1194 lines
50 KiB
Plaintext
1194 lines
50 KiB
Plaintext
|
EXAMINING PROTECTED APPLESOFT BASIC PROGRAMS.
|
|||
|
|
BY THE DISK JOCKEY.
|
|||
|
|
|
|||
|
|
Many protected programs are written in APPLESOFT. Of course, most publishers
|
|||
|
|
are sly enough to protect against break ing out of their program with CTRL C or
|
|||
|
|
reset. Also, most protect against re-entering BASIC from the monitor by
|
|||
|
|
changing the typical BASIC re-entry poi nt (at $3D0) so that it points to
|
|||
|
|
disaster. And lastly, many change the R UN flag vector at $D6 so if you manage
|
|||
|
|
to get out of their program and into BA SIC, anything you type will RUN their
|
|||
|
|
BASIC program. I will describe how to b eat all these protection schemes,
|
|||
|
|
assuming you have an old style F8 monit or ROM.
|
|||
|
|
|
|||
|
|
First, we must determine if the protect ed program is written in APPLESOFT.
|
|||
|
|
If after you boot the progra m a BASIC prompt appears, this is a good indicator
|
|||
|
|
that at least some of the program is written in BASIC. Further more, if the
|
|||
|
|
program prints a l ot of text on the screen, or requires a good deal of user
|
|||
|
|
inputs, it is a goo d guess that the program is written in BASIC. The reason
|
|||
|
|
for this is that p rinting text on the screen and inputing data from the
|
|||
|
|
keyboard is easi ly accomplished from BASIC using PRINT and INPUT statements.
|
|||
|
|
To do this from ASSEMBLY language requires a great deal more work. Also, we
|
|||
|
|
should relieze why a programmer uses ASSEMBLY language. The only real advantage
|
|||
|
|
to AS SEMBLER is speed. If speed is not critical, most (non-sadist) programmers
|
|||
|
|
will use BASIC.
|
|||
|
|
|
|||
|
|
With this in mind, look at how the prog ram runs and prints on the screen. If
|
|||
|
|
it runs at about the same speed as t he BASIC programs you have written run, it
|
|||
|
|
is a good guess that it is in B ASIC. Remember, ASSEMBLY language is
|
|||
|
|
considerably faster than BASIC in every respect.
|
|||
|
|
|
|||
|
|
Finally, read the package the program c ame in. It usually says what it was
|
|||
|
|
written it. If it doesn't, a dead give away is in the hardware requirements.
|
|||
|
|
If the program requires APPLESOFT in RO M, then at least part of the program is
|
|||
|
|
probably written in APPLESOFT.
|
|||
|
|
|
|||
|
|
Now that you have figured out your prot ected program is written in BASIC, it
|
|||
|
|
is time to LIST their code. The firs t step is to reset into the monitor when
|
|||
|
|
the program is running.
|
|||
|
|
|
|||
|
|
Now you can try to enter the immediate BASIC mode by typing:
|
|||
|
|
|
|||
|
|
|
|||
|
|
*3D0G
|
|||
|
|
|
|||
|
|
|
|||
|
|
This is the normal BASIC re-entry point . But if the protection is worth
|
|||
|
|
anything, this will not work.
|
|||
|
|
|
|||
|
|
Assuming that didn't work, reload the p rogram and reset into the monitor
|
|||
|
|
again. The next thing is to try typing 9D84G or 9DBFG. These are the DOS cold
|
|||
|
|
and warm start routines, respectively. If you are lucky enough to get a BASIC
|
|||
|
|
prompt, you have done well. Most of the time, you won't.
|
|||
|
|
|
|||
|
|
If in either case you succeed in gettin g a BASIC prompt, try LISTing the
|
|||
|
|
program or CATALOGing the disk. If anyt hing you type starts the program
|
|||
|
|
running again, the protection has chang ed the RUN flag at $D6. So reset into
|
|||
|
|
the monitor again.
|
|||
|
|
|
|||
|
|
The RUN flag is a zero page location (a t $D6) which will run the BASIC
|
|||
|
|
program in memory if $D6 contains $80 o r greater (128 or greater in decimal).
|
|||
|
|
This is easy to defeat after you have r eset into the monitor by typing:
|
|||
|
|
|
|||
|
|
|
|||
|
|
*D6:00
|
|||
|
|
|
|||
|
|
|
|||
|
|
This resets the RUN flag to normal. Now if 3D0G, 9D84G or 9DBFG previously
|
|||
|
|
rewarded you with a BASIC prompt, this will solve the problem of the program
|
|||
|
|
re-running when you type a command.
|
|||
|
|
|
|||
|
|
For debugging efforts, the RUN flag can get changed from within a BASIC progra
|
|||
|
|
m by issuing the code:
|
|||
|
|
|
|||
|
|
|
|||
|
|
10 POKE 214,255
|
|||
|
|
|
|||
|
|
|
|||
|
|
or by poking location 214 with anything greater than 127. From ASSEMBLY
|
|||
|
|
language, the code would most likely lo ok like this:
|
|||
|
|
|
|||
|
|
800- A9 FF LDA #$FF
|
|||
|
|
802- 85 D6 STA $D6
|
|||
|
|
|
|||
|
|
or by loading a register with $80 or gr eater and storing it at $D6.
|
|||
|
|
|
|||
|
|
Now if 3D0G, 9D84G or 9DBFG did not pro duce a BASIC prompt, then the DOS
|
|||
|
|
being used is more elaborate. So re-loa d the program and reset into the
|
|||
|
|
monitor after it is running.
|
|||
|
|
|
|||
|
|
Now comes the final steps in trying to examine a BASIC program. If you are
|
|||
|
|
using a ROM card in slot zero with an o ld style F8 monitor ROM to reset into
|
|||
|
|
the monitor, turn on the mother board R OMs and turn off the ROM card INTEGER
|
|||
|
|
ROMs by typing:
|
|||
|
|
|
|||
|
|
*C081
|
|||
|
|
|
|||
|
|
Now reset the RUN flag to normal, just to be sure. Type:
|
|||
|
|
|
|||
|
|
*D6:00
|
|||
|
|
|
|||
|
|
Finally, enter APPLESOFT the sure fire way by typing:
|
|||
|
|
|
|||
|
|
*<CTRL C>
|
|||
|
|
|
|||
|
|
You should see an APPLESOFT prompt. Now type:
|
|||
|
|
|
|||
|
|
]LIST
|
|||
|
|
|
|||
|
|
|
|||
|
|
and your APPLESOFT program should now a ppear.
|
|||
|
|
|
|||
|
|
Applying this to a real world example, try this method with one of Strategic
|
|||
|
|
Simulations releases (SSI). SSI uses a highly modified DOS called RDOS for
|
|||
|
|
their protection. SSI uses all the tric ks mentioned to prevent you from
|
|||
|
|
LISTing their programs. But using the a bove procedure, you can LIST their
|
|||
|
|
BASIC programs.
|
|||
|
|
|
|||
|
|
In addition, the DOS used by SSI (RDOS) uses the appersand in all of its DOS
|
|||
|
|
commands. So if you see any ampersands from within their BASIC program, you
|
|||
|
|
know it is a DOS command. For example, to catalog a SSI disk, after you follow
|
|||
|
|
the above procedure and you are in BASI C, type:
|
|||
|
|
|
|||
|
|
|
|||
|
|
]&CAT
|
|||
|
|
|
|||
|
|
|
|||
|
|
This will display SSI's catalog. Very d ifferent, eh!
|
|||
|
|
|
|||
|
|
|
|||
|
|
Well, back at the ranch, if you want to save your APPLESOFT program to a norma
|
|||
|
|
l DOS disk, do these steps:
|
|||
|
|
|
|||
|
|
1) Reset into the monitor after the pro gram is running.
|
|||
|
|
|
|||
|
|
2) If you are using a ROM card in slot zero, Type:
|
|||
|
|
|
|||
|
|
*C081
|
|||
|
|
|
|||
|
|
3) Now type:
|
|||
|
|
|
|||
|
|
*D6:00
|
|||
|
|
*9500<800.8FFM
|
|||
|
|
|
|||
|
|
3) Check where the APPLESOFT program en ds by typing:
|
|||
|
|
|
|||
|
|
*AF.B0
|
|||
|
|
|
|||
|
|
4) Write down the two bytes listed some where.
|
|||
|
|
|
|||
|
|
5) Boot a 48K normal DOS 3.3 slave disk with no HELLO program.
|
|||
|
|
|
|||
|
|
6) Enter the monitor by typing:
|
|||
|
|
|
|||
|
|
|
|||
|
|
]CALL-151
|
|||
|
|
|
|||
|
|
|
|||
|
|
7) Restore the APPLESOFT program by typ ing:
|
|||
|
|
|
|||
|
|
|
|||
|
|
*800<9500.95FFM
|
|||
|
|
*AF: enter the two bytes you wrote down here, separated by spaces.
