*************************************** * * * * * KRAKOWICZ'S KRACKING KORNER * * * * * * BASIC HARDWARE KRACKING TOOLS * * * * * * * *************************************** IN ANSWER TO AN INCREASING NUMBER OF REQUESTS, HERE ARE A COUPLE OF RELATIVELY (?) SIMPLE HARDWARE DEVICES DESIGNED TO INCREASE YOUR KRACKING AND SNOOPING ABILITY. THE SELECTION RULES ARE SIMPLE: IF YOU DON'T KNOW HOW TO MAKE IT, DON'T TRY. IF YOU DON'T KNOW HOW TO USE IT, DON'T BOTHER. SOME OF THE PIECES WILL BE HARD TO FIND, SO IF YOUR SOLE SUPPLIER OF HARDWARE IS RADIO SHACK, YOU MAY HAVE SEVERE DIFFICULTIES BUILDING AT LEAST THE FIRST DEVICE. THESE ARE NOT (AS FAR AS I KNOW) COMMERCIAL PRODUCTS, AND NEITHER I NOR THE MANAGEMENT OF THIS INFORMATION SERVICE HAS ANY ABILITY OR DESIRE TO SUPPLY YOU WITH COMPLETED DEVICES, PARTS, ADDITIONAL INFORMATION, DEBUGGING AIDS, OR ADVICE IN THEIR UTILIZATION IN KRACKING, OTHER THAN THAT PRESENTED HERE. (THESE DEVICES ARE DESCRIBED "AS IS", AND THE MANUFACTURER MAKES NO WARRANTY, EXPRESS OR IMPLIED, REGARDING, BUT NOT RESTRICTED TO, MERCHANTABILITY, FITNESS OF USE, BLAH, BLAH, BULLSHIT, HAVE YOU ANY PULL?). THERE ARE TWO DEVICES. THE FIRST IS KNOWN AS THE "ROMSWITCH", AND ALLOWS YOU TO SELECT BETWEEN TWO PROMS IN THE F8 POSITION, ONE BEING A STANDARD APPLE 9316 PROM SUCH AS AN AUTOSTART ROM, AND THE OTHER A 2716 MODIFIED TO PERFORM PERVERTED ACTS FOR CLANDESTINE PURPOSES. YOU ARE CERTAINLY AWARE OF THOSE "PROTECTION" SCHEMES WHICH REQUIRE YOU TO HAVE AN UNMODIFIED AUTOSTART ROM IN THE F8 SOCKET IN ORDER TO BOOT (SHAME ON YOU FOR TRYING TO USE LOWER CASE!), AND THERE ARE MANY TIMES WHEN IT WOULD BE NICE TO SWITCH EASILY BETWEEN A NORMAL AUTOSTART ROM AND A KRAKROM WITH VOLATILE MEMORY SAVE AND NMI CAPABILITES (CRACK-SHOT, REPLAY, WILD CARD, AND FRIENDS ARE BENEATH CONTEMPT FOR THE SERIOUS KRACKIST). (THOSE OF YOU WHO HAVE FIGURED OUT HOW TO DO THIS BY PROGRAMMING A 2732 PROM TO CONTAIN BOTH THE NORMAL AND MODIFIED CODE, AND THEN TOGGLE BETWEEN THEM WITH A SWITCH ON THE A11 LINE AT PIN 18 NEED READ NO FURTHER. YOU ARE BEYOND US AND WE SALUTE YOU.) AS WE DESCRIBED IN "THE BASICS OF KRACKING 1", THE TWO PROMS DIFFER IN THEIR UTILIZATION OF CHIP SELECT AND CHIP ENABLE PINS. FORTUNATELY, THE PINS USED TO CONNECT THE ROM TO THE BUS (CHIP SELECT LINES) ARE OF OPPOSITE SEX: THE 9316 IS ENABLED BY PULLING PIN 18 UP TO 5 VOLTS, WHILE THE 2716 IS ENABLED BY PULLING PIN 18 DOWN TO GROUND. WHAT THIS MEANS TO US IS THAT WE CAN SELECT BETWEEN THE TWO CHIPS BY WIRING ALMOST ALL THE PINS IN PARALLEL AND USING A SINGLE-POLE, SINGLE THROW SWITCH TO CONNECT BOTH PINS TO EITHER 5 VOLTS OR GROUND. (MOST OF THE TIME) YOU CAN EVEN DO IT WHILE A PROGRAM IS RUNNING WITHOUT ANYONE KNOWING YOU DID IT. TO DO IT RIGHT, YOU WILL NEED A 24-PIN PLUG THAT FITS INTO THE F8 ROM SOCKET AND CONNECTS TO A 6-INCH PIECE OF 24-CONDUCTOR FLAT RIBBON