Re: Definitive Guide to Apple Secret Keys

[rubywand@aol.com (RUBYWAND)]

re. list of cheats, etc.

     Thanks for posting the "Definitive Guide ...".

>>....
Dark Heart of Uukrul

A) Press '0' at the crack screen for a message alluding to the fact that
The
   OverByte, during our infamous country-wide rag war, said Dark Heart of
   Uukrul would never be cracked (he denied using the word "never", which
has
   long since been proven, but hey, it was funny anyway)
B) Use a sector editor to view a message embedded on Track $00, Sector $4
<<....

     Recently, I've been playing 'Uukrul and have come up with some stuff
to add to the Definitive Guide'.

     Since Uukrul is not copy protected, "crack" must refer to 'getting
into the game'-- e.g. to read messages, modify characters,
add/modify/renew key items, etc.. The game is fairly well defended,
especially since it will not run on II+ 'cracking machines'.

     Getting to Uukrul's in-game messages is doable via ProSel's Zap block
editor. There are several blocks of messages (around block $37 on 5.25"
Scenario diskette A).  These are generally unreadable because they employ
special codes ($01-1F and $80-$FF) for many key letter strings and words.

     Scanning through the Boot diskette, you will come upon a bunch of
words and strings starting around block $65. This turns out to be a
'dictionary' for the special codes!

     The first block seems to cover codes $80-CA and $01-1F. For example
$80 = _you (space y o u).  With the high bit set for the first ASCII
character, you find A0 79 6F 75 at the start of block $65. A few entries
are suffixes: $BE= thing (F4 68 69 6E 67). 

     Starting at byte $182 in this block is a list of 31 two-letter
strings. These match codes $01-1F ($01= a_, ...  $10= at,  ... $1F= sh).

     The next two blocks each seem to cover codes $CB-$FF? Since they are
different lists, you will need to use the message context to figure out
which to use for a given code. It will help to know that _cl (A0 63 6C) at
byte $03C in block $66 seems to correspond with code $D4. In block $67,
_before ($A0 62 65 66 6F 72 65)  at byte $164 seems to correspond with
code $F2.


     Of course, the ultimate game crack is to have control of character
attributes, items, $$$, etc.. Editing the Game Save info (starting at Bock
$00 on the Scenario diskette)  does not work because it is protected via
some kind of check sum. You can get around such schemes on the GS by doing
an OA-CTRL-ESC, going to Visit Monitor, finding the character info stuff
in memory, and doing the changes there. Once back in the game, you walk
around a bit and do a Save. (Walking around, going to a shop, having a
combat, etc. is often a good idea after doing a direct mod in an
adventure. It lets the program reinit pointers and other values which may
have been affected.)

     Naturally, being "uncrackable", Uukrul disables interrupts; so, GS
users cannot just hop into memory at will. You can get around this by
changing the program so that interrupts are enabled during Keyboard
inputs. Usually, this means looking for instances of AD 00 C0. There are
very few of these in Uukrul; so, it was easy to isolate the main KB input
routine.

      On the 5.25" version, I found the routine beginning at byte $110 in
block $A5 on the Boot diskette: 

2C 00 C0
10 FB
AD 00 C0 ...

On a copy of the Boot diskette, change this to 

58
AD 00 C0
10 FB
78
EA

and save the the changed block. The new routine will enable interrupts,
wait for a keypress, and, then, disable interrupts. You will be able to
interrupt the program whenever the program is waiting for a keypress and
do a Visit Monitor. 

     In Uukrul, you will find Food in hexadecimal at $976E and $$$ in
decimal at $9770. The rest of character info is in the same area. (This
applies to the 5.25" version.)  As usual, character attributes are in hex.
Items carried follow attributes. These are two-bytes each. Typically, a
"used up" item changes a "0" to an "8"in the second byte. For example, to
restore a used up Wand of Potency, change 58 D8 to 58 D0.

     By the way, there may be a bug in the Diamond Maze puzzle (i.e.
finding the correct sequence to type-in at the rhomboid panel in the room
at the south end of the diamond). If you manage to obtain a sequence and
it does not work, you can hunt for the right string of "1"'s and "2"'s
using flashing light indications. The blue light blinks twice when you are
close and 3 times when you are very close. It helps to know that you do
not have to leave the panel and return to try new sequences. The program
is checking the most recent n entries. When you hit the right string, the
panel opens.
   

Rubywand