30
Sep
'17

Where things fail to go according to plan.

Now it all started a few years ago when my brother and I started fixing up the 1996 red VW Microbus which we’ve had since 2000. It had two major issues, firstly with the fuel delivery (we ended up having the fuel tank overhauled* and replacing the fuel pump) and secondly with the battery draining (turned out to be the P.A. system my father had fitted, I tossed it). Then I replaced the distributor hall sender, fitted new rear brakes and shocks, had the aircon re-gassed, fitted new side mirrors, replaced the auxiliary coolant pump which some fool had removed along with the relay for it, messed around with the immobiliser a bit, got a quote for removing the rust and respraying… just the normal maintenance type things which had been neglected for a while.

Tanya and I wanted to go the Kgalagadi (remember the Kgalagadi? This is a story about the Kgalagadi) because we’ve been to Kruger a number of times and Kgalagadi has meerkat. And lions and leopards and cheetahs, hopefully. I figured the Kombi is a good choice for this because sitting high up gives you a longer view over the veld.

odo

Of course, a 2200 km round trip in a 20 year old bus with 200000 km on the clock is not particularly sane. But then, who wants to be known for their sanity?

So off we went, 05:30-ish on the 23rd of September, Arlo Guthrie on the hifi (coincidence — I dumped a lot of albums on a stick and it plays ’em alphabetically).

Oh, that aircon I had re-gassed? Stopped working pretty much as we left home. Feh.

The road from Cape Town to the Kgalagadi Transfrontier Park is insane. Miles and miles of straight nothing between Calvinia and Keimoes, interrupted only by the tiny towns of Brandvlei and Kenhardt. And then the road from Upington to Twee Rivieren, more on that later…

scrapping

Tanya took the opportunity to get in the back and scrap.

We stayed over in Upington at A Chateau de Lux which we can really recommend. Much attention to details, sweets on the pillows and chocolates and biscuits and bath salts ready in the bath… te lekker. Can’t comment on breakfast ’cause we were in too much of a hurry to be off. 250 km from Upington to Twee Rivieren. Got there, booked in, friendly people, pitched camp, let some air out the tires and off into the Kgalagadi we went.

IMG_1030r

P1150122cr

Yes, there was a chain across the road. OK, OK, I’ll stop with the Alice’s Restaurant Red VW Microbus references now.

Now at this stage, there was only one of two things we could do (oops. Sorry). Take the road to the left, towards Mata-Mata, or take the road to the right, towards Nossob. We chose the Nossob road.

IMG_7496r

Got as far as Kij-Kij (only about 40km from Twee Rivieren, but that’s about two hours’ drive. Distances in the Kgalagadi are insane) where we found a lion under a tree. Next to a sign saying “You are not allowed to leave your vehicle at this view point”. Yup. Gotcha. Wasn’t planning on doing that, no.

IMG_0486r

P1150126r

Damn thing had fleas.

IMG_0491r

Kalahari lions have black manes.

From Kij-Kij we took the dune road to Auchterlonie. It’s boring. Nothing moves. The two river beds are much more interesting. Stopped at Auchterlonie for a body break, and turned back towards Twee Rivieren. Now this was Sunday, and Sunday was forecas t to be the hottest day of our week in the Kgalagadi, and yes, it was hot. Got up to 48-ish inside the cab. So we’re fahrvergnügening over the dunes and *bang*. Hmmm, that’s not good. Check the rear-view mirror, that looks like water on the road behind us. Scheisse. I figured it’s a radiator hose that popped, tell the first car passing us to tell the staff back at Twee Rivieren to come fetch us. Nope, sez the omie, he’ll tow us. With a Fortuner. The humanity.

IMG_7503r

Back at camp I investigated and no, it wasn’t a radiator hose, it was the coolant bottle.

bottler

Never seen that before.

So we started a braai.

