Friday, January 2, 2015

Ultima II - The Long PC Journey




In 1982, Richard Garriott, Lord British, made Ultima II: Revenge of the Enchantress for the Apple II computer.  His previous games, Akalabeth and Ultima, had been released in ziplock bags, but not only did LB demand a box for his sequel, but also a cloth map.  No publisher would agree to this, except for up-and-coming Sierra On-line.  There began a short-lived relationship between two soon-to-be giants of the computer gaming industry.

As part of its SierraVenture line, Sierra would also release a port of Ultima for the Atari 8-bit computers, and would eventually release the obscure Ultima : Escape from Mt. Drash for the Commodore VIC-20.  However, Sierra and LB's main collaboration would be Ultima II, which would be released for the Apple II, Atari 8-bit, Commodore 64, Macintosh and Atari ST computers as well as the IBM PC.  Sierra would commission ports and sold the game at least until 1986.  LB decided to start his own publishing company with Ultima III: Exodus.  It is the PC version of Ultima II which this entry will primarily focus upon.

There are four major physical versions of Ultima II for the PC.  The first is the original release for the IBM PC by Sierra.  Next came the IBM PCjr release, also by Sierra.  Later, Origin Systems reacquired the rights to Ultima II and included it in the Ultima Trilogy.  Finally, Origin released it on CD collections with other Ultima games, culminating in the Ultima Collection.

1.  Ultima II for the IBM PC















This was ported by Jay Sullivan and released in 1983, not too long after the Apple II version in 1982.  It can be found in the large, borderless box, but later came in the black bordered box and later gray bordered boxes as well.  The borderless and black boxes are guaranteed to have the 22"x17" cloth map.  The borderless box cloth map typically has a "Sierra On-line" logo in the bottom right corner, while the black-bordered box cloth map will typically have a "Sierra" logo in the bottom right corner.  The later gray bordered boxes have a smaller, 16"x12" cloth map with no logo on it.  You can see lots of scans of the original IBM PC borderless-boxed version here : http://www.mocagh.org/loadpage.php?getgame=u2

The system requirements were very modest indeed, only 64KB of RAM, a CGA card, one floppy drive and DOS 1.1 were required.  Use of DOS 2.0 required 128KB of RAM.  While an RGB monitor could be used to play the game, it was intended for color composite monitors and TVs.  This is a game where an older CGA card may be more appropriate to use because the Viper in the dungeon demonstration screen is green with old CGA and blue with new CGA.  However, the old CGA card requires quite the brightness and contrast boost on most TVs to make the blue color stand out.

Ultima II came on three 160KB single sided floppy disks.  Disk 1 is the Program Master Disk, Disk 2 is the Player Disk and Disk 3 is the Galactic Disk.  This version's Program Master Disk is copy protected with a protection called Formaster Copylock, which was used on several other Sierra Online releases during the 1983-1984 period.

All disks are readable by real MS-DOS or PC-DOS.  Windows may not be able to read these disks because they use the DOS 1.x format, which is slightly different from the standard 2.0 format.  Sierra did not to use flippy disks because double sided drives were just beginning to be introduced.  In fact, you can install DOS 1.1 on the disk to make it bootable.  DOS 2.0 takes up too much room, so it cannot be installed, at least for the releases of the game that came on a 160KB disk.

A later 1985 release had a Program Master Disk that came on a 320KB disk, presumably to accommodate DOS 2.0-3.2.  The type of copy protection has changed to Softguard 2.0.3 with the original loader.  Here is an article mentioning the company behind it, Softguard Systems, Inc.
Sierra used the Softguard protection on the DOS releases of its AGI engine games but with its own, easier to crack loader.  The Player Master and Galactic Disks are still singled sided 160KB disks and unchanged from the 1983 disks.

The Player Master disk was meant to be copied through a normal DOS DISKCOPY command.  The original Player Master disk should never be used to play a game because it cannot be reset.  If you see a copy of any version of Ultima II with the write tab perforated on or cut into the Player Master disk, be very wary of buying it if you intend to use the software.

2.  Ultima II for the IBM PCjr.

Apparently, IBM and Sierra's close working relationship encouraged Sierra to enhance several of its PC titles for the PCjr.  Among these were Wizard and the Princess, Crossfire (floppy, not the cartridge) and Ultima II.  For Ultima II, the chief improvement was that the graphics were adjusted to show appropriate composite colors.  Thus for both the PC and PCjr, you can see purple mountains, blue water and green trees, but the brick streets in the town are red for the IBM PC with a CGA card and greenish yellow for the IBM PCjr.'s graphics adapter.  You can find screenshots showing the differences in the attachment to the first post here.

