143 Posts in 28 Topics by 27 members
Share your memories, hints, tips, queries and frustrations about your favourite IIGS time wasters.
| Page: 1 , 2 | Go to End | |
| Author | Topic: Crack for Ancient Land of Ys for Hard Drive Install | 38663 Views |
-
Crack for Ancient Land of Ys for Hard Drive Install
8 August 2008 at 12:53pm
Hi all,
Ancient Land of Ys is one of my favourite games of all time and I've been disappointed not to be able to install it on my compact flash card with CFFA for use on my IIGS. Perusing through Russell Nielson's excellent 'Espirit de Apple Corps' collection, found here: http://www.gamebits.net/kgagne/apple/#products, I found instructions for a Ys crack that purports to remove copy protection AND allow it to be hard drive installable. I've never been the best with sector editors (I'm just not meant to read code, other than in a cool, abstract, 'Matrix' kind of way) and while I found and replaced for the first four values in the following instructions, I couldn't find the next set.
If anyone else can make sense of these instructions and give Ys another chance to be run from a hard drive, please submit those disk images after you've applied this patch...!
Ancient Land of Ys from Broderbund
by Brian A. Troha
REQUIREMENTS:
512K Apple//GS
3.5" disk copier
3.5" disk editor
Ancient Land of Ys (ALY) from Broderbund is an adventure role playing game. You control a little guy and run around completing various quest in an effort to regain the six books of Ys. The game comes on two disks, the /PROGRAM disk and the /DATA disk. The file YSBOOT.SYS16 on /PROGRAM checks for enough memory then runs the program YSGS on /DATA. This information was usefull when it came time to search for the copy protection.
The overall game is nice with good graphic and sound, however, ALY has two problems. The first problem is ALY is copy protected and the other is it is NOT hard disk compatible. The reason I'm writing this article is I have been successfull in over coming both of these problems. First lets start by removing the copy protection. Broderbund has been known to use the standard nibble counting routine on tracks $20 & $21 on a few programs (Showoff, Geometry, Where in the World is Carmen Sandiego). So I began by searching for the key string (I have mentioned in so many articles) of A2 20 A0 01. I found the following routine on block $4A6 of the /DATA disk.
07:A9 00 00 LDA #$0000 ; Load a zero
0A:8D CA 65 STA 65CA ; Zero out nibble count read error flag
0D:8D C6 65 STA 65C6 ; Zero out nibble count sum for track $20
10:8D C8 65 STA 65C8 ; Zero out nibble count sum for track $21
13:E2 30 SEP #$30 ; Use 8 bit wide Accum and index regs
15:A2 20 LDX #$20 ; Load track $20
17:A0 01 LDY #$01 ; Load side
19:20 4E 65 JSR 654E ; Go to nibble count
1C:B0 13 BCS 31 (+13) ; Carry set is read error or wrong disk
1E:8E C6 65 STX 65C6 ; Store lo-byte sum for track $20
21:8C C7 65 STY 65C7 ; Store hi-byte sum for track $20
24:A2 21 LDX #$21 ; Load track $21
26:A0 01 LDY #$01 ; Load side
28:20 4E 65 JSR 654E ; Go to nibble count
2B:8E C8 65 STX 65C8 ; Store lo-byte sum for track $21
2E:8C C9 65 STY 65C9 ; Store hi-byte sum for track $21
31:C2 30 REP #$30 ; Set 16 bit wide Accum and index regs
33:90 0C BCC 41 (+0C) ; Carry clear was a good read
35:AD CA 65 LDA 65CA ; Read errors or wrong disk come here
38:49 FF FF EOR #$FFFF
3B:1A INC
3C:A2 FF FF LDX #$FFFF ; Load bad values
3F:80 06 BRA 47 (+06) ; Branch to the RTS
41:A9 C6 65 LDA #$65C6 ; Load lo-word pointer to sums
44:A2 00 00 LDX #$0000 ; Load hi-word pointer to sums
47:60 RTS ; Return to sender
48:5A PHY ; Push side
49:DA PHX ; Push track
4A:F4 00 00 PEA 0000
4D:F4 67 65 PEA 6567 ; Push pointer to disk/volume name
50:22 A0 66 00 JSL 0066A0 ; Count them up
54:8D CA 65 STA 65CA ; Temp store for Accum
57:68 PLA
58:68 PLA
59:68 PLA
5A:68 PLA
5B:68 PLA
5C:68 PLA ; Pull all pushed values of the stack
5D:AD CA 65 LDA 65CA ; Reload Accum (read/wrong disk flag)
