list I saw 11+ 27 Repute: values are: a program that I deprotected some time 00 unknown back.

16 Readers Data Exchange COMPunST#80 Softkey for... then write out the tracks to an initialized used, we have totake amuchcloserlook BPL $8954 Rear Guard disk. About 5 times around makes a at the way information is actually read is used as a "wait and watch"loop to COPYAdisk and Jack adull boy. Fortu­ from a disk. Adventure International detect when the msb has finally become nately. things have improved. There are a few absolute laws ofdisk a one. If you are still following the Requirements: COPYB is amodificationofCOPYA writing and reading which must be ob­ COPYA discussion. you should now be able to which automatically swaps the RWfS served. and severalminorstatutes which see the reason for the first law of disk Sector Editor such as CopyII+ or routines for you. To run it. you boot the may be violated with only a summons. bytes (listed in Basics Part 6): Ifthe first Diskedit (I prefer Diskedit) protected program and interrupt it. then The real. deep down. true way that data bitofthe byte weren't a one. bit 7 ofthe Disk searcher such as CopyII+ orCore move the RWfS routines from $B700 is recorded on any disk is by way of shift register would still have a zero Disk Searcher to $8000 (you can also use the read-in "magnetic flux changes". that is, rever­ when we should be at the end, and we Blank disk technique described in Basics 105 (File sals in the direction ofmagnetization of would shift atleastone more time,look­ 1. First copy the disk using a modified #5) to put the modified RWfS into a thin coating of iron oxide on the disk ing in vain for a "I". The second (not version of COPYA that will ignore memory, and you can keep a library of surface. We all recall fondly the science more that one pairofadjacent zeroes) is errors. Whenthe copyprogramgets to RWfS's if you find people like Muse experiments with iron fi1ings and a bar required to keep the circuitry from get­ the last track it will complain a lot, be and SSI using a particular one over and magnet; disk recording technology is ting lost(the thirdlaw. which requires at patient, it will finish it's task. over. These can simply be loaded as based onmakingthe particlesvery small, least one pair of adjacent ones not in­ RUNCOPYA Bfi1esinto$8oooafterbootingCOPYB). and immobilizing them on the disk so volving bit 7. is only for DOS 3.3. and etrl reset at the menu Booting COPYB and answering one they can be examined later for the state doesnotaffectthe hardware). Let'slook, POKE 929,24 cryptic and four fiddish questions al­ oftheirmagnetization Diskette reading for review. at some legal and illegal POKE 47426,24 lows you to produce a COpyA disk, is actually a (gasp!) analog process. and nibbles: RUN 80 including automatic initializationofthe is made digital by some clevercircuitry ~ .bi.wlrx ~ viQlation 2. When the copy program is finished target disk. Reasonably complete in­ just downstream ofthe read head. This 7F 01111111 No Rule 1 insert your disk searcher and search structions. written·by the author who circuitry senses the magnetic field over forthe sequence BD 89 CO. You should has achieved national prominence for a precisely defined time interval. and 8F 1000 1111 No Rule 2 find one occurrence on track 0, sector vernaldiarrhea. accoIJlpanytheprogram. translates a "'change'" (reversal) in the 92 1001 0010 No Rule 2 so we won't belabor them here. direction of magnetization to a digital 7 and anotheron anothertrack. Don't 95 10010101 Yes Not DOS 3.3 A much more complete program "one". and interprets "'no change"'. or change the one ontrack O. 1wund the 96 10010110 Yes None bytes on track 03, sector 03, byte 03. 1 called Advanced Demuffin has recently the absence ofreversal. as a "zero". changed the sequence. using a sector issued from Corrupt Computing, under On a 5.25" diskette. the changes are 97 1001 0111 Yes None editor. to 18 60 EA. the able authorshipot<'the STACK" and assessed every 4 microseconds. (usec). 98 1001 1000 No Rule 2 "the Inspector". It also makes unpro­ and the digital "bits" read are used to II1s ~ Eam Th 9A 1001 1010 Yes Not DOS 3.3 set tected copies via RWfS swaps, but is build up a disk byte or"nibble" (in case $)3 $03 $03.05 BD89CO 1860EA 9B 1001 1011 Yes None much more user-friendly and versatile. you were curious, the disk spins at 300 3. Write track 3 or whatever track you Thoroughsoftdoc accompanies thatpro­ rpm which is 5 revolutions per second, 05 11010101 Yes '" find the routine on back to disk. gram as well, so we needn't dwell on it, or200 milliseconds (msec) perrotation. AA 10101010 Yes '" You now have a deprotected copy of except to congratulate the authors on an Since 8 bits = one byte, a byte is read *These two bytes are not allowed in Rear Guard. By the way. the deprotect­ excellent and highly professional con­ every 32 usec. or 0.032 msec. and each the DOS 3.3 nibblizing scheme, butare ed copy will notgrowl the diskdrivejust tribution to the art ofunprotection. revolution of the disk corresponds to used in prologs and epilogs. before starting the game as the original Except for some clever and well­ 200 mseclO.032 msec or about 6000 Also. tuck this away in the back of did. (decimal) bytes. This is roughly $1800 hidden secondary protection, there is your mind: "'NO'" legal diskbytes can ® 1am interested to know ifanyone not much that a protector can do these bytes pertrack, which is about the num~ contain an 8. 1. or O. has deprotected Where in the USA is days with amodified DOS that we can't berofbytes you normally see displayed Carmen Sandiego. I have seen Bitkeys undo in short order with the tools and during anibblecountwithNibbles Away Now. if you want to create a non­ for Carmen USA but never a Softkey. techniques availableto us. Why arethere or Locksmith). standard disk format to keep those nasty soft~ (This is the DOS 3.3 version not the still some programs that take along time It's not too bad a physical picture to pirates out of your "unkrackable" PRODOS version). toKrack? Moreextensivemodifications. represehtthe orientation ofthe magnet­ ware.a11 you.have to do is pick a selec­ extending even to complete custom ic fields with arrows (up and down ar­ tion oflegal bytes (and maybe a few of DOS·s. Here. however. we start to sep­ rows would be nicer, but the Apple the illegal ones), and arrange your own Krakowicz arate the men from the boys. since writ­ screen no gots). In figure 9 below. the encoding scheme. The most common ing yourown operating system, no mat­ orientation of magnetic "domains" on technique is an adaptation of the old The Basics of Kracking ter how limited, costs money. While the disk for 9 bits are represented by encoding scheme called 4+4 nibblizing (part 7) DOS modifications, even with several arrows introduced to disk protection (I believe) variations, can be whipped out in a few Notice that each time the magnetic by my good friends at Sirius software. This is the same system Apple uses to Beyond DEMUFFIN: minutes by any klutzy hacker. reading field reverses during the read interval. and writing in ways not sanctioned by the bit value is read as "1", and as "0" if store volume. track and sector data in non-standard disk encoding the address field (see Basics Part 4). As techniques and diskbit tidbits the gods of Apple DOS require hiring no reversal occurs. someone who knows his stuff. and he The disk analog card and controller Recently. we have discussed the un­ also usually knows how much he's card cooperate to stackupthis"serialbit Figure 10 protectionofdisks withamodifiedDOS. worth. This has advantages for us as stream" into an 8-bit byte, using a shift primarily through the use of DEMUF­ well, since publishers will try to gettheir register which is the hardware equiva­ Shift Register Next Bit to be . Bit # added FIN PLUS. This time we'll talk a little money's worth out ofan expensive sys~ lent of the "ASL" or "arithmetic shift ~ 2.R..s..i.l2.~.Q. .1- about some other approaches to con­ left" instruction in Apple assembly lan~ tern by using it on as many products as #ofShifts 0 100000000 1<- 0 verting modified DOS disks, then get possible. Once broken, the principles guage. Theshiftregisterstarts out full of into some slightly heavier stuff about J. 1 1 can be readily applied to all disks ofthe zeroes. and keeps schlepping in. from 1 100000000 1<-1 those protection techniques which go same generation ofprotection. the right,the new bit read from the disk I 1 way beyond modifying DOS. Ifa publisher is going to go beyond every 4 microseconds. The sequence in 2 100000001 1<-1 In addition to DEMUFFIN PLUS, modifying DOS, he will normally also figure 10 represents the shift register I I .. two programs have recently become abandon standard track and sector for~ contents ateachofthe read pointsshown 3 100000011 1<- 0 available for unprotecting a disk with mat forsomething which affords greater in figure 9. 1 1 modified DOS: COPYBand AD­ security and ease of use (sometimes. Notice that the most significant bit 4 100000110 1<- 0 VANCED DEMUFFIN. Since. as we since the Apple disk hardware is so ("msb". or bit 7) of the shift register 1 1 5 100001100 1<-1 discussed earlier. most mods are made flexible. formats which were born on stays at"0" until the ninth shift. when a to the RWfSportions ofDOS. all that's 1 I entirely different systems fmd theirway "I"is shifted in. This isthe signal we use 6 100011001 1<- 0 really necessary to remove the primary into Apple protectionschemes). Games, to decide when we should stop reading protection is to read the disk into mem­ 1 I especially, have much simpler struc­ and shifting, and call it a byte. The shift 7 100110010 1<-1 ory using its ownRWfS.then switch in ture, and are readily adapted to a format register is decoded as address $COEC 1 1 a normal RWfS and write it back out to with less complexity. Since space on a (for slot six). and the familiar instruc­ 8 101100101 1<- 0 another disk. Since the file manager is game disk is usually not at a premium, a tion sequence: I I notinvoked as itisinDEMUFFINPLUS. 9 111001010 1 very common simplification is to elim­ $8954 LOA $C08C,X X-60 for slot 6 this approach has the added advantage inatesectoringaltogether,and makeeach that a disk with fairly normal sector track one big sector. This not only sim­ structure but no DOS file structure or plifies the program that has to read the Figure 9 catalog can still be converted. In the disk, but can also dramatically increase Ma&Detic flux direction - ys- Bit value early days. the technique was this: store the data transfer rate (Sirius's Hadron, both RWfS's in memory. then use the brought in a full 48K in just over four Read point 0 1 2 3 4 5 6 7 8 9 Inspectortoread inabout 8tracks. Move seconds--Eat your heart out, DOS). Magnetic orientation 11 11 II 11 11 11 II II 11 11 the normal RWfS in with the monitor. Before we discuss some ofthe formats Resulting Bit value 0 1 1 0 0 1 0 1 0

