Jump to content



0

Is this for real? (aka Drive Tech Chat)


45 replies to this topic

#1 Bryan OFFLINE  

Bryan

    Quadrunner

  • 7,626 posts
  • Cruise Elroy = 4DB7
  • Location:Port St. Lucie, Florida

Posted Sun Mar 12, 2006 3:47 PM

A programmer known as "The Unknown Base" in Holland claimed to have written 2 programs for the 1050:


Inital 1050
-----------
Move the drive head directly with your joystick or write a codename to your disks.
The code is invissible for all copiers and editors. Also normal formatting won't destroy the codename on the disk. You even can't copy the codename with the copiers!
You can always read your diskcode. Perhaps it's handy to label your bootdisks!

Bad Sector Writer 1050
----------------------
Create your own bad sectors. You just type in the sector to make bad. You can finally copy those protected old disks (Why didn't they make such a program sooner ???).

If you want to know more about those
programs or if you have questions or
even answers, call me.


I've never seen anything stating that a stock 1050 can make bad sectors or that it can hide some data that can't be formatted. I'm just wondering if these programs are real.

-Bry

Edited by Bryan, Wed Mar 15, 2006 7:09 PM.


#2 ijor OFFLINE  

ijor

    Stargunner

  • 1,431 posts

Posted Sun Mar 12, 2006 4:22 PM

I assume we are talking about pure software only, because otherwise, with custom hardware modifications (almost) everything is possible.

Creating bad sectors is not new, both Alpha Systems and CSS made such a product long ago. It didn’t require any custom hardware, but I wouldn’t call it software only neither …

One method was moving the disk with a tape, other to slow down the drive. Both of them while writing the desired sector.

The other one might be possible with enhancements, such as Happy. It might work or not depending on the mechanism and the disk. Just write one extra track beyond the normal innermost one. Never tried that myself.

Edited by ijor, Sun Mar 12, 2006 4:23 PM.


#3 Bryan OFFLINE  

Bryan

    Quadrunner

  • 7,626 posts
  • Cruise Elroy = 4DB7
  • Location:Port St. Lucie, Florida

Posted Sun Mar 12, 2006 4:35 PM

According to the author, these are for a normal 1050. That's why I wanted to see if they work.

-Bry

#4 ijor OFFLINE  

ijor

    Stargunner

  • 1,431 posts

Posted Sun Mar 12, 2006 4:47 PM

If they are supposed to be pure software with a stock 1050, then it is just a joke. Wouldn’t be the first time somebody makes this type of claims.

Wasn’t a famous case in Antic or Analog, where they published a program that was supposed to fry your computer? As I recall, after you run it you receive a message asking to press a key to assess the damage. Then when you do, you got another one saying something like “Machine too damaged, can make a detailed report”.

And IIRC, they apologized on the next month. People didn’t like the joke. Some thought it was for real.

#5 Bryan OFFLINE  

Bryan

    Quadrunner

  • 7,626 posts
  • Cruise Elroy = 4DB7
  • Location:Port St. Lucie, Florida

Posted Sun Mar 12, 2006 4:55 PM

Yeah, that was "Paperweight". It was a great little program too.

BTW... "The Unknown Base" is credited with the Alf Demo and the Return of the Beast demo.

Here's where I found the info:
http://members.chell...4-FLPCONTR.html

-Bry

#6 ijor OFFLINE  

ijor

    Stargunner

  • 1,431 posts

Posted Sun Mar 12, 2006 6:20 PM

Well, may be that besides being good at demos he is also good at jokes. Or may be there was an error on the translation, and he meant that they work only in Happy mode.

Anyway, and perhaps just for the records, there are quite some inaccuracies in the article. The controller on the XF551 (WD1772) is of course newer and more advanced than the one in the 1050 (WD279X). It seems he wrongly assumed that a larger chip number automatically means newer.

#7 Bryan OFFLINE  

Bryan

    Quadrunner

  • 7,626 posts
  • Cruise Elroy = 4DB7
  • Location:Port St. Lucie, Florida

Posted Sun Mar 12, 2006 6:58 PM

View Postijor, on Sun Mar 12, 2006 7:20 PM, said:

Well, may be that besides being good at demos he is also good at jokes. Or may be there was an error on the translation, and he meant that they work only in Happy mode.

You mean I can't believe everything I find on the Internet? :)

Oh well.. I didn't think anything like this was possible.