60:60 RTS ; Return
61:50 52 4F 47 52 41 4D ; 6567 - PROGRAM; disk/volume name
That was the routine to do the nibble counting. After tracing the program code back acouple of times I ended up with the following code on block $3BF on the /DATA disk:
059:0B PHD
05A:3B TSC
05B:38 SEC
05C:E9 FB 00 SBC #00FB
05F:5B TCD
060:69 CE 00 ADC #00CE
063:1B TCS
064:22 6F 65 00 JSL 00656F ; Goto the nibble count routine above
068:86 D2 STX D2 ; Store hi-word of pointer to sum values
06A:85 D0 STA D0 ; Store lo-word of pointer to sum values
06C:64 E0 STZ E0 ; Clear a "benchmark" flag
06E:A5 E0 LDA EA ; Load flag
070:F0 03 BEQ 075 (+03) ; If it's zero then branch to benchmark tests
072:82 B4 00 BRL 129 (+00B4) ; Branch long to continue code
075:38 SEC
076:A5 D0 LDA D0
078:E9 00 00 SBC #0000
07B:D0 07 BNE 084 (+07)
07D:A5 D2 LDA D2
07F:E9 00 00 SBC #0000
082:80 07 BRA 08B (+07)
084:A5 D2 LDA D2
086:E9 00 00 SBC #0000
089:C2 02 REP #$02
08B:70 03 BVS 090 (+03)
08D:49 00 80 EOR #$8000
090:30 22 BMI 0B4 (+22) ; Branch to compare sums
092:F4 01 00 PEA 0001
095:F4 60 00 PEA 0060
098:F4 10 00 PEA 0010
09B:F4 00 00 PEA 0000
09E:F4 B0 02 PEA 02B0 ; Push info on stack for call
0A1:22 B7 0D 00 JSL 000DB7 ; Insert /PROGRAM disk routine
0A5:7A PLY
0A6:7A PLY
0A7:7A PLY
0A8:7A PLY
0A9:7A PLY ; Pull all pushed info off the stack
0AA:22 6F 65 00 JSL 00656F ; Goto the nibble count routine
0AE:86 D2 STX D2
0B0:85 D0 STA D0 ; Store the pointer again
0B2:80 C1 BRA 075 (-3F) ; Branch back up
0B4:A6 D2 LDX D2
0B6:A5 D0 LDA D0 ; D0 & D2 point to track $20 sum
0B8:86 DE STX DE
0BA:85 DC STA DC ; Tranfer sum to DE & DC
0BC:A6 DE LDX DE
0BE:A5 DC LDA DC
0C0:DA PHX
0C1:48 PHA ; Push on stack
0C2:18 CLC
0C3:69 02 00 ADC #$0002 ; Add two for track $21 sum
0C6:85 DC STA DC
0C8:A5 DE LDA DE
0CA:90 01 BCC 0CD (+01) ; If DC was FFFE or FFFF carry set
0CC:1A INC ; Then increment the hi-word
0CD:85 DE STA DE ; DE & DC now hold pointer to track $21
0CF:68 PLA
0D0:FA PLX ; Pull pointer off stack
0D1:85 F6 STA F6
0D3:86 F8 STX F8 ; F6 & F8 now hold track $20 sum
0D5:A7 F6 LDA [F6] ; Load indrect long track $20 sum
0D7:85 DA STA DA ; Store track $20 sum in DA
0D9:A7 DC LDA [DC] ; Load indrect long track $21 sum
0DB:85 D8 STA D8 ; Store track $21 sum in D8
0DD:A5 DA LDA DA ; Load track $20 sum
0DF:38 SEC
0E0:E9 6B 20 SBC #$206B ; The hard way to compare the sum
0E3:F0 37 BEQ 11C (+37) ; it should be higher then 206B
0E5:70 03 BVS 0EA (+03) ; but less then 2103
0E7:49 00 80 EOR #$8000 ; all branches to 11C are failures
0EA:10 30 BPL 11C (+30)
0EC:A5 DA LDA DA
0EE:38 SEC
0EF:E9 03 21 SBC #$2103
0F2:70 03 BVS 0F7 (+03)
0F4:49 00 80 EOR #$8000
0F7:30 23 BMI 11C (+23)
0F9:A5 D8 LDA D8 ; Load track $21 sum
0FB:38 SEC
0FC:E9 AF 1D SBC #1DAF ; The hard way to compare the sum
0FF:F0 1B BEQ 11C (+1B) ; it should be higher the 1DAF
101:70 03 BVS 106 (+03) ; but less then 1E79
103:49 00 80 EOR #$8000 ; again, all branches to 11C are failures
106:10 14 BPL 11C (+14)
108:A5 D8 LDA D8
10A:38 SEC
10B:E9 79 1E SBC #$1E79
10E:70 03 BVS 113 (+03)
110:49 00 80 EOR #$8000
113:30 07 BPL 11C (+07)
115:A9 01 00 LDA #$0001 ; Load a non-zero value
118:85 E0 STA E0 ; Store in "benchmark" flag so BEQ is NOT taken
11A:80 0A BRA 126 (+0A) ; Branch to branch long
11C:A2 FF FF LDX #$FFFF
11F:A9 FF FF LDA #$FFFF ; Load failing values
122:68 D2 STX D2
124:85 D0 STA D0 ; Store them
126:82 45 FF BRL 06E (-00BB) ; Branch long to the top and start over
129:F4 00 00 PEA 0000 ; Continue code for the program
The above section of code is the deciding factor in the copy protection routine. The first JSL 00656F must be disabled by changing the 22 to an AF. Then we come to the STZ E0 and the LDA E0, well E0 will equal one on a passing copy so I changed the LDA E0 to INC E0. Now we zero out E0 and then increment E0 to get the value of one. The final step is to disable the BEQ +3 and that is done by over writing it with two NOPs. The resulting copy is now deprotected and will run just fine from two 3.5" disk. The step by step would be:
1. Make a copies of both Ancient Land of Ys disks
2. Make the following edits to the /DATA disk:
BLK BYTE FROM TO
------------------------------------
$3BF $64 22 6F 65 00 AF 6F 65 00
$6E 85 E0 F0 03 E6 E0 EA EA
3. Write the block back to a copy of /DATA
-
Re: Crack for Ancient Land of Ys for Hard Drive Install
10 August 2008 at 9:24pm
Really enjoyed that game when i had it and one of those games i couldnt put down till i had finished it. Hopefully someone can make sense of what needs to be done and upload the images :-).
-
Re: Crack for Ancient Land of Ys for Hard Drive Install
13 September 2008 at 6:22am
Ancient Land of Ys was definitely one of my favorite games too, and all the more special since it happened to be on the IIgs and had such fantastic sounding music. That reminds me, another IIgs user (Arekusu) gave me a collection of MIDI files from the game years ago, including some unused songs that never made it into the game. Still, they're not quite the same. I really should go back and digitally capture the original GS tunes--should be doable with a little trickery and without having to even play through the game.
Though I digress, back to the subject at hand here. I actually have Ancient Ys installed on my GS hardisk, and yes, it is deprotected AND runs just fine on a hardisk. You still need a blank floppy disk to load and save games to, but otherwise it runs fine from what I recall and should work off a flash drive. It may just have been a patched SYS file, looking at my installed copy I notice it has a lowercase name ("Land.Of.Ys"). I'll gladly send it over, assuming all you need is the one file--if not, I can archive the entire folder.
Ys reminds me of Zelda III on the Super Nintendo, another game I enjoyed years back (and ironically, had my Super Nintendo play through on my AppleColor RGB using a cable Arekusu custom built for me). :)
-MitchLast edited: 13 September 2008 at 6:53am
-
Re: Crack for Ancient Land of Ys for Hard Drive Install
16 September 2008 at 12:08pm
Better include the whole folder of Ys, just to be sure. Thanks Mitch! :-)
I've also recently been surprised that I don't have hard drive installable versions of Winter and World Games. They run fine from floppy, but they ask for the disk to be inserted when run from a hard drive. Got HD installable versions for those as well?
- Alex -
Re: Crack for Ancient Land of Ys for Hard Drive Install
17 September 2008 at 1:06am
My SuperDrive is copying it over now, you should have the patched version of Ys by the time you read this (ignore the 01/01/04 archive date in the SHK file, the battery *just* died in my ROM 3 and I just realized I forgot to manually set it--not bad that it lasted 18 years to the month!)
I do have a patched hardisk installable version of Winter Games, but not World Games. I also have Zany Golf and The Immortal hardisk patched too if you're looking for those. Looking for anything else? :)
-Mitch -
Re: Crack for Ancient Land of Ys for Hard Drive Install
17 September 2008 at 3:04am
Thanks Mitch! Got it!
Thankfully, Will Harvey's classic games have always had HD installable versions on the site, but I'll gladly take the Winter Games HD install version :-)
This is just hoping, but HD installable versions of King of Chicago, Rocket Ranger, Grand Prix Circuit and Test Drive II would also be highly desirable.
- Alex -
Re: Crack for Ancient Land of Ys for Hard Drive Install
14 October 2008 at 4:08pm
Alex,
Did you manage to Upload the Hard drive install of Ys?
Drew -
Re: Crack for Ancient Land of Ys for Hard Drive Install
15 October 2008 at 10:49am
I hope to include that and much, much more of the hard drive installable versions of games soon.
I've been really busy of late, so I haven't had as much time to spend on the site but there's lots of new content on the way.
| 38663 Views | ||
| Go to Top | Next > |
Currently Online:
There is nobody online.
Welcome to our latest member: cbee