COMPUllST #80 Readers Data Exchange 17 we described, eachreal byte is split into The Basics of Kracking by creatively altering the code to pre­ C6F8:4C 01 08 JMP $0801 odd and even halves, and encoded so vent it from running away from you. In C6FB:00 BRK that each byte stored on the disk repre­ (part 8) summary, we will: C6FC:00 BRK sents exactly4 bits, orone nibble, ofthe 1. Read in the stage 1 boot code, but C6FO:00 BRK Boot Code Tracing original byte (the beginning of the dis­ not allow it to execute, Notice the instruction "JMP $OSOI" knibble-byte confusion). Thechoice for Atlast! Thelong-awaited description 2. Alter the first stage boot so it will at $C6FS. This is the "link" to stage 1of these is limited: All diskbytes are made ofboot-code tracing and its application execute to load in stage two, while pre­ the boot. Ifwe could change it to "JMP up ofA, B, E AND F, so you can have, to disk unprotection. My Kracking law venting the new stage from running, FF59", *every* disk we booted would on the disk: #7 says "whenall else fails, boot trace." 3. Ifnecessary, repeat the process of load in the first sector, beep into the AA AB AE AF BB BA BE BF For many Krackists, notable among monitor, and obligingly wait while we EA EB EE EF FA FB FE FF whom was Mr. Xerox (may he rest in altering, loading, and halting until all the stages of the boot have been exam­ snoop through page S to our heart's You can find (pemaps too much) peace), the motto was opposite: "before ined and understood. content. Since the program is in ROM, more infonnation onthis technique and you do anything else, trace the boot we can'talterit, butwecancopyitdown In practice, the first two steps are decoding it in the ftles on Cyclod, Way code." Dependingon yourskill and pre­ to a compatible location and alter it so relatively standard, but step three can Out, and Type Attack. disposition, you'll settle somewhere in that the program halts instead of con­ get quite involved as the trace progress­ The files on Cyclod, Way Out between these extremes. tinuing with the boot process. Because es. and Type Attack will be published IfMr. Xerox didn't invent boot-trac­ the boot code has to execute from any The technique for interrupting the in later issues RDEXed ing he was certainly the first to docu­ slot, itcontains a "whereare we" routine mentitclearly in theunderground press. orderly flow ofthe boot is referred to as at $C621-$C62E to find out what its Ingeneral, while the approach to un­ "settingbreakpoints."Thetenninology The description that follows borrows current location is. Happily for us, this protectingalloftheseoddballfonnats is is borrowed from the darlc ages when heavily from his original treatise on the kind of relocatable code will run many straight forward, the worlc can be long computers had real front panels with Pirate's Harbor cracking disk #1. In places besides the $Cloo-$C7FF pe­ and hard, and can provide some real knobs and switches and lights, and you addition, "Mycroft" wrote a thorough ripheral ROM space (see the reference challenge to our skill as Krackists and could actually"dial-in"an addresswhere article in Hardcore Computing, update manual p. Sl for a description of the programmers. In broad outline: you wanted the computer to halt for 3.1, describing his own, slightly differ­ "where are we" routine). Mr. Xerox's 1. Try to figure out the disk access ent approach to boot-tracing. While I examination (is anyone out there old famous monitor instructions which re­ logic and isolate the reader/loadercode. enough to share my fond recollectionof find his process a little more laborious, locate the bootROMcode and insertthe "execute-stop" and "fetch-stop" 2. Modifyittoread inall thepertinent it might be necessary for some very first breakpoint are: parts ofthe disk. difficult cases. knobs?). Sophisticated systems with 9600 load into page S ($Soo­ to be a little more imaginative. 4. Reconstruct the program, using as page you use must end in 6 so that slot 6 $SFF). The furtherassumption is that, if In all Apple II systems, the instruc­ little new code as possible. is decoded as the controller card loca­ we can view every stage of the boot tionsequence"4C59FF" orJMP$FF59 tion). The last few lines ofthe (relocat­ By now you should know what a process, we canlearnenoughto produce goes to the reset code and provides a ed) boot ROM code now read: loader routine looks like, and in most an unprotected version ofthe program. positive,pennanentstoppingplace from cases these disks will load a complete It does not have mystical powers, and anyplace in assembly language code, 96F4:A6 2B LOX $2B trackat a time into a predetennined area still requires the ability to tear apart and and halts with a well-defined machine 96F6:90 DB BeC $9603 ofmemory. Bylocating and altering the understand assemblylanguage, muchof state. Wheneverwewanttoset a"break­ 96F8:4C 59 FF JMP $FF59 table of"where to read in", you can, in whichis intentionallymisleading. We'll point" in the Apple, we can replace any SO that typing: a few passes, read the track into memo­ begin with background material and a three bytes of code with "4C 59 FF". 9600G ry, boot a disk, and write the memory review of the nonnal boot process To begin the process, lets look at will initiate a bootsequence from our contents outunder the nonnal DOS for­ (D@mmit, Maude, we always have to some code from part of the controller code at 9600 which ends at the "break mat. After all the infonnation is saved, sit through the sennon first!), and pro­ card boot ROM: point" at $96FS, rather than continuing you canbegintheprocessofreconstruc­ ceed through an example ofanew pro­ C6OO:A2 20 LOX #$20 the boot. Ifyou try this, you'll find that tion. Usually, this consists of loading gram. C602:AO 00 LOY #$00 the disk is still spinning, and you can DOS (or at least RWTS) into memory (As with most Kracking activities, C604:A2 03 LOX #$03 tum it off by including the instruction and usingittomanipulate sectionsofthe it's best to have on hand a blank initial­ "2C ES CO" (BIT COE8) at 96F8 before original code. In cases like CYCLOO, ized diskfor saving pieces ofthe code as C621 :20 58 FF JSR $FF58 the JMP FF59, or you can just type the additional disk access between lev­ they become available). C624:BA TSX "$COES"fromthemonitor. Afterpage S els is totally unnecessary and can be Ordinarily, when you boot a (DOS C625:BO 00 01 LOA $01oo,X has been loaded with the stage 1 boot eliminated. In something like BAN­ 3.3) 4SK slave disk (a masteris slightly C628:0A ASL code, the fun begins (until you get good DITS, however, a great deal ofreal data different, but we'll ignore that for the C629:0A ASL atthis, it's a good ideato save eachpiece isreadinateachlevel, and a means must time being), a three-stage process is C62A:OA ASL ofboot code as a BFILE on a spare disk be found to accommodate the disk ac­ started which ends up with the desired C62B:OA ASL before proceeding. It's usually easier cess. Usually, this means trying to (HELLO) program running. First, the C62C:852B STA $2B than runningthroughtheentire sequence squeeze the absolutely crucial subrou­ controller card ROM at $C6oo-$C6FF each time a step doesn't worlc as you tines from RWTS into the space origi­ C62E:AA TAX loads TO, SO into page S, then jumps to expect, and it will make iteasierto print nally occupied by the loader routine. C62F:BO 8E CO LOA $C08E,X location $SOI. This is a short program out a disassembly ofthe code to figure There are a number of these "short that loads all 10 sectors ofRWTS from out what it does). DOS" routines in existence. These pro­ C658:A9 08 LOA #$08 TO, SO through TO,s9 into pages $B6­ At this point, page S must contain grams are all less than $400 bytes long, C65A:8527 STA $27 $BF($B6oo-$BFFF), thenjumps to lo­ stage l' ofthe boot with location $SOI as and includetrack seek, addressand data C65C:18 CLC cation $B7oo. This program, in tum, the starting point. If the first stage is field readers, and postnibblizing rou­ C650:08 PHP loads$1 B (27)pages into $9DOO-$B5FF kosher, location $S4A contains "6CFD tines. In the process ofkracking BAN­ C65E:BO 8C CO LOA $C08C,X from TI,S4 through TO, SB (note-this is OS", which is an indirect jump through DITS, both the shy "nameless" Kracker C661:10 FB BPL $C65E a "backwards load" for speed. Apple the location in$SFD & $SFE. This is the ("they said it couldn'tbe done...") and I C663:49 05 EOR #$05 knew about it, so why didn't DOS ever exit point of the stage one boot, and wrote virtually identical routines which C665:OO F7 BNE $C65E use it for quickloading files???). After a nonnallyjumpsto $B700 to begin read­ lived intext memory at400-7FF. Long­ C667:BO 8C CO LOA $C08C,X little housekeeping, the program jumps ing in the code for stage 2 (the $B6 at John Silver has his own version of a C66A:10 FB BPL $C667 to the DOS coldstart in $90S4, which $SFEbecomes $B7duringthe 10-sector short DOS, and an excellent implemen­ C66C:C9AA CMP#$AA runs or EXECs the hello program. In load). To continueourmission, we must