• Please review our updated Terms and Rules here

assistance requested on project to contribute to Apple II community

M

mlemmert11

Member
Joined
Oct 28, 2015
Messages
40
I’m working on a project to generate disk images for Ultima III and donate them to the user community (for backup purposes only) because the current images out there (with the exception of the ProDOS version only playable on a CFFA card) has some bugs that make the game almost unwinnable (i.e. crash upon encountering gremlins). This is the only version Apple II users who don’t own a CFFA card have available right now (i.e. this buggy version is the only one that can be written directly to floppies via ADTPro), at least that I can find and I spent many hours searching and downloading.

I’ve tracked down and purchased an original copy of the game that has a player master that hasn’t been ruined by previous owners playing on it directly (another big problem, but solved). Now the challenge is to create the disk images. From what I’ve read this requires removing the copy protection from the original disk before creating a disk image for backup purposes. I found an article on how to do so in the magazine Softkeys Volume III (ftp://ftp.apple.asimov.net/pub/appl.../hardcore_computist/book.of.softkeys.vol3.pdf)

The article makes use of a piece of software called Super IOB, downloadable from Apple2Online, Asmiov etc., which crashes when following the instructions in the article. When the crash occurs the display jumps to the system monitor and displaying a bunch of hex values.

After several days of hacking on this I narrowed down the problem to a source that was very surprising to me.

Super IOB is written, at least mostly, in Applesoft Basic. The program crashes at line 80 due to a return without gosub statement. Line 80 is accessed via a goto statement in line 520. Upon the error it jumps to the system monitor instead of displaying the usual “return without gosub” error I think because some poke calls modified some memory addresses which create that behavior for some reason (I don’t know much about the mode known as the “system monitor”).

There are about a zillion things I could have done wrong following the instructions of the article, but I know enough basic programming to strongly suspect that it wouldn’t have mattered what I did. A return without gosub is going to crash the program. Yet this is the basic code that exists on the disk image for Super IOB, and it was in a location in the program that it would have affected any software title, not just Ultima III. Additionally, I found a listing of the Super IOB source code in Softkeys Volume II and the same issue exists, which strongly implies to me the code is correct but I can't comprehend how the program can function as written.

I’m writing this post just in case somebody has encountered this problem with Super IOB , knows anybody who might who I can try to contact, or has any ideas in general to help move the project forward?

If there is any additional information that would be helpful, just let me know.


Thanks!

=====UPDATE TO ORIGINAL POST====

I misstated the source of the crash in SuperIOB. It's crashing on line 100, which pokes some addresses based on the value of the variables for track, sector etc. How the program gets to line 100 blows my mind. There are return statements without gosubs statements in this code, which should crash it way before it gets to line 100. But I'm not going to worry about that for now and will try focusing on how the variables in line 100 are set, and their values when the program crashes to try to sheet some light on why the program is crashing.
 
Last edited:
SomeGuy said:
The way you do it these days it to image the disk with a Kryoflux and/or SuperCard pro (never permit writing to the original disk)
Click to expand...

Therefore try using EDD+. The prodos images are transferable to 800K diskettes via ADTpro. CFFA is not necessary at all. Just a //GS with an 800K FDD...
 
My partner and I used to crack a lot of protected AII software back in the day. Are you able to make a copy of the disk with Locksmith or Super Disk copy?

If the game only checks the protection on boot then a Wildcard might do the job. If not I'll have to dust off the HP1611A logic analyzer. Very useful tool for examining machine code running on the AII. Cracked a lot of software back in the day with this bad boy.
 
pcjunky said:
My partner and I used to crack a lot of protected AII software back in the day. Are you able to make a copy of the disk with Locksmith or Super Disk copy?

If the game only checks the protection on boot then a Wildcard might do the job. If not I'll have to dust off the HP1611A logic analyzer. Very useful tool for examining machine code running on the AII. Cracked a lot of software back in the day with this bad boy.
Click to expand...

Thanks for the reply!

I am able to copy the software using Copy II plus 6.0. Back in the 1980s I recall that I was also able to do it with Locksmith 6.0. However, for reasons that I don't fully understand, postings in other forums have indicated that the copy protection must actually be stripped off in order to make a disk images using software such as ADTPro and CiderPress. Why a copy program like Locksmith can make a replica of a copy protected disk and a disk imaging program can't is beyond knowledge level.


What do you think? Any help/suggestions are greatly appreciated!

There is an article in Softkeys Volume III that explains how the copy protection scheme on this software (Exodus: Ultima III) works. This is the first time I've attempted something like this, and my knowledge of machine language and assembler is mainly conceptual, so much of what I'm reading I do not fully understand. If it helps, here is part of what the article says about the copy protection scheme:

"The address and data marks on the disk are changed extensively throughout the disk. The only tracks that are used on the disk are $0 - $10, the rest of the tracks being unformatted". The disk is similar to normal DOS 3.3 in that it uses normal DOS 3.3 RWTS calls and an IOB."