Sierra apparently could not get its Formaster Copylock copy protection working on the PCjr. (due to the lack of DMA most likely) so the Program Master Disk is actually not copy protected.  Disk 1 is increased in size to 180KB to accommodate copying PC-DOS 2.1 with the SYS command to make it bootable on the PCjr.  PC-DOS 2.1 is the earliest version of DOS which is fully PCjr. compatible.

Considering that this version was generally unknown until recently, it almost certainly did not sell many copies.  The only known complete physical copy comes in the black bordered box and the full-size 22"x17" cloth map.



When this is run on a PCjr., the system will need 128KB.  You should boot this disk from the built-in DOS, if any, or make it bootable with PC-DOS 2.1 SYS command.  Otherwise, if your system has a sidecar RAM expansion, do not load a memory manager when playing this game.  The game will run too fast.

The PC version can be run on the PCjr if cracked, but the colors will be less than ideal.  However, if run with 128KB, it will run slower than it should.  If run with 256KB or more and a memory manager installed, it should run at an appropriate speed.

3.  Ultima Trilogy
















By 1989, Origin Systems had reacquired the rights to publish Ultima II, and they were preparing to release the first Ultima trilogy with Ultima I, II and III.  This box came with four disks, with Ultima I (Enhanced Re-release) taking up one disk, Ultima III taking up a second disk, and Ultima II requiring two disks.  All three games are copy protected, with Ultima I and II using Origin Systems, Inc.-1 (OSI-1)  in-house copy protection.

For all PC floppy versions of Ultima II, you cannot run them from a hard drive, despite being DOS disks. This is because the Player Master and Galactic Disks use several of the same file names, but the files themselves are different.  This reflected the way the disks were distributed on the Apple II original, which used 143KB disks.  When the game was ported to the IBM PC, they used single sided disks with 8 sectors for 160KB, allowing the game to be used with single-sided drives and DOS 1.1.

For the Ultima Trilogy, Origin Systems used 360KB disks and put the Program Master and Galactic Disks onto a single disk.  In 1989 everybody was using 360KB disks (requiring DOS 2.0 or better) and double sided drives, so this was unobjectionable.  The were no files with the same names on the previously-separate Program Master and Galactic Disks.  The Player Master Disk was left on a separate disk.  The game will not save when you are not on Earth and never writes to the Program Master* or Galactic Disks.

* - The player may write to the Program Master disk to make it bootable, but for the Ultima Trilogy version, it comes as a bootable DOS 2.1 disk.

4.  Ultima I-VI Series and the Ultima Collection

These represent the last time Ultima II was released on physical media, in this case CD-ROMs.  These versions of Ultima II are not copy protected and are intended to be run from a hard drive.  Moreover, they did not do anything sensible like update the program to support subdirectories.  Had they done so, they could have put the Player Master and Galactic Disk files in separate subdirectories.  Instead they copied the Galactic Disk files then overwrote them with the more important Player Master files.  Thus several planets maps are replaced by Earth maps.  Here is the file overlap between the two disks :

Player Disk
File
Location

Galactic Disk
File
Location

MAPX00 Legends

MAPX03 Shadow Guard

MAPX10 Pangea 9,000,000 B.C. MAPX10 Mercury
MAPX11 Baradins Town

MAPX15 Greenland Dungeon MAPX15 Mercury Dungeon
MAPX20 1423 B.C. MAPX20 Venus
MAPX21 Le Jester

MAPX22 Towne Linda

MAPX23 Castle of Lord British

MAPX24 South America Tower

MAPX25 Greenland Dungeon

MAPX30 1990 A.D. MAPX30 Mars
MAPX31 Port Bonifice

MAPX32 New San Antonio MAPX32 Towne Mary
MAPX33 Castle of Lord British

MAPX34 Egypt Tower

MAPX35 Greenland Dungeon

MAPX40 Aftermath 2112 A.D. MAPX40 Jupiter
MAPX41 Pirates Harbour MAPX41 Jupiter Village


MAPX44 Jupiter Tower
MAPX45 Greenland Dungeon MAPX45 Jupiter Dungeon


MAPX50 Saturn


MAPX60 Uranus


MAPX61 New Jester


MAPX70 Neptune


MAPX71 Computer Camp


MAPX80 Pluto


MAPX81 Tommersville


MAPX82 Towne Makler


MAPX85 Pluto Dungeon


MAPX90 Planet X


MAPX92 Towne Basko


MAPX93 Castle Barataria
MONX00


MONX03


MONX10
MONX10
MONX11


MONX15
MONX15
MONX20
MONX20
MONX21


MONX22


MONX23


MONX24


MONX25


MONX30
MONX30
MONX31


MONX32
MONX32
MONX33


MONX34


MONX35


MONX40
MONX40
MONX41
MONX41


MONX44
MONX45
MONX45


MONX50


MONX60


MONX61


MONX70


MONX71


MONX80


MONX81


MONX82


MONX85


MONX90


MONX92


MONX93
TLKX03


TLKX11


TLKX21


TLKX22


TLKX23


TLKX31


TLKX32
TLKX32
TLKX33


TLKX41
TLKX41


TLKX61


TLKX71


TLKX81


TLKX82


TLKX92


TLKX93
MONSTERS


PLAYER



MAPX## gives the tile definitions for each of the 64x64 tiles on each map and the definitions for each dungeon and tower level and the MONX## are the monster/NPC placement files.  The TLKX## files are for the text for the NPCs in the towns, villages and castles only.  PLAYER gives the stores the statistics for the player character.   MONSTERS holds the graphics for the dungeon monsters.