tation has recently been introduced by C66E:OO F3 BNE $C663 summary: locate the exit point of this stage and the Stack and The Inspector of "COR­ C670:EA NOP insert a breakpoint. RUPf COMPUTING". It is extremely Code # of Dest Name C671 :BO 8C CO LOA $C08C,X well documented, and justas inthe case Location ~ ~ l.Y.!:!:m Next C674:10 FB BPL $C671 0801 :A5 27 LOA $27 of Advanced Demuffin, the best utility C600-C6FF 1 08 Stage 0 801 C676:C9 96 CMP #$96 0803:C9 09 CMP #$09 available to the practicing Krackist 0801-08FF 9 B6-BF Stage 1 B700 C678:FO 09 BEQ $C683 0805:00 18 BNE $081F That's a crude outline of the disk B700-B7FF 27 9D-B5 Stage 2 9D84 0807:A5 2B LOA $2B 0809:4A LSR protection schemes which go beyond Of course, in a nonstandard fonnat C6E6:9126 STA ($26),Y 080A:4A LSR modified DOS; unfortunately, most are intended for protection, things aren't C6E8:C8 INY 080B:4A LSR quite differentindetail, and yourskill as necessarily the same. To see the differ­ C6E9:00 EE BNE $C609 08OC:4A LSR a Krackist must be made equal to the ences, you need to examine each stage C6EB:E627 INC $27 0800:09 CO ORA #$CO task of each one. We'll continue the separately to see what itdoes and where CSEO:E630 INC $30 basics ofKrackingseries nexttime with it goes. C6EF:A530 LOA $30 080F:853F STA $3F the long-promised article onboot-code­ Thetheoryofboot-tracingis straight­ C6F1 :CO 00 08 CMP$0800 0811:A9 5C LOA #$5C tracing. forward: follow the boot process one C6F4:A62B LOX $2B 0813:853E STA $3E step at a time to see where is leads you, C6F6:90 DB BeC $C603 0815:18 CLC

18 Readers Data Exchange COMPunST #80 0816:AO FE 08 LOA $08FE we have to arrange it so that the first The modified page 8 will load TO, SO 4 blank 5.25" fonnatted ProDOS disks 0819:60 FF 08 ADC $08FF stage bootcode is sent offinto oblivion. through TO, S9 into pages 20 to 29, then withvolumename/HI.TECH.BOOT 081 C:80 FE 08 STA $08FE Referring back to the boot code,loca­ jump to our modified code at $B700. 1 blank 3.5" fonnatted ProDOS disk or 081 F:AE FF 08 LOX $08FF tion $9658 (originally $C658) contains The modified code at $B700 will RAMdisk on IIgs 0822:30 15 BMI $0839 the page number where TO, SO loads in, load 27 sectors ofDOS into pages $9A­ 1 5.25" disk with normal ProDOS, 0824:BO 40 08 LOA $0840,X nonnally 08. Changing it to $20 will $B5, then halt when it hits the break­ BASIC.SYSTEM on it. 0827:8530 STA $30 cause TO, SO to load into $2000 instead point at $B747. The Teacher's Tool Kit comes on of $0800, and the boot will continue 0829:CE FF 08 DGC$08FF Before the next episode, try this pro­ four 5.25" disks that have a non-stan­ through ouraltered page 8. Note that we 082C:AO FE 08 LOA $08FE cess on a few different disks, including dard ProDOS format with altered trail­ have to remove the first break point at O82F:8527 STA $27 some protected ones - practice is essen­ ers. I tried to make a bit copy ofit, and $96F8 and restore the original JMP 0831 :CE FE 08 OEC$08FE tial. In the second part, we'll take on evenused COPYA to make a copy with $0801: 0834:A62B LOX $2B SSI'S RDF 1985. standardtrailers,butneithercopywould 0836:6C 3E 00 JMP ($OO3E) 9658:20 boot. On Computist #65 page 18, Jack 0839:EE FE 08 INC $08FE 96F8:4C 01 08 Moravetz'ssoftkeyhelped. Buthis soft­ 083C:EE FE 08 INC $08FE Now, when we type "96()(x}", the John C. De La Cruz CA keywasforanolderrelease ofthe Teach­ O83F:2O 89 FE JSR $FE89 boot code will load TO, SO into $2000­ er's Tool Kit. So the resulting copies Softkey for... 0842:20 93 FE JSR $FE93 $20FF, where it won't bother us at all, still would not worlc. On my copy ofthe 0845:20 2F FB JSR $FB2F then jump to $801 to execute our code. Rendezvous with Rama tool kit each ofthe four programs come 0848:A62B LOX $2B AfterRWTS has beenloaded in, instead Fahrenheit 451 on a two sided disk, the front side is the O84A:6C FO 08 JMP ($08FO) ofjumping to $B700 to continue load­ Trillium program disk and is unprotected, the ing DOS, the program hits the (second) back side is the startup disk which is 0840:00 BRK Requirements: break point at $84A and halts. protectedwiththe non-standard trailers. O84E:OO OS 09 ORA$090B 2 blank disks The final phase of this process is to So to boot up the disk you flip it over 0851:07 ??? A fast copy program locate the exit point from this area of boot the computer then you will be 0852:0503 ORA $03 Copy II plus sector editor 0854:010E ORA ($OE,X) code, insert another breakpoint, and ex­ prompted to insert the program disk or amine all the code loaded in by stage 2. 1. Copy original disks to the blankdisks 0856:OC ??? press ESC to quit. Again, we have to make sure that the with fast copyprogram such as Lock­ 0857:OA ASL Boot up one of the programs and boot process doesn't overwrite the smith 6.0. when prompted to insert the program 0858:08 PHP changes, which means we have to un­ 2. With yoursectoreditorscan side A of disk. Press ESC to quit. Their ProDOS 0859:0604 ASL $04 derstand how the destination addresses the copy for 20 30 EO. has a Quitco<,te thatwillshowyou allthe O85B:02 ??? are set up in stage 1. Even in normal volumes in your 3.5" drives, RAMdisk, 085C:OF ??? Rendezvous with Rama DOS it's not obvious, but enough head­ and eventheirprotecteddisk. Butifyou 0850:00 BRK scratching or reading ofBeneath Apple Id1 ~ am frgm IQ have a normal ProDOS disk in your DOS will reveal thatthe byte in location $)3 $OC $24-26 20 30 EO 20 29 1C 5.25" drive it won't read it. Insert Copy 08FE:B609 LOX $09,Y $8FE is one higher than the first page Fahrenheit 451 11+ plus in your 3.5" drive and Prefix Nonstandard formats can have any loaded into, and the byte at $8FF is one that drive, now you willbeshownall the number of exit instructions, and this is less than the number of sectors to be Id1 ~ am frgm IQ files on Copy 11+, from here select and where yourknowledge ofassembly lan­ loaded. As before, we remove the previ­ $02 $OC $28-2A 20 30 EO 20 20 1C run UTIL.SYSTEM. Remove Copy 11+ guage and experience at reading code ous breakpoint, alter the destination of 3. Don't forget to write the sector back and insert your fonnatted 3.5" disk and will startto payoff. Unless thefirst stage the real code loaded in under this stage, to the disk. use the copy files option to copy the is relatively standard, it's necessary to and set the new breakpoint: following files from the startup side of spend time examining and tearing apart Softkey for... B700:8E E9 B7 STX $B7E9 all four disks to your disk: the code until you understand what's B703:8E F7 B7 STX $B7F7 Magic Spells v2.0 Word Search: WSBT.sYSTEM and going on. Look first for a jump or indi­ B706:A901 LOA #$01 The Learning Company WS.BTPROG rect jump to someplace outside ofpage B708:80 F8 B7 STA $B7F8 Word Match: HTP.SYSTEM and 8, and change that to JMP $FF59. If Requir.ements: B70B:80 EA B7 STA $B7EA PARAMS.BT none appears, look for a "jump through A blank disk B70E:AO EO B7 LOA $B7EO Word Scramble: SCBT.SYSTEM and the stack" trick as described in the AR­ A sector editor B711:80 E1 B7 STA $B7E1 A fast copy program SCPARAMS.BT CADEMACHINE me: Forexample, to Multiple Choice: MC.SYSTEM and go to $BBOO there will be, somewhere B714:A902 LOA #$02 1. Make a copy of your original B716:80 EC B7 STA $B7EC PARAMS.BT inthecode, two"PHA'S"and an"RTS". 2. Scan disk for the following bytes 08 B719:A904 LOA #$04 If you noticed on Word Match and The first push onto the stack would be 68 8D5E 61 78 A9 Change the $08 to B71B:80 ED B7 STA $B7EO Multiple Choice that the second file is $BA; the second $FF. When the RTS is $60. Here is where I found the bytes B71 E:AC E7 B7 LOY $B7E7 named the same, then on Multiple executed, the two bytes are pulled off on my disk. the stack, incrementedbyone to $BBOO, ... Choice, rename the second file to II:K ~ Emm IQ and jumped to. In addition, more than B738:2O 93 B7 JSR $B793 am PARAMS.BTI. $14 $09 $00 08 00 one page can be loaded under stage 0, B73B:A2 FF LOX #$FF Next let's get rid of their ProDOS 3. Write the sector back to the disk. and accessed by a relative branch in- B730:9A TXS now that we're done with itand boot up struction, so you'll have to examine B73E:8E EB B7 STX $B7EB Copy 11+ and copy the files to the four Softkey for... the code loaded in (it's good prac- B741:4C C8 BF JMP $BFC8 5.25" fonnatted disks with the volume I tice to clear out all of memory before B744:2O 89 FE JSR $FE89 Magic Spells v2.1 HI.TECH.BOOT and label each disk starting; this will work if DOS is not B747:4C 84 90 JMP $9084 The Learning Company accordingly, remember to rename PARAMS.BTI back to PARAMS.BT active: 800:0 N 801<800.BFFFM). The changes are: Requirements: on Multiple Choice. Copy the Program When you find the exitpoint, make it 84A:4C 00 B7 A blank disk Disk side to the other side ofeach disk. a breakpoint with "4C59 FF"to prevent A sector editor (Wecan'tuse the indirectjumpin the Now to remove the copy protection the continuationofthe boot. Beforepro­ A fast copy program original, since we have redirected the boot BASIC and insert each disk and ceeding, take a good look at all the code boot.) 1. Make a copy ofthe original. tobe sureyouunderstand where the next load the following files: 8FE:20 09 2. Scan disk for the following bytes A2 stage loads, and any unusual conditions Word Search (page 20 or anyplace else where 10 or instructions. 03 B5 00 48 CA 10 FA Change the pages ofcode won't hurt anything.) BLOAD WSBT.SYSTEM, TSYS, A$2000 The altered portion ofcode is now: $A2 to $60. Here is where I found the B747:4C 59 FF bytes on my disk. CALL-151 0839:EE FE 08 INC $08FE 2063:60 1860 was 0838 2C JMP $9D84 is the DOS cold-start. Id1 ~ frgm IQ 083C:EE FE 08 INC $08FE am The JMP $BFC8 is a patch which re­ $14 $00 $00 A2 00 BSAVE WSBT.SYSTEM, TSYS, A$2000 O83F:2O 89 FG JSR $FE89 turns with a JMP $B744) 3. Write the sector back to the disk. Word Match 0842:20 93 FE JSR $FE93 The last few lines ofcode are now: 0845:20 2F FB JSR $FB2F BLOAD HTP.SYSTEM, TSYS, A$2000 Softkey for... 0848:A6 2B LOX $2B B741:4C C8 BF JMP $BFC8 CALL 151 O84A:4C 59 FF JMP $FF59 B744:20 89 FE JSR $FE89 Teacher's Tool Kit 2063:60 1860 was 0838 2C Word Search 3.1 0840:00 BRK B747:4C 59 FF JMP $FF59 BSAVE HTP.SYSTEM, TSYS, A$2000 Now type 9600G, and let's recap the Word Match 3.1 Thetheory now is to allow the bootto Word Scramble 3.1 Word Scramble process that will occur: proceed throughonemorestage,halting Multiple Choice 3.1 BLOAD SCBT.SYSTEM, TSYS, A$2000 The modified stage 0 code at 9600­ afterRWTS has beenread in, and giving Hi Tech ofSanta Cruz CALL 151 us a chance to examine that portion of 96FF will load TO, SO into page 20 Requirements: 2063:60 18 60 was 08 38 2C the program for alterations. If we just (since we don'twantit),thenjumptothe Apple IIgs BSAVE SCBT.SYSTEM, TSYS, A$2000 rebootedwith"96()(x}",theoriginalcode start ofour modified page 8 at 801. Copy II plus on 3.5" disk would overwrite our altered page 8, so