IMG_7505r

And worked on Plan B, being, get to Upington, hire a car, get a new water bottle, fix kombi. With complications, because the next day was a public holiday. I got up early, toodled on down to the gate, asked about organising a lift with some staff maybe going to Upington. Nope, nothing like that, you’ll have to hitch a ride. So I stopped the first car out the gate, being Ditmar and his wife whose name I didn’t catch from Cape Town, they gave me a lift to the airport. Much appreciated. Got a car, flogged it† back to Twee Rivieren, and off we went for more sightseeing.

Took the Mata-Mata road this time, found the meerkats Tanya was looking for. They like being high up, so they can see further.

IMG_0691r

A car stopped and told us there was a cheetah with kill under a tree, so off we went to find it.

IMG_1198r

The cheetah had brought down a springbok ram and was nomming down under a tree on the other side of the river bed. Good thing Tanya has a long lens.

We’d also heard there was a leopard in a tree further up the road, so we left the cheetah, tried to find the leopard. Found some people who claimed they could see the leopard lying behind something, we saw squat (of course, if we had the kombi it might have been easier) so went back to the cheetah who was just leaving her meal to the jackals and moving off, fortunately towards the road.

IMG_7513r

We think this is Hanri, a six year old female, but I am new to this, feel free to correct me.

IMG_1296r

This owl has a nest and a large chick opposite the road from the Monro water hole. We stopped there a number of times.

Plan B still required that I go to Upington again (to get a new water bottle on a day that the shops are actually open), but we started Tuesday by going out early to see what we could find.

IMG_1377r

Found two jackals close to where we’d seen the cheetah, they were fast asleep. We stuck around until they got up but they didn’t feel like doing much — I suspect they finished off the cheetah’s springbok pretty much on their own, and were still stuffed to the gills (we ended up seeing lots of jackals).

IMG_1419r

Got back to camp around 10 (after which not much moves until late afternoon anyway) and then I mercilessly flogged the Polo the 250km to Upington, found a new water bottle at Goldwagen, got a lead on a towing company (Plan C), and mercilessly flogged the Polo the 250km back to Twee Rivieren (and of course we eventually had to get the Polo back to Upington again. It came with 1000 free kilometers. So much for that. We ended up putting around 1800km on it). Got back close to five, and of course out we went again.

We were watching jackals come and go at Kij-Kij when I looked the other way (always look the other way) and spotted two bat eared foxes quite far away. Cute little buggers.

IMG_1479r

Back on the way to Twee Rivieren we stopped to look at some meerkat, I looked around and spotted a little cape fox sleeping close bye. The meerkat also spotted the fox…

IMG_1516r

… and proceeded to chase him off.

IMG_1535r

Little bastards.

So back to Plan B. I fitted the new water bottle, added water, and… water poured out of the side of the cylinder head flange. I suspect this is where I lost the water in the first place, leading to the destruction of the bottle.

Time for Plan C? I got a beer and thought about it.

Coincidence #1. I’d packed the toolkit I normally have in the Golf at the last moment, mostly for the shifter. But it includes four small sockets, and the largest socket fitted the bolts on the flange. So I could remove the flange.

Coincidence #2. Our old mattress had leaked and I tried a new O ring on the valve. Didn’t work, and I tossed the mattress, but I still had spare O rings in the kombi. And they turned out to be the exact diameter.

Coincidence #3. I’d also packed a tube of gasket maker.

Which means I could apply a temporary fix. Which I did — not that I trusted the fix enough to take the kombi back into the Kgalagadi, we ended up using the Polo for the rest of the week — but (spoiler alert) it did end up getting us home with no further issues.

IMG_1554r

Secretary bird.

IMG_1587r

We spotted two cape foxes with cubs, but they were extremely far away. 500m or more. This picture is at the limit of Tanya’s 600mm lens.

IMG_0579r

This owl had a nest just outside the camp gate. We stopped there often.