Fortunately, Moonstone Dragon's Patch fixed this in time for the Ultima Collection.  The PC and Apple II versions of the game use the same Player Master and Galactic Disk files.  None of the official Origin releases contain the patch.  As you can see, there was nothing critical omitted from the game by the effective removal of Mercury, Venus, Mars and Jupiter.

5.  Differences

The Sierra IBM PC and PCjr. versions say "SIERRA ON-LINE PROUDLY PRESENTS" where the Ultima Trilogy says "ORIGIN PROUDLY PRESENTS"  The copyright is "(C)-1983 BY LORD BRITISH AND SIERRA ON-LINE", whereas the Ultima Trilogy and later gives a copyright of "(C)-1983, 1989 BY LORD BRITISH AND ORIGIN".  That is it for text differences.  The IBM PC and PCjr. versions use PWM sound effects during the intro where the Ultima Trilogy and later versions are silent.  There are also PWM sound effects in the game, like the attack sound effect, that were replaced with simpler sweep type effects for the Trilogy and later.  This could have been done because the originals sound rather harsh.  More likely it was done because the PWM effect is mostly lost at the higher CPU speeds available in the late 1980s.  (See Section 7 below)

In the original Apple II version, there is a screen in the demonstration that says "PLEAD WITH MEDIEVAL KINGS FOR ASSISTANCE."  Unfortunately, due to the inefficient way in which the demonstration screens were stored (16KB CGA full-screen bitmap instead of using a 200 byte tilemap) and the use of PC-DOS instead of a custom bootloader, there was no room on the Program Master Disk for this screen.  This can be restored with Voyager Dragon's Ultima II Upgrade Patch. Additionally, the Apple II and Atari 8-bit versions have an animated title screen with the dragon breathing fire to reveal the ][ and the  "REVENGE OF THE ENCHANTRESS" caption.  In the PC versions, this is a static screen and the sound effects are not present.

One improvement of the PC version vs. the Apple II and Atari 8-bit versions is that the Strength bug is apparently absent on all copies.  In the early Apple II and Atari 8-bit versions of the game, the Clerk in New San Antonio will not raise your Strength attribute, but will raise other attributes.  This is the only way to raise your Strength in the game, absent hacking or implementing a bug fix by writing to the affected sector on the disk.

One other point of interest is the Pangea Greenland Dungeon.  According to the README supplied with Moonstone Dragon's Patch, Origin apparently removed the entrance to the Pangea Greenland Dungeon because the map file for the dungeon itself was corrupted when they ported the game to the Ultima I-VI Series CD.  However, the entrance is not on the IBM PC, IBM PCjr. or Ultima Trilogy versions.  It seems that if the error was "fixed", it was fixed by Sierra back in 1983.  Of course, no one apparently realized that the Greenland Dungeon is present in all four Earth timezones and is identical in each.  All they had to do was to make a copy from one of the other files and rename it.  (This is not the only time a port of Ultima II was missing a feature, the Atari 8-bit version is missing Pangea dungeon and the demonstration screens, probably because the disks at 90KB were too small to include the pictures).  The Apple II versions, both the older :ON-LINE SYSTEMS PRESENTS" version and the re-released "Origin Systems Presents" version have a Pangea dungeon entrance and an uncorrupted dungeon.

The Sierra On-line versions of Ultima II had no speed limiting of any kind.  At the time, 1983-1984, there were only two system speeds in wide use, the PC and the PCjr.  These games will not necessarily crash when played at faster speeds, but may be unplayable at AT speeds.  When Origin released the Ultima Trilogy in 1989, it included speed adjustment code in this release for people with AT class systems.  The program will count CPU cycles and try to adjust itself, but eventually will give a Divide By Zero error once the CPU speed increases past a certain threshold.  This was carried over to the Ultima I-VI Series CD. The version in the Ultima Collection replaces the speed test with a hard coded delay value, but the value was way too small for the systems of 1998. However, the Collection included a version of MoSlo for all the Ultima games.