|
|||
|
|
|
|||
|
|
8) Enter BASIC and save the program by typing:
|
|||
|
|
|
|||
|
|
*3D0G
|
|||
|
|
]SAVE PROGNAME
|
|||
|
|
|
|||
|
|
What you have done is to move $800 to $ 8FF out of the way so you can boot a
|
|||
|
|
slave disk. After normal DOS is up, you restore $800 to $8FF from $9500 to
|
|||
|
|
$95FF, and then restore the end of APPL ESOFT program pointers so DOS knows how
|
|||
|
|
big your BASIC program is. Next you just save it to your disk! Of course there
|
|||
|
|
are other more automated ways of getting programs to a normal DOS 3.3 disk (such
|
|||
|
|
as Demuffin Plus or CopyB), but this is a quick and dirty method that will
|
|||
|
|
always work. Keep in mind tha t the program may not run from normal DOS because
|
|||
|
|
of more secondary pr otection from within the BASIC program itself. Any curious
|
|||
|
|
CALLs, POKE s or PEEKs to memory above 40192 (this is memory where DOS resides)
|
|||
|
|
or b elow 256 (zero page memory) should be examined closely.
|
|||
|
|
|
|||
|
|
I hope this will help you learn more ab out the protected programs you own
|
|||
|
|
that are written in APPLESOFT.
|
|||
|
|
|
|||
|
|
--------------------------------------
|
|||
|
|
|
|||
|
|
COPYB DOCUMENTATION FILE. BY THE DISK JOCKEY.
|
|||
|
|
|
|||
|
|
|
|||
|
|
INTRODUCTION:
|
|||
|
|
|
|||
|
|
There are probably hundreds of ways to protect a program from being copied.
|
|||
|
|
But generally speaking, protection fall s under two categories: protect the
|
|||
|
|
actual program (by various means), or p rotect a disk full of programs with some
|
|||
|
|
sort of DOS modification. DOS modi fications are the most common since they are
|
|||
|
|
the easiest to deal with (from the publisher's point of view). DOS
|
|||
|
|
modifications are also the least succes sful of protection, since someone always
|
|||
|
|
seems to find a way to copy all the files onto a normal DOS disk, eluding all
|
|||
|
|
the protection. The classic program for dealing with modified DOS' s is
|
|||
|
|
DEMUFFIN PLUS. It works much the sam e way as Apple's MUFFIN program works.
|
|||
|
|
MUFFIN was written to read files from a DOS 3.2 disk and then write the m to a
|
|||
|
|
DOS 3.3 disk. DEMUFFIN was a varia tion of MUFFIN, allowing the hardcore 3.2
|
|||
|
|
user to copy files from DO S 3.3 to DOS 3.2. DEMUFFIN PLUS operates on the same
|
|||
|
|
principle, but use s whatever DOS is in memory to read the disk, and then writes
|
|||
|
|
out to an ini tialized DOS 3.3 disk. While this is a powerful utility, it only
|
|||
|
|
works with programs that are based on DOS file structures and that have a
|
|||
|
|
catalog trac k.
|
|||
|
|
|
|||
|
|
|
|||
|
|
INTRODUCING COPYB:
|
|||
|
|
|
|||
|
|
COPYB is a highly modified version of C OPYA which converts a protected disk
|
|||
|
|
that uses a modified DOS and/or RWTS to normal DOS 3.3 format. The protected
|
|||
|
|
disk may have a normal DOS file structu re, or it may not. Since COPYB copies
|
|||
|
|
on a track by track basis, this does not matter. This makes COPYB a far more
|
|||
|
|
flexible tool than DEMUFFIN PLUS.
|
|||
|
|
|
|||
|
|
COPYB uses the protected disk's RWTS to read in the tracks and then uses norma
|
|||
|
|
l DOS 3.3 to write them back out to an in itialized disk. Unless otherwise
|
|||
|
|
instructed, COPYB copies track $03 to t rack $22, sector $0F to sector $00 of
|
|||
|
|
each track. Here are the parameters for COPYB:
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
LOCATION NORMALLY
|
|||
|
|
HEX DEC DESCRIPTION HEX DEC NT.
|
|||
|
|
---------------------------------------
|
|||
|
|
22E 558 FIRST TRACK TO READ 03 03 (1)
|
|||
|
|
236 556 FIRST SECTOR TO READ 0F 15 (2)
|
|||
|
|
365 869 RESET SECTOR NUMBER 0F 15 (2)
|
|||
|
|
3A1 929 STOP ON ERROR($18=NO) 38 56 (3)
|
|||
|
|
302 770 TRK TO STOP READING+1 23 35 (4)
|
|||
|
|
35F 863 TRK TO STOP READING+1 23 35 (4)
|
|||
|
|
|
|||
|
|
|
|||
|
|
NOTES (NT.):
|
|||
|
|
|
|||
|
|
1) This is the first track that COPYB s tarts reading at. This is normally
|
|||
|
|
set at track 3, so not to copy the protecte d DOS which normally resides on
|
|||
|
|
track 0 through track 2.
|
|||
|
|
|
|||
|
|
2) These two parameters are normally se t to $0F for 16 sector disks. Change
|
|||
|
|
these two parameters to $0C for 13 sect or disks. Most of today's protection
|
|||
|
|
schemes are based on 16 sect ors. Yet there are still a few using 13 sectors
|
|||
|
|
(such as Muse). Intere stingly enough, there is a handful of authors that also
|
|||
|
|
us sectori ng other than 13 or 16 sectors per track. An example of this is
|
|||
|
|
"Thief " from Datamost. This program uses 11 sectors per track. COPYB can al
|
|||
|
|
so accommodate these programs.
|
|||
|
|
|
|||
|
|
at upon reading a 'bad sector' COPYB will stop and display an error. To let
|
|||
|
|
COPYB keep going after a read error, change this byte to $18 (24 in decimal) .
|
|||
|
|
The equivalent sector on the copied disk will be written blank.
|
|||
|
|
|
|||
|
|
4) These two parameter determine where COPYB will stop reading the protected
|
|||
|
|
disk. Normally, this is set to the last track, $22 (34 in decimal) , plus one.
|
|||
|
|
To change this, add one to the last tra ck you want to copy and change these two
|
|||
|
|
parameters.
|
|||
|
|
|
|||
|
|
|
|||
|
|
CREATING COPYB:
|
|||
|
|
|
|||
|
|
After entering or downloading the BASIC program, save the program by typing:
|
|||
|
|
|
|||
|
|
|
|||
|
|
]SAVE COPYB
|
|||
|
|
|
|||
|
|
Now you must enter the ASSEMBLY languag e subroutines that COPYB uses. COPYB
|
|||
|
|
uses the main subroutines that CO PYA uses, so we only have to modify the file
|
|||
|
|
COPY.OBJ0 that is on the DOS 3 .3 System Master. But first I will explain the
|
|||
|
|
added subroutines that COPY B needs.
|
|||
|
|
|
|||
|
|
Remember that COPYB uses the protected program's RWTS to read the disk by
|
|||
|
|
moving it from $8000 to $B700 - $BFFF. After COPYB is done reading the
|
|||
|
|
protected disk, normal RWTS is moved ba ck up to $B700 - $BFFF from $8900 to
|
|||
|
|
write to a normal DOS disk. This is han dled by some subroutines which will add
|
|||
|
|
to the existing file COPY.OBJ0. Her e are the routines (formatted in 80
|
|||
|
|
columns):
|
|||
|
|
|
|||
|
|
0220- 20 B0 02 JSR $02B0 :save the registers.
|
|||
|
|
0223- A0 B7 LDY #$B7 :botto m page to move from.
|
|||
|
|
0225- A9 89 LDA #$89 :desti nation page to move to.
|
|||
|
|
0227- 20 80 02 JSR $0280 :copy normal RWTS from $B700-BFFF to 89 00-91FF.
|
|||
|
|
022A- 20 B4 03 JSR $03B4 :subro utine to locate RWTS ($3E3).
|
|||
|
|
022D- A9 03 LDA #$03 :start ing track to read from.
|
|||
|
|
022F- 8D D1 02 STA $02D1 :store track.
|
|||
|
|
0232- 8D D2 02 STA $02D2 :store track.
|
|||
|
|
0235- A9 0F LDA #$0F :start ing sector to read from.
|
|||
|
|
0237- 8D D3 02 STA $02D3 :store sector.
|
|||
|
|
023A- 8D D4 02 STA $02D4 :store sector.
|
|||
|
|
023D- 4C E7 02 JMP $02E7 :jump to read routine.
|
|||
|
|
0240- 20 B0 02 JSR $02B0 :save the registers.
|
|||
|
|
0243- A0 80 LDY #$80 :botto m page to move from.
|
|||
|
|
0247- 20 80 02 JSR $0280 :move normal RWTS from $8900 back to $B700 -BFFF.
|
|||
|
|
024A- 4C F7 02 JMP $02F7 :jump to write routine.
|
|||
|
|
0260- 20 B0 02 JSR $02B0 :save the registers.
|
|||
|
|
0263- A0 89 LDY #$89 :botto m page to move from.
|
|||
|
|
0265- A9 B7 LDA #$B7 :desti nation page to move to.
|
|||
|
|
0267- 20 80 02 JSR $0280 :move normal RWTS from $8900 back to $B700 -BFFF.
|
|||
|
|
026A- 4C 17 03 JMP $0317 :jump to write routine
|
|||
|
|
0270- 20 B0 02 JSR $02B0 :save the registers.
|
|||
|
|
0273- A0 89 LDY #$89 :botto m page to move from.
|
|||
|
|
0275- A9 B7 LDA #$B7 :desti nation page to move to.
|
|||
|
|
0277- 20 80 02 JSR $0280 :move normal RWTS from $8900 to $B700 -BFFF.
|
|||
|
|
027A- 4C BC 03 JMP $03BC :Resto re the registers and exit.
|
|||
|
|
0280- 84 07 STY $07 :store original page to move from.
|
|||
|
|
0282- 85 09 STA $09 :store destination page to move to.