COMPunST#80 Readers Data Exchange 19 Multiple Choice JMP$FF59 to preventtheSYSTEMfile BSAVE WSBT.SYSTEM, TSYS, A$2000, built in CDA Visit Monitor option to BLOAD MC.SYSTEM, TSYS, A$2000 from executing and to throw us back L$600 snoop around after the program was CALL-151 into the monitor. BSAVEWS.BTPROG, A$B400, L$18A loaded in memory and found that most ... 2316:4C 59 FF 2054:60 18 60 was 0838 2C Word Match ofMonsters and Make Believe is writ­ BSAVE Me.SYSTEM, TSYS, A$2000 Now run the ProDOS in memory. ten in BASIC. After trial and error I CREATE HTP.SYSTEM, TSYS finally came up with a way to copy the That's all enjoy your unprotected 2000G BSAVE HTP.SYSTEM, TSYS, A$2000, files to anonnaldisk using theirprotect­ copies. When the drive stops you'll be back L$600 ed DOS with FlD. in the Monitor again. With the SYS­ BSAVE PARAMS.BT, A$B400, L$100 Softkey for... TEMfile inmemory. Uptothis pointthe 1. Boot upyour IIgs and enterthe Mon­ Teacher's Tool Kit (fic) above infonnation will work on all four Word Scramble itor with a CALL-I5I, at the asterisk Word Search 3.1 disks past this point I'll give you the CREATE SCBT.SYSTEM, TSYS type the # signand return to the getthe Word Match 3.1 different infonnation for each disk. BSAVE SCBT.SYSTEM, TSYS, A$2000, CDA Visit Monitor installed. Word Scramble 3.1 Next we have to move the SYSTEM L$600 2. Next on one of the blank disk copy Multiple Choice 3.1 me to a safe memory location. BSAVE SCPARAMS.BT, A$B400, L$100 FlDonto itthentype this shortBASIC Hi Tech ofSanta Cruz program and save it to the same disk For Word Search, Word Match, and Multiple Choice Requirements: Word Scramble enter: with the name MAKE. If you only CREATE MC.SYSTEM, TSYS Apple IIc 8000c2000.25FFM have one drive change D2 to D1. BSAVE MC.SYSTEM, TSYS, A$2000, 4 blank 5.25" fonnatted ProDOS disks 10 TEXT : HOME For Multiple Choice enter: L$500 .withvolume name/HI.TECH.BOOT 8000c2000.24FFM 20 PRINT CHR$(4);"BRUN BSAVE PARAMS.BT, A$8500, L$400 FID,D2" 1 5.25" disk with nonnal ProDOS, Next there is one more me that has to And that all there is to it so enjoy. 3. Boot up the original Monsters and BASIC.SYSTEM on it. be loaded in from the disk but again we Make Believe, when you get to the The easiest way to unprotect these want it loaded and not executed. By the way, if you like their Quit Code (which I did) you can capture it to main menu Press Control, Open Ap­ disks is if you have a IIgs with a 3.5" For Word Search and Word Match use it with your own ProDOS. When ple, ESC to get to the Control Panel drive or a RAMdisk. But I realize not enter: youhavetheirProDOSinmemorymove from here choose VisitMonitor. Once everyonehas a IIgs soI decided to figure 20F4:4C 59 FF out a way to retrieve the necessary files the QuitCodeto a safeplace inmemory. intheMonitortypethefollowing bytes. For Word Scramble enter: from the protected sideonmyAppleIIc. 8000c5700.59FFM 101 B:4D 41 4B 45 2C 44 32 22 3A 20F7:4C 59 FF On the IIc it's not so easy. It involves Boot a nonnal ProDOS and get into What youjust did was change partof boot code tracing, since I couldn't reset For Multiple Choice enter: BASIC. Then: the BASIC program in memory from out ofthe program without trashing the 20C4:4C 59 FF BSAVE QUIT CODE, A$8000, L$300 "RUN SETUP,DI" to "RUN MAKE, program in memory. What we've done is change the JSR Now you can load in your nonnal D2": again if you only have one drive Forthe hard way on the IIc, enter the 2000BF65 which is theJMPto the Quit ProDOS and patch it. change the 32 to 31. Monitor and clear memory by filling it Code in ProDOS. And changed it to BLOAD PRODOS, TSYS, A$2000 Then press ctrl Y and press return to with zeros. drop us back into the Monitor. Next run BLOAD QUIT.CODE, A$5AOO reenter the Control Panel. Choose Quit CALL-151 the SYSTEM file. BSAVE PRODOS, TSYS, A$2000 to return to the program. Remove the 800:00 N801 c800.BFFFM 2000G original disk ifyou only have one drive Note: Different versions ofProDOS and insert the disk with FID and the Next move the boot code down to When the Title screen comes on to have the Quilcode at different loca­ short BASIC file on it. Ifyou have two where we can alter it. insert the PROGRAM DISK or press tions. On versions 1.2, 1.3, 1.4, 1.6 and drivesleavetheoriginal indriveone and 8600cC600.C7FFM ESC to Quit. Press ESCdo notpress any 1.7, itlives at $5900soonthese versions insert the disk with FlD into drive two. Now enter the following otherkey. Pressing ESC would nonnal­ BLOAD the QUIT.CODE at A$5900. Afteryou have donethischoose Change 863A:20 09 87 lytake you to the QuitCode but with the On version 1.1.1 itlives at $5700 and on Setup from the main menu which will 8728:A988 change we made above you will be put version 1.8 it lives at $5AOO. run the MAKE file we created to brun 86F8:4C 01 88 into the Monitor. Once in the Monitor do the following to move the file that FlO. What we've done here is change the Softkey for... was loaded into memory to a safeplace 4. Once FlO is loaded, put the original bootcode (Boot0) so thatthe next Boot Fay's Word Rally where it won't be erased. back into the drive choose COpy stage (Boot 1) will load at page $8800 Didatech For Word Search enter: FILES and copy all the files from the instead of$0800 insert one ofthe orig­ Requirements: original to your fonnatted disk. inal disks in drive 1. After making the 8700cB400.B58AM A blank disk ~asy changes check to see that they are cor­ ForWord Match and Word Scramble That's all there is to it. isn't it. A sector editor rect, then runthecode at$8600(Boot0). enter: Locksmith 6.0orfast copyprogram that Softkey for... 8600G 8700cB400.B4FFM will ignore errors Stop the drive by typing: For Multiple Choice enter: Same or Different 1. Make a backup using Locksmith fast­ COE8 8500cACOO.AFFFM Learning Technologies copy to ignore error ontrack 2, sector Check memorypages 8800 and 8900 Now that both mes are in a safe 7. Requirements: A blank disk there should be some code at both loca­ location. Remove the original and insert 2. Use your sector editor to make the the disk with the nonnal ProDOS and A sector editor tions especially inpage$8900to $89FF. following sector edits: Ifpage 8900is stillfilled with zeros then BASIC.SYSTEM, to get you into BA­ A fast copy program ~ ~ Ergm redo the above steps over again. Ifthe SIC. Once your in BASIC type CALL­ I!:K I2 I used the Softkey from Computist $00 $04 $89-91 A21C989D A9oo8DFG code is there then we have to move both 151 to enter the Monitor. Now let's EOBCCAoo 868D967A #66, page 8 to help me crack this one. pages at $8800,$8900 to $0800,$0900. move the files back to where they be­ FA EA 1. Fast copy your original to your blank 800c8800.89FFM long so we can save them to disk. 3. Write the sector back to the disk.· disk. After moving the code we have to do For Word Search enter: 2. Make the following sector edits to a couple ofchanges. First ifyou look at 2000c8000.85FFM Softkey for... your copy: the Boot 1code, atlocation $08FCthere B400<8700.888AM Monsters and Make Believe vl.l I!:K .sg ~ Ergm ~ is aJMP$2000which is thejumpto start ForWord Matehand Word Scramble Dinosaur Days vl.O $06 $04 $8A-8B 00 DB 00 EA ProDOS which we want to stop from enter: 3. Write the sector back to you disk. executing. Here I putJMP$FF59 which 2000<8000.85FFM Pelican Software puts us back into Monitor. And the sec­ Requirements: B400<8700.87FFM Softkey for... ond change is in Boot 0 at location Apple IIgs with ROM vOl & up For Multiple Choice enter: Greeting Card Maker $86F8 where we just change it back to 2000<8000.84FFM FlD from the DOS 3.3 System Master its original value ofJMP $0801. 2/3 blank disks fonnatted with DOS 3.3 Activision Since you are inthe Monitor already, 8FC:4C59 FF Requirements: you can unprotect the SYSTEM file. MonstersandMake BelieveusesDOS 86F8:4C 01 08 3.3 but the disk is fonnatted in a very A blank disk Restart Boot 0 again. For Word Search. Word Match, and strange fonnat. The DOS on this disk A fast copy program 8600G Word Scramble enter: can read itself and also a nonnal DOS A sector editor 2063:60 18 60 When the drive stops, ProDOS will 3.3 disk. This was easy to figure out 1. Copy the original to your blank disk. For Multiple Choice enter: have beenloaded into memory at $2000 since the data disks that it creates are in 2. Make the following sector edits: 2054:60 18 60 a nonnal fonnat. I could not copy this now we want ProDOS to load the SyS­ ~ disk with any of the disk copiers or I!:K .sg Er2m I2 TEM file (example HTP.SYSTEM) but Get backto BASIC (enter3DOG) and $20 $09 $58-5C?? A9FF18903D notto startit. So wemakeanotherchange BSAVE the meso nibble copiers that I have. And every­ thing else that I tried didn't work either. 3. Write the sector back to the disk this time on the ProDOS in memory. At Word Search location $2316 there is a JMP $2000 I gave up on this program at one point. I'm sorry but when taking down my which is the jump to the start of the CREATE WSBT.SYSTEM, TSYS Butlater I gave it another try and finally notes I neglected to write down the SYSTEM me. Here we enter another succeeded. WhatI did was use the IIgs's original bytes that I found.

