Today I hacked ...

discussion of beeb/electron applications, languages, utils and educational s/w
User avatar
flaxcottage
Posts: 2796
Joined: Thu Dec 13, 2012 8:46 pm
Location: Derbyshire

Today I hacked ...

Postby flaxcottage » Fri Jan 02, 2015 8:11 pm

During my archiving of BBC educational titles I have come across several different methods of protecting software so I thought I would start this thread to pool software hacking experience.

My latest conquest is Reading Pack 1 by Highlight Software. This was one of several similar titles sent to me by Dave_E from this thread viewtopic.php?f=32&t=9040

There was multi-level protection on the disc;

    1. The disc was a 40/80T hybrid, designed to run on 40T,
    2. Only tracks 0 and 29 to 39 in 80T mode were formatted and included data,
    3. Track 11 in 40T mode contained only one sector and that had a Data CRC error. The Track ID was also phoney, announcing itself as Track 22. (This corresponded to tracks 22 and 23 in 80T mode.)
    4. The disc title contained VDU23 commands that slowly faded the screen and hung the machine.
    5. The filenames on the disk all had top-bit-set characters so they would not appear on the catalogue.
    6. There were only three files appearing on the disc.
    7. The disc size had been wrongly set.
    8. The BASIC programs were hidden on the formatted part of the disc and encrypted as well.
    9. The BASIC programs had machine code sections below PAGE and above TOP

The first line of attack was to examine !BOOT which was machine code. Amongst other things this program loaded code from &4000 to &57FF and decrypted it by EORing with &35. It then placed *BASIC|MPAGE=&4300|MOLD|MVDU6|MRUN|M into the keyboard buffer. !BOOT did not check for the Data CRC error or that other tracks were not formatted.

Extracting the code that !BOOT loaded allowed me to work out that it loaded one of two other programs directly from the disc surface and that it did not check for faulty formatting either.

The entry to cracking the protection was now clear. Using ADI and switching both my disc drives to 80T I copied Track 0 to a newly formatted 80T disc. I then copied tracks 29 to 39 inclusive.

Using the copied disk in 80T mode the software loaded and ran properly. It would not, however copy nor would it make an archive. Again using ADI I edited the catalogue sectors to remove the VDU23 trap in the disc title and I reset the disc size in T0 S1 to reflect the 80T size. Exporting to USB using my datacentre produced the SSD archive.

I did not change the filenames so that when *CAT is performed the disc looks blank. Kind of cute I thought. :twisted:
- John

Currently running Level 4 Econet with BBC B, BBC B+ 128K, Master 128K, 4Mb A3000, 4Mb A3020, 4Mb A4000, 4Mb A5000 dual FDD; UK101; HP41CX setup; Psion 3a, 3mx and 5mx; Z88; TI-58c, TI-59 and printer, HP-16C programmer's calculator

User avatar
flaxcottage
Posts: 2796
Joined: Thu Dec 13, 2012 8:46 pm
Location: Derbyshire

Re: Today I hacked ...

Postby flaxcottage » Fri Jan 02, 2015 8:26 pm

Other hacks reported can be found here;

- John

Currently running Level 4 Econet with BBC B, BBC B+ 128K, Master 128K, 4Mb A3000, 4Mb A3020, 4Mb A4000, 4Mb A5000 dual FDD; UK101; HP41CX setup; Psion 3a, 3mx and 5mx; Z88; TI-58c, TI-59 and printer, HP-16C programmer's calculator

User avatar
leenew
Posts: 3396
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire

Re: Today I hacked ...

Postby leenew » Fri Jan 02, 2015 8:49 pm

There is a sort of beginner's guide covering tape to disc transfers over at 8-bit
http://www.8bs.com/artt2d.htm :wink:
Lee.

User avatar
sydney
Posts: 1985
Joined: Wed May 18, 2005 9:09 am
Location: Newcastle upon Tyne

Re: Today I hacked ...

Postby sydney » Sat Jan 03, 2015 9:16 am

leenew wrote:There is a sort of beginner's guide covering tape to disc transfers over at 8-bit
http://www.8bs.com/artt2d.htm :wink:
Lee.


Cheers Lee, had a quick read and it looks very interesting.

User avatar
flaxcottage
Posts: 2796
Joined: Thu Dec 13, 2012 8:46 pm
Location: Derbyshire

Re: Today I hacked ...

Postby flaxcottage » Mon Jan 05, 2015 10:25 pm

Highlight Software Reading Pack 1A has just been cracked.

