Sadim Castle (MP Software) - Anyone Able To Hack?

reminisce about bbc micro & electron games like chuckie egg, repton, elite & exileRelated forum: adventures


User avatar
Dave_E
Posts: 712
Joined: Fri Jun 16, 2006 12:55 pm
Location: Middlesbrough
Contact:

Sadim Castle (MP Software) - Anyone Able To Hack?

Post by Dave_E » Sat Jul 20, 2013 1:17 pm

Sadim Castle by MP Software is an adventure that is crap and unwinnable because, when each game starts, you are allocated a set number of moves before you will be killed off. So for example, sometimes you get 100 moves, sometimes 125, etc. You need roughly 250 to complete the game.

I attempted to play through it with a solution 100 times a few years ago and on every occasion I was killed off before I made it. I am tremendously pissed off with this particular game.

There is actually a not-too-bad text adventure there, but this death-at-random completely ruins it.

Can anyone hack it and take out whatever powers this death-at-random bit?

User avatar
billcarr2005
Posts: 1191
Joined: Fri Sep 09, 2005 3:01 pm
Location: UK
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by billcarr2005 » Sat Jul 20, 2013 7:12 pm

Are you sure there are a random number of moves, or is it part of "SADIM CASTLE is a real-time adventure,that means the game will continue to play when it is waiting for you to enter a command and the characters you encounter may not wait for you to think."
Might prove hard to remove the timer, since some things might only happen after certain a time has passed.

User avatar
Dave_E
Posts: 712
Joined: Fri Jun 16, 2006 12:55 pm
Location: Middlesbrough
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by Dave_E » Mon Jul 22, 2013 1:37 am

I have no idea. I can only go on my experience with the game as outlined above. If anyone has managed to win it then please let me know.

User avatar
leenew
Posts: 3572
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by leenew » Mon Nov 24, 2014 9:33 pm

Hi Dave,
I see this thread is a bit old, but here's my two penneth.....

MP's other adventure game "Crown of Mardan" is similar in structure, with the odd random element and real time play.
Most versions out in the wild were unwinnable. Unfinishable.
The one on Pernod's disc seemed to be the only winnable version. (Now transferred to Mick Brown's disc 99).

My guess is this is a cruel form of software protection.
Let people copy the game, or THINK they have copied the game, but in fact, the game is just playable but unwinnable.
Maybe the version you had was hampered in this way?
You published a solution, so SOMEBODY completed it!

**EDIT** Just had a go from the UEF and as Dave says.... It's crap! no chance in completing it. This can't be right.

Another thought... could the random number generator be behaving badly, eg was it written for o.s 0.1 and if we use o.s. 1.20 it does not work??
I can't check this as it is in machine code I think. (well it's *RUN anyway)

Cheers,

Lee.

User avatar
leenew
Posts: 3572
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by leenew » Mon Nov 24, 2014 10:23 pm

I have sent an enquiry to the CASA guys.

Lee.

User avatar
richardtoohey
Posts: 3563
Joined: Thu Dec 29, 2011 5:13 am
Location: Tauranga, New Zealand
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by richardtoohey » Mon Nov 24, 2014 11:07 pm

I've unlocked the files and copied to this SSD. This is JUST the files, I haven't put any code in to stop copy protection, or download from &1900 to correct memory locations, etc., etc., so it's definitely not playable like this.

So all files have been *LOADed to &1900, whereas they need to go to the correct locations as per the UEF/tape:

Code: Select all

SADIM      12 1214    00001900 00001900
SADIM1     02 02F5    000004F0 00000429
SADIM2     04 04C0    000008D0 00000435
SADIM3     51 51E1    00000E00 00000441
I took the UEF from here: http://www.stairwaytohell.com/bbc/archi ... RUN_BE.zip

I'll come back and have another look - just posting this to save others the loading UEF, Unlocking, etc. if they fancy having a look.

EDIT - taken off the SSD, it's not quite right! And now added a "better-looking" version ...
Attachments
sadim.zip
(19.09 KiB) Downloaded 51 times

User avatar
richardtoohey
Posts: 3563
Joined: Thu Dec 29, 2011 5:13 am
Location: Tauranga, New Zealand
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by richardtoohey » Tue Nov 25, 2014 3:32 am

Have got past the initial protection, so I can get SADIM to load.