20 Readers Data Exchange COMPunST #80 Softkey for... exponentially greater than the previous mycharacterfrom reaching the console. after they cashed in my money order GATOvl.3 one; for example, 2 ships from Harm­ I recall that I once made it through, after they claimed bankruptcy. less to Mostly Harmless, 4 ships (2 Finster said something like "well, that These programs are Wizardry sce- Spectrum Holobyte squared) from MostlyHarmlesstoPoor, was quite a logic flaw", and then the nario creators and editors. Requirements: etc. Of course, these numbers are just floor ceased its annoying conveyor-belt To Blain Johnson: Thank-you for COPYA wishful thinking, because in actuality it action. However, even though I saved your softkey for ELECTRONIC ARTS Blank disk seems that you need many more kills to the game, I found I couldn't make it SOFfWAREinCOMPUTIST#76. This Protected GATO v1.3 disk advance thanjust 2 or 4 per rating. throughagain, becauseafterhackingthe softkey, without modification, allowed A sector editor The Elite disk, as you suggested, is Proton Axe vainly against the web of me to copy Wasteland. The copy boots I followed the softkeys from Com­ heavily encoded. After first receiving deceit in room five, I switched charac- perfectly and now the original is safe. putist #59 and #62 byMikeEgnotovich that message about the lost ship, I tried ters, and re-entered the labyrinth with a The copy even boots quieter. Unfortu­ and I was able to transfer the files to a to re-read it by using the Copy II Plus different character, who is now unable natelytheprogramcouldnotcopyLEG­ normal Pascal formatted disk but the sector editor to scan for the text, but to to reach the console in the fourth room. ACY OF THE ANCIENTS. copy still wouldn'tboot It would grind no avail; it, and anythingelse in English I'd appreciate any tips on how to get ® Does anyone know why the latest and then stop with the message "IN­ on the disk were obviously encoded. through the fourth and fifth rooms. versionofCOpyIIPLUS (ver9.0)does sERT BOOT DISK WITH Luckily, I recently was able to attain a ToGaryWills:Concemingyour3.5" not accept the RAM disk option for SYSTEM.PASCAL ON IT, THEN COMPETENT rating again (with the modification to OMEGA, I might be choice ofdrives. I cannotFORMAT the PRESSRETURN". I found thatifatthis help of Dan Reid's APT in COMPUT­ able to help you out if I knew what RAM drive from the menu. The COPY point I inserted the original GATO 1.3 1ST#75, and withthe assistance ofCom­ procedure you used to attain the "limit- II PLUS (ver 8.3) accepts it and I use it disk that the program would load and mander Jameson), and thus re-read the ed success" that you've had. I've stud- all the time. start as ifI had booted up the original. I bulletin. I eventook aphotoofthe entire ied the formats ofUltima V and Wind- ® Does anyone know how to make finally figured out that maybe the boot message, so for your benefit, and the walker, as well as OMEGA, and each the view files option ofCOpy IIPLUS file waslookingfortheprotected header benefit ofany other Eliters, I'm writing seem to use the same DOS, namely in general, print 80 columns to printer and trailers on the original GATO. So I it here: DinkeyDOS. I have for quite a while instead ofjust 40 columns like it does. scan the disk for C9 6A and I hit the "Greetings,CommanderJAMESON, been trying to make these programs jackpot. I am Captain Curruthers upgradeable, but since the only manual ® Why is "Wizardry: Return of 1. Boot your DOS 3.3 system di*. of Her Majesty's Space Navy and I on ProDOS I have is too general, I Werdna" (Wizardry IV) on the most beg a moment of your 2. Change DOS and make a COpyA haven'tbeen able to thoroughlydevelop wanted list. This program, at least my valuable time. a procedure (Beneath Apple ProDOS is copy is only protected by a password copy of your Gato 1.3 disk. We would like you to do a little job CALL-151 next on my"to buy"list, for sure). What check, no disk protection, the same is for us. 8954:4A C9 6A DO EF I was thinking of doing is to somehow true for Wizardry: Heart of Maelstrom The ship you see here is anewmodel, 8988:1860 rename the fIles and volumes, and then (Wizardry V) only password check. the Constrictor, RUNCOPYA alterthem with a sectoreditorso that the Could itbe possible that it is on here for equipped witha top secretnew shield programtreatseachseparatedisk side as password removal, ifso the please add 3. Use the System Utilities !O format a generator. a subdirectory, instead ofa volume. As Wizardry V: Heart ofMaelstrom as the disk inPascal and copy the files from Unfortunately, it's been stolen. you can see, the process I've got inmind password check is annoying. the COPYA copy to the disk you for­ It wentmissing from ourshipyardon is not quite refined! Also, have you When I asked ifpassword (and matted. Xeer Five months noticed that the fIle DINKEYDOS on other non-disk) protection should 4. Make the following sector edits: ago and was last seen at Reesdice. boot side of OMEGA and the other be handledthe sameasdiskprotec­ Ids ~.6lt1e. fmm. 12 .Your mission, should you decide to programs seems wholly responsible for tion. the readers overwhelmingly $X) ~F $71 />F DE accept it, is to booting the program? It doesn't even responded "YES". So any kind of $7A 08 M seek and destroy this ship. utilize any other SYSTEM-type files protection makes software eligible $34 4A EA You are cautioned that only Military (Le. BASIC.SYSTEM, etc.). for the most wanted list..RDEXed $36 SA OS lasers will ® I hope that someone out there can I myself even with the password 5. Write the sector back to the disk. penetratethe new shields and thatthe provid~a detailed breakdownofthe file checkshavefinished all Wizardry's with Constrictor is DIN"KEYbOS before I strain my brain no cheat disks or editing. I am now Zarro FL fitted with an E.C.M. system. trying. awaiting an Apple lIe or IIc version of Good luck, Commander." To Ross A. Holmes: In answer to Wizardry: Bainofthe CosmicForge. As Questions & Answers I'd be glad to help indiscovering the your query in COMPUTIST #75, con- ofJanuary, SirTechthe makers ofWiz­ To E.N. Hondrick: Thanks for your secret to attaining Elite status, so please cerningthat"program"LittleComputer . ardry said that only a MSDOS version send in any ideas you've got on how to informationpublished in COMPUTIST People by Activision. I first saw this will be out. APT #77. However, concerning FrEdwriter, organize some sort of collection program way back in 1983, and it is Outrageous! First ORIGIN made the please be aware that I was not attempt­ for Elite. really just a silly little demonstration mistake of not making an Apple IIc or ingto sell copiesofthe program, nordid To Jeff Hurlburt: Thanks for your program in which the authors wished to lIe version of Ultima VI: The False I wish to make a dishonest profit - I'm tips on Elite within COMPUTIST #76. personnify the bytes within yourApple, Prophet. This disappointed a lot ofAp­ well aware that the program is 'Free­ After reading through them, though, I and have you watch them "live". It's pieowners whoboughtallormostofthe ware'; I merely used the term 'public still have a couple ofquestions to ask of somewhat similar to watching guppies Ultima series, awaiting more, just to domain' in a very general fashion. Be­ you; First off, I know that to complete in an aquarium, but it's a lot less inter- then be left in the cold by the company lieve me, I know how some programs the first mission for the Navy, I have to esting. they supported. Now SirTechlookslike which end up in public domain can seek and destroy the Constrictor. Could ToEdison: I know UltimaIIIlike the they are doing the same thing. appear under several different authors, you tell me inwhichgalaxies the planets back of my hand, so either contact me Somehow let us Apple owners make each asking for a fee as if the program Xeer Five and Reesdice are, and if you through the RDEXed, orsend a letter to them (the companies) acknowledge the were Shareware. can, could you tell me their general COMPUTIST, and I'll answer as soon Apple computer is alive and well and Asto yourofferofthatEPROMburn­ location within the galaxy on the galac­ as possible. existing on the planet Earth, not some er, thanks, butlately I've been trying to tic starmap? Also, could you give the distant world, as companies now seem raise some cash to get an IBM clone general location of Errius in galaxy 2? to think. Let's see more Apple IIc, lIe (GASP!), a situation whichissomewhat I'd really appreciate your help on this. Steven Kalynuik Canada programs in the future. complicatedbythe fact thatI don'twish And by the way, your poem in COM­ First, I would like to thank the read­ to sell my Apple lIe, not to mention my PUTIST#.76 was great -maybe abiteon er's ofCOMPUTIST who came to my current financial situation. However, that citric deluge will tell lame software aid in request ofthe programs COpyA IBM RDEX IBM RDEX even if!did have the money, I'm sorry, producers to get going on some better and DISK MUNCHER. butI'dstillhave to sayno, becausethere stuff! Howevermyrequestlistwasnotcom­ Don Westcott CO havebeensome ads I'velooked through ToGroucho: I enjoyed reading your pletely fulfilled as I still require the recentlyofferingburners (withdocs)for tipsforWastelandinCOMPUTIST#75. following programs: I recently boughta DTK 386SXIBM less than $50. Thanks anyway, though. There's just one part of the game I'm DOS TOOL KIT verl.O backside by compatible computer so I could play ToBobIgo: Thanksfor yourinquiry stuck on, so I'll take up your offer and Apple Computer (my HRCG, someoftheseMS-DOSgamesthataren't in COMPUTIST #76. It's been awhile, ask for some advice. RLOAD, RBOOT don't work) being released for APPLE. but if I remember correctly, I got a AfterwastingFinsteratDarwinBase, WIZARD'S WORKBENCH I or II ®Oneofmy favorites is SIM CITY DANGEROUS rating onElitethequick I salvaged his head and had my charac­ WIZI-SCOUT by MAXIS. I tried the softkey for SIM and hard way; I traded illicit goods in ter with Cyborg skill install it in the WIZI-DOC CITYonpage 22 ofCOMPUTIST #74. UsingPCTOOLS I found thebytestring Anarchic and Feudal worlds, and de­ mindlink. I thenhad this samecharacter Allthe "WIZ" programs are from the and made the alterationbutwhen I ran it stroyed any pirates that got in my way. don the helmet and enterwhat I assume now nonexistentcompanyofMagicsoft I was still asked for information from Afterdoing this for a long, LONG time, to be Finster's perverted brain. I easily who ripped my off as they cashed a the unreadable chart. Does anyone have I eventually got DANGEROUS status. made it past the first, second, and third money order for WIZARD'S WORK­ another softkey for SIM CITY I could It seems that the number of ships you rooms, butIfmd myselfhopelesslystuck BENCHIIand neversent it, ontrying to try? need to reach the next combat rating is inthe fourth, sincetheunrulyfloorkeeps contactthem I found outthat on the day

