Apple II Magazines (DO)

home *** CD-ROM | disk | FTP | other *** search

/ Apple II Magazines (DO) / Bootlegger Magazine (1983)(Bootleg).zip / Bootlegger Magazine (1983)(Bootleg).do / CRACKING-PART 8.txt < prev next >

Wrap

Text File | 1996-12-24 | 16KB | 485 lines

8 *=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=* *************************************** * * * * * * * * * SSI'S RDOS * * * * * *************************************** IT'S REALLY NOT FAIR WHEN ONE PUBLISHER HAS A SYSTEM THAT KEEPS THEIR SOFTWARE FROM BEING CONVENIENTLY BACKED UP, ESPECIALLY WHEN SO MANY OF THE OTHER "PROTECTION" SCHEMES HAVE FALLEN TO THE GROWING CORPS OF TALENTED KRACKISTS. WITH THAT IN MIND, AND BECAUSE WE ALL LOVE A CHALLENGE, WE WILL TAKE A LONG LOOK AT THE APPROACH USED BY STRATEGIC SIMULATIONS, INC. (SSI) IN PROVIDING COPY PROTECTION FOR THEIR SERIES OF WAR SIMULATIONS AND "RAPID-FIRE" SERIES, AS WELL AS SOME RECENT GAMES WHICH HAVE A LITTLE REDEEMING SOCIAL MERIT: EPIDEMIC, RINGSIDE SEAT, AND GALACTIC ADVENTURES. AS WE'VE DISCUSSED IN THE BASICS OF KRACKING SERIES, YOU CAN EITHER PROTECT A PROGRAM BY VARIOUS MEANS, OR YOU CAN PROTECT A DISK FULL OF PROGRAMS WITH SOME SORT OF DOS MODIFICATION. DOS MODIFICATIONS ARE USUALLY NOT TOO SUCCESSFUL, SINCE SOME ENTERPRISING PERSON OUT IN PIRATELAND WILL SOONER OR LATER FIGURE A WAY TO COPY ALL THE FILES ONTO A NORMAL DOS DISK, MAKING ALL THE DISK PROTECTION WORTHLESS. SSI'S ANSWER TO THIS PROBLEM WAS NOT ONLY TO WRITE AN EXTENSIVELY REVISED DOS, BUT TO COUPLE IT WITH "ENHANCEMENTS" TO APPLESOFT USING THE AMPERSAND VECTOR (MORE ON THIS LATER). THIS WAY, EVEN IF YOU COULD STRIP THE FILES OFF THE DISK, YOU WOULD NEED TO WRITE A DOS WHICH WAS: A. DOS 3.3 COMPATIBLE, B. AS SHORT AS RDOS ($B100-$BFFF), SINCE THE PROGRAMS FREQUENTLY USE ALL OF THE FREE SPACE, AND C. CAPABLE OF CORRECTLY INTERPRETING THE AMPERSAND COMMANDS WHICH ARE LIBERALLY SPRINKLED THROUGH ALL THE APPLESOFT PROGRAMS. THE AMOUNT OF EFFORT REQUIRED TO DO THIS HAS KEPT KRACKISTS AT BAY, AT LEAST UNTIL NOW. FIRST, HOW TO APPROACH THIS TYPE OF KRACKING JOB? THE SEVENTH LAW OF KRACKING SAYS: "WHEN YOU'RE TOTALLY LOST, BOOT-TRACE" (I KNOW, I KNOW -- I PROMISE THAT I'LL WRITE A COMPLETE COLUMN ON BOOT-TRACING SOON. IF YOU JUST CAN'T WAIT, TRY TO GET HOLD OF THE HARDCORE MAGAZINE UPDATE 3.1, PAGES 6-15. IT HAS A LUCID, WELL-EXAMPLED DISCUSSION OF THE BOOT-TRACING PROCESS). WHEN YOU LOAD T0, S0 INTO $800, YOU WILL IMMEDIATELY SEE THE FAMILIAR "BRODY LOADY" (NAMED AFTER THAT FUN-LOVING BUNCH OF SCANDAHOOVIANS AT BR0DERBUND) WHICH MOVES THE ENTIRE PAGE DOWN TO PAGE 2 AND JUMPS TO $20F TO COMPLETE THE BOOT. THIS IS A FAIRLY TRICKY BOOT WHICH HAS BEEN USED FOR ALL TYPES OF PROTECTION SCHEMES, BUT IF YOU PUZZLE OVER IT LONG ENOUGH, YOU'LL SEE THAT THE JMP ($003E) AT LOCATION 343 DOUBLES AS A JUMP TO THE SECTOR READ ROUTINE, THEN AS A JUMP TO THE PROGRAM START WHEN ALL THE SECTORS ARE READ IN. THE PROGRAM START IN THIS CASE IS $B300, WHICH IS A JMP $B974 THAT DROPS YOU INTO A DISCOURAGINGLY COMPLEX SERIES OF JSR'S AND JMP'S. AT THIS POINT, DISCRETION IS THE BETTER PART OF VALOR (REMEMBER THE SECOND LAW: THERE'S ALWAYS ANOTHER WAY). WHAT THE BOOT-TRACE HAS TOLD US IS THAT THE DOS CODE LIVES FROM $B300 TO $BFFF, AND IS NOT STRAIGHTFORWARD, "LINEAR" CODE. YOU MAY RECALL THAT WE DESCRIBED HOW TO LIST AN RDOS APPLESOFT FILE