UPDATE: MAME as of version 0.231 supports 3.5″ .WOZ images and can boot the original copy-protected Alien Mind, so this modified crack has been superseded. qkumba also made his own modified crack which is more compatible with various modern Apple II mass-storage solutions. The rest of this post remains for historical reference.
One of the major exclusive games for the Apple IIgs was Alien Mind, by programmer Robin Kar and artist Matt Crysdale. The game originally came on 2 protected 3.5″ disks using a non-standard format which fit 920K on a disk (Apple’s standard format fit 800K). There’s a common crack by a French group called the F.U.C.K. on 3 normally formatted disks which uses the standard SmartPort firmware interface to the 3.5″ drive. In theory, this should be able to work with a lot of mass storage devices for the IIgs, most of which implemented at least some version of the SmartPort API in their on-card firmware.
In practice, this didn’t work out so well, so someone who goes by ballmerpeak decided to fix some issues with the crack. First up, they made it work on ROM 03 machines, but it was still only the first disk and hardcoded slot 5. In part 2 they concatenated the 3 disks of the crack plus a 4th save game disk into a single .2MG image and made it all work that way. Unfortunately, that version doesn’t boot on any of the 3 available emulated mass storage cards in MAME that should otherwise work. The CFFA2 and CMS SCSI II Card (with the 3-1-1990 ROM revision) support SmartPort as originally defined, with 16-bit buffer and block addresses. The IIgs introduced an extension called “extended SmartPort” which made the buffer and block addresses both 32 bits if the command number has bit 6 set. And the F.U.C.K. crack as modified by ballmerpeak relies heavily on extended SmartPort, so those two cards are out without extensive patching.
However, MAME also supports the Apple Rev C. SCSI Card, which does support extended SmartPort. So it should work, right? Nope, trying to boot it there results in loading for a second and then the tell-tale Monitor beep of a BRK crash. (Alien Mind has set the text and background colors both to black at this point, so you can’t actually see what’s going on). Investigation with the MAME debugger showed that the SCSI Card firmware was actually doing the crashing, and it’s because Alien Mind was making SmartPort calls with the 65816 direct page register set to $AF00, when the card firmware assumed it would be at the classic 6502-compatible location of $0000. Fortunately, ballmerpeak included their disassembly of the boot loader and “DOS” code. I noticed some nice empty space at $B1C6 where a patch could go, and used MAME’s debugger to patch the code in RAM before it executed accordingly. That was successful!
The patch looks like this:
$B2D0 became JMP $B1C6. At $B1C6 we did SEC / XCE / PHY / PHX, imitating the original code at $B2D0. Next the patch did PHD / PEA $0000 / PLD (which saves the existing direct page and sets it to the $0000 the SCSI Card firmware is looking for) and then JMP $B2D5 to resume the code at the actual SmartPort call. (We couldn’t easily relocate the call itself because it’s patched by several places in the code). At $B2DD there was a BCS instruction checking for errors in the SmartPort call; we needed that space and since we’re targeting emulators primarily we can safely assume the reads will never fail. So at $B2DD we changed it to PLD / NOP to restore the original direct page, and the NOP simply takes out what was the second byte of the BCS.
Unfortunately, all of this code is compressed on disk, so we couldn’t easily modify it there. Fortunately, there’s lots of space in the initial boot loader after ballmerpeak disabled the F.U.C.K.’s original crack screen. There’s a routine at $0A3C that originally waited for a key or mouse press in the crack screen; we repurposed it to patch the freshly decompressed code with the patch above. We changed $091B to jump to our new patch code at $0A3C immediately after decompressing the next stage instead of actually running the decompressed code. The patch at $0A3C consists of JSR $0962 / LDX #$000c / $0A42: LDA $0A60,X / STA $22A2,X / DEX / DEX / BPL $0A42 / LDA #$EA2B / STA $23B9 / LDA #$C64C / STA $23AC / LDA #$B1B1 / STA $21AE / BRA $0AB0. The loop creates the main body of the patch at $B1C6, and the 3 LDA/STA pairs insert the JMP at $B2D0 and change the BCS to the PLD / NOP sequence.
With all of this fun out of the way, the game works fine on MAME with the Rev. C SCSI Card emulation:
And here is the patched .2MG image, renamed “alienmind2016b” from “alienmind2016a”, because I was too lazy to edit the title screen like ballmerpeak did. Sometime I might try and figure out why the SCSI Card’s firmware is failing and see if it can be fixed, but this works for now.