|
|||
|
|
0284- A2 09 LDX #$09 :load X with number of pages to move.
|
|||
|
|
0286- A9 00 LDA #$00 :load accum with $00.
|
|||
|
|
0288- A8 TAY :trans fer #$00 to Y.
|
|||
|
|
0289- 85 06 STA $06 :store #$00 at $06.
|
|||
|
|
028B- 85 08 STA $08 :store #$00 at $08.
|
|||
|
|
028D- B1 06 LDA ($06),Y:load accum with the address pointed to by locations
|
|||
|
|
$06 & $07 (lo-hi order), index ed by Y.
|
|||
|
|
028F- 91 08 STA ($08),Y:store accum at the address pointed to by locations $07
|
|||
|
|
& $08 (lo-hi order) index ed by Y.
|
|||
|
|
0291- C8 INY :incre ment Y.
|
|||
|
|
0292- D0 F9 BNE $028D :conti nue until end of page.
|
|||
|
|
0294- E6 07 INC $07 :incre ment original page.
|
|||
|
|
0296- E6 09 INC $09 :incre ment destination page.
|
|||
|
|
0298- CA DEX :decre ment X.
|
|||
|
|
0299- D0 F2 BNE $028D :if ha ven't moved 9 pages, do again.
|
|||
|
|
029B- 60 RTS :retur n from subroutine.
|
|||
|
|
02B0- 8D C7 03 STA $03C7 :store accumulator at $3C7.
|
|||
|
|
02B3- 8E C8 03 STX $03C8 :store X-register at $3C8.
|
|||
|
|
02B6- 8C C9 03 STY $03C9 :store Y-register at $3C9.
|
|||
|
|
02B9- 60 RTS :retur n from subrotine.
|
|||
|
|
|
|||
|
|
So to create the objective file for COP YB, we should first enter the monitor
|
|||
|
|
by typing:
|
|||
|
|
|
|||
|
|
]CALL-151
|
|||
|
|
|
|||
|
|
Next we should initialize the memory ar ea by typing:
|
|||
|
|
|
|||
|
|
*220:FF N 221<220.2CDM
|
|||
|
|
|
|||
|
|
Now bload the file COPY.OBJ0 from the D OS 3.3 System Master by typing:
|
|||
|
|
|
|||
|
|
*BLOAD COPY.OBJ0
|
|||
|
|
|
|||
|
|
Now type in the new code and some chang es:
|
|||
|
|
|
|||
|
|
*228:80 02 20 B4 03 A9 03 8D
|
|||
|
|
*230:D1 02 8D D2 02 A9 0F 8D
|
|||
|
|
*238:D3 02 8D D4 02 4C E7 02
|
|||
|
|
*240:20 B0 02 A0 80 A9 B7 20
|
|||
|
|
*248:80 02 4C F7 02
|
|||
|
|
*260:20 B0 02 A0 89 A9 B7 20
|
|||
|
|
*268:80 02 4C 17 03
|
|||
|
|
*270:20 B0 02 A0 89 A9 B7 20
|
|||
|
|
*278:80 02 4C BC 03
|
|||
|
|
*280:84 07 85 09 A2 09 A9 00
|
|||
|
|
*288:A8 85 06 85 08 B1 06 91
|
|||
|
|
*290:08 C8 D0 F9 E6 07 E6 09
|
|||
|
|
*298:CA D0 F2 60
|
|||
|
|
*2B0:8D C7 03 8E C8 03 8C C9
|
|||
|
|
*2B8:03 60
|
|||
|
|
*2C1:20
|
|||
|
|
*2C4:40
|
|||
|
|
*2C7:60 02
|
|||
|
|
*2CB:13 7F B0 60
|
|||
|
|
*2D0:01 03 03 0F 0F
|
|||
|
|
*2D8:B4
|
|||
|
|
*2DD:02
|
|||
|
|
*2F8:B4
|
|||
|
|
*318:B4
|
|||
|
|
*3C7:02 9D C0 B3 C4 C4
|
|||
|
|
*220:20 B0 02 A0 B7 A9 89 20
|
|||
|
|
|
|||
|
|
After entering these changes, save the file by typing:
|
|||
|
|
|
|||
|
|
*BSAVE COPYB.OBJ,A$220,L$1AB
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
USING COPYB:
|
|||
|
|
|
|||
|
|
To use COPYB, you must capture the fore ign RWTS and put it at locations $8000
|
|||
|
|
through $88FF. You can do this on e of two ways:
|
|||
|
|
|
|||
|
|
1) Boot the protected disk and after th e foreign DOS is loaded, reset into
|
|||
|
|
the monitor. The foreign DOS will usual ly be loaded a few seconds after the
|
|||
|
|
boot starts. You can tell this beca use many times a BASIC prompt will appear
|
|||
|
|
at the bottom of the text screen . Use the monitor move command to move RWTS
|
|||
|
|
down to $8000 as so:
|
|||
|
|
|
|||
|
|
*8000<B700.BFFFM
|
|||
|
|
|
|||
|
|
Now boot a 48k slave disk (this will no t destroy memory from $900 to $95FF)
|
|||
|
|
and run COPYB.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
ENTERING THE PARAMETERS AND RUNNING COPYB:
|
|||
|
|
|
|||
|
|
Run COPYB by typing:
|
|||
|
|
|
|||
|
|
]RUN COPYB
|
|||
|
|
|
|||
|
|
The program will come up and ask what p arameters to use, all described above.
|
|||
|
|
COPYB will poke in the values you have entered for you. Enter all values in
|
|||
|
|
DECIMAL.
|
|||
|
|
|
|||
|
|
After entering the parameters, you will be asked if your selections are
|
|||
|
|
correct. If you answer YES, the next se t of prompts will appear, which should
|
|||
|
|
look familiar. Enter the origina l and destination drive and slot numbers, just
|
|||
|
|
like in COPYA. Lastly, yo u will be asked if you want the destination disk to
|
|||
|
|
be initialized, res pond yes or no. Now press the RETURN key to start the copy.
|
|||
|
|
|
|||
|
|
When the copy is completed, assuming al l went correctly, you will have a
|
|||
|
|
normal DOS 3.3 version of your protecte d disk which may run or be examined and
|
|||
|
|
changed more easily then t he original disk.
|
|||
|
|
|
|||
|
|
This method of deprotection is more dep endable that using DEMUFFIN PLUS and
|
|||
|
|
covers more types of programs. I am sur e you will find COPYB an excellant
|
|||
|
|
utility to have.
|
|||
|
|
---------------------------------------
|
|||
|
|
|
|||
|
|
INTRODUCTION TO KRAKING PART TWO.B. MAK ING YOUR OWN CUSTOM F8 MONITOR ROM.
|
|||
|
|
BY THE DISK JOCKEY.
|
|||
|
|
|
|||
|
|
In this section I will describe how to make the code for the modified F8
|
|||
|
|
monitor ROM that you will find extremel y useful in kraking.
|
|||
|
|
|
|||
|
|
The EPROM will act like a old style F8 monitor ROM with regards to resets.
|
|||
|
|
What I mean is that hitting reset will cause you to jump into the monitor.
|
|||
|
|
|
|||
|
|
The EPROM will also have a special func tion when an NMI is encountered. Upon
|
|||
|
|
NMI, this ROM will push the accumu lator, the x-register,the y-register and
|
|||
|
|
location $00 onto the st ack. The stack pointer will then be saved at location
|
|||
|
|
$00.
|
|||
|
|
|
|||
|
|
Next, the EPROM will move $00 to $4000 into a RAM card in slot zero. This
|
|||
|
|
clears the way for a 16K slave disk boo t. Here is the code and an explanation
|
|||
|
|
of how it works (in 80 colu mn format):
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
FCC9- 48 PHA PUSH
|
|||
|
|
ACCUM ONTO THE STACK.
|
|||
|
|
FCCA- 8A TXA TRANS
|
|||
|
|
FER X-REG TO ACCUM.
|
|||
|
|
FCCB- 48 PHA PUSH
|
|||
|
|
(X) ACCUM ONTO THE STACK.
|
|||
|
|
FCCC- 98 TYA TRANS
|
|||
|
|
FER Y-REG TO ACCUM.
|
|||
|
|
FCCD- 48 PHA PUSH
|
|||
|
|
(Y) ACCUM ONTO THE STACK.
|
|||
|
|
FCCE- A5 00 LDA $00 LOAD
|
|||
|
|
ACCUM WITH $00.
|
|||
|
|
FCD0- 48 PHA PUSH
|
|||
|
|
($00) ACCUM ONTO THE STACK.
|
|||
|
|
FCD1- BA TSX TRANS
|
|||
|
|
FER STACK POINTER TO X-REG.
|
|||
|
|
FCD2- 86 00 STX $00 STORE
|
|||
|
|
STACK POINTER AT $00.
|
|||
|
|
FCD4- AD 81 C0 LDA $C081 ENABL
|
|||
|
|
E WRITE TO RAM BANK 1.
|
|||
|
|
FCD7- AD 81 C0 LDA $C081 (MUST
|
|||
|
|
ACCESS TWICE).
|
|||
|
|
FCDA- A0 00 LDY #$00 -----
|
|||
|
|
------------------------------
|
|||
|
|
FCDC- B9 00 00 LDA $0000,Y MOVE
|
|||
|
|
$00 TO $FF INTO RAM CARD SO WE
|
|||
|
|
FCDF- 99 00 D0 STA $D000,Y CAN U
|
|||
|
|
SE ZERO PAGE FOR REST OF MOVE.