COMPUnST #80 Readers Data Exchange 21 ® Another one that I like is SIER­ 1943:6OC7 E89FA3 CALL 0469 Get answer for 1943:6129 032E9210 ADD BP,[1092) BP + W RA's new STELLAR 7. It plays very question Index 20. Exit debug. similarlyto the old APPLE game but the 1943:6OCA 83C4OC ADD SP,+OC 1943:612036 SS: Q graphics are much better and it has no 1943:6OCD 33C0 XOR AX,AX 1943:612E 885604 MOV [BP·2C),DL Move to 21. Rename the file WELLTRIS to copy-protection! I also like STORMO­ 1943:6OCF A3941 0 MOV [l094],AX ours, theirs WELLTRIS.EXE VIK from ELECfRONIC ARTS but it 1943:6002 A3921 0 MOV [1092],AX 1943:6131 3E OS: REN WELLTRIS WELLTRIS.EXE has a tedious manual check protection. 1943:6005 EB42 JMP 6119 Verily answer 1943:61322B2E9210 SUB BP,[1092) Bp· That concludes the crack for Welltris You have to look up the Englishtransla­ At this point, I NOP'ed out the calls Index (dated 10-3-89). I hope the above article tion ofa Russian word. I hope someone to the screen routines, and started down 1943:6136 C3 RET has been helpful to those who are aspir­ has a sofikey for this. the merry path ofexamining the verifi­ Finally, we need to replace the com­ ing IBM crackers. My IBM Most Wanted List cationroutine. Afterinvestigation (trac­ pare on line 6109 with a CALL to our Ace of Aces Accolade ing), it became obvious that the code routine, and replace the FF on line 6110 IBM Softkey for... Battle Chess II Interplay does not ever verify the complete an­ (bad flag) with 00 (good flag), and NOP Serve and Volley swer, but only the first four characters the exiting calls to the graphics that clear Colony, The Mindscape Accolade Heat Wave Accolade (lazy programmers!). This fact howev­ out the message box (CALL 7963 on Serve and Volley (S&V) by Acco­ Sim City Maxis er doesn't help our effort to crack this line 62C1 - Not shown) and display lade is a very fun game tennis simula­ Stonnovik Electronic Arts one. At 1943:6119, the code checks its "That is correct" (CALL 3F4B on line tion. The protection used involved self­ Tower Toppler U.S. Gold index variable ([1092)) for the value 4 62EB - Not shown). (as noted above), and ifthe index is less modifying code that turns nonnal Inter­ Wayne Gretzky Hockey 2 Bethesda Step by Step than that, itjumps to 60DO (thm 6007). rupt 21 's (Dos service calls) into fero­ Following the code here revealed that Note: Thefollowing steps are provid­ cious Iflterrupt 13's (disk drive service Marc Batchelor FL the location of the user entered answer ed for the "non-debug literate". For calls). When started up from a hard could be obtained through subtracting those ofus who are, remember the days drive (or a copy for that matter), a rou­ IBM Softkey for... 2C from the byte pointer (BP) + the when you asked: "What's a debug?" tine in the main program perfonns a Welltris index number ([ 1092)), and that the ex­ We have to givethe beginners anoppor­ search ofall drives for the 'key' disk. If this disk is not found, it jumps directly Spectrum Holobyte pected answer is loaded byte by byte tunity to liberate their software as well. into demo mode. WhenI read the crackfor this piece of into the DX register. Also, the code sets 1. Rename and copy the a pass flag ([BP-17]) to FFifanyone of WELLTRIS.EXE file: Tracingthe codeusingTurboDebug­ software inComputistnumber74 (Mike ger (Borland Software) was very easy Basford), I decided to try it out since I the 4 characters expected do not match COPY WELLTRIS.EXE WELLTRIS.BAK the answer provided by the user. That RENAME WELLTRIS.EXE WELLTRIS since there were no "funky" far returns happened to be attempting to crack it (RETF) and very little messing with the chunk ofcode is listed as follows: 2. Fire up DEBUG and prepare to make myself. His crack DID allow you to get stack. I found the entry point to the 1943:60EA 8D5ED4 LEA BX,[BP-2C) WRITE some modifications: past the opening screen without ever program around $B53 (hex OB53). Fol­ asking for name of some city from the THISOOWN DEBUG WELLTRIS 1943:60ED031E9410 ADD BX,[l094) lowing this chunk ofcode led to a CALL stupid manual. However, the crack (on 3. Search for the CALL 38E3 (Line 1943:60F1 36 SS: 9053 (E8 DO 84). After tracing this my version) was bad in that the vertical 603A shown above) code (very messy!), I found that it mod­ 1943:60F2 SA07 MOV AL,[BX] lines on the pit(forlack ofa betterterm) SO FFFF E8 A6 D8 ified the INT 21 's to INT 13's, read disappeared. Without these lines, it is ." 4. The system will respond with: several sectors off the drive (for no CALL A262Don't know very difficult to know where the pieces 1943:60F7 E86841 xxxx:yyyy apparent reason), and returned with the purpose?! are going to fall. So, I continued withmy AX register zero'd out. Upon return 1943:60FA 44 INC SP Issue the following debug command: crack. from the routine, the AX register is 1943:60FB 44 INC SP Eyyyy 90 90 90 tested for zero, and ifit is zero, hex 0000 Where is it? 5. Searchforthe CALL7963 (Line6077 is stored at a memory location ([203A)). Tracing the code through its opening shown above) 1943:6103 26 ES: The solutionis a 3 byte fix. Instead of screen was indeed fun, having to deal SO FFFF E8 E918 1943:6104 8A5702 MOV DL,[BX+02) The CALLing 9053, we store 0000 into the with graphics and all. However, using Expected Value 6. Issue the following debug command Borland Software's Turbo Debugger AX register. This passes the protection 1943:61078600 MOV DH,OO (using step 4 as a guide) routine without ever looking for a key made it much easier. I found the call to 1943:6109 3BC2 CMP AX,DX Eyyyy 90 90 90 .theprotection(similarto Mike's)around disk. Compare Ours 7. Search for the CALL 7831 (Line $lB50 (that is Hex 1B50). Following is wnhtheirs 60A3 shown above) Step by Step a listing ofthe surrounding code: 1943:610B 7404 JZ 611111 equal, skip SO FFFF E8 8B 17 1. Copyall files from the original disk to 1943:1B4A 50 PUSH AX bad nag 8. Issue the following debug command you hard drive (or another disk) 1943:1B4B E8FEE5 CALL 0140 1943:6100 C646E9FF MOV BYTE PTR [BP· (using step 4 as a guide) C: 1943:1B4E 44 INC SP 17),FF Set Bad Eyyyy 90 90 90 CD TENNIS 1943:1B4F 44 INC SP 1943:6111 FF069210 INC WORD PTR [1092] 9. Search for the CALL 0469 (Line XCOPY A:*.* 1943:1850 E86942 CALL 5DBC Call to 1943:6115 FF069410 INC WORD PTR (1094] 60C7 shown above) 2. Rename TENNIS.EXE to TENNIS Protection 1943:6119833E921004 CMPWORDPTR SO FFFF E8 9F A3 so that we can modify it with DE­ 1943:1B53 E8BD15 CALL 3113 [1092],+04 10. Issue the following debug command BUG. 1943:1856 E99FOO JMP 1BF8 1943:611E7CB7 JL 6007 REN TENNIS.EXE TENNIS Mike's crack invo1voo NOPing the 1943:6120807EE900 CMP BYTE PTR [BP· (using step 4 as a guide) 3) Start up DEBUG and specify TEN- call to the protection. However, in my 17),00 Check Eyyyy 90 90 90 NIS as the me to modify. version, the "protection" routine also Flag 11. Search for the check routine (Line DEBUG TENNIS sets up some things (or calls some rou­ 1943:61247503 JNZ 6129 Failure 6107 shown above) tines) that are responsible for the draw­ 1943:6126 E90201 JMP 622BMust be ok, SO FFFF 3B C2 7404 C6 46 39 FF 4) Search for the bytes to change. ing of the vertical lines. continue. 12. Issue the following debug command: SO 1000 E8 DD 84 Diving right into the thick ofthings, 1943:6129 33CO XOR AX,AX Start Eyyyy E81D 00 90 C646 E800 5) DEBUG will respond with the ad­ I listed out the code at 5DBC until I Failure routine. 13. Search for the fail routine (line 6129 dress of the bytes to change in the came across the following code: WhenI sawthe above code, I thought shown above) form of: xxxx:yyyy 1943:6034 E896DE CALL 3ECD that this would be as simple as flipping SO FFFF 33 CO 50 B81E 00 50 A1 1943:603783C408 ADD SP,+08 the FF on line 6010 to a 00, and letting 14. The system will respond: 6) Edit the provided address as follows: 1943:603A E8A6D8 CALL 38E3Copy 'er rip. However, trying this approach xxxx:yyyy EXXXX:YYYY B8 00 00 protection screen results in some message at the top ofthe xxxx:zzzz 7) Write the software back out. 1943:6030 C646ED02 MOV BYTE PTR [BP· screen (something like "Escape Code W Issue the following ~ebug command: 13),02 OxOF7") and then an abnonnal tennina­ Eyyyy 03 2E 9210 36 88 56 D4 3E 2B 2E 8) Exit DEBUG tion. So, I was forced to patch in some 9210 C3 Q 1943:6073 FFB71A03 PUSH [BX+031A] code that copies the expected answer to 9) Rename TENNIS back to 1943:60n E8E918 CALL 7963 Clear box for the location of the actual answer. The 15. Search for the CALL 7963 SO FFFF E8 9F 16 TENNIS.EXE input only relevant question left to answer is REN TENNIS TENNIS.EXE 1943:607A 83C4OA ADD SP,+OA where to put such a routine. Aftermuch 16. Issue the following debug command: That's all folks. needless deliberation, it came to me... Eyyyy 90 90 90 1943:60A25O PUSH AX why don't we use 6129 since it won't 17. Search for the CALL 3F4B Marc sentmore material than is 1943:6OA3 E88B17 CALL 7831 Clear box for ever be used again (we won't be failing SO FFFF E8 5D DC printed here. I bumped the rest to message the check again). This turns out to work 18. Issuethe following debug command: issue #81. Sorry Marc....RDEXed 1943:6OA683C406 ADD SP,f06 perfectly. The code that does justthat is Eyyyy 90 90 90 one ofthe data epilogue bytes makes listed below: 19. Write out all the changes with the it impossible to catalogue a protected 1943:60C6 50 PUSH AX following debug command: disk) that several ofthe files come up as