CABLE. THIS IS KNOWN IN HARDWARE CIRCLES AS A CRIMP-ON 24-PIN DIP PLUG (3M #3460 OR EQUIVALENT). IF YOU CAN'T FIND ONE, YOU CAN SOLDER THE INDIVIDUAL WIRES TO THE SOCKET HOLES OF A 24-PIN SOCKET OR THE PINS OF A 24-PIN COMPONENT CARRIER, BUT YOU WILL NEED MUCH MORE SOLDERING SKILL TO AVOID SHORTS. CRIMP THE DIP PLUG ONTO THE 24-PIN CABLE, THEN AT THE OTHER END, CRIMP ON A TOTAL OF 4 40-PIN "BIPIN" HEADERS (EACH ONE HAS TWO ROWS OF 20 PINS ON 0.100 INCH CENTERS; ANSLEY, 3M, AMP MAKE 'EM), ALLOWING A SPACE OF EXACTLY 0.2 INCHES BETWEEN EACH PAIR. THE SPACING BETWEEN OUTSIDE ROWS ON ADJACENT HEADERS WILL THEN BE 0.6", JUST RIGHT FOR THE PINS ON 24-PIN DIP SOCKETS (IF ANYONE EVER FINDS A SOURCE OF 24-PIN CRIMP-ON IC SOCKETS, PLEASE POST A MESSAGE LISTING THE SOURCE. WE WILL BE ETERNALLY GRATEFUL TO YOU). (IN THE DIAGRAMS BELOW, PLEASE TRY TO PRETEND THAT THE THINGS THAT ARE SHAPED LIKE: /\/\/\ LOOK LIKE RESISTOR SYMBOLS. IT'LL MAKE ME FEEL A LOT BETTER). ___ ____________________ ^ !....................!_________ ! !....................!4 ^ ! !____________________!____ ! ! ! ! 0.2" ! !2716->!___________!_______ ____ 0.6" ! !....................! ! ! !....................!3______!_ ! !____________________! ! ! ! ! !___________!_______ ! !....................! ! !....................!2 ! !____________________! !9316->! ! ! !___________!_______ ! !....................! 40-PIN ! !....................!1 HEADERS ! !____________________! 6" ! ! ! ! ! ! ! ! ! ! ! ! ! ! 24-CONDUCTOR ! ! ! RIBBON CABLE ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! _!___________!_ ! ! ............ ! ! ! ! 24-PIN DIP ! ! ! PLUG ! ! ! ! ! ............ ! (TOP VIEW) _V_ !_______________! / PIN 1 PREPARE TWO 24-PIN WIRE-WRAP SOCKETS AS SHOWN BELOW: (THESE ARE BOTTOM VIEWS) --------------------------------------- ! 13 14 15 16 17 18 19 20 21 22 23 24! ! ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ ! ! X ! ! 1000 OHMS /\ ! ! \ / ! / ! _/\/\/\/\___/ ! (NOTCH)->! ! ! ! \ ! ! ! 9316 PROM ! ! ! . . . . .! . . . . . . ! !/ / / / / / !/ / / / / / ! !12 11 10 9 8 7 !6 5 4 3 2 1 ! ------------------!-------------------- ! ! 100 OHMS ! / _!____/ --/\/\/\----> ! ! TO ! SPST 5 VOLTS ! SWITCH (PIN24) ! -----------------!--------------------- ! 13 14 15 16 17!18 19 20 21 22 23 24! ! ./ ./ ./ ./ ./ !/ ./ ./ / ./ ./ ./ ! ! -X X / ! ! 1000 OHMS / / / ! ! \ / /_______/ / ! _/\/\/\/\_/ ! ! / \ ! / 2716 PROM ! ! / . . . . . . . . . . . ! !/ / / / / / / / / / / / ! !12 11 10 9 8 7 6 5 4 3 2 1 ! --------------------------------------- X=CUT OFF THE PIN INSERT THE SOCKET PINS INTO THE =>OUTSIDE<= ROWS OF HOLES IN THE HEADERS: 4 3 ----- ----- ! . . ! ! . . ! ENLARGED VIEW ! . . ! ! . . ! OF LEFT SIDE ! . . ! ! . . ! OF CABLE ! . . ! ! . . ! ASSEMBLY SHOWN ! . . ! ! . . ! ABOVE ! . . ! ! . . ! ! . . ! ! . . ! ..! . . !....! . . !.. . ! . . !----! . . !-.