We saw many more animals. Gemsbok, springbok, red hartbeest, giraffe — those are pretty much guaranteed. Lots of Kori bustards (they’re scarce in Kruger). Ground squirrels everywhere. Slender and yellow mongoose. But… no cats. Well, OK, we did see two lions silhouetted against a ridge far off, but they don’t count in our books.

So right at the end of our last day in the Kgalagadi we decided to go out one last time. Looked at the sightings board, saw that some people has seen lion(s?) around Rooiputs. So that’s where we went. Didn’t see much, except there was a guy parked next to the road, we asked him what he had. Turns out there was a lion under a tree, but the only reason he knew it was that “it had been there all day”. Couldn’t see much of it, would not have spotted it on our own.

IMG_1857r

Whaddayamean can’t see it? He’s right there! (The tree’s about 100m from the road).

IMG_1867r

So we waited for him to wake up.

IMG_1887r

We will rule over all this land! And we will call it… this land!

IMG_0763cr

We had supper at the restaurant the last evening. Can you believe that T-shirt is over 20 years old? Thanks Unca Joel :-)

The next morning the kombi didn’t want to start. I spent an hour fiddling with the wiring, I think it was a bad connection to the MAP sensor since that’s the last thing I touched. For the rest the drive back was uneventful. Stopped at Goldwagen again,  bought a new Topran 107613755 (Goldwagen part number A1300) as well as the two O-rings for the temperature sensors (Goldwagen part number 1821). After that I was not concerned, because if my temporary fix failed, I could fix it properly. Of course my temporary fix held. Got home not that long after nine the evening.

More »





P1150114r

The pump on the right is part number 251 955 651 and it’s made of weapons-grade unobtanium-around-here. It’s also buggered.

The one on the left comes from… well, this one came from a VW Fox, but that’s just a Golf 1, the Golf 2 used the same thing.

P1150115r

The only difference is the connector.

P1150117r

Bit of work with a crimping tool and, as they say, Robert is your mother’s brother.





The first copy protection scheme I cracked on my Apple ][ was that of Zork. It wasn’t that difficult, the data prologue bits were changed from D5 AA AD to D5 AA BC. Copying the disk involved patching the standard copy program COPYA and then editing the disk so that it could read itself.

But today I’m interested in the IBM PC version of Zork. Like the Apple ][ version, the disk could not be copied by the standard tool (in this case diskcopy) but Copy II PC worked just fine. Interestingly, the disk allowed you to make one copy of the game for backup purposes.

The weak point of copy protected disks is that the standard BIOS must be able to read the first bit of the disk. This code is then executed to read the “uncopyable” part of the disk. Anyone can read the first sector, disassemble it, and work out how to read the rest of the disk. Granted, this process is sometimes extremely difficult. Not so in the case of Zork.

On the IBM PC, the BIOS reads track 0 sector 1 into segment 0, offset 7C00 and jumps to it.

0000:7C00 FA     CLI                   Disable interrupts

The first thing after disabling the interrupts (which is pretty standard) is to change the pointer (at 0000:0078) to the disk controller parameter block to point at the first location after this actual code, 0000:7C79.

0000:7C01 2BC0   SUB AX,AX             AX=0
0000:7C03 8ED8   MOV DS,AX             DS=AX=0
0000:7C05 BB7800 MOV BX,0078           DISK_POINTER, points to parameter block
0000:7C08 B97900 MOV CX,0079
0000:7C0B BAC007 MOV DX,07C0
0000:7C0E 8B37   MOV SI,[BX]           Save current pointer at 0000:0078 in SI
0000:7C10 8B7F02 MOV DI,[BX+02]        Save current pointer at 0000:007A in DI
0000:7C13 890F   MOV [BX],CX           0000:0078 = 0079
0000:7C15 895702 MOV [BX+02],DX        0000:007A = 07C0