22 Readers Data Exchange COMPunST #80 TRADE YOUR APPLE SOFTWARE 80 Colony, The Mindscape 68 Rails West SSI unClassifieds Send your list of programs to trade. I have over 68 Comics Accolade 63 Renegade Taito 120 originals to trade. 63 Cosmic Relief Datasol! How to place an UnClassified Ad 67 Rescue Raiders Sir Tech Byron Blystone 65 Crime &Punishment Imagic 67 Rings of Satum - Level 10 1 Send a typed sample copy with appropriate POBox 1313 69 Crossword Magic v4.0 1 63 Rocket Ranger (I/gs) Cinemaware instructions. (If possible, send text on a 5.25" Snohomish, WA 98290 Apple format disk.) Use up to 40 characters per 69 Cybemation : Nexa Corp. 69 Roundabout Datamost line, we will adjust word wrap. 74 Decimal Dungeon Unicorn 75 Russki Duck SOftsmith Special Graphics Instructions: The first BOOK SALE three words ofthe rustline are printed in bold for 74 Decisions Decisions: Colonization v1.0 63 S.D.I. (1Igs) Cinemaware free. If you want other words bolded, use 5 Keys to Solving Computer Adventure Games. . Tom Snyder Productions 62 Sea Stalker Broderbund Maps, hints, clues, & some solutions. Black characters less perline. Use 10 characters less per 69 Delta Squadron Nexa Corp. 67 Serpentine Broderbund line if you have a lot of uppercase bold letters. Cauldron, Kings QuestII, Leather Goddesses, & Bold letters are wider than normal. If the typed more. 26 games for Apple & others. 67 Desecration Mind Games 74 Seven Cities of Gold Electronic Arts copy does not show bold, circle the words you M.K. Simon 286 pgs 66 Disk Optimizer System Nibble Notch 68 Skeletal System Brainbank want bolded and, on the side, write BOLD. Ifyou Prentice Hall $15.00 65 Dondra Spectrum Holobyte 63 Sky Shark Taito want aline centered, write CENTERnext to that Keys to Solving Computer Adventure Games, 69 Dragon Eye El7fx 80 Sim City Maxis line. There is no charge for centering any line. Book II. Maps, hints, clues, & some solutions. You must check your ad for errors, the first 69 Dueling Digits Broderbund 63 Sound Song & Vision Advanced Software fudianaJones, Gunslinger, Hollywood Hi-Jinx time it runs. Errors on our part will be corrected, 68 D&D-Master Assistant vol2 SSI 67 Space Ark Datamost & more. 13 games for Apple & others. then, for free. Errors or changes onyour part will 62 DROL Broderbund 62 Spare Change Broderbund be charged a $5 processing fee. M.K. Simon 292 pgs Prentice Hall $15.00 67 Epoch Sirius 67 Spectre Datamost Add $2.50 for postage & Insurance 74 Exploring Tables &Graphs Level 2 (SU) 62 Speedy Spides Readers Digest **** New Rates (per line) **** Computist club member 25¢ Software - Books - Magazines ...... Weekly Reader 67 Star Cruiser Sirius All others 35¢ Webuy &seliout-of-print&hard-to-findApple II 67 Evolution Sydney 67 Star Maze Sir Tech The minimum order Is $5. originals, old and new. Send $1 for catalog. 67 Falcons Piccadilly 63 StickyBear Math: Add &SubtractOptimum Resources Frank Polosky 68 Factastics Trivia Daystar 68 Stickybear GS Versions 3.5 Xerox oOurliability for errors or omissions is limited to PO Box 9542 75 Final Frontier Softsmith 80 Stormovik Electronic Arts the cost of the ad Pgh, PA 15223 oWe reserve the right to refuse any ad. 73 Fisher's Cove Tom Snyder Productions 67 Succession Piccadilly oWashington state residents add 7.8% sales tax. 69 Fit Wars Sirius 65 Superstar Ice Hockey Mindscape oSend a check or money order (fmlds ~awn on 74 Fraction Action Unicorn 61 Superstar Indoor Spor1S Mindscape US bank only) for the entire amount to: RDEX 69 Gemstone Healer SSI 74 Surveys Unlimited Mindscape 73 Geometric Supposer (the) Sunburst 68 Talking Text Writer GS Scholastic COMPUTIST unCLASSIFIEDS 33821 East OrvlIIe Road Contributors: 66 GEOS Berkley Softworks 68 Tangled Tales ., Origin Systems Eatonville, WA 98328 72 Galactic Gladiators SSI 69 Tetris (lie) Spectrum HoIobyte Safaa Abdulla 15 63 Gladiator Taito 72 Theatre Europe PBI Big A1 8 73 Goodell Diamond Caper Tom Snyder Productions 74 The Other Side v2.0 Tom Snyder Productions BOOK and MAGAZINE SALE!!! Back issue of 2600 (1985-90) $2 each. A+ Marc Batchelor 22 67 Gorgon Sirius 65 Thunder Chopper 1 (1984-86,89) $1, Apple Assembly Line (1980­ John C. De La Cruz 19 66 GradeBuster 123 Grade Buster 63 Ticket to Washington D.C Blue Lion Software 88) $2, Apple Orchard (1983-84) $1, Apple William Degelmann 16 61 Gutenberg Sr Micromation LTO. 74 Time Explorers Gameco Software Protection Digest vI $1, Bootlegger Nonnan Dodge 8 65 Halls of Montezuma Electronic Arts 74 Time Liner v1.1 Tom Snyder Productions (vl-7) $3, Byte (1977-91) $2.50, Call AP­ Bob Feigenblatt 8 80 Heat Wave Accolade 63 Tomahawk Electronic Arts PLE(1982, 85-87) $1.50, Circuit Cellar Ink (1989-90) $1.75, COMPUTE! (1981, 85,86) David R. Hopkins 7 67 High Orbit Softsmith 68 Tomahawk (I/gs) Datasol! $1.25, COMPUTE! Apple Applications (1988) Jeff Hurlburt .4 67 Horizon V SOftsmith 80 Tower Toppler U.S. Gold $1.25, Computist (4-80) $2.50, Creative Com­ Steven Kalynuik 21 75 Hunt for Red October GS Datasol! 69 Track Attack Broderbund puting (1981-85) $1, InCider (1983-88) $1.25, Kilroy 16 69 Impossible Mission El7fx 68 Triad Thunder Mountain Journal of Computer Game Design (1989­ Jay Kitaguchi 15 62 Indoor Spor1S Mindscape 72 Triango (I/gs) CaIifomia Dreams 91)$3.25, Micro Adventurer (1984-85) $1, Nib­ ble(1981-84)$1.50, 0pen-Apple(l985-87).75, Krakowicz 17 68 Infocom ics Infocom 68 Trinity Infocom Softalk (1981-84) $1.50. Orders $20 or over, Carl D. Purdy 16 66 Jane 1 73 Unicorn 5.25" software Unicom take 25% off. $50 or over take 50% off, except Brian A. Troha 15 63 Joker Poker Mindscape 73 Vincent's Museum Tom Snyder Productions for AAL, 2600 & Computist, to which book Terry Waskowich 8, 15 72 Kabul Sp;,.. Sirius 68 Volcanoes v1.8 Earthware Comp. Services discount applies. Don Westcott 21 71 Keyboarding Klass Mastery Developement 66 War in the Middle Earth Melboume .Books: 75 King's Bounty New World ComputingiBroderbund 80 Wayne Gretzky Hockey 2 Bethesda Apple Reference Manual 1980 (worn) $9 Zorro 21 DOS 3.3 Reference Manual $7 68 Kingdom of Facts Santa BarbaralThunder Mountain 67 Wayout Sirius Apple Pascal ReferenceManual $18 75 Kobayashi Alternative (The) Simon &Schuster 63 Wings of Fury Broderbund Apple Pascal Operating Sys Manual $8 72 Lane Mastodon Infocom 63 Wizardry:Retum of Werda Sir·Tech. Beneath Apple ProDOS $15 67 Lancaster SVS 68 Word Attack Plus (1Igs) Davidson Call APPLE: All About Pascal $12~ Most Peeking at Call APPLE v21979 $13 72 Laser Force (1Igs) Britannica 65 Works (the) First Star Software Peeking at Call APPLE v3 1980 $17 75 LA Land Monopoly SOftsmith 67 Zenith SOftsmith Best ofCreative Computing v2 1976 $12 Wanted 66 Legacy of the Ancients Electronic Arts mM Most Wanted Best ofCreative Computing v3 1977 $9 65 Lost Tomb Datasol! 80 ke AI;es Best ofMICRO v2 1978-79 $9 of Accolade 74 Mammals· Reptiles &Amphibians Focus Media 75 Empire Intersil Best ofMIRCO v3 1979-80 $11 65 Airheart Broderbund 65 Manhunter New York IIgs Sierra On Une 72 GBA Championship Football Electronic Arts Open Apple: vol 1 1985 $9 63 Alcon Taito 68 Graphitti George Best Phillips Academy Apple Machine Language, by Inman $7 65 Mavis Beacon Teaches Typing (gs) Software Author's Guide 1983 $~ 74 Algebra Shop Scholastic ...... SOltware Toolworks 61 Gunship MiClOprose More BASIC Computer Games $6 63 Alien Mind PSI Software 73 McGraw-Hili ProbIem·SOlving Lvl5&6 Tom Snyder 63 Heros of the Lance SSI Apple II Users' Guide 1981 (385p) $7 73 American History Explorer Series Mindscape 74 Micro-Typewriter v3.1/4.0 S.E. Warner 72 Kings Quest III Sierra Apple Writers Minute Manual, II+ & lIe $8 75 Anchorman Virginia Reel 67 Microwave Cavalier 72 Operation Wolf Taito Proceedings ofthe 1990 & 1991 Computer 74 Animals of the Past Focus Medie 72 Radio Baseball Electronic Arts Game Developers' Conference $20 66 Might and Magic 11.. Activision ffiM VM/SP manuals, many titles inquire 72 Ankh Datamost 73 Mind Castle I MCE Inc. 73 Ant Farm Sunburst Onbook orders of$n, take (nlI0)% off. Include 69 Minotaur Sirius 67 Aquatron Sierra 70¢ permagazine and $2 per book for postage. I 63 Modern MGR MGR Software will refmld excess orbill amount due. Minimum 69 Axis Assassin 1 68 Mr. Pixel's Cartoon Kit. MindscapelThunder Mountain order of$10. 63 Bad Street Brawler Mindscape 73 Mystery of Hotel Victoria Tom Snyder Productions PhUGoetz 73 Bank Street Beginner's Filer Sunburst 63 National Inspirer Tom Snyder Productions 4023 Huckleberry Row 73 Bank Street School Filer Sunburst EUicott City, MD 21043 75 Neptune SOftsmith 80 Battle Chess II Interplay 66 Observatory (The) MindscapeA.ightspeed Software 63 Beyond Zork Infocom 74 Ocean Ufe Focus Media Wanted 65 Bilestoad Datamost 66 Odin Odessta Most Wanted List Software 69 Blue Powder - Grey Smoke Grade 63 Operation Wolf Taito ? Need assistance to deprotect a disk? 74 Birds -Trees &Flowers Focus Media 68 Pensate DatasoftlSol!disk Softkey hobbist is interested in acquiring copy 63 Border Zone Infocom 69 Phantasie 1/ SSI protected software to deprotect. Good track 65 Borg Sirius record, many successful attempts. Original disk 67 Phantoms 5 Sirius 67 Bouncing Kamungas PengUin will be returned along with Softkey for Comput­ 67 Pig Pen Datamost ist Especially interested in older software (pre­ 66 Boxing 1 74 Plans &Animals of the Desert Focus Media 1988) but will give any disk a shot System: 65 Bureaucracy Infocom 75 Prince of Persia (5.25j Broderbund Apple 11+, 64K. Send disk to: 67 C'est La Vie Adventure International 67 Project: Space Station Avantage Rich Etarlp 69 Caverns of Callisto Origin 75 Promethean Prophecy (The) Simon &Schuster 824 WIUlam Charles, Apt #2 69 Checker Odesta Green Bay, WI 54304 67 Pulsar II Sirius 69 Chess 7.0 Odesta 68 Pure Stat Basketball ; 1 F~ 69 Chuck Yeager's Adv Trainer Electronic Arts 62 Quadratic Equations II Olympus Educational Software 75 Clue Master Deleclive Leisure Genius 63 Questron 1/ 8ectronic Arts