A more detailed explanation of the copy protection scheme is available at ftp://ftp.apple.asimov.net/pub/apple...tkeys.vol3.pdf (see page 120 of the book, page 121 of the PDF document).

The article actually give step by step instructions to deprotect the software using a a method they call boot tracing, but as mentioned I'm stuck because the Super IOB program they say to use crashes.
 
george said:
Therefore try using EDD+. The prodos images are transferable to 800K diskettes via ADTpro. CFFA is not necessary at all. Just a //GS with an 800K FDD...
Click to expand...

George & Someguy,

Thanks for your replies! I wasn't aware of these options. Unfortunately I do not have an Apple IIGS. I did some quick research on Kyroflux and SuperCards and I'm going to continue to try to do it the old fashioned way for now and avoid purchasing special hardware. But again that's great to know these options exist.
 
mlemmert11 said:
I did some quick research on Kyroflux and SuperCards and I'm going to continue to try to do it the old fashioned way for now and avoid purchasing special hardware. But again that's great to know these options exist.
Click to expand...
The hardware options are not really the way you want to approach this (as you already decided). You don't want to make a flux-accurate copy of the disk... you want to "normalize," or deprotect the disk. You want to remove/avoid/defeat the protection scheme that the authors put in place. This is a very different thing than faithfully reproducing (or even extracting) the bit patterns on the disk.

And that's what the hotkey document was trying to help you do... but it's not a process for the faint of heart. If you have a Twitter account, get in touch with #4am. This is a contemporary person skilled in the art of deprotection that has been extremely active lately (look up any file on Asimov ending in "...(4am crack).txt").
 
I'd recommend doing both. Make an accurate copy of the original and a decrypted version.

I'd love to have a version of Ultima V that can be played form a HDD.
 
david__schmidt said:
The hardware options are not really the way you want to approach this (as you already decided). You don't want to make a flux-accurate copy of the disk... you want to "normalize," or deprotect the disk. You want to remove/avoid/defeat the protection scheme that the authors put in place. This is a very different thing than faithfully reproducing (or even extracting) the bit patterns on the disk.

And that's what the hotkey document was trying to help you do... but it's not a process for the faint of heart. If you have a Twitter account, get in touch with #4am. This is a contemporary person skilled in the art of deprotection that has been extremely active lately (look up any file on Asimov ending in "...(4am crack).txt").
Click to expand...

Thank you very much for your offer of assistance! It sounds like you are very knowledgable in this area.

I do not have a twitter account, but I will set one up and contact you soon. Is there any particular time of day that you'd prefer?
 
Alternate disk images tested

Alternate disk images tested

I tried the Ultima Trilogy.zip file on Asmivo recently pointed out by another user (thanks again!).

Here was the result:

The boot disk works fine but the player disk hangs (both the player disk created from the disk image and a confirmed working player disk copy from the original game I own). I followed the instructions in the Ultima Trilogy Notes.txt file about using volume labels 1 & 2, etc.

From reading the notes file, a modification was made to enable the disks to work in an emulator. The notes files says it doesn’t affect use via floppies on an Apple II, yet the player disk hangs for me on my particular system (Apple IIE).

Maybe I could get it to work with some horsing around. But, I think it would be nice to have a version Ultima III available that can be burned to floppies with ADTPro or similar software with no special work arounds. Accordingly, I’m going to continue my project to attempt to remove the copy protection from the floppies I own and create disk images that are easy to use for users with physical Apple II computers.
 
Last edited:
david__schmidt said:
You don't want to make a flux-accurate copy of the disk... you want to "normalize," or deprotect the disk. You want to remove/avoid/defeat the protection scheme that the authors put in place. This is a very different thing than faithfully reproducing (or even extracting) the bit patterns on the disk.
Click to expand...

David,

Do you know why this is?

I’m running into a mental block on understanding this because if a copy program like Copy II Plus, with built in knowledge of the protection scheme on many disks, can make a flux accurate copy to floppy disk, it would seem logical to me that a disk imaging program with built in knowledge of the protection scheme could make an exact binary replica of a protected floppy disk, store it in a disk image file, and then later read that disk image file and write the binary back to a floppy disk. The protection would exist after the disk image was extracted to the floppy, but that doesn’t seem like a big deal as long as it runs.

I considered the possibility that the disk imaging programs just weren’t written to be that “smart” unlike the commercial copy software programs of the 1980s. But it seems like there is more to it because the “automatic” solutions like Kyroflux and SuperCards for some reason require special hardware to make it all work. (by automatic I just mean they can make disk images from protected disks without removing the protection, at least as I understand it).

Thanks much if you have any insights.

This question is one of the mysteries of the universe that I can’t stop thinking about lately LOL, and if I understand this better it might help me figure out what I’m doing wrong with the Ultima III crack.

p.s.