----- . ! . . ! ! . . ! . . ! . . ! ! . . ! . /THE SOCKET . ! . . ! ! . . ! ./ WILL COVER . ! . . ! ! . . ! . THE SPACE . ! . . ! ! . . ! . INSIDE THE . ! . . ! ! . . ! . DOTTED LINE . ! . . ! ! . . ! . . ! . . ! ! . . ! . . ! . . ! ! . . ! . . ! . . ! ! . . ! . . ! . . ! ! . . ! . ..! !....! !..------ ----- ----- \ / \ PIN 1 / \ IC SOCKET PINS FIT IN THESE TWO LINES OF HOLES (ONE 24-PIN SOCKET COVERS THE LOWER PART OF BOTH HEADERS) (BECAUSE OF THE OFFSET USED TO CONNECT THE CRIMP PINS TO THE CABLE, THE INSIDE ROWS CONTAIN THE SAME PINS, BUT WITH THE SIDES SWITCHED. DON'T THINK ABOUT IT TOO LONG--IT INVITES MADNESS) INSERT THE SOCKET FOR THE 2716 PROM IN THE LEFTMOST PAIR OF HEADERS (IT DOESN'T REALLY MATTER WHICH ONE YOU USE AS LONG AS YOU PLUG EACH PROM INTO THE RIGHT SOCKET), AND THE 9316 SOCKET INTO THE RIGHTMOST PAIR. YOU CAN OBTAIN THE +5 VOLTS AT PIN 24 OF EITHER SOCKET, OR FROM PIN 25 OF ANY PERIPHERAL SLOT CONNECTOR. REMOVE THE PROM FROM THE F8 SOCKET ON THE MOTHER BOARD AND PLUG IT INTO THE 9316 SOCKET IN THE HEADERS (NOTCH AND PIN 1 TOWARD THE KEYBOARD, PLEASE). PLUG YOUR 2716 INTO THE OTHER SOCKET, THEN INSERT THE DIP PLUG AT THE OTHER END OF THE CABLE INTO THE F8 SOCKET ON THE MOTHER BOARD. IF YOU LIKE TO LEAVE YOUR APPLE OPEN, YOU CAN PUT THE SWITCH WHEREVER IT'S HANDY, OR ATTACH IT TO A COUPLE OF WIRES AND SNAKE IT OUT THROUGH ONE OF THE SLOTS IN THE BACK BEFORE YOU PUT THE TOP BACK ON YOUR APPLE. IF YOU CUT THE WIRE WRAP PINS ON THE 24-PIN SOCKETS DOWN TO ABOUT 1/4", THE ENTIRE CABLE ASSEMBLY CAN SAFELY SIT ON TOP OF THE POWER SUPPLY, EVEN WITH A "ZIF" SOCKET IN THE 2716 SOCKET FOR RAPID PROM CHANGING. --------------------------------------- THE SECOND CIRCUIT IS A "DEBOUNCED" NMI SWITCH. MOST OF US KNOW BY NOW THAT CONNECTING PIN 29 TO PIN 26 ON ANY OF THE PERIPHERAL SOCKETS WILL CAUSE AN NMI INTERRUPT. WHAT WE FOUND OUT A LITTLE LATER WAS THAT USING A MECHANICAL SWITCH TO CONNECT THE TWO LINES GAVE A LOT OF EXTRA "GARBAGE" ON THE STACK AND CAUSED A LARGE DISCREPANCY BETWEEN THE VALUE IN THE STACK POINTER STASH LOCATION ($2903 OR $4903 FOR KRAKROMS) AND THE ACTUAL LOCATIONS OF THE PROGRAM COUNTER AND STATUS WORD ON THE STACK. THE REASON FOR THIS IS "CONTACT BOUNCE". IF YOU TAKE A MICRO VIEW OF SWITCH CONTACTS SLAMMING AGAINST EACH OTHER AS A SPRING PULLS THEM TOGETHER, THEY ACTUALLY HIT, FLY APART, AND COME BACK TOGETHER AS MANY AS TEN OR TWENTY TIMES BEFORE THEY REMAIN IN CONTACT. THE ENTIRE PROCESS TAKES ONLY A FEW MILLISECONDS, BUT EACH TIME THE CONTACTS TOUCH, THE APPLE'S 6502 OBEDIENTLY DOES ANOTHER NMI INTERRUPT, EVEN IF IT HASN'T FINISHED THE LAST ONE (IT'S SORT OF A CPU ARCHITECT'S MORAL DILEMMA: DO YOU ALLOW AN NMI TO BE TRULY NON-MASKABLE BY ALLOWING IT TO EVEN INTERRUPT ITSELF, OR SHOULD YOU HAVE A FLAG THAT'S RAISED TO PREVENT AN NMI FROM DISTURBING AN NMI IN PROGRESS?). AT ANY RATE, IT'S AN UNWELCOME COMPLICATION