COMPunST180 Reader. Data Exchange 23 72 Features, Notes and such: The Prod­ tion -Fractions -Freddy's Puzzling Adven­ ·Laser Force ·Math Blaster Mystery -The ·Wasteland ·Who Framed Roger Rabbit uctMonitor-A Bugin PrenticeHallScience tures -Frogger -Galaxy Math Games -Gal­ Huntfor Red October ·APTs: Anti Gravity •WingsOfFury ·IBMSoftkeys: 688Attack Courseware ·A note on Stickybear encrypt­ axy Search -Garfield Companion ·Garfield ·Autoduel·Bard's Tale II ·Chrono Warrior Sub ·Battle Chess -Battle Hawks 1942 ed sector ·An accelerated lIe & EDD 4 Trivia ·Geometry (GS) ·Ghostbusters -Commando·DemonicDecks·Neuromanc­ ·Chuck Yeager's Advanced Flight Simula­ -Finding the licencee's name in GEOS -A ·Gnarly Golf (GS) ·Gnee or Not Gnee er·PoolofRadiance-Tetris·TheBardsTale tor v1.0 ·Shinobi ·IBM Feature & Notes: BUGin Teacher's Tool KitSeries -Areader ·Grammar Examiner -Graphics Studio III -Track & Field·Victory Road·Xevious Bug in APT for Zany Golf·Cracking on the review ofthe Trac Card -An Explanation of ·Guiness World Records -Homeworker ·zany Golf ·Playing Tips: Bard's Tale II IBMpc· Self-syncBytes·AnotherreasonwhyCook­ •Houghton Mifflin Math Courseware •Ice -Bard's Tale III ·Defender ·Defender Of and much more••• book Cracks might not work -BBS News Demons -Ivitation to Math series -Kid Niki TheCrown(IIGS) -LeisureSuitLarry·Moe­ Fora complete back issuelist, senda 75¢ -Beginners Guide to"PACMAN" deprotec­ -King ofChicago -Kittens, Kids, anda Frog bius -Pool of Radiance ·Print Shop Com­ stamp to Computist. tion. -Bogus 18 sector disks? -Bug in Type! -L.A.Crackdown-LanguageCamival-Mag- panion ·Robocop ·Tower of Myraglen softkey -Bugs in Pool ofRadiance -Chang­ ic Slate II -Magic Word -Master Match ing levels onTetris (lIe) -Cheats, Hints, and •Math And Me -Math Blaster·Math Blaster Tips for Neuromancer -Comments & possi­ Plus •Math for Everyday Living·Math in a ble help to other readers -Comments on Nutshell ·Math Masters ·Math Tutor (per­ IBM Ragging -Converting Print Magic cents -Mathematics Skills -Mavis Beacon Special Software Sale Graphics to Publish It! -Copy Protecting Teaches Typing (lIe) ·McGrawHill Comp­ Your Own Disks with ProDOS -Determin­ ucat Quizware -Memory Castle -Meteor Only $10 each (while they last) ing when individual files can be removed Multiplication -Microzine #3 ·Microzine from a Protected Disk -OOS 3.3P (for pro­ #8·Microzine#9-Microzine#lO·Microzine tected) -Enhancing OOS 3.3 -FIND.CAT #11 ·Microzine #12 -Microzine #13 ·Mi­ ThesesoftwarepackagesareNEW Victory Road, Ikari Warriors II Enhancement -Half & quarter Tracks -In­ crozine# 15 •Microzine# 16 •Microzine#22 (shrink-wrapped except for the one Data East stalling GSIOS on Sierra 3D Adventures •Microzine #23 •Microzines and Microzine copy of Sound Master that I opened (Apple He, c, gs, 128K required) $10.00 -Lifting the Lid on COpyA -Making Jack Jr. ·Mixed Numbers -Moptown Hotel·Mr. in order to find out what it was). Nicklaus Greatest 18 Holes of Champion­ and Mrs. Patatohead ·Mr. Pixel's Program­ Your heroes from Ikari Warriors are back. shipGolfplayfaster -Moving DestroyerGS ming Paint Set ·Mystery Matter ·Mystery They're software packages that And this time, they're up against the monstrous (Epyx) to Hard Disk -Note on '84 & '85 Objects -Numbers ·Opposite -Organic someone ordered and then canceled Stonehead and his army of bizarre, inhuman MECC disks -Notesonprogramspublished Chemistry·Pacman·PeanutsMathMatcher and we were unable to return. creatures! Make your way through a desolate landscape, as hordes ofbloodthirslyGreenGrem­ by Micrograms -Notes on Time Out and -Percentages ·Perplexing Puzzles ·Pick the SubLogic Scenery Disk 2 lins, Winged Man-beasts and enormous Worm­ Appleworks 2.1 -Notes on Ultima IV and V Numbers-PicturePerfect-Piratesl GS ·Pix­ snakes threaten to overwhelm you. Do you have -Printin Colorwith Appleworks -PutAuto­ elwerks -Platoon -Police Quest -Pool of (Phoenix, Albquerque & EI Paso) the courage to travel the Victory Road? duel on a 3.5" diskette -Reading From Pro­ Radiance ·Quest Strategy Checker ·Rain­ SubLogic tected ProOOS Disks -Removing the Man­ bow Painter·Ratios & Propotions •Read 'N Murder Party ual Checkfrom Piratesl GS -Running other Roll 1.1 -Read-Write-Publish -Reading (All Apple H's) $10.00 Electronic Arts programs from your Hard Disk -Super 6.0 Comprehension -Robomath -Sailing Foruse with Jet and/or Right Simulatorv2.0. FastcopyA -Fun with Super6.0 FastcopyA ThroughStoryProblems·ScuffyandFriends Each scenery disk covers a geographical region (Apple H+,e,c) $10.00 -Turn Dig Dug into aBRUNableFile-Ulti­ ·Sensible Speller (ProOOS) ·Sierra Pr0­ ofthe country and includes major airports, radio­ Choose from two mysteries and personalize mapper V: a mapping program -Softkeys: grams-SiliconDreams·SOKO-BAN·Solv­ nav aids, cities, highways, rivers and lakes locat­ the characters to fit your players. Each time it's Addition &Subtraction -Aesop'sFables lIe ing Quadratic Equations ·Spelling Bee ed in that region. Enough detail is available for a different "party", so you won't be bored when either visual or intrwnental cross-country navi­ -Algebra I-Algebra2 -Algebra3 -Alphabet ·Spelltronics ·Spy's Adventure in South you play again and again and again... gation. -An Introduction to General Chemistry America ·SquarePairs ·StarTrek ·Stickers SoundQuest CZ Master -APBA Major League Players Baseball ·Study for Success -Success With Typing Print Quick -Arkanoid -Arkanoid II:The Revenge of Sound Quest In ·Super Print ·Tales of Fantasy ·Talking Third Wave Technology Inc OOH (GS) -Balance -Balance of Power Stickybear Opposites ·Talking Text Writer (Commodore Amiga) $10.00 1990 v. 2.08 -Biosolve -Bubble Ghost (GS) ·Teasers by Tobbs ·Test Drive II: The Duel (All Apple II's) $10.00 For use with the Casio CZ-I0l, CZ-l000, -Building memory Skills -Calendar Crafter (lIgs) -Test Taking Made Easy -The Boars Print Quick puts your most needed printer CZ-3000, CZ-5000 and other compatable syn­ v1.2 -CBS's Pathwords -Charlie Brown's Store ... ·TheBoarsTellTime·TheDuel:Test support programs on one disk. Quick Setup to thesizers. Included are file management and 1,2,3's -Chessmaster21 00 v1.1 -Children's Drive II ·The Game Show ·The Games: put the control ofall printfeatures at your finger­ bank editing features, patch mixing and random Writing & Publishing Center ·Conquering Winter Edition ·The Wonderful World of tips. Quick Typer to turns your printer into an voice generation features. Compose and mix Decimals ... and 1-Conquering Decimals + Paws·TimeCapsule·TimesofLore·Town­ electronic typewriter by sending text right to the your own music using many of the package and -. -ConqueringFractions; ... andI. -Con­ builder ·Transylvania •VCR Companion printer. Quick Dumper allows you to choose options available. over 30 handy sign phrases or one button Hi-Res queringFractions; + and-. -CoordinateMath •Voyage ofthe Mimi·What makes a Dino­ screen printing. Quick Font allows you to quick­ -D.C.Heath/MB -Dark Lord -DataEast saur sore -Where in the USA is Carmen ly change the shape and style of your printer Send orders to Computist Garnes -Decimal Concepts -Decimal Dis­ SanDiego ·Where in the World is Carmen characters. Text File Utilities will print text files covery -Decimals) -Delta Drawing 3.33 SanDeigo? (GS)·Who,What,Where,When, or display them on screen with all the hidden at the address listed on the -Designasauraus -Dig Dug -Duel (gs) -Ear­ Why ·Whole Number Operations -WISCR command characters revealed. Owner's Manual, Back issue order form below. ly Games -Eliminator -EqUation Math -Es­ Intelligence Test -Wood Car Rally ·Word quick reference card, and detailed Help screens timation -Explora-Classicseries -Explora­ Attack Plus! Spanish ·World Geograph make this a useful print tool. Science Whales -Fraction Concepts -Frac­ -World History Adventure ·Xenocide (GS) tion Practice Unlimited -Fraction Recogni- -Bitkeys: Borg ·Great Western Shootout .------, ;~~ ni::::~ ~ ~:::::~ ~ ~:::::~ ~ ell'i;;iW'F'""<'2\lll!ll!$II;lfle,IiE!~lli[ly<':;';I',l 2 ...... 0 U 24 0 0 48 0 0 72 .0 0 Core2o ~ 25 0 0 49 0 0 73 .0 0 COMPUTIST back issues and Number of back is,sues. 3 0 26 0 0 50 0 0 74 .0 0 library disks are frequently $----- 4 0 27 .0 0 51 .0 0 75 .0 0 referenced in current issues. 5 0 0 28*.. 0 0 52 .0 0 76 00 Number of Zox back issues. $----- 6 0 0 29 0 0 53 .0 0 77 .0 0 Back Issue and Library Disk Rates Core30 0 30 0 0 54 0 0 78 0 0 Number of library Disks. $----- 7 00 31 0 0 55 0 0 79 00 US, Canada All 8 0 32.. 0 0 56 0 0 Quantity & Mexico 21hm Washington state residents add 7.8% tax $----- 9 0 0 33.. 0 0 57.....0 0 Back issues 5 or less $4.75 $8.75 6 t09 $3.75 $6.00 10 0 0 34 0 0 58 0 0 Total enclosed $----- 11.. 0 0 35 0 0 59 .0 0 lO or more $3.00 $5.00 12 0 0 36 0 0 60 0 0 Zox* back issues any qty. $4.75 $8.75 13 0 0 37 0 0 61.. 0 0 Library disks 5 or less $5.50 $7.50 Name 0 _ 14 0 0 38 0 0 62.....0 0 6 t09 $4.00 $6.00 Ad"- _ 15 0 0 39 0 0 63 0 0 10 or more $3.00 S5.OO 16*.. 0 0 40 0 0 64 .0 0 17 0 0 41.. 0 0 65 .0 0 ·Due to the time and effort involved in making Zox 18 0 0 42 0 0 66* 0 0 copies, their price will remain at $4.75 each for US, Canada & Mexico and at $8.75 for all other Foreign. city _0 s-__Zip _ 19*.. 00 43 00 67 0 0 Shipping is included in all the prices shown. 20 0 0 44 0 0 68 0 0 CllWIlry - _

21. 0 0 45 0 0 69 0 0 VISA What's a library disk? MC ______Expo _ 1 A library disk is a 5 /. inch floppy diskette that Some disks apply to more than one issue and are contains programs that would normally have to be typed Si....-. _ shown as taller boxes. in by the user. Documentation for each library disk can • US funds drawn on US bank.• Most orders shipped within 5 working days, be found in the corresponding issue. however please allow up to 4 weeks delivery for some orders.• Large orders are *: Limited supply - frrst-come-first-serve basis. oLibrary disks are available for all issues of shipped UPS so please use astreet address. o Offer good while supply lasts. o Call o Out-of-print_ only "Zeroxed" copies for sale. COMPUflST. (206) 832-3055 to use a credit card or send check/money order to: 1 ~ * Issue 66 is laser printed on 8 / by 11 paper. C For complete back issue list, send a 75¢ stamp to COMPUllST 33821 E Orville Road Eatonville WA 98328 L.------2 ompww. ..J 24 Readers Data Exchange COMPUllST #80