|
|||
|
|
FCE2- C8 INY
|
|||
|
|
FCE3- D0 F7 BNE $FCDC -----
|
|||
|
|
------------------------------
|
|||
|
|
FCE5- 84 00 STY $00 MOVE
|
|||
|
|
$100-$2FFF INTO BANK 1
|
|||
|
|
FCE7- 84 02 STY $02 OF TH
|
|||
|
|
E RAM CARD.
|
|||
|
|
FCE9- A9 01 LDA #$01
|
|||
|
|
FCEB- 85 01 STA $01
|
|||
|
|
FCED- A9 D1 LDA #$D1
|
|||
|
|
FCEF- 85 03 STA $03
|
|||
|
|
FCF1- B1 00 LDA ($00),Y
|
|||
|
|
FCF3- 91 02 STA ($02),Y
|
|||
|
|
FCF5- C8 INY
|
|||
|
|
FCF6- D0 F9 BNE $FCF1
|
|||
|
|
FCF8- E6 03 INC $03
|
|||
|
|
FCFA- E6 01 INC $01
|
|||
|
|
FCFC- A5 01 LDA $01
|
|||
|
|
FCFE- C9 30 CMP #$30
|
|||
|
|
FD00- D0 EF BNE $FCF1 -----
|
|||
|
|
------------------------------
|
|||
|
|
FD02- 4C CD FE JMP $FECD RAN O
|
|||
|
|
UT OF ROOM HERE, JMP TO $FECD.
|
|||
|
|
.
|
|||
|
|
.
|
|||
|
|
.
|
|||
|
|
FECD- A9 D0 LDA #$D0 RESET
|
|||
|
|
MOVE ROUTINE POINTERS.
|
|||
|
|
FECF- 85 03 STA $03
|
|||
|
|
FED1- AD 89 C0 LDA $C089 ENABL
|
|||
|
|
E BANK 2 OF RAM CARD.
|
|||
|
|
FED4- AD 89 C0 LDA $C089 (MUST
|
|||
|
|
ACCESS TWICE).
|
|||
|
|
FED7- B1 00 LDA ($00),Y -----
|
|||
|
|
------------------------------
|
|||
|
|
FED9- 91 02 STA ($02),Y MOVE
|
|||
|
|
$3000-$3FFF INTO BANK 2
|
|||
|
|
FEDB- C8 INY OF TH
|
|||
|
|
E RAM CARD.
|
|||
|
|
FEDC- D0 F9 BNE $FED7
|
|||
|
|
FEDE- E6 03 INC $03
|
|||
|
|
FEE0- E6 01 INC $01
|
|||
|
|
FEE2- A5 01 LDA $01
|
|||
|
|
FEE4- C9 40 CMP #$40
|
|||
|
|
FEE6- D0 EF BNE $FED7 -----
|
|||
|
|
------------------------------
|
|||
|
|
FEE8- AD 82 C0 LDA $C082 TURN
|
|||
|
|
ON MOTHERBOARD RAM AND WRITE
|
|||
|
|
FEEB- AD 8A C0 LDA $C08A PROTE
|
|||
|
|
CT BANKS 1&2 OF RAM CARD.
|
|||
|
|
FEEE- 4C FD FE JMP $FEFD RAN O
|
|||
|
|
UT OF ROOM, JUMP TO $FEFD.
|
|||
|
|
.
|
|||
|
|
.
|
|||
|
|
.
|
|||
|
|
FEFD- A2 1C LDX #$1C THIS
|
|||
|
|
SUBROUTINE OUPUTS THE
|
|||
|
|
FEFF- BD 0B FF LDA $FF0B,X MESSA
|
|||
|
|
GE "RAM CARD LOADED WITH
|
|||
|
|
FF02- 9D D6 07 STA $07D6,X $00-3
|
|||
|
|
FFF" AT THE BOTTOM OF
|
|||
|
|
FF05- CA DEX THE T
|
|||
|
|
EXT SCREEN.
|
|||
|
|
FF06- 10 F7 BPL $FEFF -----
|
|||
|
|
-----------------------------
|
|||
|
|
FF08- 4C 59 FF JMP $FF59 ALL D
|
|||
|
|
ONE, EXIT THRU NORMAL RESET.
|
|||
|
|
|
|||
|
|
|
|||
|
|
To create this EPROM file, here are the steps:
|
|||
|
|
|
|||
|
|
1) Boot a normal DOS disk and enter the monitor by typing:
|
|||
|
|
|
|||
|
|
]CALL -151
|
|||
|
|
|
|||
|
|
2) Move your autostart F8 monitor ROM c ode down into RAM by typing:
|
|||
|
|
|
|||
|
|
*4800<F800.FFFFM
|
|||
|
|
|
|||
|
|
3) Now change the code as follows:
|
|||
|
|
|
|||
|
|
*4CC9:48 8A 48 98 48 A5 00 *4CD0:48 BA 86 00 AD 81 C0 AD 81 C0 A0 00 B9 00 00
|
|||
|
|
99 *4CE0:00 D0 C8 D0 F7 84 00 84 02 A9 01 85 01 A9 D1 85 *4CF0:03 B1 00 91 02 C8
|
|||
|
|
D0 F9 E6 03 E6 01 A5 01 C9 30 *4D00:D0 EF 4C CD FE *4ECD:A9 D0 85 03 AD 89 C0 AD
|
|||
|
|
89 C0 B1 00 91 02 C8 D0 F9 E6 03 *4EE0:E6 01 A5 01 C9 40 D0 EF AD 82 C0 AD 8A C0
|
|||
|
|
4C FD FE *4EFD:A2 1C BD 0B FF 9D D6 07 CA 10 F7 4C 59 FF *4F0B:52 41 4D 60 43 41
|
|||
|
|
52 44 60 4C 4F 41 44 45 44 60 57 49 54 48 60 *4F20:64 70 70 6D 73 46 46 46
|
|||
|
|
*4FFA:C9 FC 59 FF
|
|||
|
|
|
|||
|
|
4) Now save the file to a disk by typin g:
|
|||
|
|
|
|||
|
|
*BSAVE F8 SAVE RAM EPROM,A$4800,L$800
|
|||
|
|
|
|||
|
|
5) Finally, burn the 2716 EPROM with th is code or have someone do it for you.
|
|||
|
|
|
|||
|
|
Now to use your new 2716 EPROM, you mus t make these changes directly to the
|
|||
|
|
chip itself (not advisable), or to a ju mper socket which your new chip will
|
|||
|
|
plug into, and then which will be plugg ed into your motherboard.
|
|||
|
|
|
|||
|
|
You need a 24 pin low-profile socket (n ot wire-wrap!, they will destroy your
|
|||
|
|
motherboard sockets!). These are availa ble from radio shack (part number
|
|||
|
|
276-1989) or the such. Now with the soc ket up-side-down and the pins looking
|
|||
|
|
you in the face, it should look like this:
|
|||
|
|
|
|||
|
|
---------------------------------------
|
|||
|
|
! 13 14 15 16 17 18 19 20 21 22 23 24!
|
|||
|
|
! ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ !
|
|||
|
|
! !
|
|||
|
|
! !
|
|||
|
|
! -
|
|||
|
|
! (notch)->!
|
|||
|
|
! -!
|
|||
|
|
! !
|
|||
|
|
! . . . . . . . . . . . . !
|
|||
|
|
!/ / / / / / / / / / / / !
|
|||
|
|
!12 11 10 9 8 7 6 5 4 3 2 1 !
|
|||
|
|
---------------------------------------
|
|||
|
|
|
|||
|
|
Now your soldering skills come in handy ! Using some short, hi-gauge wire
|
|||
|
|
(wire-wrap is preferable, but anything in the 26-30 gauge will work), solder a
|
|||
|
|
piece between pins 21 and 24, and solde r a piece between pins 12 and 18. Be
|
|||
|
|
extremely careful not to short out t he wire or to cross solder any pins! Also,
|
|||
|
|
try and solder as close to the ba se of the socket as possible, since you have
|
|||
|
|
to cut off pins 18 and 21 afte r you have finished soldering them. Now cut of
|
|||
|
|
pins 18 and 21 as close to t he base of the socket without cutting the freshly
|
|||
|
|
soldered wires! Remember, p ins 18 and 21 should be short enough so that they
|
|||
|
|
will not touch the socket you will be plugging this one into. The socket should
|
|||
|
|
now look like this:
|
|||
|
|
|
|||
|
|
---------------------------------------
|
|||
|
|
! 13 14 15 16 17 18 19 20 21 22 23 24!
|
|||
|
|
! ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ !
|
|||
|
|
! x x / !
|
|||
|
|
! / / / !
|
|||
|
|
! / /--------/ -
|
|||
|
|
! /--------/ !
|
|||
|
|
! / -!6
|
|||
|
|
! / !
|
|||
|
|
! / . . . . . . . . . . . !
|
|||
|
|
!/ / / / / / / / / / / / !
|
|||
|
|
!12 11 10 9 8 7 6 5 4 3 2 1 !
|
|||
|
|
---------------------------------------
|
|||
|
|
|
|||
|
|
Double check your soldering and the con nections (and notice that pin 18 and
|
|||
|
|
21 are cut off!). Now carefully remove the ROM labelled F8 (it is the socket
|
|||
|
|
farthest on the left that has 24 pins a s you face the keyboard) and plug this
|
|||
|
|
jumper socket into the motherboard. Now plug your modified 2716 EPROM into thi
|
|||
|
|
s jumper socket and your all done! Make s ure you have the notch pointing in
|
|||
|
|
the same direction as the other ROMs (towar ds the keyboard).