-Bry

#8 www.atarimania.com ONLINE  

www.atarimania.com

    Stargunner

  • 1,517 posts

Posted Sun Mar 12, 2006 7:53 PM

You should ask some of the Dutch guys if the author's still around. His full name is pretty easy to find.

--
Atari Frog
http://www.atarimania.com

#9 Rybags ONLINE  

Rybags

    Quadrunner

  • 10,323 posts
  • Location:Australia

Posted Sun Mar 12, 2006 9:32 PM

I have the feeling that when he says "programs" he is referring to actually modifying the OS inside the disk drive.

The "codenames" he refers to are probably extra sectors written to a track.

I don't see how anything could survive a formatting though, since Atari drives use soft-formatting, and ignore the timing hole, which means that a track will start in a random place on the disk each time it's formatted.

To do his tricks, he is probably just using the write track command, which would should allow things like duplicate or missing sectors.

#10 drac030 OFFLINE  

drac030

    Stargunner

  • 1,023 posts
  • Location:Warszawa, Poland

Posted Sun Mar 12, 2006 11:40 PM

View PostBryan, on Sun Mar 12, 2006 11:47 PM, said:

If you want to know more about those
programs or if you have questions or even answers, call me.
[/i]

I've never seen anything stating that a stock 1050 can make bad sectors or that it can hide some data that can't be formatted. I'm just wondering if these programs are real.

So why you just don't call him? And BTW a stock 1050 has more commands than officially documented. If I know two of them ($23 and $24 - warning, $23 does floppy formatting on XF551), it may be that there are yet more of them.

If the guy is able to force the drive to do a seek to an arbitrary track, then it is probably also possible to position the drive's head beyond the track 39. This may be why the "codename" survives formatting.

Edited by drac030, Sun Mar 12, 2006 11:41 PM.


#11 ijor OFFLINE  

ijor

    Stargunner

  • 1,431 posts

Posted Mon Mar 13, 2006 1:01 AM

View Postdrac030, on Mon Mar 13, 2006 12:40 AM, said:

If I know two of them ($23 and $24 - warning, $23 does floppy formatting on XF551), it may be that there are yet more of them.

They are the only undocumented commands, there aren't any more. At least not in the 1050, I don't know about the XF551. Command $23 can format the disk or not, it depends on other parameters.

Quote

If the guy is able to force the drive to do a seek to an arbitrary track, then it is probably also possible to position the drive's head beyond the track 39. This may be why the "codename" survives formatting.

Yes, you can position the head at almost any place with some variations of command $23. And I think that you can even read it, but you cannot format that track (not without a custom OS).

So I assume he is talking about making signatures with a Happy or a custom ROM. And then reading them with the $23-$24 commands on a stock drive. That should be possible.

#12 ijor OFFLINE  

ijor

    Stargunner

  • 1,431 posts

Posted Mon Mar 13, 2006 1:05 AM

One small correction. I think you do can write to track 40 using a stock drive as long as the track is already formatted.

So you need first to format that track with a custom OS. Then write and read them with the diagnostic commands on a stock drive.

#13 ijor OFFLINE  

ijor

    Stargunner

  • 1,431 posts

Posted Mon Mar 13, 2006 1:26 AM

One more thought.

With the same principle as slowing down the drive, it might be possible to create bad sectors using the same head positioning trick. I’m not sure how reliably that would be or how many retries you would need, but it might be possible.

So it is possible that he wasn’t joking after all. The only gotcha is that you still need a somehow preformatted track 40. Very nice idea anyway.

#14 JR> OFFLINE  

JR>

    Chopper Commander

  • 134 posts

Posted Mon Mar 13, 2006 1:41 AM

View Postijor, on Mon Mar 13, 2006 12:05 AM, said:

One small correction. I think you do can write to track 40 using a stock drive as long as the track is already formatted.

So you need first to format that track with a custom OS. Then write and read them with the diagnostic commands on a stock drive.
This seems to indicate that it might be possible with a stock 1050:
http://groups.google...3a93b12ef07cd99

Edited by JR>, Mon Mar 13, 2006 1:42 AM.


#15 Bryan OFFLINE  

Bryan

    Quadrunner

  • 7,626 posts
  • Cruise Elroy = 4DB7
  • Location:Port St. Lucie, Florida

Posted Mon Mar 13, 2006 3:08 AM

Does anyone have the 1050 source listing mentioned in the group?

