The pump on the right is part number 251 955 651 and it’s made of weapons-grade unobtanium-around-here. It’s also buggered.
The one on the left comes from… well, this one came from a VW Fox, but that’s just a Golf 1, the Golf 2 used the same thing.
The only difference is the connector.
Bit of work with a crimping tool and, as they say, Robert is your mother’s brother.
The first copy protection scheme I cracked on my Apple ][ was that of Zork. It wasn’t that difficult, the data prologue bits were changed from D5 AA AD to D5 AA BC. Copying the disk involved patching the standard copy program COPYA and then editing the disk so that it could read itself.
But today I’m interested in the IBM PC version of Zork. Like the Apple ][ version, the disk could not be copied by the standard tool (in this case diskcopy) but Copy II PC worked just fine. Interestingly, the disk allowed you to make one copy of the game for backup purposes.
The weak point of copy protected disks is that the standard BIOS must be able to read the first bit of the disk. This code is then executed to read the “uncopyable” part of the disk. Anyone can read the first sector, disassemble it, and work out how to read the rest of the disk. Granted, this process is sometimes extremely difficult. Not so in the case of Zork.
On the IBM PC, the BIOS reads track 0 sector 1 into segment 0, offset 7C00 and jumps to it.
0000:7C00 FA CLI Disable interrupts
The first thing after disabling the interrupts (which is pretty standard) is to change the pointer (at 0000:0078) to the disk controller parameter block to point at the first location after this actual code, 0000:7C79.
0000:7C01 2BC0 SUB AX,AX AX=0 0000:7C03 8ED8 MOV DS,AX DS=AX=0 0000:7C05 BB7800 MOV BX,0078 DISK_POINTER, points to parameter block 0000:7C08 B97900 MOV CX,0079 0000:7C0B BAC007 MOV DX,07C0 0000:7C0E 8B37 MOV SI,[BX] Save current pointer at 0000:0078 in SI 0000:7C10 8B7F02 MOV DI,[BX+02] Save current pointer at 0000:007A in DI 0000:7C13 890F MOV [BX],CX 0000:0078 = 0079 0000:7C15 895702 MOV [BX+02],DX 0000:007A = 07C0 0000:7C18 8CC8 MOV AX,CS 0000:7C1A 8ED8 MOV DS,AX Set DS = CS ; Set stack to 0000:7C00 Fairly standard 0000:7C1C BA0000 MOV DX,0000 0000:7C1F 8ED2 MOV SS,DX 0000:7C21 BB007C MOV BX,7C00 0000:7C24 8BE3 MOV SP,BX 0000:7C26 FB STI Enable interrupts 0000:7C27 B86000 MOV AX,0060 0000:7C2A 8ED8 MOV DS,AX Set DS and ES to 0x0060 0000:7C2C 8EC0 MOV ES,AX ; Reset disk drive (AH=0) 0000:7C2E 2BC0 SUB AX,AX AX=0 0000:7C30 2BD2 SUB DX,DX DX=0 0000:7C32 CD13 INT 13 0000:7C34 BA0300 MOV DX,0003 DX=3 0000:7C37 2BDB SUB BX,BX BX=0 0000:7C39 B501 MOV CH,01 CH=1 0000:7C3B 52 PUSH DX Save DX 0000:7C3C B101 MOV CL,01 CL=1 0000:7C3E 51 PUSH CX Save CX (= 0101) 0000:7C3F 2BD2 SUB DX,DX DX=0 0000:7C41 B80402 MOV AX,0204 AH=2, AL=4 0000:7C44 CD13 INT 13
INT 13 with AH=2 reads AL (=4) sectors from cylinder CH (=1), sector CL (=1) of head/drive DX (0/0) into ES:BX (0060:0000). This read uses the new parameter block further down, which differs from the standard parameter block in that it specifies 1024 byte sectors, four sectors per track.
0000:7C46 721C JB 7C64 If INT13 returns error, print "ILL" and halt 0000:7C48 59 POP CX Restore CX (I don't think INT13 corrupts CX, so I don't know why) 0000:7C49 FEC5 INC CH Next cylinder 0000:7C4B 81C30010 ADD BX,1000 Move data pointer 4 kb ahead 0000:7C4F 5A POP DX Track (cylinder) counter, started at 3... 0000:7C50 4A DEC DX ...2...1... 0000:7C51 75E8 JNZ 7C3B Loop back unless 0
So we have now read three tracks of four sectors of 1024 bytes each into 0060:0000, 0060:1000 and 0060:2000.