6.  Fixing the Player Disk

Ultima II is very annoying because it can overwrite the files on the Player disk.  If some cheap idiot used his original Player disk to save a game, then the game will not be able to restore it to its pristine state.  Fortunately, they can be fixed.  The only files the game saves to are MAPX10, MAPX20, MAPX30, MAPX40, PLAYER, MONX10, MONX20, MONX30 & MONX40.  Replace those files with untouched versions and you enjoy a new game of Ultima II.  The pristine PLAYER and MONX files only have 00s in them.  Note that MAPX10, which is the Pangea map, will not have the dungeon entrance unless the file has been patched.

7.  Sound Effects of the Sierra Online PC and PCjr. Versions

Since I own an IBM PC and an IBM PCjr. and have access to all PC versions of Ultima II and some of the sounds rely on effects not properly emulated at present and speed-sensitive, I decided to record the playback from the respective speakers of these systems.  In each case I placed my smartphone close to the speaker's location outside of the case.  You will therefore hear keyboard keys, fans and other background noise.  I chose to do it this way in order to give the listener a true impression of how these games will sound to the actual computer user.  Note that the PCjr. was recorded without a memory device driver loaded for the proper speed.









I did not feel anything was to be gained by recording the Origin System's version, DOSBox can do justice to its simple sound effects.

Sunday, December 28, 2014

Atari 2600 - Just How Many Games?

The Atari 2600 was the most successful of all the pre-crash consoles, but unfortunately its game library is somewhat inflated.  The 2600, even though it games were sold for it in North America from 1977-1990, , had far fewer games than the NES, with games available from 1985-1995.  However, the number of unique NES games available in North America, licensed and unlicensed, reached 750.  Unique for the NES means no cartridge label variations, re-releases prototypes, contest only-games or multi-cartridges where single carts exist.  Atari 2600 games only approached 400, but often numbers of 600-700 games are quoted in places around the internet.

Atari itself bears much of the blame here.  It marketed its console as the Atari Video Computer System (VCS) and later as the Atari 2600.  In Sears' department stores the console was called the Sears Video Arcade, and while the label covering the switches may have been different, underneath they were exactly the same system as the Atari-branded system being sold in non-Sears stores.

Similarly, Atari allowed Sears to sell Atari's cartridges under the Sears Tele-games label.  Thus each game would have two releases, and the names would not be the same but the ROMs would be identical.  Thus the game Atari called Breakout, Sears called Breakaway IV, Circus Atari was shortened to Circus, and Outlaw became Gunslinger.  Sears' actual contribution are three games Atari never released under its own label.

In addition to the Sears license, Atari kept most of its early titles in circulation with corresponding differences in labels.  Space Invaders has a text, picture, silver and red label, but it should always be counted as one game.  Sometimes games would be renamed, as Hunt & Score was renamed to A Game of Concentration and also released by Sears as Memory Match.  Finally, Atari did release games in its Red Label era originally published by rivals in the pre-crash era such as Coleco's Donkey Kong & Donkey Kong Jr.

Pepsi Invaders and Atlantis II are variations on the originals and were provided only to a select few, so I consider them as to prototypes, and they should not be counted in an official list of a system's games.  However, there are several other extremely rare games like CommaVid's Video Life, only available to people who purchased the MagiCard.  Essentially it would have been purchased only by the few of the few. And then there were games like Birthday Mania, sold only in a limited geographic area and so rare that the ROM has not been dumped.  Unlike Pepsi Invaders and Atlantis II, they are not hacks of existing games, so they are included.  While there are several games that are very rare, they were at least available to the general public, usually only via mail order.  However, even if included, the final number would not significantly change.

Two issues with a list of North American Atari games is that games only released in PAL territories must be weeded out.  Prototypes and reproductions should also be filtered out.  The final number is focused on games released during the console's lifespan, so homebrew games are not counted.  What games were released in North America is mostly well-known, but when you go to the many European countries, South America and Taiwan, the titles really start to become difficult to manage.  If pirate cartridges are considered, the PAL territories probably had more games released than the U.S. and Canada, where relatively little piracy occurred.

Finally, games released by pirate labels, which frequently only rename the game, should also be left out unless that has been confirmed as the only a game found a North American release.  Thus most, but not all, releases by Zellers should not be counted.  Cartridges that are not games like diagnostic carts, copy carts, rewritable cartridges.  Nor are the Gameline Master Module or the Starpath Supercharger counted, but the former allowed exclusive access to Save the Whales (included under 20th Century Fox) and the latter came with Phaser Control.  The term "game" is liberally interpreted to include any kind of cartridge or cassette software intended to have some kind of entertainment or edutainment purpose.  Carts like Basic Programming, Music Machine and MagiCard are thus included.  Double-ended cartridges are always counted as one game so long as one-half of the cartridge was not released as a single game.  Virtually all the games so released were also released as single cartridges.  Here is the Tally :