0000:7C18 8CC8   MOV AX,CS
0000:7C1A 8ED8   MOV DS,AX             Set DS = CS

; Set stack to 0000:7C00               Fairly standard
0000:7C1C BA0000 MOV DX,0000
0000:7C1F 8ED2   MOV SS,DX
0000:7C21 BB007C MOV BX,7C00
0000:7C24 8BE3   MOV SP,BX

0000:7C26 FB     STI                   Enable interrupts
0000:7C27 B86000 MOV AX,0060
0000:7C2A 8ED8   MOV DS,AX             Set DS and ES to 0x0060
0000:7C2C 8EC0   MOV ES,AX

; Reset disk drive (AH=0)
0000:7C2E 2BC0   SUB AX,AX AX=0
0000:7C30 2BD2   SUB DX,DX DX=0
0000:7C32 CD13   INT 13

0000:7C34 BA0300 MOV DX,0003           DX=3
0000:7C37 2BDB   SUB BX,BX             BX=0
0000:7C39 B501   MOV CH,01             CH=1
0000:7C3B 52     PUSH DX               Save DX
0000:7C3C B101   MOV CL,01             CL=1
0000:7C3E 51     PUSH CX               Save CX (= 0101)
0000:7C3F 2BD2   SUB DX,DX             DX=0
0000:7C41 B80402 MOV AX,0204           AH=2, AL=4
0000:7C44 CD13   INT 13

INT 13 with AH=2 reads AL (=4) sectors from cylinder CH (=1), sector CL (=1) of head/drive DX (0/0) into ES:BX (0060:0000). This read uses the new parameter block further down, which differs from the standard parameter block in that it specifies 1024 byte sectors, four sectors per track.

0000:7C46 721C   JB 7C64               If INT13 returns error, print "ILL" and halt
0000:7C48 59     POP CX                Restore CX (I don't think INT13 corrupts CX, so I don't know why)
0000:7C49 FEC5   INC CH                Next cylinder
0000:7C4B 81C30010 ADD BX,1000         Move data pointer 4 kb ahead
0000:7C4F 5A     POP DX                Track (cylinder) counter, started at 3...
0000:7C50 4A     DEC DX                ...2...1...
0000:7C51 75E8   JNZ 7C3B              Loop back unless 0

So we have now read three tracks of four sectors of 1024 bytes each into 0060:0000, 0060:1000 and 0060:2000.

; Restore disk controller parameter block pointer
0000:7C53 2BC0   SUB AX,AX               AX=0
0000:7C55 8ED8   MOV DS,AX               DX=0
0000:7C57 BB7800 MOV BX,0078             BX=0078
0000:7C5A 8937   MOV [BX],SI
0000:7C5C 897F02 MOV [BX+02],DI
0000:7C5F 06     PUSH ES
0000:7C60 2BC0   SUB AX,AX
0000:7C62 50     PUSH AX
0000:7C63 CB     RETF                    POP IP = 0, POP CS = ES

RETF pulls an instruction pointer and code segment from the stack, and execution moves there (0060:0000).

; ERROR
0000:7C64 2BDB   SUB BX,BX               BX=0
0000:7C66 B049   MOV AL,49
0000:7C68 B40E   MOV AH,0E
0000:7C6A CD10   INT 10                  AH=0E, teletype output, 49 "I"
0000:7C6C B04C   MOV AL,4C
0000:7C6E B40E   MOV AH,0E
0000:7C70 CD10   INT 10                  "L"
0000:7C72 B04C   MOV AL,4C
0000:7C74 B40E   MOV AH,0E
0000:7C76 CD10   INT 10                  "L"
0000:7C78 F4     HLT

0000:7C79 CF 02 25 03 04 2A FF 50 F6 19 04

This is the modified parameter block, 03 = 1024 bytes/sector (normally 2 = 512 bytes/sector) , 04 = 4 sectors per track (normally 8).
Of course MSDOS diskcopy barfs at 1024 byte sectors and there’s your copy protection.

ZORKTOOLS will rewrite the 4×1024 byte sectors to 8×512 byte sectors and patch the bootloader to match.