Ricochet (Mind Toys, 1982)

[toinet]

Play a game of ricochet against a human or the computer. Difficult game!


PROTECTION TYPE
It is a non-standard 16-sector disk. A DOS 3.3 disk with change of data markers depending on the filename... just like Elite. Refer to that thread for more info even though that thread's next messages are more documented.

Just like Elite, the RWTS data read routine is slightly modified. You can read D5AAAD with the standard routine but reading of D5AAxx sectors imply a change of the decoding routine.

I believe I will update my crack of Elite with the method used here.


DISK COPY
Step 1
Boot a DOS 3.3 master disk
Put a blank disk in drive 2
Type INIT HELLO,D2
Leave the disk in drive 2

Step 2
Launch Advanced Demuffin
Press P to bypass boot
Go to the monitor
Move the code of the third message in that thread to $B700
- B8DC: 4C 00 B7
Return to Advanced Demuffin (press control-y)
Copy tracks 3 to $22 onto drive 2


Reboot and... enjoy,

Toinet

[toinet]

The following code is the original data read routine. The interesting part is located at $B8AF.

Location $31 contains the third marker to be read. If its value is $AD, we read a sector normally, otherwise we go to $B8BE.

Code : Tout sélectionner

*
* Ricochet
* (c) 1982, Mind Toys
*
* (k) 2007, LoGo
*

         mx    %11
         org   $B895
         lst   off

*
*
*

LB895    LDY   #$20
LB897    DEY
         BEQ   LB90C
LB89A    LDA   $C08C,X
         BPL   LB89A
LB89F    EOR   #$D5
         BNE   LB897
         NOP
LB8A4    LDA   $C08C,X
         BPL   LB8A4
         CMP   #$AA
         BNE   LB89F
         PHA
         PLA
LB8AF    LDA   $C08C,X
         BPL   LB8AF
         CMP   $31
         BNE   LB89F
         EOR   #$AD
         BEQ   LB8C7
         BNE   LB8BE

LB8BE    LDY   $C08C,X    ; Extra nibble if D5AAxx
         BPL   LB8BE
         LDA   $BB00,Y

         DB    $2C        ; The opcode for BIT $xxxx
LB8C7    LDA   #$00       ; Normal reading if D5AAAD
         LDY   #$56
LB8CB    DEY
         STY   $26
LB8CE    LDY   $C08C,X
         BPL   LB8CE
         EOR   $BB00,Y
         LDY   $26
         STA   $BD00,Y
         BNE   LB8CB
LB8DD    STY   $26
LB8DF    LDY   $C08C,X
         BPL   LB8DF
         EOR   $BB00,Y
         LDY   $26
         STA   $BC00,Y
         INY
         BNE   LB8DD
LB8EF    LDY   $C08C,X
         BPL   LB8EF
         CMP   $BB00,Y
         BNE   LB90C
LB8F9    LDA   $C08C,X
         BPL   LB8F9
         CMP   #$DE
         BNE   LB90C
         NOP
LB903    LDA   $C08C,X
         BPL   LB903
         CMP   #$AA
         BEQ   LB90E
LB90C    SEC
         RTS

LB90E    CLC
         RTS

[toinet]

And my modified code to use the standard DOS 3.3 tables addresses: $BA00 instead of $BB00, etc.

The change is at $B71A...

Code : Tout sélectionner

*
* Ricochet
* (c) 1982, Mind Toys
*
* (k) 2007, LoGo
*

         mx    %11
         org   $B700
         lst   off

*
*
*

LB700    LDY   #$20
LB702    DEY
         BEQ   LB777
LB705    LDA   $C08C,X
         BPL   LB705
LB70A    EOR   #$D5
         BNE   LB702
         NOP
LB70F    LDA   $C08C,X
         BPL   LB70F
         CMP   #$AA
         BNE   LB70A
         PHA
         PLA
LB71A    LDA   $C08C,X
         BPL   LB71A
         CMP   #$AD       ; Rewrite comparison routine
         BEQ   LB732
         NOP
         NOP
         NOP
         NOP
         NOP
         NOP
LB729    LDY   $C08C,X    ; Extra nibble if D5AAxx
         BPL   LB729
         LDA   $BA00,Y
         DB    $2C

LB732    LDA   #$00       ; Normal reading if D5AAAD
         LDY   #$56
LB736    DEY
         STY   $26
LB739    LDY   $C08C,X
         BPL   LB739
         EOR   $BA00,Y    ; The table addresses...
         LDY   $26
         STA   $BC00,Y    ; ...have been corrected
         BNE   LB736
LB748    STY   $26
LB74A    LDY   $C08C,X
         BPL   LB74A
         EOR   $BA00,Y
         LDY   $26
         STA   $BB00,Y
         INY
         BNE   LB748
LB75A    LDY   $C08C,X
         BPL   LB75A
         CMP   $BA00,Y
         BNE   LB777
LB764    LDA   $C08C,X
         BPL   LB764
         CMP   #$DE
         BNE   LB777
         NOP
LB76E    LDA   $C08C,X
         BPL   LB76E
         CMP   #$AA
         BEQ   LB779
LB777    SEC
         RTS

LB779    CLC
         RTS