It moves a checking/loading routine from &2A80 to &400.

It then does *RUN SADIM1 (which isn't valid 6502 code), with the EXEC address set (&429) to within the checking/loading routine in SADIM.

If it passes the check, it then does *RUN SADIM2 with the EXEC address set (&435) to within the checking/loading routine in SADIM.

If it passes the check, it then does *RUN SADIM3 with the EXEC address set (&441) to within the checking/loading routine in SADIM.

So, in effect, the *RUNs are actually *LOADs - because the EXEC addresses are pointing to previously loaded code.

If it passes for the final time, the checking/loading routine calls &8D0 - the load address of SADIM2.

So I think the best approach is to create empty SADIM1 and SADIM2 files, then write my own version of SADIM3. This SADIM3 will *LOAD XSADMIN1, XSADIM2 and XSADIM3 (so copies of the original files) out of DFS memory, then copy all three files down to the correct locations, and call &8D0.

But I suspect there is yet more protection to overcome, and if there is any clever EORing with contents of memory, we're DOOMED.

If it does work, then we might at least have the game on an SSD for looking at the originally reported issue.

User avatar
leenew
Posts: 3572
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by leenew » Tue Nov 25, 2014 9:54 am

Cheers Richard.
I am just concerned that it is not working from the original uef.
Can anyone play the original uef on a real beeb?
I could try the version on Mick's disc 97 on my real beeb tonight. Then try yours if you manage to foil the protection.

The Walk through is on the CASA archive.
Cheers.
Lee.

User avatar
richardtoohey
Posts: 3563
Joined: Thu Dec 29, 2011 5:13 am
Location: Tauranga, New Zealand
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by richardtoohey » Tue Nov 25, 2014 10:11 am

I wanted to see if (a) I could get the UEF onto SSD and (b) if I got that far, I could see the code and possibly determine where the turns logic is.

Very very close (not that there's too much point if already on one of Mick's discs!) - the screen gets corrupted but I can type in the background (got my Beebem sending printer output to a console window) and it is responding - just the screen is "locked":
sadim.jpg
Even if I get nowhere, it's been educational! :D

User avatar
leenew
Posts: 3572
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by leenew » Tue Nov 25, 2014 10:13 am

I am at work at the minute so I can't check, but doesn't the first file set up all the text windows?

Lee.

User avatar
richardtoohey
Posts: 3563
Joined: Thu Dec 29, 2011 5:13 am
Location: Tauranga, New Zealand
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by richardtoohey » Tue Nov 25, 2014 10:19 am

I'm using all the files; all I've hacked is the protection so that (in theory) it always comes back with "I'm happy!"

So I've only changed 2 bytes in the original files, and then made a loader file that does the moving in memory.

If I do the moving with a BASIC mover, it seems slightly better than my m/c code loader, but still doesn't work. It works for about one command and then crashes.

So it could be my 2 byte change is too much.

User avatar
leenew
Posts: 3572
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by leenew » Tue Nov 25, 2014 6:10 pm

I have just played the version on Disc097 on my real beeb. It is the same. Nowhere near enough moves before the swirling mists kill you.
Just going to see if I can find an os 0.1 .......
Anyone able to try the UEF on a real beeb via UPURS?

**EDIT* not got one :( How do I use Beebem and tell it to use BASIC1 and OS 0.1?


Lee.

User avatar
richardtoohey
Posts: 3563
Joined: Thu Dec 29, 2011 5:13 am
Location: Tauranga, New Zealand
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by richardtoohey » Tue Nov 25, 2014 6:58 pm

It's not easy on Beebem (I had to change some code) - can you use b-em?

User avatar
MartinB
Posts: 4698
Joined: Mon Mar 31, 2008 9:04 pm
Location: Obscurity
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by MartinB » Tue Nov 25, 2014 7:03 pm

Lee wrote:Anyone able to try the UEF on a real beeb via UPURS?
I downloaded the uef from Richard's link and unzipped it once but UPCFS on a real Beeb told me it's a GZIP which UPCFS won't handle directly. When I unzip it a second time (all this is normal to use UPCFS btw), WinZip then tells me the GZIP archive is broken...... :(

Maybe that's your issue...?

User avatar
leenew
Posts: 3572
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by leenew » Tue Nov 25, 2014 7:29 pm

Hmmm... not sure about that Martin? The UEF loads and plays (on Beebem), just not with the correct 'variables' (maybe). But the fact it loads and plays means the UEF is ok...... doesn't it? :-k
Lee.

