Lode Runner (Broderbund, 1983)

[toinet]

You are a miner. You must collect all the coffins, avoid foes and escape from each level.

That game is one of my favorites: easy rules, fantastic gameplay, hours of entertainment. It is one of the best selling software of the Apple II.

The program is heavily protected:
- boot code is coded
- code executed in the zero page area
- code loaded in the text screen area
- all vectors redirected to the reboot code
- jumps to different parts of code through the stack
- on-disk protection with half-tracks (the sound of the head moving is nice)
- nibbles on disk are 4*4 coded

But... it has passed the LoGo's exam

The following table summarizes the memory usage:
- $0060..$010F: boot stage / phase 1 (oh! the stack)
- $0200..$02FF: reboot code
- $0400..$04FF: final boot / inits (replaces data of phase 2)
- $0400..$07FF: boot stage / phase 2
- $0800..$08FF: boot stage / phase 0
- $0F00..$1EFF: program
- $6000..$BFFF: program

Final jump to $6000 once code at $0400 has been executed.

Let me find my external USB CF reader and I will upload the boot source codes.

What a grat program!!!!

Antoine
10/2008

[toinet]

Second digging into the disk organization of Lode Runner...

TRACK $00
- sector 0: first boot loaded at $0800..$08FF
- other pseudo 4*4 sectors: $0400..$07FF

TRACKS $01-$02 : NO DATA

TRACKS $03-$0C : GAME LEVELS
- track $0C / sector $ 0F : score board loaded at $1F00..$1FFF
- sectors can be copied with DEMUFFIN once $B942:18 is set

TRACKS $0D-$1E : PROGRAM CODE
- eight 4*4 sectors per half-track ($0D and $0D.5)
- then move to next 1.5 track
- data is loaded from $0F00..$1EFF
- program is loaded from $6000..$BFFF
- $B700..$BFFF is a standard DOS 3.3 RWTS

TRACK $21 : PROGRAM INIT
- last boot phase loaded at $0400..$04FF

Now that we have gathered all the necessary information about the program, there are different ways to create a standard and copyable diskette:
- rewrite the boot code at $0400..$07FF using the $Cx5C routine
- use a fastboot code (the one from EA games)
- use the standard DOS 3.3 RWTS track $00 code and use it to load the game.

As always, I would like to minimize the changes of the original code. As the $0900..$0EFF RAM space is free, it can be used for our routines.

My choice has not been decided yet, that fantastic game needs some good load routines...

Antoine
10/2008

[toinet]

And now, introducing you to the boot 1 code of Lode Runner, the one that is loaded from track $0 / sector $ 0 at address $0800:

[toinet]

The code decyphered from $0850 to $0060 is just there...

[toinet]

The next boot stage on track $00 which is loaded from $0400 to $07FF is included in that message.

Note that page 7 ($0700..$07FF) is copied from $0200..$02FF. The interesting load routines and arm move are located there.

Once program is loaded from $0F00..$1EFF and $6000..$BFFF, a final "sector" is loaded from track $21 at $0400..$04FF then a jump is executed.

[toinet]

And now the final boot stage from track $21 loaded from $0400..$04FF. It inits some game values and jumps to the program at $6000.

[toinet]

How can we load the complete program data into memory as wildcards and other hardware stuff are turned off. Just disassemble and reassemble the load program where memory is free...

The first step is to perform the famous "2600<C600.C6FFM N 26FB:60" for Apple IIgs owners. Then, execute the following code 2000G. The program is now loaded into memory...

[toinet]

And the final code which should have been put before the previous message is the rewritten code to get the original $0400..$07FF code from track $00:

[toinet]

The pre-final stage is to reconstruct the disk with the data and program recorded onto different tracks.

The following table lists how it is done:
- T00/S00: boot 1 code ($0800..$08FF)
- T00/S01..S04: new boot 2 code ($0400..$07FF)
- T03-T0C: level data
- T0D: program data ($0F00..$1EFF)
- T0E..T13: program code ($6000..$BFFF)

For vintage and historical digging, please find the original boot codes there:
- T01/S01..S04: original boot 2 code ($0400..$07FF)
- T21/S00: original boot 3 code ($0400..$04FF)

Please use our own program to copy the program and its data at the right places.

Antoine
11/2008

[vladitx]

Toto, you rule.

[toinet]

And now... the rewritten Boot 1 routine as well as my new "fast" track loading, similar to the Electronic Arts' one.

As previously written, I always want to make minimal changes to the programs, therefore I load five sectors directly with the ROM routine, copy data to the right places and load the program. I apply the same vector routines change and other inits that are not really useful there but that is similar to the original program

And for curious people, download the disk at the following place: http://www.brutal-deluxe.fr/crack/LODERUNNER.DSK