TO THE ALREADY DIFFICULT TASK OF PROGRAM SNOOPING, SO WE HAVE TO DEAL WITH IT. THE SOLUTION IS TO USE A "DEBOUNCED" SWITCH, AND THE ACTUAL CIRCUIT CONSISTS OF ONLY ONE CHIP AND A PAIR OF RESISTORS. THE METHOD OF CONSTRUCTION IS OPEN, SINCE THERE ARE NO CRITICAL IMPEDANCES OR FREQUENCIES INVOLVED. IT'S EVEN POSSIBLE, IF YOU HAVE RUN OUT OF SLOTS, TO WIRE UP THE IC DIRECTLY TO THE SWITCH, AND CONNECT TO A PERIPHERAL CARD WITH A 3-WIRE CABLE. SOLDER THE APPROPRIATE WIRES ONTO ANY CARD WHICH HAS "FINGERS" ON PINS 25, 26, AND 29 (A PLAGUE OF THERMAL INTERMITTENTS ON THOSE HARDWARE PRODUCERS WHO SAVE ELEVEN CENTS PER BOARD BY ELIMINATING THE GOLD CARD-EDGE FINGERS THAT THEY DECIDE ARE SUPERFLUOUS!). IF YOU HAVE SLOTS TO SPARE, EITHER OBTAIN THE CARD-EDGE TO MAKE CONNECTIONS TO THE SOCKET (IT'S SURPRISING HOW MUCH SURPLUS ELECTRONICS EXISTS WITH CARD-EDGE CONNECTORS OF 50 OR MORE CONTACTS ON 0.100" CENTERS), OR BUY ONE OF THE HOBBY OR "KLUDGE" BOARDS DESIGNED FOR THIS KIND OF FOOLISHNESS. (AS USUAL, A.P.P.L.E. IN WASHINGTON STATE HAS THE BEST DEAL I'VE SEEN AT $14.00 FOR A BLANK BOARD--TERRIFIC OUTFIT, GOOD CHEAP SOFTWARE AND HARDWARE, GOOD MAGAZINE. YOU SHOULD JOIN). ONE OTHER SMALL DISADVANTAGE OF THIS CIRCUIT IS THAT YOU NEED AN SPDT SWITCH WHERE AN SPST IS ALL THAT'S REQUIRED ELECTRICALLY, BUT IT'S A SMALL PRICE TO PAY. NOW LET'S SEE IF WE CAN MAKE THIS LOOK LIKE A SCHEMATIC... +---+---O +5 VOLTS - ! ! SLOT PIN 25 \ \ (ALSO CONNECTED R1 / / R2 TO PIN 14, IC1) 3K \ \ 3K / / \ \ IC1 74LS00 ! ! ____ * ! ! ! \ O--+--/!\---+1 \ 3 * / ! ! O-+ ____/ ! +-+2 / ! ! * ! ! !____/ ! ! O--+ ! !________ / --- / ! ! \/__(NO - SPDT ! ! _________/\ CONN.) . SWITCH ! ! ! ____ \ \ ! ! ! ! \ ! \ ! ! +-+4 \ 6! GROUND- ! ! ! O-+-----O SLOT PIN 26 +---+----+5 / (ALSO TO !____/ TO SLOT PIN 7, IC1) PIN 29 (NMI) * CONNECTION POINT FOR WIRES TO SWITCH (IF THE CHIP IS ATTACHED TO THE SWITCH, THE WIRES GO TO PINS 25, 26 AND 29 OF THE PERIPHERAL SLOT CONNECTOR). NUMBERS AROUND THE ERSATZ NAND GATES ARE IC PIN NUMBERS-NOT PERIPHERAL SLOT CONNECTOR PINS A PUSHBUTTON SWITCH GIVES YOU A LITTLE FASTER RESPONSE WHEN YOU'RE TRYING TO STOP A PROGRAM AT JUST THE RIGHT POINT, BUT A TOGGLE SWITCH WILL ALSO GET THE JOB DONE. THE RESISTOR VALUES ARE NOT CRITICAL--ANYTHING FROM 1K TO 3K IS FINE. TO USE THESE DEVICES TOGETHER, REMEMBER THAT THE SWITCH GIVES YOU ABSOLUTE SELECTION OF THE 2716 OR 9316 AS LONG AS THE MOTHER BOARD HAS BEEN SELECTED AS THE SOURCE OF F8 CODE. THE MOTHER BOARD IS SELECTED AS THE ROM READ SPACE WHEN THE ADDRESSES $C081 OR $C082 WERE MOST RECENTLY ACCESSED. IF THE SWITCH IS PLACED IN THE "2716" POSITION WHEN THE MOTHER BOARD IS SELECTED, THE ADDRESS SPACE FROM $F800 TO $FFFF WILL BE MAPPED TO THE 2716 PROM, AND ALL MONITOR CALLS, RESETS, AND NMI OPERATIONS WILL GO WHERE YOU WANT THEM TO, NOT WHERE SOME PUBLISHER HAS DECIDED WOULD BE NICE.