The protection here revolved around a peculiar disc format. The disc is definitely 40T when it runs but has been formatted as though it were an 80T disc. Only even-numbered tracks were formatted. Tracks 0-12 and then tracks 52-78. Tracks 11 and 13 had only one sector formatted and that contained a data CRC error. All other tracks were unformatted.

The way this was cracked was to format a blank disc to 40T. The drives were then switched to 80T mode. Using ADI the even numbered tracks mentioned above were manually copied one track at a time. (I shall write a program to automate this process for the other discs but I wanted to see if it worked first.)

Switching back to 40T and the program ran as expected. The disc verified correctly in 40T mode and *EXPORT worked, producing the SSD, which ran correctly in BeebEm 4.14.

These guys were quite sneaky. =D> but not sneaky enough! [-X :lol:

Edit:
Almost forgot ... The logical track numbers were all double the physical track number. The software must use this to enable reading on a 40T drive even though an 80T format was used.
Last edited by flaxcottage on Tue Jan 06, 2015 7:31 am, edited 1 time in total.
- John

Currently running Level 4 Econet with BBC B, BBC B+ 128K, Master 128K, 4Mb A3000, 4Mb A3020, 4Mb A4000, 4Mb A5000 dual FDD; UK101; HP41CX setup; Psion 3a, 3mx and 5mx; Z88; TI-58c, TI-59 and printer, HP-16C programmer's calculator

User avatar
leenew
Posts: 3396
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire

Re: Today I hacked ...

Postby leenew » Mon Jan 05, 2015 10:30 pm

=D> You are becoming quite a disc guru John!
I wish I knew about this stuff!
Even back in the 80s I didn't know about disc protection. All my efforts were tape to disc. I think it probably stemmed from me not being able to afford disc versions :-)
Lee.

User avatar
flaxcottage
Posts: 2796
Joined: Thu Dec 13, 2012 8:46 pm
Location: Derbyshire

Re: Today I hacked ...

Postby flaxcottage » Mon Jan 05, 2015 10:39 pm

leenew wrote:=D> You are becoming quite a disc guru John!


Thanks, Lee. I'm not really, though.

I just thrash around in the dark and get lucky. So far I haven't met protection that reads bytes from the inter-sector gaps, well not officially. I have met a track that had sector 9 as a 512 byte sector rather than a 256 byte one, so I suppose that counts.

BBC DFS is quite easy to understand, especially with the guides that are around. The secret is getting into the head of the programmer who devised the protection in the first place.

I am also getting to know ADFS (sorry Col) but the one that really has me stumped is the Archimedes disc protection. I can read it but not write it.

Then there is the whole world of ARM code that I need to learn to hack the protection used ... #-o
- John

Currently running Level 4 Econet with BBC B, BBC B+ 128K, Master 128K, 4Mb A3000, 4Mb A3020, 4Mb A4000, 4Mb A5000 dual FDD; UK101; HP41CX setup; Psion 3a, 3mx and 5mx; Z88; TI-58c, TI-59 and printer, HP-16C programmer's calculator

User avatar
sydney
Posts: 1985
Joined: Wed May 18, 2005 9:09 am
Location: Newcastle upon Tyne

Re: Today I hacked ...

Postby sydney » Wed Jan 14, 2015 6:37 pm

I'm interested in learning more about this. Could anyone suggest a couple of games that are quite easy to transfer to disk so I can have a go without attempting something too hard and losing heart.

I presume I can just download a uef from the sth archive and create a blank disk and be on my way?

User avatar
richardtoohey
Posts: 3378
Joined: Thu Dec 29, 2011 5:13 am
Location: Tauranga, New Zealand

Re: Today I hacked ...

Postby richardtoohey » Wed Jan 14, 2015 7:37 pm

Do you want a *really* simple one where you just have to:

*TAPE
*OPT 1 2
*LOAD FILE

*DISC
*SAVE FILE

... repeat until all files done. Or something where you'll have to think about a code downloader (to move code from &1900 to &E00 after the last part has loaded)?

Probably the older Acornsoft titles would be a good place to start. This is Labyrinth:

http://www.stairwaytohell.com/bbc/archi ... v1.0_B.zip

Labyrinth-v1.0_B.uef

Code: Select all

>*TAPE
>*OPT 1 2
>*.

LAB        07 07EF    00001900 00001900
?          51 5149    00000E00 00006200
V1         00 0000    FFFFFFFF FFFFFFFF
So you have to cope with changing the filename from "?" to something else ("?" OK on CFS, but to DFS it is a wildcard, so invalid.)