-Bry

#16 ijor OFFLINE  

ijor

    Stargunner

  • 1,431 posts

Posted Mon Mar 13, 2006 2:08 PM

View PostJR>, on Mon Mar 13, 2006 2:41 AM, said:

This seems to indicate that it might be possible with a stock 1050:
http://groups.google...3a93b12ef07cd99

What can I say... Ivo is absolutely right!

Attempting to format tracks beyond track 39 should not work. The trick is to use track –1 (one outer track from track 0), and not track 40.

Hats off to Ivo and to TUB (they are perhaps the same, isn't Ivo from Holland?)

Sorry Brian, I’ve never seen or heard about an official Atari/Tandom source listing. And if you check Rick’s comment, it doesn’t seem like he really have it. But we always can hope that Curt might have or find one ! :)

#17 Bryan OFFLINE  

Bryan

    Quadrunner

  • 7,626 posts
  • Cruise Elroy = 4DB7
  • Location:Port St. Lucie, Florida

Posted Mon Mar 13, 2006 4:49 PM

I made some disassemblies of various 1050 ROMs, but I haven't started into them yet. They're only 4K, and there's very little hardware so it can't be too hard to figure them out.

-Bry

#18 ijor OFFLINE  

ijor

    Stargunner

  • 1,431 posts

Posted Mon Mar 13, 2006 5:41 PM

I think I've seen online one, may be two, commented disassemblies (Of course, it is not the same as the original source). IIRC they were in the Nir Dary collection.

You mention "various" ROMs. Would you mind posting the revision number of the ROM dumps you have? It's one of the last bytes of the ROM. So if you could post an hex dump of the last 8 bytes that would be enough.

Edited by ijor, Mon Mar 13, 2006 5:44 PM.


#19 Bryan OFFLINE  

Bryan

    Quadrunner

  • 7,626 posts
  • Cruise Elroy = 4DB7
  • Location:Port St. Lucie, Florida

Posted Mon Mar 13, 2006 5:58 PM

If you could help me locate these, it would be greaty appreciated!!

I have the 1050a and 1050b rom images that are floating around, plus I disassembled the USD rom as well, but no comments yet.

-Bry

#20 ijor OFFLINE  

ijor

    Stargunner

  • 1,431 posts

Posted Mon Mar 13, 2006 6:09 PM

View PostBryan, on Mon Mar 13, 2006 6:58 PM, said:

If you could help me locate these, it would be greaty appreciated!!

It'a zip file named FLOPOS. I just google and the link to the ftp polish site is not working, at least not for me. I remember I found an alternate ftp site that included Nir Dary's collection. But can't locate it right now. Anybody knows?

If you still can't find it, it'll post/send it to you.

Quote

I have the 1050a and 1050b rom images that are floating around

I have revisions K and L. Never seen those such old. I just checked and the revision letter is located in plain ASCII at $FFF9 (7th byte starting from the end).

Revision L seems to be last one. I think I also checked long ago, and the only difference between K and L seems to be the additional support for the 2797.

#21 Bryan OFFLINE  

Bryan

    Quadrunner

  • 7,626 posts
  • Cruise Elroy = 4DB7
  • Location:Port St. Lucie, Florida

Posted Mon Mar 13, 2006 6:14 PM

View Postijor, on Mon Mar 13, 2006 7:09 PM, said:

If you still can't find it, it'll post/send it to you.

If you could attach it to a PM, that would be great!

Quote

I have revisions K and L. Never seen those such old. I just checked and the revision letter is located in plain ASCII at $FFF9 (7th byte starting from the end).

Revision L seems to be last one. I think I also checked long ago, and the only difference between K and L seems to be the additional support for the 2797.

The ones I have say 4C and 4B.

-Bry

#22 drac030 OFFLINE  

drac030

    Stargunner

  • 1,023 posts
  • Location:Warszawa, Poland

Posted Mon Mar 13, 2006 10:50 PM

View Postijor, on Tue Mar 14, 2006 2:09 AM, said:

It'a zip file named FLOPOS. I just google and the link to the ftp polish site is not working, at least not for me. I remember I found an alternate ftp site that included Nir Dary's collection. But can't locate it right now. Anybody knows?

http://www.atariage....0

#23 ijor OFFLINE  

ijor

    Stargunner

  • 1,431 posts

Posted Tue Mar 14, 2006 8:30 AM

I’ve been asked how the “codename” thingy that survives a format works. I didn’t actually try it, but I guess they did. This is how it works (or at least it should):

The whole trick relies in one of the variants of the 1050 diagnostic commands, that let you position the drive head virtually on any place, limited only by the mechanical constraints. And what is more important is that the drive moves the head without updating its internal variables of the current logical track position.