Company   Unique Games
Atari, Inc. / Sears 101
Activision 44
Parker Brothers 21
Atari Corp 19
M Network 17
20th Century Fox 18
Imagic 16
U.S. Games 14
Coleco 13
Spectravision 11
Arcadia / Starpath 11
Apollo 11
Tigervision 10
Telegames 10
Sega 9
CBS Electronics 9
Xonox 8
Panda 8
Data Age 8
CommaVid 7
Telesys 6
Playaround 5
Avalon Hill 5
Zimag 4
Bomb 4
Absolute Entertainment 4
Zellers 3
Mythicon 3
Mystique 3
Konami 3
Epyx 3
Wizard Video 2
Ultravision 2
Puzzy 2
Milton Bradley 2
Exus 2
Answer Software 2
Amiga 2
VentureVision 1
Universal Gamex 1
TNT Games 1
Sunrise 1
Sparrow 1
Simage 1
Selchow & Righter 1
Personal Games Company 1
MenAvision 1
K-Tel Vision 1
Gammation  1
First Star Software 1
DSD/Camelot 1
American Videogame 1


Total Unique Games 436

Thursday, December 25, 2014

Atari Joysticks on the PC : Four Historical Interfaces

The standard PC joystick was an analog design that uses potentiometers to vary the rate of a capacitor's charge.  Most console systems of the time used joysticks with pure digital switches.  Before console emulators became popular with PCs, there were some historical hardware that could implement a digital, Atari-style joystick.  This post will describe the methods used to implement them.

1.  Amstrad PC-1512 & 1640

The Amstrad PC-1512 and PC-1640 supported a digital joystick, with a port built into the keyboard.  The joystick directionals and fire buttons function just like keyboard keys, and send the following untranslated scancodes :

77 Fire 2
78 Fire 1
79 Right
7A Left
7B Down
7C Up

A program can read the raw scancode, but most typically use Int 16H to read a translated scancode.  The Amstrad translates the joystick directions into the XT compatible numberpad cursor scancodes.  Thus the joystick functions identically to the 2, 4, 6 & 8 keys on the numberpad, assuming the program is not trying to distinguish between the number pad cursor keys and the dedicated cursor keys with their raw scancodes.  The buttons are not defined by the BIOS and are ignored until an assignment is given to them by writing to the systems' non-volatile RAM.  As its name implies, this RAM will retain its contents even after the system is powered down.  This provides for maximum configurability, because games commonly use the Spacebar, Enter/Return or even F1 as a fire key.

Amstrad connects pins 1-4 and 6-8.  Pin 7 is normally unconnected on an Atari joystick, but Amstrad uses it as a second button.  Amstrad CPC JY2 and JY3 joysticks function properly with this pin arrangement.

2.  Covox Sound Master

The original Covox Sound Master has two DE-9 ports.  Having viewed closeups of the PCBs of the board, I can give a fair analysis of how the joysticks work.  The joystick lines for each joystick are connected to pullup resistors and then a 74HC365 line buffer, non-inverting.  From the solder side of the board, there are lines connecting pins 1-5 and 8 & 9 to these buffers.  Pin 9 is used on a Sega Master System controller as button 2, but it is unconnected on an Atari one-button controller.  However, pin 6, which is the only button on an Atari controller, is unconnected on the Covox's PCB.  Pin 5, which is unconnected on an Atari controller, is connected.  This leads me to believe that Covox either sold its own joysticks or, more likely, connected pins 5 & 6 on the component side of the board.  We cannot see underneath the plastic.

From the line buffers, the joystick inputs appear to be connected to the I/O pins of the AY8930.  The AY8930 contains a pair of 8-bit I/O ports that can be set to input or output.  The original SimCity has explicit support for Covox Sound Master Joysticks.  It sets the I/O ports to input and reads the values of the pins.  More information will have to wait until the project to clone the board has been completed.

3.  The FTL Sound Adapter

This device was a parallel port dongle that output sound in the manner of a Covox Speech Thing and had a DE-9 port on the end of it.  It was included in some releases of Dungeon Master for the IBM PC.  PCB and schematic for the device can be found here :

http://dmweb.free.fr/?q=node/1514

As you can see, each joystick input is connected to one of the five status port lines.  Four of those five inputs are also connected to a separate control port line.  Here are the connections :

1 Up     15  1 (Strobe - Error)
2 Down   13 14 (Select - Line Feed)
3 Left   12 17 (Paper Out - Select Printer)
4 Right  10    (Acknowledge)
5 NC
6 Fire   11 16 (Busy - Reset)
7 NC
8 Ground 18
9 NC

When a directional or button is pressed, a bit in the status port will flip to indicate that the direction has been pressed.  As you can see, you cannot use more than a one button joystick by this method.