And also the main part loads at E00, so it would need a downloader.

I don't think there is any protection but haven't checked!

User avatar
sydney
Posts: 1985
Joined: Wed May 18, 2005 9:09 am
Location: Newcastle upon Tyne

Re: Today I hacked ...

Postby sydney » Tue Jan 20, 2015 1:06 pm

Thanks for the reply Richard, I'd already started on Arcadians before I'd read your it so I'll describe what I did with that first then move on to Labyrinth.

First of all I simply did a *. to see what is on the tape which gave me a list of file name and some numbers so I went off and did some reading. After learning about *opt and what the numbers mean I started again.

Code: Select all

>*TAPE
>*OPT 1,2
>LOAD""
Searching

Loading

ARCADIANS  04 04B3    00001900 0000801F
>

With my new knowledge I can see that 'ARCADIANS' is 4 Blocks long on the tape, the program is &04B3 bytes in length, it's load address is &1900 and it's execution address is &801F. That doesn't seem right - isn't &801F in ROM?
Anyway, I then LISTed the program to see line 100 is

Code: Select all

*RUN"Arcadians"

Obviously this will be a problem on disk as filenames cannot be more than 7 characters in length so I changed it.

Code: Select all

>100*RUN"ARC1"
>*DISC
>SAVE "ARCADE"

Thats the loader onto disk! Woohoo! Now for the main machine code program.

Code: Select all

>*TAPE
>*LOAD""
Searching

Loading

Arcadians  4B 4C00    00001900 00003F00
>*DISK
>*SAVE "ARC1" 1900 +4C00 3F00 1900

>*BUILD !BOOT
0001 CH."ARCADE"
0002
Escape


And it works - almost! The standard acornsoft loading screen does not appear at all correctly. At first I assumed I was in the wrong screen mode but that's not it.

User avatar
leenew
Posts: 3396
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire

Re: Today I hacked ...

Postby leenew » Tue Jan 20, 2015 1:17 pm

What you have to do Simon is check the value of TOP. Then look at how the program is displaying the Acornsoft Logo. ........
Lee

User avatar
sydney
Posts: 1985
Joined: Wed May 18, 2005 9:09 am
Location: Newcastle upon Tyne

Re: Today I hacked ...

Postby sydney » Tue Jan 20, 2015 1:26 pm

leenew wrote:What you have to do Simon is check the value of TOP. Then look at how the program is displaying the Acornsoft Logo. ........
Lee

Cheers Lee. Just quickly did a list just now and can see what you are getting at. I'd not actually looked at the list other than to change the filename!

User avatar
leenew
Posts: 3396
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire

Re: Today I hacked ...

Postby leenew » Tue Jan 20, 2015 1:39 pm

Yep. Either make sure TOP is the same, or move the graphics for the logo up a bit to give you some room to mess about, and slightly alter the display routine to move it from the new location to the screen rather than from TOP to the screen :D
Lee.

User avatar
flaxcottage
Posts: 2796
Joined: Thu Dec 13, 2012 8:46 pm
Location: Derbyshire

Re: Today I hacked ...

Postby flaxcottage » Tue Jan 20, 2015 1:40 pm

Feels great doesn't it when you have got it working? 8) :D
- John

Currently running Level 4 Econet with BBC B, BBC B+ 128K, Master 128K, 4Mb A3000, 4Mb A3020, 4Mb A4000, 4Mb A5000 dual FDD; UK101; HP41CX setup; Psion 3a, 3mx and 5mx; Z88; TI-58c, TI-59 and printer, HP-16C programmer's calculator

User avatar
tricky
Posts: 1916
Joined: Tue Jun 21, 2011 8:25 am
Contact:

Re: Today I hacked ...

Postby tricky » Tue Jan 20, 2015 1:50 pm

run address of &801f is BASIC1 and &8023 BASIC2 if I remember correctly, but you have probably already worked that out.

duikkie
Posts: 2690
Joined: Fri Feb 07, 2014 3:28 pm

Re: Today I hacked ...

Postby duikkie » Tue Jan 20, 2015 1:50 pm

always do the following thing

PRINT ~TOP-PAGE

if not same as lengte file there is some code above a basic program ;)

User avatar
sydney
Posts: 1985
Joined: Wed May 18, 2005 9:09 am
Location: Newcastle upon Tyne

Re: Today I hacked ...