|
|||
|
|
|
|||
|
|
When you turn on the Apple you should s ee a screen full of garbage with the
|
|||
|
|
monitor prompt at the bottom of the scr een. To boot your Apple, just type "6
|
|||
|
|
ctrlP", and your computer will act j ust as usual.
|
|||
|
|
|
|||
|
|
---------------------------------------
|
|||
|
|
|
|||
|
|
INTRODUCTION TO KRAKING PART TWO.C. MAKING YOUR OWN NMI BOARD. BY THE DISK
|
|||
|
|
JOCKEY.
|
|||
|
|
|
|||
|
|
In this article I will describe how to make your own NMI board that will work
|
|||
|
|
in conjunction with the modified F8 monitor EPROM you have (or will) create.
|
|||
|
|
Here is the parts lists for the NMI board:
|
|||
|
|
|
|||
|
|
(1) 7400 or 74LS00 chip. Radio Shack part #276-1801. $0.59
|
|||
|
|
|
|||
|
|
(1) SPDT momentary push switch. Radio Shack part #275-1549. $2.19
|
|||
|
|
|
|||
|
|
(1) 14 pin low profile or wire wrap socket. Radio Shack part #276-1999 or
|
|||
|
|
#276-1993. $0.89
|
|||
|
|
|
|||
|
|
(2) 3.3k ohm resisters, 1/4 watt. Radio Shack part #271-1328. $0.39
|
|||
|
|
|
|||
|
|
(1) Dual plug-in interface board. Radio Shack part #276-164. $4.95 NOTE:
|
|||
|
|
This part has been discontinued by Radio Shack, but you can sometimes still find
|
|||
|
|
them in the junk bin. Cut the board so it will fit inside your Apple.
|
|||
|
|
|
|||
|
|
ALTERNATIVELY: (1) Apple bare board number PAPGBP5001. $13.95 from Priority
|
|||
|
|
Electronics, 9161 Deering Ave., Chatsworth, CA 91311.
|
|||
|
|
|
|||
|
|
After you have obtained all the parts above, you should solder the 14 pin
|
|||
|
|
socket and the two resistors somewhere convenient on the bare board. Next get
|
|||
|
|
some hi-gauge wire and make the following connections:
|
|||
|
|
|
|||
|
|
1) Connect pin 25 of the bare board to one leg of each of the two resistors.
|
|||
|
|
|
|||
|
|
2) Connect each of the other legs of the resistors to the two outside contacts
|
|||
|
|
of the switch. (one resistor goes to one contact, the other resistor goes to
|
|||
|
|
the other contact). Use some good wire.
|
|||
|
|
|
|||
|
|
3) Connect pin 25 of the bare board to pin 14 of the 14 pin socket.
|
|||
|
|
|
|||
|
|
4) Connect the middle contact of the switch to pin 7 of the 14 pin socket.
|
|||
|
|
|
|||
|
|
5) Connect pin 26 of the bare board to pin 7 of the 14 pin socket.
|
|||
|
|
|
|||
|
|
6) Connect pin 2 of the 14 pin socket to pin 6 of the 14 pin socket.
|
|||
|
|
|
|||
|
|
7) Connect pin 3 of the 14 pin socket to pin 4 of the 14 pin socket.
|
|||
|
|
|
|||
|
|
8) Connect pin 4 of the 14 pin socket to pin 29 of the bare board.
|
|||
|
|
|
|||
|
|
9) Connect the leg of one of the resistors that is connected to the switch to
|
|||
|
|
pin 5 of the 14 pin socket.
|
|||
|
|
|
|||
|
|
10) Connect the other leg of the resistor that is connected to the switch to
|
|||
|
|
pin 1 of the 14 pin socket.
|
|||
|
|
|
|||
|
|
11) Check all connections twice, and don't get confused on what pin is what on
|
|||
|
|
the bare board and the 14 pin socket.
|
|||
|
|
|
|||
|
|
You have now completed building your own NMI board. This board may be plugged
|
|||
|
|
into any one of the peripheral slots.
|
|||
|
|
|
|||
|
|
---------------------------------------
|
|||
|
|
|
|||
|
|
THE ROM CARD. BY THE DISK JOCKEY.
|
|||
|
|
|
|||
|
|
OBJECTIVE:
|
|||
|
|
|
|||
|
|
While being able to deprotect programs from files on Pirate's Harbor is
|
|||
|
|
certainly helpful in the quest for copyable software, it would be optimal to
|
|||
|
|
deprotect your own programs without the help of other sources. This works on
|
|||
|
|
the premise that you can give a man a fish and feed him today, or you can teach
|
|||
|
|
him to fish and feed him for life.
|
|||
|
|
|
|||
|
|
With this in mind, our objective is to teach you the ways of deprotection in
|
|||
|
|
general, and mention some of the tools that will make this easier. Although
|
|||
|
|
some of these tools will cost money and are somewhat specialized, they will only
|
|||
|
|
increase your knowledge of the Apple computer, for what that's worth.
|
|||
|
|
|
|||
|
|
INTRODUCING THE ROM CARD:
|
|||
|
|
|
|||
|
|
The foremost of important tools for easily snooping through memory is the ROM
|
|||
|
|
card. The ROM card was originally developed for t`g{m(a|`(xzograms written in
|
|||
|
|
both INTEGER and APPLESOFT BASIC. Remember that your motherboard (the big green
|
|||
|
|
printed circuit board inside your computer case) can house only one of the BASIC
|
|||
|
|
languages, either INTEGER or APPLESOFT. When the Apple was originally released,
|
|||
|
|
it was only available with INTEGER BASIC. So many programs were written in
|
|||
|
|
INTEGER, and would not run on the Apple II+ (with APPLESOFT on board) when it
|
|||
|
|
was introduced.
|
|||
|
|
|
|||
|
|
Before RAM memory was very cheap, many people bought ROM cards for their Apple
|
|||
|
|
II+ that could be put in slot zero (as you would a RAM card), to enable them to
|
|||
|
|
run programs that were written in either BASIC language. It was just as though
|
|||
|
|
you had loaded INTEGER BASIC into you RAM card, like the DOS 3.3 System Master's
|
|||
|
|
HELLO program does. When RAM cards became available at a reasonable cost,
|
|||
|
|
everyone started buying them because they are so much more versatile for the
|
|||
|
|
average folk. That is why you don't see ROM cards for sale too much any more.
|
|||
|
|
But for deprotecting Apple programs, the ROM card is indespensible.
|
|||
|
|
|
|||
|
|
Also, for the Apple II owner who wanted to run the newer APPLESOFT programs,
|
|||
|
|
the ROM card was available with APPLESOFT ROMs. The INTEGER and the APPLESOFT
|
|||
|
|
versions of the ROM card are identical, except for the actual ROMS on the card.
|
|||
|
|
In other words, one had INTEGER ROMs and the other had APPLESOFT ROMs, and there
|
|||
|
|
is no other differences.
|
|||
|
|
|
|||
|
|
THE REASONS WHY:
|
|||
|
|
|
|||
|
|
Their are several reasons the ROM card is so important. The least of the
|
|||
|
|
reasons is the need for INTEGER BASIC or the Programmer's Aid chip. If you can
|
|||
|
|
get a ROM card cheaply without INTEGER or the Programmer's Aid ROMs, do so.
|
|||
|
|
From a cost outlook, it is to your advantage. Besides, INTEGER is a dead
|
|||
|
|
dinosaur, and who really cares if it's faster than APPLESOFT?
|
|||
|
|
|
|||
|
|
The reason we want a ROM card is so we can put an old style F8 monitor ROM and
|
|||
|
|
THE INSPECTOR ROM (from Omega Microware) on it. These two ROM chips are really
|
|||
|
|
essential for learning more about protected programs. Ultimately, we would like
|
|||
|
|
WATSON in conjunction with THE INSPECTOR, but to do so you will also need
|
|||
|
|
INTEGER BASIC ROMs, since WATSON uses some routines from the INTEGER BASIC ROMs.
|
|||
|
|
Watson enhances the Inspector by adding even more commands and flexibility. The
|
|||
|
|
combination of Watson and the Inspector provides you with great power for not
|
|||
|
|
only snooping, but also for general purpose utility chores.
|
|||
|
|
|
|||
|
|
The reason we want the old style F8 ROM should be obvious by now. After
|
|||
|
|
reading several kraking articles and from your own experiences, you have noticed
|
|||
|
|
that it is impossible to break out of many programs with just an autostart F8
|
|||
|
|
monitor ROM. The reason we should have the old style F8 ROM on the ROM card and
|
|||
|
|
not on the mother board is for convenience. The ROM card has a switch which
|
|||
|
|
determines which F8 monitor ROM is active when you hit reset. So you can have
|
|||
|
|
the convenience of the Autostart F8 monitor ROM, and when you need it, hit the
|
|||
|
|
switch and be able to break out of any program you want with the old style F8
|
|||
|
|
monitor ROM.
