ral-clan wrote:Has anyone tried this game on a real NTSC VIC. Is it PAL only?
Looking the hidden basic code it does not change screen coordinates, except for the protection that is not executed anymore after my fix.
Playing it on VICE (NTSC mode) it has the same X/Y coordinates of a standard NTSC screen so i assume that it works on real NTSC vics too, which is the problem ? may i reproduce it on VICE ?
Kweepa wrote:nbla000 wrote:
During my fixing work, i've extracted the full hidden basic code in TXT form if someone need.
I'd love to see it
You may download the hidden basic code in TXT form
here.
and a quick explanation of what you did to fix it!
Not so quick btw it was a work "on-fly" so no log file this time but i remember the main important phases.
As first thing i've loaded from TAP and saved to disk image the main program but when i reloaded and ran it, the vic crashed.
OK, so this is an hard work, good...
I focused my attention on the main program single row of code:
It means that the real basic code is from $2001 and from $1201-1fff there are data or LM routines if any.
43-44 Pointer: Start of Basic (lo/hi)
Phase 1:
using vice i've loaded the second part, without run it, to look where is the last byte of code by checking locations *002D-002E 45-46 Pointer: Start of Variables
after ever using vice monitor i've saved code from $2001 to the last used address
now load the saved file using:
Et voila the hidden basic code....
There is a strange row after the first 2 lines that hidden itself by using backspace technique, so how to read it ?
Phase 2:
I loaded the BASIC-CODE from C64 VICE emulator and resaved it without modifies.
Now i've the same basic v2.0 code but in a C64 prg files.
Code: Select all
LOAD "BASIC-CODE",8 [NOT ,8,1]
SAVE "BASIC-CODE64",8
To manipulate d64 images i use
Star Commander or
DirMaster
Now using the tool
TOK64: Text <==> C64 Basic Converter
i've converted the basic prg file in a TXT file:
Et voila the basic hidden code in
TXT form
now i may look the strange hidden basic row, it is the row number 8 but there is another strange row the number 945
Code: Select all
8 ifpeek(849)<>66thenpoke36864,99:sys1:rem "{BACKSPACES*40}
945 ifpeek(849)<>66thenpoke36864,99:sys1:rem "{BACKSPACES*40}
both does the same and this is the copy protection.
the code look on the Cassette buffer area 828-1019 ($033C-$03FB) for the value on the byte 849 ($351), if is not 66 ($42) it crash the vic.
This value is present when the program is loaded from the tape but not from disk of course.
To confirm my thesis, i've loaded my old non working saved prg file from disk image using these commands to start it.
Good it works but the work is not finished yet....
Phase 3:
To start the game, using a poke before, is not so elegant, what i can do ?
As first thing i crunch the file using
Pucrunch to reduce size.
Code: Select all
PUCRUNCH.EXE original.prg crunched.prg -c20 -m5 -x0xc871
That produce a compressed ML program for 16k vics that automatically start the basic code by calling (c871 run Perform [run]) after decrunching process.
OK, now i've the compressed file but i still use POKE to start it.
I need to hack the crunched file, for this work some LM knowledge and BASIC tokens structure infos are required.
Phase 4:
Using the Vice monitor take a look on the firsts bytes of the crunched file, it is not LM code but basic structure to execute SYS4621, the real LM code that decrunch the basic program and start it:
Code: Select all
1201 0B 12 (where the next basic line is located in memory [$120B])
1203 EF 00 (the basic line number [239])
1205 9E (the basic SYS command token)
1206 34 36 32 31 (4621 [the SYS call to $120d])
120a 00 (First basic line finished)
120b 00 00 (second basic line [00 00] means that the basic program is finished)
120d 78 SEI (first decrunch LM command)
ok, now to fix our program we need to add new code on the bottom to set the value 66 ($42) on the location 849 ($351).
The last used byte from the crunched program is $3e47 so we can attach and execute code from $3e48 and after execute the normal decrunch routines from $120d.
to start code from $3e48 (SYS 15944) we need to change the basic structure and hack a bit the crunched routines
Code: Select all
1201 0C 12 (where the next basic line is located in memory [$120C])
1203 D8 07 (the basic line number [2008] ;-)
1205 9E (the basic SYS command token)
1206 31 35 39 34 34 (15944 [the SYS call to $3E48])
120b 00 (First basic line finished)
120c 00 00 (second basic line [00 00] means that the basic program is finished)
Since we need an additional byte for 15944 we must replace the first byte of LM code on our FIX code:
Code: Select all
3e48 A9 42 LDA #$42
3e4a 8D 51 03 STA $0351 ; POKE849,66
3e4d 78 SEI ; Replace the hacked command
3e4e 4C 0E 12 JMP $120E ; and continue to normal decrunch routines
OK done, and now save it using the vice monitor:
SAVE "FIXED-PRG" 8 $1201 $3e50
FINISH, i hope that someone may use my experience for other fixes/hacks.
PS: I hope that the Hidden Basic TXT file may help for a future manual too, Orion