Postby sydney » Tue Jan 20, 2015 2:14 pm

leenew wrote:Yep. Either make sure TOP is the same, or move the graphics for the logo up a bit to give you some room to mess about, and slightly alter the display routine to move it from the new location to the screen rather than from TOP to the screen :D
Lee.

Because the file name "ARC1" if 5 characters shorter than "Arcadians" the graphic data loaded by the loader is in the wrong place in memory for the display routine. I've changed line 20 from 20REM to 20REM12345 and now TOP is in the correct place. However, it still does not work so back to the drawing board.
flaxcottage wrote:Feels great doesn't it when you have got it working? 8) :D

It does! But it wasn't exactly difficult though. Once I've got the logo problem sorted I'll move onto something harder(Labyrinth has a locked file so counts as harder!)
tricky wrote:run address of &801f is BASIC1 and &8023 BASIC2 if I remember correctly, but you have probably already worked that out.

I'd not worked it out, I'd not even looked at it yet! Just been working on this today as I took a day off to have a bit of 'me time'.
duikkie wrote:always do the following thing

PRINT ~TOP-PAGE

if not same as lengte file there is some code above a basic program ;)

That's a useful tip. I'd figured out there had to be more in the loader than the 10-11 lines of BASIC code and I'd looked at it with exmon too so I've learned a bit about BASIC tokens and how BASIC priograms are stored in memory.

User avatar
leenew
Posts: 3396
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire

Re: Today I hacked ...

Postby leenew » Tue Jan 20, 2015 2:19 pm

Make sure you do the first file from scratch. You probably haven't saved the screen graphics if you have just "SAVED" it instead of *SAVE the whole BASIC program plus the graphics too.
Lee.

User avatar
sydney
Posts: 1985
Joined: Wed May 18, 2005 9:09 am
Location: Newcastle upon Tyne

Re: Today I hacked ...

Postby sydney » Tue Jan 20, 2015 2:31 pm

leenew wrote:Make sure you do the first file from scratch. You probably haven't saved the screen graphics if you have just "SAVED" it instead of *SAVE the whole BASIC program plus the graphics too.
Lee.


Yes. I think that's it. I was messing around loading the tape version followed by my version and got an almost correct logo.

I've just tried this:

Code: Select all

>*INFO "ARCADE"
$.ARCADE      FF1900 FF8023 0000B3 002


I've not looked it up yet but I presume FF1900 is the load address, FF8023 is the execution address (BASIC2 - thanks Tricky) and 0000B3 is the program length, much shorter - &400 bytes,the size of a MODE 7 screen!

Off on the school run now. I'll hopefully get this finished later today.

Zarchos
Posts: 2355
Joined: Sun May 19, 2013 8:19 am
Location: FRANCE

Re: Today I hacked ...

Postby Zarchos » Tue Jan 20, 2015 2:37 pm

OOpps wrong thread sorry.
Last edited by Zarchos on Tue Jan 20, 2015 3:07 pm, edited 3 times in total.

duikkie
Posts: 2690
Joined: Fri Feb 07, 2014 3:28 pm

Re: Today I hacked ...

Postby duikkie » Tue Jan 20, 2015 3:02 pm

if you have trouble with code above a basic program
save the part above top in a file till end code
by doing
*save "ontop" xxxx(=top adress) +lengte(top-page)
example top=&2000 : page=&1900
*save "ontop" 2000 +(lengtefile-(&2000-&1900)

now you can do anything with the basic file
*load ontop ( at newtop)
*save modfile 1900 +(newtop+lengte ontopfile)

easy or not ???

sydney wrote:
leenew wrote:Yep. Either make sure TOP is the same, or move the graphics for the logo up a bit to give you some room to mess about, and slightly alter the display routine to move it from the new location to the screen rather than from TOP to the screen :D
Lee.

Because the file name "ARC1" if 5 characters shorter than "Arcadians" the graphic data loaded by the loader is in the wrong place in memory for the display routine. I've changed line 20 from 20REM to 20REM12345 and now TOP is in the correct place. However, it still does not work so back to the drawing board.
flaxcottage wrote:Feels great doesn't it when you have got it working? 8) :D

It does! But it wasn't exactly difficult though. Once I've got the logo problem sorted I'll move onto something harder(Labyrinth has a locked file so counts as harder!)
tricky wrote:run address of &801f is BASIC1 and &8023 BASIC2 if I remember correctly, but you have probably already worked that out.