|
|||
|
|
|
|||
|
|
OBTAINING YOUR OWN ROM CARD:
|
|||
|
|
|
|||
|
|
ROM cards are available used at very cheap prices. Check your local Apple
|
|||
|
|
users' group. Alternatively, you can get blank cards and stuff it yourse8f. I
|
|||
|
|
would suggest stuff your own since the parts are easy to get, and it is usually
|
|||
|
|
the least expensive route! I have also seen Japanese clone cards for sale at a
|
|||
|
|
very reasonable price. The best place to check for these is in The Computer
|
|||
|
|
Shopper, a bi-monthly newspaper of Apple and other computer bargins.
|
|||
|
|
|
|||
|
|
OBTAINING YOUR OWN ROMs:
|
|||
|
|
|
|||
|
|
You can either buy an old style F8 monitor ROM, or you can make one by
|
|||
|
|
changing your autostart F8 code slightly. After making the change, you can save
|
|||
|
|
the file to disk and have a friend or your local computer store burn the image
|
|||
|
|
into a 2716 EPROM. Here is the instructions for creating your own:
|
|||
|
|
|
|||
|
|
1) Boot a normal DOS 3.3 disk. 2) Enter the monitor by typing:
|
|||
|
|
|
|||
|
|
]CALL-151
|
|||
|
|
|
|||
|
|
3) Move the autostart F8 ROM image into RAM by typing:
|
|||
|
|
|
|||
|
|
*4800<F800.FFFFM
|
|||
|
|
|
|||
|
|
4) To enter the monitor when reset is pressed, type these changes:
|
|||
|
|
|
|||
|
|
*4FFC:59 FF
|
|||
|
|
|
|||
|
|
5) Bsave the file to a blank disk by
|
|||
|
|
typing:
|
|||
|
|
|
|||
|
|
*BSAVE OLD $F8,A$4800,L$800
|
|||
|
|
|
|||
|
|
6) Burn this image into a 2716 EPROM.
|
|||
|
|
|
|||
|
|
This new F8 EPROM will be just like the autostart version F8 ROM except when
|
|||
|
|
you hit reset, you will be in the monitor and not in BASIC. Now you can reset
|
|||
|
|
out of any program.
|
|||
|
|
|
|||
|
|
Alternatively, you can use a modified F8 EPROM too, as described in other
|
|||
|
|
kraking articles. This will give you the advantage of being able to save memory
|
|||
|
|
from $00 to $8FF when you hit reset. This would certainly be helpful at times.
|
|||
|
|
|
|||
|
|
If you want INTEGER BASIC on your ROM board, you can either buy the ROMs from
|
|||
|
|
your local Apple dealer, or you can make them. When you bought your Apple disk
|
|||
|
|
drive and controller you also bought DOS 3.3, the DOS 3.3 System Master, and all
|
|||
|
|
the programs on the System Master, including INTEGER BASIC. So you can also
|
|||
|
|
burn INTEGER into 2716 EPROMs just like you burned your new F8 EPROM, and put
|
|||
|
|
them on your ROM card. Here are the steps to do this:
|
|||
|
|
|
|||
|
|
1) Boot your DOS 3.3 System Master.
|
|||
|
|
|
|||
|
|
2) Bload the file INTBASIC by typing:
|
|||
|
|
|
|||
|
|
]BLOAD INTBASIC,A$2000
|
|||
|
|
|
|||
|
|
3) Bsave the INTEGER files to a blank disk by typing:
|
|||
|
|
|
|||
|
|
]BSAVE INT $E0,A$3000,L$800
|
|||
|
|
]BSAVE INT $E8,A$3800,L$800
|
|||
|
|
]BSAVE INT $F0,A$4000,L$800
|
|||
|
|
|
|||
|
|
4) Burn three 2716 EPROMs from each of these files.
|
|||
|
|
|
|||
|
|
IMPORTANT: In order to use 2716 EPROMs on your ROM card instead of the
|
|||
|
|
F8 ROM socket on the ROM board white circle with the word "2716" next to it.
|
|||
|
|
Inside the circle will be four solder pads, grouped into two pairs. Notice each
|
|||
|
|
pair has two pads real close together, but not touching. Take a soldering iron
|
|||
|
|
and cross each pad in each pair together with some solder. So now the circle
|
|||
|
|
will have two solder pads, instead of four. DO NOT CROSS ALL FOUR PADS
|
|||
|
|
TOGETHER! Your ROM board will now except ONLY 2716 EPROMs, so when you do this
|
|||
|
|
you have to use all 2716 EPROMs, and no 9316 ROMs.
|
|||
|
|
|
|||
|
|
While on the subject of jumpers, there is another jumper on your ROM card just
|
|||
|
|
below the E8 ROM. This jumper, when crossed, will ignore the position of the
|
|||
|
|
ROM card switch. Reset will always ignore the F8 monitor ROM on the ROM board,
|
|||
|
|
and just use the motherboard F8 monitor ROM. Obviously, we do not want to cross
|
|||
|
|
this jumper.
|
|||
|
|
|
|||
|
|
If you can't tell if you should cross the 2716 jumper because you don't know
|
|||
|
|
if you have 2716's or 9316's, it is easy to tell the difference. 2716's have a
|
|||
|
|
small quartz window on their face, usually beneath some label. The window is
|
|||
|
|
used to erase the EPROM (hence the name Erasable, Programable,0Read Only
|
|||
|
|
Memory). They should also say "2716" somewhere on them too.
|
|||
|
|
|
|||
|
|
If you must mix 9316's and 2716's on the same ROM card, do not cross any of
|
|||
|
|
the two pairs of jumpers. Instead, refer to INTRODUCTION TO KRAKING PART 2.B on
|
|||
|
|
how to make 2716 scrambler sockets for using 2716's in 9316 applications.
|
|||
|
|
|
|||
|
|
9316's are the all black 24 pin ROM chips that come with your Apple, and are
|
|||
|
|
not erasable. They will not have a quartz window.
|
|||
|
|
|
|||
|
|
Now plug in your F8 monitor EPROM or ROM in the socket labeled F8, and do the
|
|||
|
|
same with the other E0, E8 and F0 INTEGER EPROMs or ROMs. We are ready for the
|
|||
|
|
next step.
|
|||
|
|
|
|||
|
|
THE INSPECTOR:
|
|||
|
|
|
|||
|
|
The next thing the ROM board enables us to do is to use THE INSPECTOR from
|
|||
|
|
Omega Microware. The Inspector is basically a sector editor program with some
|
|||
|
|
really nice features which come in handy when deprotecting programs. To use The
|
|||
|
|
Inspector, we just reset out of a program and into the monitor, and type C080 N
|
|||
|
|
D800G. Now The Inspector is running without disturbing anything in memory
|
|||
|
|
outside of what normally gets disturbed upon hitting reset.
|
|||
|
|
|
|||
|
|
Besides being a sector editor, The Inspector has a very useful FIND command
|
|||
|
|
which enables us to find any string of bytes in memory or to locate them on a
|
|||
|
|
disk. This can help us find where a particular routine is being called from, or
|
|||
|
|
to help find the starting address of a program, etc. Also, The Inspector has a
|
|||
|
|
free sector map, removes DOS from a disk, does nibble reads of protected disks,
|
|||
|
|
displays bytes in HEX or ASCII, reads half tracks, and compares or verifies
|
|||
|
|
disks. It also has unlimited uses in snooping and changing memory and disks.
|
|||
|
|
|
|||
|
|
The Inspector is VERY useful, especially in conjunction with its partner,
|
|||
|
|
WATSON (also from Omega1Microware). It is the most powerful and well used
|
|||
|
|
utility I have. And since it is on my ROM card, it is always available without
|
|||
|
|
disturbing mother board memory. This is why it is so useful. If we had to load
|
|||
|
|
it in from disk like any other program, it would be just like any other sector
|
|||
|
|
editor to a large extent.
|
|||
|
|
|
|||
|
|
Ask around and try and find someone with the Inspector and Watson code saved
|
|||
|
|
in a Bfile so you can burn your own Inspector EPROM and plug it into your ROM
|
|||
|
|
card. If you buy the Inspector, BE SURE you tell Omega when buying The
|
|||
|
|
Inspector that you want it in 2716 EPROM form if you are planning on using only
|
|||
|
|
2716 EPROMs on your ROM card, instead of 9316's.
|
|||
|
|
|
|||
|
|
WHERE Do I PUT IT?:
|
|||
|
|
|
|||
|
|
Now that you have a ROM board, what slot should you put it in? Generally, the
|
|||
|
|
conventional slot is slot zero. But, I am sure many of you have RAM cards in
|
|||
|
|
slot zero. It is probably best 99 percent of the time to have your RAM card in
|
|||
|
|
slot zero, since most programs which use RAM cards expect it in only slot zero
|
|||
|
|
(although it has some uses in other slots). So that leaves you with two
|
|||
|
|
choices, put your ROM card in another slot, or play musical slots when you need
|
|||
|
|
the ROM card.
|
|||
|
|
|
|||
|
|
I prefer to put my ROM card in slot two since the card (and The Inspector) is
|
|||
|
|
still always available, but that presents some problems. The main problem is
|
|||
|
|
that after flipping the ROM board switch up to use the old F8 monitor ROM and
|
|||
|
|
hitting reset, your computer cannot find APPLESOFT when you boot a disk, it can
|
|||
|
|
only find INTEGER BASIC (assuming you have it on the ROM card). One way out is
|
|||
|
|
to flip the switch back down and hit reset again before booting a disk. I do
|
|||
|
|
not recommend this when deprotecting a program since now your computer will jump
|
|||
|
|
to the reset routine that was there when you originally hit reset. Of course,
|
|||
|
|
there is a better way.