The command was surely implemented for a variety of reasons, like alignment, cleaning, etc. But there is always somebody that finds an unexpected usage :)

So if you read sector #1 (head will be in track 0) and then move the head to track 1, the drive will still “think” it is in track 0. And if you then try to read any other sector on track 0, it won’t move the head back. It will look for the sector on track 1. Of course, normally it won’t find it there.

Assume now you somehow formatted track 40 (one beyond the last normal one, track 39). And assume you formatted it with sectors headers where the track field is 39 (you could accomplish this with a custom OS like the Happy if you want). You make a normal seek to track 39, for example reading sector 720. Then you use the diagnostic command to move the head to track 40.

At this point the head is on track 40, but the drive “thinks” is in track 39. So if try to read or write for example sector 720, it will read/write it at track 40. And because the track was already formatted (and formatted logically as being track 39) there won’t be any errors. And of course that whatever you write to track 40, it will survive a normal format.

If you however attempt to use this trick to actually format track 40, it won’t work. You can make a logical seek to track 0, and then physically position the head on track 1. And you could think that if you now issue a format disk command the disk will formatted with one track displacement (track 1-40 instead of track 0-39). But before formatting the disk, the drive performs a hardware “restore” by stepping out the head until sensing the track zero detector being active. This is done disregarding the current logical track position.

However, amazing as it sound, the trick does work the other way around, formatting physical tracks –1 to 38. It works as a consequence of two points.

One is the particular way that the zero-track sensor and stepper motor works in the 1050. The 1050 mechanism allows you to position the head even outer than track 0. Something that a PC drive normally doesn’t let you to do.

The other point is exactly how the 1050 ROM performs the hardware restore mentioned above. If you have seen how the head moves during drive power on, you know that it first moves the head inwards, at a middle position, and then outwards until sensing track 0. But the hardware restore at format time doesn’t move the head inwards at all. It just steps out until sensing track 0, which will be already active if the head is at track –1.

Amazing, isn’t it?

#24 Rybags ONLINE  

Rybags

    Quadrunner

  • 10,323 posts
  • Location:Australia

Posted Tue Mar 14, 2006 8:51 AM

So the question is, has anyone else put it into practice lately?

I assume the COMMAND value is $23 or $24. I can remember years ago discovering 1 or 2 command values that were undocumented, but never took it further.

I suppose you would need to plug in the right AUX1/2 values to get it to work properly. Might try it sometime later.

#25 ijor OFFLINE  

ijor

    Stargunner

  • 1,431 posts

Posted Tue Mar 14, 2006 12:52 PM

View PostRybags, on Tue Mar 14, 2006 9:51 AM, said:

I suppose you would need to plug in the right AUX1/2 values to get it to work properly.

I’m not so familiar with these commands. But as far as I can see, none of the diagnostic command takes parameters in the aux bytes. Actually, I never looked into these commands until now. I thought they wouldn’t perform anything really fancy or interesting. I wrongly assumed that otherwise it would have already widely known. That's why I thought the whole thing was just a joke. I was very wrong.

Command $23 receives a normal data frame, as when you write a sector. Parameters are specified in the data frame. Seems that aux bytes are completely ignored. The first byte in the data frame specifies the subcommand. Subcommand 3 is the one that performs those unconditional steps. The second byte specifies the direction, positive for step in (higher track numbers), and negative is a step out (lower track numbers). Note that each step is actually half a track distance. You must step twice in the same direction to move the head to the next/previous track.

Be warned that subcommand 4 is the actual burn-in, which formats the whole disk and performs a zillion of writes.

Note that this is for a 1050 drive. I have no idea about other Atari or third party drives. The trick won’t work in a XF-551 even if it implements this command, because the mechanism won’t step outwards from track 0. Won’t work with USD or other 1050 enhancements unless they are reprogrammed accordingly (something that you can do with those Happy type ones, but not with the USD).

Also note that some actions will make the drive to resync its physical and logical head position.

You probably can’t use the disk handler at $E453 to issue command $23, you must call SIO directly at $E459 (or go directly to the hardware).




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users