I founded my copy of the Apple II Users Guide last night in some old boxes, and brushed up on the system monitor, machine, and assembly langue. I’m going to do some more work on this before contacting #4A so that I can helpfully at least narrow down my questions to something much more specific than I have now. Thanks again for the contact.
 
mlemmert11 said:
I tried the Ultima Trilogy.zip file on Asmivo recently pointed out by another user (thanks again!).

Here were the result:

The boot disk works fine but the player disk hangs (both the player disk created from the disk image and a confirmed working player disk copy from the original game I own). I followed the instructions in the Ultima Trilogy Notes.txt file about using volume labels 1 & 2, etc.

From reading the notes file, a modification was made to enable the disks to work in an emulator. The notes files says it doesn’t affect use via floppies on an Apple II, yet the player disk hangs for me on my particular system (Apple IIE).

Maybe I could get it to work with some horsing around. But, I think it would be nice to have a version Ultima III available that can be burned to floppies with ADTPro or similar software with no special work arounds. Accordingly, I’m going to continue my project to attempt to remove the copy protection from the floppies I own and create disk images that are easy to use for users with physical Apple II computers.
Click to expand...

I had no trouble running the Ultima III images in Ultima Trilogy.zip with the latest AppleWin 1.25.03. I did not need to change the Disk Volume ID as indicated in the readme. Do the images work on your Apple IIe with the Volume ID changed? The maker of the images indicated he had a problem with Mockingboards and an accelerated IIe, but not on a stock Apple IIe.
 
=====UPDATE====

Thank to everyone who was replied so far.

I’ve significantly narrowed down the problem since posting this thread, so I’m posting an update.


After brushing up on assembly language, I observed the following:

*In the boot tracing process the jump out to the monitor in Boot1 isn’t working, thus ultimately the BSAVED file for use with Super IOB isn’t what is should be, causing Super IOB to crash.

*I noticed upon a closer read that the softkey articls say it requires a 48k Apple II computer. I’m using an Apple IIe which I think has two 64k memory cards. I’m not 100% sure, but I suspect that the operation of boot1 is different on an Apple IIe than on an Apple II plus, which is why keying in the code from the Softkeys article verbatim doesn’t work.

I tried Softkeys for other problems and hit the same problem in boot1 (the Softkey says to modify the jump instruction at a memory address where there is no jump instruction). I think this supports the theory that there is something “different” about my system than what was contemplated by the Softkeys. Not surprising I suppose given the low level nature of this activity.


*My next thought was to examine the assembly code in boot1 and to try to figure out how to adjust the Softkey article’s instructions to accommodate.

I encountered some very odd behavior in boot1. There are certain commands that aren’t functioning as I’d expect them to. To understand boot1 on my Apple IIe I’m going to need to know a lot more assembler than I know. I’m working on that by reading some great books and fiddling around. And, I also posted another topic to this forum detailing a very specific assembly language question that I have, the answer to which will help me move the Ultima III project forward.


A link to that other topic is here:

http://www.vintage-computer.com/vcf...odd-JMP-behavior-in-boot1&p=388230#post388230


Thanks again to all who have replied and I appreciate any additional insights anyone may have given this new information.
 
mlemmert11 said:
David,

Do you know why this is?

I’m running into a mental block on understanding this because if a copy program like Copy II Plus, with built in knowledge of the protection scheme on many disks, can make a flux accurate copy to floppy disk, it would seem logical to me that a disk imaging program with built in knowledge of the protection scheme could make an exact binary replica of a protected floppy disk, store it in a disk image file, and then later read that disk image file and write the binary back to a floppy disk. The protection would exist after the disk image was extracted to the floppy, but that doesn’t seem like a big deal as long as it runs.
Click to expand...

The main problem is that the Disk II is mostly CPU-controlled, so there was approximately infinite variety in the way protection schemes could be formulated. If you spend some time going through 4am's writeups about how protection and deprotection is applied in specific cases, you'll start to get a feel for this (and you'll learn some wicked assembly in the process). The most fundamental reason there exists formats that can be read but not written by the Disk II controller is its own state machine. This thread has more on that subject:
http://www.applefritter.com/content/saving-nib-images-back-physical-diskettes
 
====UPDATE===

I’ve made significant progress, and was able to resolve the problem described in the last update with boot1 thanks to the help of david_schmidt, pcjunky, and sellam in the assembly language thread (
http://www.vintage-computer.com/vcfo...230#post388230)

I was able to load and BSAVE the custom RWTS of Ultima III and input it into Super IOB as the Softkey article described. Super IOB gets past the point it was crashing, but when it tries to read the Ultima III disk the drive spins endlessly and the track/sector never progresses past 00.

If I recall there were two or more releases of Ultima III for the Apple II. If the RWTS were modified even slightly I could see that causing a problem. The only way to proceed I think is for me to learn more about RWTS and see if I can figure out where the misalignment is between the custom RWTS of Ultima III and Super IOB’s expectations on how it is setup.
 
You must log in or register to reply here.
Back
Top