User avatar
MartinB
Posts: 4698
Joined: Mon Mar 31, 2008 9:04 pm
Location: Obscurity
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by MartinB » Tue Nov 25, 2014 7:47 pm

Ooops... no, you're quite right Lee - I renamed the first pass uef to zip rather than gz #-o

I can try it on a Beeb later then if nobody else does.... 8)

User avatar
leenew
Posts: 3572
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by leenew » Tue Nov 25, 2014 7:58 pm

Cool.
Well whoever tries it, the solution is here: http://solutionarchive.com/game/id%2C10 ... astle.html and there should obviously be enough moves to complete the game before the "swirling mists" devour you....

Lee.

User avatar
leenew
Posts: 3572
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by leenew » Tue Nov 25, 2014 8:07 pm

Richard, there is something wrong with B-Em (at least on my laptop), I set it to OS 0.1 and it refuses to load the tape. It seems to skip blocks, only seeing blocks 1, 3, 5, 7 etc. Weird, but I think there is a known issue?

Lee.

User avatar
richardtoohey
Posts: 3563
Joined: Thu Dec 29, 2011 5:13 am
Location: Tauranga, New Zealand
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by richardtoohey » Tue Nov 25, 2014 8:30 pm

Every avenue seems to uhhh ... lead to swirling mists of doom! :lol:

Work-time here now, but I'll have another look later to see if I can get my SSD version going ... or failing that, cheat and look at Mick's version (then at least there is some easily loaded code!)

User avatar
MartinB
Posts: 4698
Joined: Mon Mar 31, 2008 9:04 pm
Location: Obscurity
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by MartinB » Tue Nov 25, 2014 8:36 pm

Well... the first part loads and I can step through all the instruction pages but when the next section tries to load, it bombs out with a 'Bad Chunk' immediately after block 01 of SADIM1. That error message is a UPCFS one and it either means that there is an integrity issue with the associated uef Chunk or, more usually, the small amount of UPCFS ram code (most is obviously rom) or the UPCFS serial input buffer is getting trampled on as the code and/or data is loaded.

So, assuming the uef itself isn't in question, it looks as if this is perhaps one of the few programs that won't work with UPCFS :roll:

User avatar
leenew
Posts: 3572
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by leenew » Tue Nov 25, 2014 8:39 pm

Gah! Why is nothing simple? :evil:
Well at least you have something else to get your teeth into now Martin :D

Lee.

User avatar
richardtoohey
Posts: 3563
Joined: Thu Dec 29, 2011 5:13 am
Location: Tauranga, New Zealand
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by richardtoohey » Tue Nov 25, 2014 8:43 pm

MartinB wrote:the small amount of UPCFS ram code (most is obviously rom) or the UPCFS serial input buffer is getting trampled on as the code and/or data is loaded.

Code: Select all

SADIM1     02 02F5    000004F0 00000429
So loads from 4F0 to 7E5 - is any of that used by UPCFS? (The exec address looks odd, but it jumps into previously loaded and moved code from the SADIM file)

User avatar
leenew
Posts: 3572
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by leenew » Tue Nov 25, 2014 9:05 pm

Maybe it always has been faulty. See this review from A&B computing from 1984
http://www.acornelectron.co.uk/mags/aab ... -sadi.html

I still refuse to believe this is how it played on the authors' computer.
If only I knew what setup they had at the time.......

Lee.

User avatar
MartinB
Posts: 4698
Joined: Mon Mar 31, 2008 9:04 pm
Location: Obscurity
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by MartinB » Tue Nov 25, 2014 9:10 pm

Richard wrote:So loads from 4F0 to 7E5 - is any of that used by UPCFS?
Heh heh - yes Richard, double whammy I'm afraid :roll:

Here's a snip from the source.....