The control port lines, which are not intended to function as input lines, are connected to allow Dungeon Master to detect the presence of the FTL Sound Adapter.  First, the game writes 0C to the control port and checks to see if bit 5 is a 0 on the status port.  Then it writes 04 to the control port and checks to see if bit 5 is a 1 on the status port.  If either check fails, the game will not allow the user to select the FTL Sound Adapter.  Now recall how the DB-25 parallel port connector is wired :

           Bit 7 6 5 4 3 2 1 0
Data Port    Pin 9 8 7 6 5 4 3 2
Status Port Pin 11 10 12 13 15 NC NC NC
Control Port Pin NC NC NC NC 17 16 14 1

underlined = inverted input or output from value written

0C = 0000 0011
04 = 0000 0100

Now, bit 5 of the status port is connected to bit 1 of the control port, which inverts.  If a 1 is written to bit 1 of the control port, then a 0 will appear at bit 5 of the status port.  Conversely, if a 0 is written to bit 1 of the control port, then a 1 will appear at bit 5 of the status port.

Dungeon Master will attempt this check for every parallel port address reported by the BIOS.  Once it has passed, then it will allow the user to select the FTL Sound Adapter and should allow the user to use the joystick plugged into the Sound Adapter.  The adapter cannot actually verify if a joystick is connected, however, unless it asks the user to move the joystick around and press the button.

The PC version of Dungeon Master that came with the FTL Sound Adapter shows an Atari joystick plugged into the back of the Adapter.  It says that the joystick port is the next best thing and the user can plug in any switch style joystick for easy game play.  (The computer in the photo looks like a Tandy 1000 TL, SL or SL/2).  However, the quick start guide only talks about analog joysticks and identifies the DE-9 port on the Sound Adapter as "Future expansion port".  The sound functionality is adequately described in the quick start guide, but because the joystick isn't specifically mentioned, I wonder whether the game actually supports a digital joystick.

If it does, then it would read the joystick in parallel, with a 0 value on each bit of the status port, except for bit 7, which would be a 1, indicating that a directional or button was pressed.

4.  The Dyna Blaster Adapter

The Dyna Blaster Adapter, on the other hand, is a truly working Atari parallel port joystick adapter.  Dyna Blaster, a.k.a. Bomberman in the U.S. and Japan, was released for DOS only in Europe.  Apparently it was a somewhat obscure release; it is not easy to find.

This adapter has two DE-9 ports and supports two Atari joysticks.  Uniquely for a PC game, the dongle functions as the copy protection.  The system requirements label on the box states that an Atari joystick is required, and without the joystick and the dongle you cannot make any selections on the main menu screen. Fortunately the dongle's function has been more or less reverse engineered.  (There is also a crack available for the game to use the keyboard at the menu).

When the game starts up, it calls a subroutine that writes FF to the data port and then checks to see if bit 6 of the status port is 0.  Then it writes 7F to the data port and then checks to see if bit 6 of the status port is 1.  This sequence then loops 20 times for each parallel port the BIOS reports.  In terms of bits, the patterns are

FF = 1111 1111
7F = 0111 1111

Therefore, data port bit 7 is connected to status port bit 6 because that is the only bit that is changing.

The second subroutine is called at the menu and when playing the game.  It writes the following values to the data port twice :

3E = 0011 1110
3D = 0011 1101
3B = 0011 1011
37 = 0011 0111
2F = 0010 1111

The first time this data is written, bit 5 of the status port is checked after each write, and if 0, then a directional bit is set in the program's memory.  The second time this data is written, bit 7 of the status port is checked after each write, and if 1, then a directional bit is set in the program's memory.  Obviously, this corresponds to the first and second joysticks.

The bit pattern for the five values above gives us the key as to how each joystick is wired.  The joystick is being read in a serial fashion.  Instead of the status lines being connected to each switch, instead the common line of each joystick is connected to a single status bit.  The low five bits of the data port are connected to the five switch lines of both joysticks.  The data lines send logical 1s to everything but the joystick switch being queried.  If the first joystick switch is pressed, a logical 0 will appear on status bit 5.  If a second joystick switch is pressed, a logical 1 will appear on status bit 7 (which is inverted at the parallel port adapter)..

One last necessary observation is that data bit 6 is always a logical 1.  I believe that this is to allow a pull-up resistor on status bit lines 5 & 7.  According to this page, 4.7K resistors should be sufficient as a pull up resistor : http://arcadecontrols.com/arcade_tormod.html  Otherwise, the program would have no way to determine whether a joystick switch has stopped being pressed.  As a consequence of the pull-up resistor, when the joystick switch is no longer pressed, then the line will settle back to a logical one 1.  Thus the FTL problem is solved.