; Restore disk controller parameter block pointer 0000:7C53 2BC0 SUB AX,AX AX=0 0000:7C55 8ED8 MOV DS,AX DX=0 0000:7C57 BB7800 MOV BX,0078 BX=0078 0000:7C5A 8937 MOV [BX],SI 0000:7C5C 897F02 MOV [BX+02],DI 0000:7C5F 06 PUSH ES 0000:7C60 2BC0 SUB AX,AX 0000:7C62 50 PUSH AX 0000:7C63 CB RETF POP IP = 0, POP CS = ES
RETF pulls an instruction pointer and code segment from the stack, and execution moves there (0060:0000).
; ERROR 0000:7C64 2BDB SUB BX,BX BX=0 0000:7C66 B049 MOV AL,49 0000:7C68 B40E MOV AH,0E 0000:7C6A CD10 INT 10 AH=0E, teletype output, 49 "I" 0000:7C6C B04C MOV AL,4C 0000:7C6E B40E MOV AH,0E 0000:7C70 CD10 INT 10 "L" 0000:7C72 B04C MOV AL,4C 0000:7C74 B40E MOV AH,0E 0000:7C76 CD10 INT 10 "L" 0000:7C78 F4 HLT 0000:7C79 CF 02 25 03 04 2A FF 50 F6 19 04
This is the modified parameter block, 03 = 1024 bytes/sector (normally 2 = 512 bytes/sector) , 04 = 4 sectors per track (normally 8).
Of course MSDOS diskcopy barfs at 1024 byte sectors and there’s your copy protection.
ZORKTOOLS will rewrite the 4×1024 byte sectors to 8×512 byte sectors and patch the bootloader to match.
If you’re re-doing the rear brakes on your T3 Type 2, this picture over at TheSamba will help a lot.
Note the orientation of the springs, the top springs are under the hooks. Note the long end of the adjuster fork on the right goes towards the backing plate, short end to the front. Note the bevelled edge of the left-hand adjuster fork goes to the back. Some people say the long hook on the bottom spring should go on the left so as not to foul the handbrake cable.
Yes, you can put it back the way you found it but don’t discount the existence of a DPO.
From a bunch of stuff some other ham wanted to throw away, this ex-SWR meter.
I have no idea why the Dreaded Previous Owner stripped it down to this state. The meter movement is fine, 950-ish mV over a 4k7 resistor gives FSD, so it’s a 200uA unit.
The detector components are still in place, and it looks very similar to the Micronta 21-520A except that there’s only one meter. There’s also a little bobbin on the side for an antenna, presumably to make it into a Field-Strength Meter, but that’s a gimmick and won’t happen.
The junkbox yielded two switches of the right type and size (one selects Power / SWR, and in SWR mode the other selects Forward / Reverse). There will also be a pot to set FSD in Forward mode after which the Reverse mode should give the SWR. Give or take. Don’t expect a lot from meters like this.
Fast forward a bit and we have
Don’t ask me what used to live in those two extra holes. This setup works for me, for the price of a few junkbox parts and some time.
Orms was advertising Canon 100D bodies for R3 795*. I wasted no time to get one (should have snagged three). They also had a number of second-hand EF 70-300mm 4-5.6 IS lenses, priced from R3 800 to R5 000. All rated “80%”. I took the R3 800 one.
And then I chanced upon an EF 50mm f1.8 “nifty fifty” on Gumtree for R1 200. I had to get it mailed down from Pretoria, which cost me an extra R100, but that’s how it is. It allows me to do things like this.
Available light, 1/80 at f 4.0, ISO 4000. Lightroomed to bring the eyes out a bit, here’s a strip at original resolution and no processing.
Toothless the black cat, however, is still impossible to photograph.
(IMO, of course. And Geek Alert)
This is the switch and tuner schematic for an MFJ-949E Versa Tuner II. Great little unit, with a built-in dummy load. It has a switch that selects the dummy load, then the three antenna connectors in pass-through mode, then the three antenna connectors through the matching network, and then the dummy load again… through the matching network.
Which means that if you want to tune into the dummy load, you have to use the setting all the way to the left, or you have to adjust the tuner to match the dummy load to the rig, using the switch setting on the right.
Now why would you need to match a 50 ohm dummy load to your rig? Insane. The dummy load switch setting on the right should connect straight to the dummy load, not via the tuner.
I have a soldering iron, I can fix it.
Predecessor of the SIMM?
This comes from a piece of medical equipment made by the other S&W, Simonsen & Weel, Denmark, circa 1979.
Each module has 8 x AM2808PC 1024-bit dynamic shift registers, driven by a DS0025CN two-phase clock driver. That’s one kilobyte of storage per module, and you have to keep on clocking the data around the ring otherwise the capacitors making up the memory discharge and forget.
It’s a lot simpler than a mercury delay line memory, but functionally it’s not that much different.