Code: Select all

upiob    EQU   $FE60      \I/O Register B
upddrb	EQU	$FE62		\Data Direction Register B
upacr	 EQU	$FE6B		\Auxilliary Control Register

serbuf	EQU	$06E0		\serial input buffer
romsel	EQU	$07A9		\location of external rom select code
notape	EQU	$0398		\location of external *TAPE trap
hchunk	EQU	$03CB		\Chunk header type(2) + length(4)

cli      EQU   $F2        \command line pointer - use (cli),Y

bufsize  EQU	28		   \data burst (buffer) size
sbuft    EQU	$F5		  \top of buffer pointer 0 (empty) - $FF
sbufl	 EQU	$F8        \current buffer drain pointer

User avatar
richardtoohey
Posts: 3563
Joined: Thu Dec 29, 2011 5:13 am
Location: Tauranga, New Zealand
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by richardtoohey » Tue Nov 25, 2014 9:20 pm

Code: Select all

serbuf   EQU   $06E0      \serial input buffer
romsel   EQU   $07A9      \location of external rom select code
So are these in any way important? :wink:

@leenew - the review isn't exactly a glowing endorsement, is it? :shock: Maybe the game was just this bad? And if it was sold as an Electron game, that means the OS 0.1 question is answered?

User avatar
leenew
Posts: 3572
Joined: Wed Jul 04, 2012 3:27 pm
Location: Doncaster, Yorkshire
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by leenew » Tue Nov 25, 2014 9:29 pm

Well one review page states it is compatible with Electron, B, B+ and Master.
I have tried it in ElectrEm, and Beebem in B, B+, and master mode and all are the same.

I still REFUSE to believe it played like this on the Authors' computer. I REFUSE I TELLS YA. R E F U S E!!! :roll:

Lee.

User avatar
richardtoohey
Posts: 3563
Joined: Thu Dec 29, 2011 5:13 am
Location: Tauranga, New Zealand
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by richardtoohey » Tue Nov 25, 2014 9:32 pm

Maybe his computer had some timing or random number generator issue that meant the random time worked fine for him? Not that I am grasping at straws or anything ... :^o

duikkie
Posts: 2852
Joined: Fri Feb 07, 2014 3:28 pm
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by duikkie » Sun Dec 07, 2014 10:07 am

oke i made the sadim files to 2 files sadim and sadim1
it runs now on mmc card

i don't know about the game has it still the time and move problem
i can not play any game , so tell me what must i do
to counter the time or move error ??

if i know the problem i can fix it :)

edit look at fixtbsadim
Last edited by duikkie on Mon Dec 08, 2014 4:52 pm, edited 1 time in total.

User avatar
lurkio
Posts: 1557
Joined: Tue Apr 09, 2013 11:30 pm
Location: Doomawangara
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by lurkio » Sun Dec 07, 2014 4:43 pm

duikkie wrote:oke i made the sadim files to 2 files sadim and sadim1
it runs now on mmc card
Thanks, duikkie! But this is all I get when I try your version in BeebEm:
duikkie_sadim.jpg
duikkie wrote:i don't know about the game has it still the time and move problem i can not play any game , so tell me what must i do to counter the time or move error ??
You need to follow this walkthrough:

http://solutionarchive.com/file/id%2C1418/

But you will soon die! You won't be able to complete the game.

I think the random-number routine in the program is malfunctioning or corrupt (or deliberately degraded as a form of copy-protection) -- so that you can never finish the game! You're always killed in the swirling mist long before you reach the end of the walkthrough!
sadim_death.jpg

duikkie
Posts: 2852
Joined: Fri Feb 07, 2014 3:28 pm
Contact:

Re: Sadim Castle (MP Software) - Anyone Able To Hack?

Post by duikkie » Sun Dec 07, 2014 5:52 pm

on bbc b i can play it , but still die to soon :shock: , i have found a read clock statement, have to look what happens if i change that. but someone has to show up to give you the keys. maybe i can reset the counter or time ??

strange that beeb-em , is different from the real bbc b :)
lurkio wrote:
duikkie wrote:oke i made the sadim files to 2 files sadim and sadim1
it runs now on mmc card
Thanks, duikkie! But this is all I get when I try your version in BeebEm:
duikkie_sadim.jpg
duikkie wrote:i don't know about the game has it still the time and move problem i can not play any game , so tell me what must i do to counter the time or move error ??
You need to follow this walkthrough:

http://solutionarchive.com/file/id%2C1418/

But you will soon die! You won't be able to complete the game.

I think the random-number routine in the program is malfunctioning or corrupt (or deliberately degraded as a form of copy-protection) -- so that you can never finish the game! You're always killed in the swirling mist long before you reach the end of the walkthrough!
sadim_death.jpg

Post Reply