|
|||
|
|
|
|||
|
|
After reseting into the monitor and just before you boot a disk you must turn
|
|||
|
|
off your ROM card ROMs and turn on the motherboard ROMs. This is accomplished
|
|||
|
|
with a softswitch, much like turning on the hi-res page. Remember how we
|
|||
|
|
activated the Inspector with C080 N D800G? Well, the C080 turns on the ROM
|
|||
|
|
card, so those ROMs are active, much like typing INT from BASIC. If you type
|
|||
|
|
C081 from the monitor, this turns the ROM card ROMs off, and the motherboard
|
|||
|
|
ROMs on. If your ROM card is in another slot, you need to type the slot number
|
|||
|
|
times ten, and add it to C081. Then you can boot a disk, and APPLESOFT will be
|
|||
|
|
found. Here is a chart of what you would type from the monitor just prior to
|
|||
|
|
booting a disk (you do not have to do this if your ROM card is in slot zero):
|
|||
|
|
|
|||
|
|
TURN ON TURN ON
|
|||
|
|
SLOT ROM CARD MOTHERBOARD
|
|||
|
|
---------------------------------------
|
|||
|
|
0 C080 C081
|
|||
|
|
1 C090 C091
|
|||
|
|
2 C0A0 C0A1
|
|||
|
|
3 C0B0 C0B1
|
|||
|
|
4 C0C0 C0C1
|
|||
|
|
5 C0D0 C0D1
|
|||
|
|
6 C0E0 C0E1
|
|||
|
|
7 C0F0 C0F1
|
|||
|
|
|
|||
|
|
|
|||
|
|
For example, if your ROM card was in slot two, and you have reseted into the
|
|||
|
|
monitor, type:
|
|||
|
|
|
|||
|
|
*C0A1
|
|||
|
|
|
|||
|
|
before you boot a disk to turn on your motherboard ROMs so APPLESOFT can be
|
|||
|
|
found.
|
|||
|
|
|
|||
|
|
Likewise, if you have reset into the monitor and you want to use the
|
|||
|
|
Inspector, type (assuming slot two):
|
|||
|
|
|
|||
|
|
*C0A0 N D800G
|
|||
|
|
|
|||
|
|
Notice we multiply the slot number by twenty and add it to $C080 or $C081.
|
|||
|
|
|
|||
|
|
Another alternative is to use DAVID DOS from David Data when you boot normal
|
|||
|
|
DOS 3.3. This DOS is incredible in just speed savings of loading programs. It
|
|||
|
|
will also recognize your ROM card in any slot (and hence solves our problem),
|
|||
|
|
has a relocatable DOS function to put DOS in your RAM card, has a find command,
|
|||
|
|
and has a disassemble command. If that is not enough, it has a TLOAD and TLIST
|
|||
|
|
command which loads and lists text files like BASIC or binary files! This alone
|
|||
|
|
make DAVID DOS worth the price. The only disadvantage to David DOS is it does
|
|||
|
|
not have an INIT disk command. To put David DOS on another disk requires using
|
|||
|
|
a program that comes with it.
|
|||
|
|
|
|||
|
|
Of course, if you are booting a disk which does not run under normal DOS, you
|
|||
|
|
can not use David DOS and you must use the first alternative.
|
|||
|
|
|
|||
|
|
CONCLUSION:
|
|||
|
|
|
|||
|
|
This completes our discussion of ROM cards and what configuration is most
|
|||
|
|
desirable. In summary, we would like a ROM card with an old style F8 monitor
|
|||
|
|
ROM, The Inspector, and ultimately, INTEGER BASIC and WATSON. Next we will
|
|||
|
|
discuss some general methods of deprotecting single load programs.
|
|||
|
|
|
|||
|
|
---------------------------------------
|
|||
|
|
|
|||
|
|
INTRODUCTION TO KRAKING PART TWO. USING
|
|||
|
|
SOME MINIMAL HARDWARE.
|
|||
|
|
BY THE DISK JOCKEY.
|
|||
|
|
|
|||
|
|
INTRODUCTION:
|
|||
|
|
|
|||
|
|
Assuming that you have read part one of this series, you now should possess
|
|||
|
|
some basic information regarding the ar chitecture of the Apple computer. Using
|
|||
|
|
this basic information you will g o quite far down "memory lane" in your kraking
|
|||
|
|
efforts, but it doesn't stop th ere. Now we need to talk about some basic
|
|||
|
|
hardware you will need to make yo ur job easier. What we will be discussing is
|
|||
|
|
the use of resets and "NM Is" in the art of kraking.
|
|||
|
|
|
|||
|
|
As you have probably noticed, when you try to reset from a protected program
|
|||
|
|
with your II+ or //e, the computer can do some strange things. This is because
|
|||
|
|
the reset key is actually a programable key that when hit, can be made to run a
|
|||
|
|
program within memory. In most cases, t he program that is run clears memory
|
|||
|
|
and re-boots your disk. This of course keeps undesirables from snooping through
|
|||
|
|
memory, discovering any secrets a publisher may be hiding.
|
|||
|
|
|
|||
|
|
The reason the reset key is programable computer will jump to the address
|
|||
|
|
point $3F3, in "backassward" order. This mean s if $3F2 = 00 and $3F3 = 60,
|
|||
|
|
then upon reset you will jump to $6000. The worst part about this is there is
|
|||
|
|
no way to stop it unless you use some hard ware (although you may use a RAM
|
|||
|
|
card, I will discuss this method later) .
|
|||
|
|
|
|||
|
|
The hardware I am getting to is the fam ed "old F8 monitor ROM", which when
|
|||
|
|
you hit reset, jumps unconditionally to $FF59 and puts your program to a halt
|
|||
|
|
and leaves you in monitor. Using this c hip, you may break out of any program
|
|||
|
|
and examine memory. Now you ask, "what the hell is a old F8 monitor ROM
|
|||
|
|
anyways?".
|
|||
|
|
|
|||
|
|
The F8 monitor ROM is a set of programs that oversees the operations of your
|
|||
|
|
Apple, and hence is called a "monitor". It is a ROM because it is "Read Only
|
|||
|
|
Memory", or a permanent memory, as oppo sed to random Access Memory, or RAM.
|
|||
|
|
The reason it is called a "F8" ROM is because it occupies memory from $F800 to
|
|||
|
|
$FFFF. The chip is located jus t in front of the peripheral slots on the II+,
|
|||
|
|
and should be labeled "ROM- F8". On a //e, this chip is not as accessible as on
|
|||
|
|
the II+, and generally you are "SOL" (shit out of luck) in trying to replace it.
|
|||
|
|
But fear not, ref er to the article "The ROM card" or "RAM card Resets" for help
|
|||
|
|
in your effo rts.
|
|||
|
|
|
|||
|
|
Back in the old days when the Apple was first introduced, it came with the "ol
|
|||
|
|
d style F8 monitor ROM". But later it was replaced by the "autostart F8 monitor
|
|||
|
|
ROM". It would be most easy for us to f ind the old style ROM and replace it
|
|||
|
|
with our present autostart monitor ROM. This would allow us to reset out of an
|
|||
|
|
y program, at any time with it installed. But before you run out and buy one,
|
|||
|
|
read on as I introduce another topic th at will parallel our ROM discussion.
|
|||
|
|
|
|||
|
|
|
|||
|
|
INTRODUCING THE NMI:
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
NMI is an acronym for NON MASKABLE INTE RRUPT, and as the name implies, it can
|
|||
|
|
not be prevented (or masked) on the Apple. The NMI is the basis behind mos t of
|
|||
|
|
the "copy cards" on the market, such as the Wildcard or Replay cards. The NMI
|
|||
|
|
allows us to interrupt a program, a nd to restart it with minimal effort.
|
|||
|
|
Obviously this is of extreme importance to the krakist, who wants to interrupt a
|
|||
|
|
programs, save memory to a normal DOS disk, and restart the program upon BRUNing
|
|||
|
|
the file.
|
|||
|
|
|
|||
|
|
To use an NMI you can simply crossed pi n 26 (ground) and pin 29 (NMI) of any
|
|||
|
|
one of the peripheral slots. You can do this with a 100 ohm resistor. This wil
|
|||
|
|
l execute an NMI.
|
|||
|
|
|
|||
|
|
Unfortunately, this is less than ideal since when you try to do this, you will
|
|||
|
|
probably execute 20 or so NMI's. This i s because it happens so fast, that an
|
|||
|
|
NMI will interrupt an NMI, and so on fo r many, many times. This will put much
|
|||
|
|
garbage onto the stack (page one). Using a switch for this chore doesn't help
|
|||
|
|
since the switch actually slams (o r bounces) against itself many times causing
|
|||
|
|
the same problem. To solve this we need to make a "de-bounced" NMI switch.
|
|||
|
|
This will constitute about $8 t o $20 of capital resources (depending on your
|
|||
|
|
parts supplier), and a solderin g iron. This is considerably less expensive
|
|||
|
|
than a store bought NMI board, but will lack some of the features the commercial
|
|||
|
|
ones have. A fu ll discussion of how to make an NMI board is in the file
|
|||
|
|
"KRAKING PART TWO. C".
|
|||
|
|
|
|||
|
|
Assuming you have made your NMI card, I will now tell you more about how it
|
|||
|
|
works and its uses. If you don't fully understand the workings of the NMI,
|
|||
|
|
don't worry about it. Just try and foll ow along.