I'd not worked it out, I'd not even looked at it yet! Just been working on this today as I took a day off to have a bit of 'me time'.
duikkie wrote:always do the following thing

PRINT ~TOP-PAGE

if not same as lengte file there is some code above a basic program ;)

That's a useful tip. I'd figured out there had to be more in the loader than the 10-11 lines of BASIC code and I'd looked at it with exmon too so I've learned a bit about BASIC tokens and how BASIC priograms are stored in memory.

duikkie
Posts: 2690
Joined: Fri Feb 07, 2014 3:28 pm

Re: Today I hacked ...

Postby duikkie » Tue Jan 20, 2015 3:11 pm

try this
load the 4b3 lengte file in at 1900
*save ontop 19b3 +400

do
old
list
make changes to the basic file ( what ever you want)

print ~top
( 19xx or 20xx)
*load ontop 19xx(or20xx)

*save modnew 1900 +(top+400)




sydney wrote:
leenew wrote:Make sure you do the first file from scratch. You probably haven't saved the screen graphics if you have just "SAVED" it instead of *SAVE the whole BASIC program plus the graphics too.
Lee.


Yes. I think that's it. I was messing around loading the tape version followed by my version and got an almost correct logo.

I've just tried this:

Code: Select all

>*INFO "ARCADE"
$.ARCADE      FF1900 FF8023 0000B3 002


I've not looked it up yet but I presume FF1900 is the load address, FF8023 is the execution address (BASIC2 - thanks Tricky) and 0000B3 is the program length, much shorter - &400 bytes,the size of a MODE 7 screen!

Off on the school run now. I'll hopefully get this finished later today.

User avatar
sydney
Posts: 1985
Joined: Wed May 18, 2005 9:09 am
Location: Newcastle upon Tyne

Re: Today I hacked ...

Postby sydney » Wed Jan 21, 2015 10:52 am

I don't know why but when I *SAVEd the loader there were two bytes corrupted so the file on disk did not match the contents of memory. The two bytes were the first two bytes of the logo screen, TOP and TOP+1. I tried to remedy this by loading the tape version and writing down the value of the word stored at TOP then loading the disk version and changing the word stored at TOP to the correct value:

Code: Select all

>PRINT !TOP
 539007633
>*DISK
>LOAD"ARCADE"
>PRINT !TOP
 539007588 (I CAN'T REMEMBER THE ACTUAL NUMBER)
>!TOP = 539007633
>PRINT !TOP
 539007634 (AGAIN I CAN'T REMEMBER THE NUMBER)
>

This didn't quite work as only TOP+1 kept it's value, Top would not hold the value I wanted. Any ideas why? This has all been done in beebem.
I got around this by loading EXMON 2 and changing the value of the byte there and then *SAVEing the file.
At last - IT WORKS! Now onto something a bit harder, though I do fancy trying to dissasemble Arcadians to see how much of it I can follow.

User avatar
leenew
Posts: 3396
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire

Re: Today I hacked ...

Postby leenew » Wed Jan 21, 2015 11:18 am

Well done :D
Last night I had an hour spare and I tape-to-disced the newest versions (from the tape archive) of Arcadians, Hopper, Snapper, Monsters, Planetoid, and Meteors.
They were all pretty similar but if you want to try Monsters Simon, it does involve a tad more work than Arcadians :D
Lee.
BTW I tried chess but it didn't work :roll:

duikkie
Posts: 2690
Joined: Fri Feb 07, 2014 3:28 pm

Re: Today I hacked ...

Postby duikkie » Wed Jan 21, 2015 12:07 pm

do not use ! but ~ this is a big thing :)

sydney wrote:I don't know why but when I *SAVEd the loader there were two bytes corrupted so the file on disk did not match the contents of memory. The two bytes were the first two bytes of the logo screen, TOP and TOP+1. I tried to remedy this by loading the tape version and writing down the value of the word stored at TOP then loading the disk version and changing the word stored at TOP to the correct value:

Code: Select all

>PRINT !TOP
 539007633
>*DISK
>LOAD"ARCADE"
>PRINT !TOP
 539007588 (I CAN'T REMEMBER THE ACTUAL NUMBER)
>!TOP = 539007633
>PRINT !TOP
 539007634 (AGAIN I CAN'T REMEMBER THE NUMBER)
>

This didn't quite work as only TOP+1 kept it's value, Top would not hold the value I wanted. Any ideas why? This has all been done in beebem.
I got around this by loading EXMON 2 and changing the value of the byte there and then *SAVEing the file.
At last - IT WORKS! Now onto something a bit harder, though I do fancy trying to dissasemble Arcadians to see how much of it I can follow.

User avatar
leenew
Posts: 3396
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire

Re: Today I hacked ...