While Bomberman does not use diagonals, what happens if a user pushes the stick in a way that closes two switches or pushes the button as he holds the joystick down?  As the adapter can only test one joystick switch at a time, there will be a 0 and 1 (or two 1s if the diagnonal is pressed) coming down the status line.  Fortunately, it is almost impossible to press two directionals and or the fire button exactly at the same time. The game, however, only cares about 0s on the first joystick port.  Each time it reads the port, it is only reading for one direction.  Presumably it will read the stick several times to make sure it finds the 0, if there is one.

Sunday, December 21, 2014

The Wringer - Breaking PC DOS Game Copy Protection

Copy Protection is the bane of the PC Gamer's existence.  It ranges from "You must insert your ORIGINAL disk into drive a:" whenever you play the game to "Find the fifth word in the third paragraph on page eight in your manual" and "Type in the name of this planet at coordinayes x 645 and y 743".  However, if you want to enjoy games from their original media, it is necessary to deal with it.  It stinks when you buy a PC game from a thift store or on ebay and it is missing the code wheel or the map or the manual.  If you do not want to deal with it, there are several programs you can use to break the protection.  In this blog post, I will identify these programs, point out some special cases and generally help people play their games without the original documentation.  Let me start with a group of cracking programs I call, collectively, "The Wringer".

The Wringer

The Wringer consists of eight DOS programs.  All these programs have a text-based GUI that allows you to select your game from a list.  There is undoubtedly considerable overlap among these programs, but I have not the time or the patience to create a spreadsheet identifying which program has a crack for which game.  It is an unusual game that cannot be cracked by one of these programs.  Unfortunately, this means that you may not find a crack for your game until the fifth or sixth program you try.  DOSBox is excellent for going those these programs and applying their patches quickly.

NoGuard R6.0 by Central Point Software

This program is the oldest, dated 10/11/1990.  It says it can break the SuperLok, ProLok and EverLock disk-based protections and Sierra Online's protections.  It then has a list of individual games and programs. It can also detect some protection schemes.

Central Point Software was the publisher of CopyIIPC, and versions of CopyIIPC would include NoGuard for people to make hassle free backups and fully hard drive functional installations. It also included the NoKey program for certain disks for which CopyIIPC could not make a working backup.

The executable is NOGUARD.EXE.

The Patcher v6.5 by Michael Caldwell

This program has a file date of 05/09/1995.  It supports 171 distinct games.  The executable is PATCHER.EXE

CrackAid v3.39 by Rawhide

This program supports 323 entries, but some games have more than one entry.  This is because they have multiple versions.  The file date is 11/05/1993 and the executable is CRACKAID.EXE.  It should be kept in its own subdirectory.

Crock v2.32 by Firebug & Eryx

This program is good when you want to crack CGA or Tandy versions of some games.  It has 624 cracks and some cheats as well. It also comes with UNP, (see below).

The files date from 01/16/1995 and the executable is CROCK2.EXE.  It should be kept in its own subdirectory.

Locksmith v1.31 by REM Software

This program is by far the most annoying of the bunch.  If you move the subdirectory, you must reinstall the program again.  You need to mount the install files to a floppy drive and you need a serial number.  If you download it where indicated, the serial will be included.  The executable is LOCK.EXE.  The program is dated 07-17-1994 and consists of 792 entries.  It does include a Hex Editor and will tell you what each crack does.

NeverLock by Copyware Inc.

This version is from Spring, 1996, dated 03/30/1996 and has a nag screen or two.  It can search for some commercial copy protections.  It has 424 protections divided into a Modern and a Classic Collection.  The executable is NEV_UNIV.EXE.  The executable NEV_BUSI.EXE is for commercial programs.

Dprotector v3.1 by Tim Trahan

This program was compiled on 12/10/1993.  It has libraries for Classic and Modern games, a TSR loader library (see below).  One really nice feature is that the program will tell you exactly what it does for each game.  Annoyingly, there is a nag screen when the program starts.  The executable is DPRO3DOS.EXE and it requires its own subdirectory.

Rawcopy PC v1.0 from "MSI"

Program date is 1992-1993.  This supports 476 entries.  The executable is RAWCOPY.EXE.

Where to Find

You can find all the programs I have identified here : http://retro.icequake.net/dob/#soft

Limitations

The cracks contained in these programs tend to be of varying quality.  They may not work on every version of a game, may only work on a narrow range of systems, or may work to get into the game but do not defeat protection checks later on.

Special Cases

Cracked by the Publisher

When companies started to release their floppy disk titles on CDs, they would have to break the copy protection to get them to run.  Sierra did this for their AGI games on their Anniversary and Collection CDs. However they included the necessary information for the SCI games in the manual for the collection, so those games had intact copy protection.    LucasArts cracked their games, even for floppy compilations, but they did not release every version in a Collection, so there are versions that need to be cracked manually.  Origin and Sir-Tech cracked the games that relied on disk based protection like Sierra, but included full documentation for all their games because the later games used a manual-lookup protection.  SSI included code wheels for compilations that included their early Gold Box games, even with compilations released in the late 1990s and early 2000s.

