[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Module 6 (was Re: CiderPress v2.1.0 released)
Andy McFadden <fadden@fadden.com> wrote:
> Andy McFadden <fadden@fadden.com> wrote:
>> That doesn't make much sense. Just to check: BRK sends us to the BRK/IRQ
>> vector at $FFFF/FF, which is $FA40 in the autostart ROM. That does an
>> indirect jump through the vector at $3FE, which doesn't seem to be set
>> to anything.
>
> Actually, it goes to the BREAK function, which jumps to MON at $FF65 in
> the monitor ROM and $3F0 in the autostart ROM. If it's assuming monitor
> ROM it *might* pick up the stuff at $200, but that looks bogus. I don't
> see what good jumping to $ffff will do either.
It occurred to me last night that they changed $36-39 (COUT and RDKEY
vectors), so any character I/O would cause execution to jump to their code.
00000030: ff 00 ff aa 13 28 40 08 00 08 00 40 3c 00 00 40 ...*.(@....@<..@
So KSWL ($38) goes here:
0800- A9 8E LDA #$8E
0801- 85 CA STA $CA
0804- A9 22 LDA #$22
0806- 85 CB STA $CB
0808- 86 02 STX $02
080A- A9 30 LDA #$30
080C- 85 00 STA $00
080E- A9 08 LDA #$08
0810- 85 01 STA $01
0812- A2 00 LDX #$00
0814- A9 EA LDA #$EA
0816- 8D 0C 08 STA $080C
0819- 8D 0D 08 STA $080D
081C- 8D 10 08 STA $0810
081F- 8D 11 08 STA $0811
0822- A1 00 LDA ($00,X)
0824- E6 00 INC $00
0826- D0 02 BNE $082A
0828- E6 01 INC $01
082A- A6 02 LDX $02
082C- 60 RTS
082D- FF ???
082E- FF ???
082F- FF ???
0830- 9B ???
0831- C0 83 CPY #$83
0833- 8D D2 D5 STA $D5D2
0836- CE 8D FF DEC $FF8D
0839- FF ???
083A- FF ???
083B- FF ???
083C- FF ???
083D- FF ???
083E- FF ???
083F- FF ???
This points $CA at $228E and $00 at $0830, and then NOPs out the part
that sets up $00 with some self-modifying code. If I'm not mistaken,
this routine is called every time the monitor asks for keyboard input
(note it's preserving the X-register for the benefit of GETLN), but it's
substituting the data at $830 in place of actual keystrokes. The stuff
at $830 happens to be:
ESC @ Ctrl-C <return> R U N <return>
$CA is the Integer BASIC program start address. So, it's setting up an
embedded Integer program and launching it in a rather oblique way.
CSWL ($36) goes here:
0840- A9 00 LDA #$00
0842- 85 36 STA $36
0844- A9 09 LDA #$09
0846- 85 37 STA $37
0848- 00 BRK
Any output from the BRK changes the vector and BRKs again, to here:
0900- 60 RTS
0901- A0 00 LDY #$00
[...]
which is a big no-op.
The stuff at $228E looks like this:
00002280: 09 00 5d a0 a0 aa d0 d2 cf c7 d2 c1 cd a0 6c 00 ..] *PROGRAM l.
00002290: 00 4f c4 34 b5 34 00 72 43 d2 40 22 b4 29 00 72 .OD454.rCR@"4).r
000022a0: 43 d1 40 22 b9 09 00 72 43 d3 40 22 b3 03 00 72 CQ@"9..rCS@"3..r
000022b0: 43 c3 40 22 b3 03 00 72 43 c6 40 22 b4 04 00 72 CC@"3..rCF@"4..r
000022c0: 43 c1 40 22 b1 0a 00 72 44 c4 c5 c2 d4 34 b4 04 CA@"1..rDDEBT44.
000022d0: 00 72 44 c3 c1 d3 c8 34 b4 04 00 72 44 d5 34 b4 .rDCASH44..rDU44
000022e0: 04 00 72 44 c8 34 b1 90 00 72 44 c9 ce d3 d2 34 ..rDH41..rDINSR4
000022f0: b4 04 00 72 03 5f b3 00 7d 01 1f 00 00 5d a0 a0 4..r._3.}....]
00002300: aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa ****************
00002310: aa aa aa aa aa aa aa aa 01 20 01 00 5d a0 a0 aa ********. ..] *
00002320: a0 a0 a0 a0 a0 a0 d3 cf c6 d4 c1 d0 c5 a0 aa a0 SOFTAPE *
00002330: a0 a0 a0 a0 a0 a0 aa a0 01 1f 02 00 5d a0 a0 aa * ....] *
00002340: a0 a0 d3 cf c6 d4 d7 c1 d2 c5 a0 c5 d8 c3 c8 c1 SOFTWARE EXCHA
00002350: ce c7 c5 a0 a0 a0 aa 01 27 03 00 5d a0 a0 aa 87 NGE *.'..] *.
00002360: bd bd bd 87 bd bd bd 87 bd bd bd 87 bd bd bd 87 ===.===.===.===.
00002370: bd bd bd 87 bd bd bd 87 bd bd bd 87 bd aa 01 1f ===.===.===.=*..
00002380: 04 00 5d a0 a0 aa a0 a0 a0 a0 a0 cd cf c4 d5 cc ..] * MODUL
Which translates to:
0 DIM D(52),R$(41),Q$(9),S$(3),C$(3),F$(4),A$(10),DEBT(4),CASH(4),U(4),H(144),INSR(4): GOTO 32000
0 REM ************************
1 REM * SOFTAPE * *
2 REM * SOFTWARE EXCHANGE *
3 REM *.===.===.===.===.===.===.===.=*
4 REM * MODULE #6 *
5 REM * *
6 REM *COPYRIGHT 1978-SOFTAPE*
7 REM *----------------------*
8 REM * DUPLICATION OF THIS *
9 REM *PROGRAM OR ANY PORTION*
10 REM * THEREOF CONSTITUTES *
11 REM * INFRINGEMENT OF *
12 REM * COPYRIGHT *
13 REM *.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*
14 REM
15 POKE 204,63: POKE 205,10
30 TEXT : CALL -936: VTAB 4: TAB 14: PRINT "S O F T A P E": TAB 4: PRINT "S O F T W A R E E X C H A N G E": PRINT
[...]
32000 DEL 0: IN# 0: PR# 0: GOTO 15
65535 REM WRITTEN BY BILL DEPEW COPYRIGHT 1978 BY SOFTECH (213)-985-5763
Note there are two line zeroes, the first of which appears to get deleted.
Note also the formatting looks funny because the '.'s are actually
embedded Ctrl-Gs.
Of course, it's not over yet. The above game is "Apple 21". If you look
instead at $ff0, you see a similar looking Integer BASIC program called
"MODULE #3", which is "Mastermind", and it appears that Othello is in
there somewhere as well. However, the cassette is simply labeled "module 6".
Looks like they crammed more than one program into a package and simply
changed the start address in the part in the beginning.
--
Send mail to fadden@fadden.com (Andy McFadden) - http://www.fadden.com/
CD-Recordable FAQ - http://www.cdrfaq.org/
CiderPress Apple II archive utility for Windows - http://www.faddensoft.com/
Fight Internet Spam - http://spam.abuse.net/spam/ & http://spamcop.net/