Postby leenew » Wed Jan 21, 2015 6:52 pm

I am just starting to try a bit of hacking that doesn't involve just BASIC.
My knowledge of 6502 Assembler is just about ZERO :D
So I thought I would start with something easy and see if I could understand it, before tip-toeing further into the rabbit hole...
I have chosen the !BOOT file on Mick Brown's Games discs, as they are *RUN and contain a MENU program all in 1.
it loads at &1900 and execs at &1E00.
It is straightforward to follow but painstaking for me, as I don't know any of the vectors or anything off by heart.
Dis1.jpg

dis2.jpg

dis3.jpg


So:
*FX200,3 - clear RAM on break and disable ESCAPE key
*FX15 - flush all buffers
*FX4,1 - disable cursor keys
*FX144 - *TV0
*FX18 - reset soft keys (is this the function keys?)

Then something I am not sure about....

Then

*FX129,80 - INKEY(80) wait for 0.8 seconds to see if a key is pressed
VDU12 - CLS
*KEY0 PAGE=&1900| OLD| RUN |

Have I got this right?
SO, the bit I am not sure about is at &1E23
This is something to do with interrupts (NMI) what does it actually do?***

and, &1E34, does this put ZERO's (from &1E80 onward) and place them at &0040 onwards for 128 bytes? in other words &0040 to &00C0 will all be zero?

Told you I didn't know anything! :lol:

What is the best one page reference to remind me what FFEE FFF4 FE00 etc. etc. are all pointing to?

I have a "Advanced user guide", a normal "user guide", and "Within the BBC" and a few others to hand but it was like jumping backwards and forwards endlessly trying to find anything.
Is that because I am new to this, and soon it will be obvious to me? - (answers own question - "Yes")

Once I grasp this, I want to move on to some "lightly" protected tape loaders...

So, one more question before I go...

Some games give false info for their load and execution addresses.
I have learned that if you press escape as soon as a file starts to load you can get the load address from !&3BE and the execution address from !&3C2.
I know that the load address from the first block must be the real load address (even if *OPT1,2 gives a different one on the last block) but must the real execution address be the one given by the last block, or the first block??...

*** The menu program itself also has many pokes to FE00 and FE01, what is it doing?

Thanks,
Lee.

User avatar
sydney
Posts: 1985
Joined: Wed May 18, 2005 9:09 am
Location: Newcastle upon Tyne

Re: Today I hacked ...

Postby sydney » Wed Jan 21, 2015 7:02 pm

&FE00 and &FE01 are used to write(and read?) to the 6845 crtc.
I think you write the register number to &FE00 which can then be written to or read from &FE01. In the above case 0 is being written to register 1. I think. No doubt someone will come along and correct me soon.
See page 360 of the advanced user guide.

User avatar
leenew
Posts: 3396
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire

Re: Today I hacked ...

Postby leenew » Wed Jan 21, 2015 7:16 pm

Cheers Simon,
Call me old-fashioned, but why would a menu program for a games disc need to program the 6845?
In the BASIC menu listing, I also find:
?&FE00=6 and ?&FE01=1
?&FE00=6 and ?&FE01=25

Is this approach going to make these menu's less friendly to the Master?

My menus had "Press A to play game A, and press B to play game B!" :roll:

Lee.
Last edited by leenew on Wed Jan 21, 2015 8:19 pm, edited 1 time in total.

User avatar
leenew
Posts: 3396
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire

Re: Today I hacked ...

Postby leenew » Wed Jan 21, 2015 7:27 pm

Well unless I am mistaken, these pokes turn the screen off, and then turn it back on.
The original one at &1E23 seems to turn the screen off too...

Lee.

User avatar
lurkio
Posts: 1284
Joined: Tue Apr 09, 2013 11:30 pm
Location: Doomawangara
Contact:

Re: Today I hacked ...

Postby lurkio » Wed Jan 21, 2015 8:29 pm

leenew wrote:and, &1E34, does this put ZERO's (from &1E80 onward) and place them at &0040 onwards for 128 bytes? in other words &0040 to &00C0 will all be zero?

Not quite, because &1EE0 to &1EFF contains data of some kind, which gets copied to &A0 to &BF, which apparently comprises "Current NMI owners workspace", "Transient command space" and "Filing system scratch space"!

No idea what that's doing. Possibly nothing because if you disable the copy by replacing &1E39 to &1E3B with &EAEAEA, the menu still works!

:-?


Return to “software: other”

Who is online

Users browsing this forum: No registered users and 7 guests