The "SUP" Sierra Unprotection Program v2.01 by Anders M. Olsson

This is a special but important case, it only deals with Sierra floppy games that use the SuperLok v3.2 disk-based protection system.  This includes all v2 AGI DOS games and a few others.  It does not work with any other AGI Sierra games such as the booter versions of King's Quest and King's Quest II, the Black Cauldron or Donald Duck's Playground.   It is not needed with v3 AGI DOS games.  The list of games which it supports are as follows :

3-D Helicopter Simulator
Black Cauldron, The (comes in v2 and v3 AGI versions, v3 is unprotected)
King's Quest I, II and III
Leisure Suit Larry
Space Quest I & II
Police Quest (most versions are not protected)
Thexder

The program can be found here : http://www.sierrahelp.com/GeneralHelp/FloppyDiskBackupProblems.html

The program requires the original disk 1 from the game, it reads the encryption string from the disk, inserts it into the Sierra .COM loader and patches the floppy disk error checks so that the loader will decrypt the AGI file, which is the real executable file.

CD-ROM Protection

CD versions of games rarely had copy protection.  In the early and mid-90s, the cost of duplicating a CD was well out of reach and CD-Rs were not really available.  In the late 1990s, burners and writable CDs had become affordable and publishers again looked to disc-based methods to protect their games, but this was typically after the DOS era.  However, there are DOS games like Orion Burger and Championship Manager 2 series, which rely on an early version of the LaserLok CD protection system.  This is not an issue if you are trying to run these games on real hardware or have a CD image and a burner that can support this protection.  However, with DOSBox, you will need patches, found here :

http://pferrie.host22.com/misc/dosbox.htm

Some CD-ROM versions of Warcraft: Orcs and Humans will ask for a word from the manual in order to install and use the game.  I believe this is a holdover from the floppy disk version, which has the same protection.  Once the game has passed the SETUP.EXE, which selects the sound devices, it can be played freely without needing to look up a word in the manual.  If you have the combo MS-DOS and Macintosh CD (with CD-Audio tracks used only by the Mac executable), then you won't encounter this problem.

If your CD has files in the root directory with 05/02/1995 dates, you will encounter the protection.   If your CD has 11/03/1994 or 09/06/1996 root directory files (the latter is the CD-Audio version), then you won't have to deal with the protection.

Compressed Executables

To save space, and to prevent instant debugging, several programs compressed their executables with a program like LZEXE  In order to crack them, these executables have to be uncompressed with a program like UNP v3.31, then have the crack applied.

Loaders

There are some games that simply could not be easily cracked.  This is because they encrypt or otherwise obfuscates that portion of the program that controls the protection.  In this case, a .COM loader may be provided that will intercept the protection and allow you to get past it.  The .COM may be loaded as a TSR or simply run in place of the game's actual executable.

Documents Required (No Crack Known)

Finally, some games had protection that could not be broken easily.  You will not find a ready crack for King's Quest V, for example.  KQ5's protection does not occur on startup.  In fact, it often does not popup until you have progressed through a substantial portion of the game.  The protection requires you to enter four symbols found on a particular page of the manual. Because the protection is buried within the SCI engine files, it was not something that could be broken with a few bytes.  In this case, its usually easier just to get a scan of the manual, but back in the day, people used ASCII art and paint program printouts to display the symbols.  Fortunately, scans for the most popular games can be found.  Here are some good places to look for them :

http://www.replacementdocs.com/news.php
http://www.mocagh.org/index.php
http://www.sierragamers.com/aspx/m/634055

In addition, there are versions of games or obscure games for which no crack may be available.  The cracks contained in The Wringer for King's Quest IV, for example, only work with the early versions.

Other Resources

The Textfiles site contains many files with unprotection instructions for DOS games.  You can find them here : http://www.textfiles.com/piracy/  You can also search the site for cracking information located elsewhere.

Other sites with cracking information include :

http://www.oocities.org/gammadragon/Cracks2.html
http://www.mmnt.net/db/0/0/ftp.gamers.org/pub/archives/uwp-uml/romulus/cracks/

Scene Releases

If there is no other choice, and you must play a game and you can't find a crack for it, then you may want to look for scene releases by warez groups.  Typically scene releases game with softdocs, which is the manual information in plain text.  Otherwise they would come with a crack or pre-cracked.  The game Dyna Blaster for DOS comes with a unique copy protection method, it requires you to use an Atari-style joystick with a parallel port adapter, which came with the game, to make menu selections.  The Wringer does not contain a crack for that obscure, Europe-only game, so you will have to play the cracked version if you do not have the dongle.