|
|||
|
|
|
|||
|
|
When you push the NMI switch, the 6502 processor will push the present value
|
|||
|
|
of the program counter on the stack alo ng with the processor status word. Then
|
|||
|
|
it will jump to what ever location s are pointed to by $FFFA and $FFFB. So the
|
|||
|
|
restart a interrupted pro gram, we only need to restore the registers (x, y,
|
|||
|
|
accum), the lower page s of memory, and the stack pointer, and do a "RTI"
|
|||
|
|
(return for int errupt) instruction.
|
|||
|
|
|
|||
|
|
Now remember our old F8 monitor ROM? We ll these two locations live in the
|
|||
|
|
monitor ROM. It would be nice if we cou ld change these location and after an
|
|||
|
|
NMI is executed, run a small program to that will save the registers, the stack
|
|||
|
|
pointer, and the lower pages of m emory. Now this leads us back to our old
|
|||
|
|
friend, the F8 monitor ROM.
|
|||
|
|
|
|||
|
|
This is indeed what we need to do. The best thing would be to execute an NMI,
|
|||
|
|
and then jump to a routine that moves t he lower 16K of memory into a RAM card.
|
|||
|
|
Then we could boot a 16K slave di sk (which would only disturb the lower 16K of
|
|||
|
|
memory), and save all of m emory to a disk. After we have saved all of memory,
|
|||
|
|
we could reconstruct our program and re-start, or do a "return from interrupt".
|
|||
|
|
|
|||
|
|
Of course to do this we need to change some of the code in the F8 monitor ROM.
|
|||
|
|
We can not do this directly to the F8 c hip that comes with your Apple since it
|
|||
|
|
is Read Only Memory. But we can move the code in the ROM down to RAM, put our
|
|||
|
|
routines in, and burn a new "2716 E PROM". The 2716 EPROM will replace the ROM,
|
|||
|
|
and will have our new kraking rout ines in it.
|
|||
|
|
|
|||
|
|
Now you ask, "how do I burn a 2716 EPRO M?". Well, if you don't have access
|
|||
|
|
to an EPROM programmer, you can take yo ur modified F8 code (saved to a disk) to
|
|||
|
|
a local computer store and they shou ld be able to burn you one for a nominal
|
|||
|
|
fee.
|
|||
|
|
|
|||
|
|
Refer to the article entitled "KRAKING PART TWO.B" for an explanation of how
|
|||
|
|
to create the code for the new EMPROM a nd how to plug it in after it is burnt.
|
|||
|
|
|
|||
|
|
Lastly, we need to make a 16K slave dis k and to use the program to save all
|
|||
|
|
of memory to a disk. To get the program type it in or download it from someone
|
|||
|
|
. To create a 16K slave disk, do the foll owing: (NOTE: this only applies to
|
|||
|
|
the Apple II or II+)
|
|||
|
|
|
|||
|
|
1) Turn off your computer.
|
|||
|
|
|
|||
|
|
2) Open the lid, and look for the 3 row s of chips that have a white line
|
|||
|
|
boarder around them. These are the 48K of RAM in your Apple II+.
|
|||
|
|
|
|||
|
|
3) Remove any one chip from each of the two rows of RAM furthest away from the
|
|||
|
|
keyboard.
|
|||
|
|
|
|||
|
|
4) Turn the computer on and boot your D OS 3.3 System Master.
|
|||
|
|
|
|||
|
|
5) Put a blank disk in the drive and ty pe:
|
|||
|
|
|
|||
|
|
]INIT RAM 48K SAVER
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
6) When this is complete, turn the comp
|
|||
|
|
|
|||
|
|
uter off and replace the two chips.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
7) Run a sector editor and change the f ollowing sectors of the 16K slave
|
|||
|
|
disk:
|
|||
|
|
|
|||
|
|
|
|||
|
|
TRK SECTOR BYTE FROM TO
|
|||
|
|
------------------------------
|
|||
|
|
$00 $01 $48 $03 $00
|
|||
|
|
$00 $0D $42 $06 $34
|
|||
|
|
|
|||
|
|
8) Write the sector back out to your 16 K slave disk.
|
|||
|
|
|
|||
|
|
9) Delete the Hello program on the disk by typing:
|
|||
|
|
|
|||
|
|
]DELETE RAM 48K SAVER
|
|||
|
|
|
|||
|
|
Now download the "RAM 48K SAVER" file a nd save it to your 16K slave disk.
|
|||
|
|
Also down load the file "MEMORY MOVE WR ITER". Save these to your 16K slave
|
|||
|
|
disk also, and then write protect it.
|
|||
|
|
|
|||
|
|
In the next episode, I will discuss how to use these hardware and software in
|
|||
|
|
a real-life application.
|
|||
|
|
|
|||
|
|
---------------------------------------
|
|||
|
|
|
|||
|
|
DEPROTECTION PART THREE.
|
|||
|
|
PRACTICAL USES FOR THE NMI/MODIFIED ROM HARDWARE.
|
|||
|
|
BY THE DISK JOCKEY
|
|||
|
|
|
|||
|
|
Now that you have burned your own F8 mo nitor ROM, constructed your own NMI
|
|||
|
|
board and created a 16K slave disk with the previously mentioned files, its time
|
|||
|
|
to put it all together and use it (also make sure you have a RAM card in slot
|
|||
|
|
0). The primary use for these hard ware devices is for the single load program.
|
|||
|
|
As a practical example, we wil l be putting the Locksmith 5.0 fastcopy program
|
|||
|
|
into a file. This prog ram is a really fast normal DOS copy program that is
|
|||
|
|
worth having in a file.
|
|||
|
|
|
|||
|
|
First turn off your computer and instal l your new F8 monitor EPROM into the
|
|||
|
|
motherboard, and put your NMI board in any slot. Now boot your Locksmith 5.0
|
|||
|
|
(an original or a copy will do) and select the "16 sctr utilities" option. Next
|
|||
|
|
select the "16 sector fast disk ba ckup". Now just after the drive stops
|
|||
|
|
spinning, and before you see the prompt "drive- original:1", hit the NMI switc h
|
|||
|
|
on your NMI card. You should then be in the monitor.
|
|||
|
|
|
|||
|
|
Now boot your 16K slave disk. The "RAM 48K SAVER" program will run and will
|
|||
|
|
initialize a disk and save all 48K of m emory to your disk.
|
|||
|
|
|
|||
|
|
Finally, run the "MEMORY MOVE WRITER" p rogram and select the number of moves
|
|||
|
|
as one. Next select the running address as $8000. Use a forward memory move,
|
|||
|
|
and enter the start page as $40, and th e hi page as $80. Next select the
|
|||
|
|
starting page to move to as $00. Finall y, select the text page, page one, and
|
|||
|
|
full text. Now enter $8024 as the address to jump to and save the memory move
|
|||
|
|
program to disk.
|
|||
|
|
|
|||
|
|
Now its time to put all these files tog ether as the final product. Boot a
|
|||
|
|
normal 48K disk and Bload the following files by typing:
|
|||
|
|
|
|||
|
|
]BLOAD ^00-3FFF,A$4000
|
|||
|
|
]BLOAD MEMORY MOVE $8000,A$8000
|
|||
|
|
]BLOAD RERUN,A$8024
|
|||
|
|
|
|||
|
|
Now make the file run when you brun it by typing:
|
|||
|
|
|
|||
|
|
]CALL -151
|
|||
|
|
|
|||
|
|
*3FFD:4C 00 80
|
|||
|
|
|
|||
|
|
|
|||
|
|
Now we can save the final product by ty ping:
|
|||
|
|
|
|||
|
|
*BSAVE LS 5.0 FASTCOPY,A$3FFD,L$4040
|
|||
|
|
|
|||
|
|
Congratulations! You now have deprotect ed the Locksmith fast copy program
|
|||
|
|
into a file that you may brun a nytime!
|
|||
|
|
|
|||
|
|
This technique will work well for depro tection other single load programs
|
|||
|
|
too! The main advantage to this techniq ue is that you don't have to find the
|
|||
|
|
starting address of the progra m to restart it. The program will just start up
|
|||
|
|
from the point where you interrupted it.
|
|||
|
|
|
|||
|
|
The only other thing you really must do is determine what parts of memory you
|
|||
|
|
must save so the program will run. REME MBER, YOU MUST ALWAYS SAVE MEMORY FROM
|
|||
|
|
$00 TO $2FF FOR THIS PROCESS TO WO RK CORRECTLY! Use the Memory Move Writer to
|
|||
|
|
rearrange memory so you can s ave it in a normal DOS binary file.
|
|||
|
|
|
|||
|
|
If you want further practice in using y our NMI/F8 EPROM hardware, write a
|
|||
|
|
program in APPLESOFT that some some scr een displaying and interrupt the
|
|||
|
|
program. Then try and reconstruct it us ing the same technique as described
|
|||
|
|
above and restart the program.
|
|||
|
|
|
|||
|
|
You can save the BASIC program in a Bfi le by saving $00 to $7FF and from $800
|
|||
|
|
to the end of the program, where e ver that might be (zero page locations $AF
|
|||
|
|
and $B0 will give you the ending lo cation of a APPLESOFT program, in
|
|||
|
|
backassward order). You might also have to save some of the variable storage
|
|||
|
|
for your BASIC program, which lives fro m $95FF down (depending on size). The
|
|||
|
|
best thing to do is to experiment, and practice makes perfect.
|
|||
|
|
---------------------------------------
|
|||
|
|
|
|||
|
|
|