IN BASICS 103: RESET, D6:00, C081, CTRL-C, "LIST". YOU WILL BE IMMEDIATELY STRUCK BY A WHOLE NEW LIST OF COMMANDS THAT MOTHER APPLE NEVER TOLD YOU ABOUT. THESE ARE AMPERSAND (&) COMMANDS WHICH HAVE BEEN ADDED TO IMPLEMENT THE RDOS COMMANDS, AND THEY WORK AS FOLLOWS: WHENEVER THE "&" IS ENCOUNTERED, APPLESOFT JUMPS TO LOCATION $3F5. LOOKING AT THAT LOCATION WILL TELL YOU WHERE THE AMPERSAND EVALUATION ROUTINE IS LOCATED; IN THIS CASE, IT CONTAINS 4C 03 B3 OR JMP $B303. EXAMINATION OF THE CODE THERE REVEALS THAT THE ACCUMULATOR IS COMPARED TO A TABLE OF NUMBERS IN $B320-$B330, AND THE ADDRESS OF THE ROUTINE TO BE EXECUTED IS PICKED UP FROM A TABLE IN $B331-$B352. YOU CAN EASILY SEE ALL THIS CODE BY RESETTING ANY OF THE RDOS SSI GAMES, AND IF YOU'RE REALLY INTERESTED, YOU CAN CONTACT YOUR LOCAL PIRATE FOR A COPY OF THE SOURCE CODE LISTINGS, IN BIG MAC FORMAT, FOR BOTH THE ORIGINAL AND DOS 3.3 COMPATIBLE VERSIONS OF RDOS. THE DISK ALSO CONTAINS OBJECT CODE FOR RDOS 3.3 AND LISTINGS OF THE OTHER PROGRAMS USED FOR SECONDARY PROTECTION AND INITIALIZING. IF THERE'S ENOUGH INTEREST, THE SYSOP MIGHT BE PERSUADED TO INCLUDE THEM ON HIS APPLE TREK KRACKING DISK #2. NOW WE'RE STARTING TO MAKE PROGRESS. EACH TIME THE & COMMAND IS ENCOUNTERED, APPLESOFT OBLIGINGLY JUMPS UP TO $B303 WITH THE HEX VALUE OF THE NEXT BASIC TOKEN IN THE ACCUMULATOR, AND THEN DECIDES WHAT TO DO NEXT. THE TOKENS, WITH THEIR VALUE, SUBROUTINE ADDRESS START, AND FUNCTION ARE SHOWN BELOW: & --- HEX DEC ADDR FUNCTION IN RDOS ----- --- --- ---- ---------------- C 43 67 B353 CATALOG (&C AT) LOAD B6 182 B371 LOAD APLSFT FILE RUN AC 172 B446 RUN APLSFT FILE GOTO AB 171 B44C EXEC (?) SAVE B7 183 B48D SAVE APLSFT FILE STORE A8 168 B511 BSAVE (WITH A,L) RECALL A7 167 B52B BLOAD, A OPTIONAL DEF B8 184 B544 ? PRINT BA 186 B56C WRITE TO TEXTFILE READ 87 135 B582 READ TEXT FILE END 80 128 B5A9 CLOSE A FILE DEL 85 133 B5AE DELETE A FILE LEN E3 227 B5CD ? D 44 68 B620 DRIVE? S 53 83 B62E SLOT? NEW BF 191 B64F ? USR D5 213 B670 CHG RTN FROM & AS YOU CAN SEE, NOT ALL HAVE BEEN CHASED DOWN. INTERESTED PARTIES ARE INVITED TO INVESTIGATE AND SHARE THE RESULTS WITH US ALL. BUT THIS, TOO HAS ONLY A LIMITED VALUE, SINCE WE RUN OUT OF INFORMATIVE TOKENS AT ABOUT $B679 IN A LISTING THAT CONTINUES UP TO $BFFF. THE ONLY WAY TO GET THERE IS TO CALL UP THE INFANTRY AND SLOG OUR WAY THROUGH THE CODE, BRUTE FORCE. SINCE IT'S A DOS, THERE MUST BE READ AND WRITE CODE OF SOME SORT, SO LOOKING AROUND FOR DISK ACCESSES ($C08C,X) IS A GOOD PLACE TO START. THE FIRST ENCOUNTER IS AT $BB6B, WHICH IS CLEARLY A "WRITE" SECTION-- $C08F,X = OUTPUT; $C08E,X = SENSE WRITE PROTECT. IT'S FOLLOWED BY A READ SECTOR ROUTINE AT $BBFD-BC64, AND READ ADDRESS ROUTINE AT $BC65-BCC0. ON CLOSE EXAMINATION, IT CAN BE SEEN THAT THE ROUTINES HAVE BEEN LIFTED ALMOST VERBATIM FROM DOS 3.2, WITH THE ADDRESS MARKER CHANGED TO D4 AA B7 (IN MOST CASES). AHA! MAYBE WE CAN SNEAK IN THE APPROPRIATE ROUTINES FROM DOS 3.3 AND MAKE IT DO D5 AA 96'S? TO MAKE A LENGTHY STORY SHORT, THE ANSWER IS YES, BUT. DOS 3.2 USES, AS YOU PROBABLY KNOW, "6+2" NIBBLIZING IN STORING DATA ON THE DISK, WHILE 3.3 USES "5+3". THE END RESULT IS THAT THE PRE- AND POST-NIBBLIZING ROUTINES MUST BE TRANSPLANTED FROM DOS 3.3, AS WELL AS BOTH READ AND WRITE BYTE TRANSLATE TABLES. THE ADDRESS MARKERS AND THE SIZE OF THE NIBBLE BUFFERS MUST ALSO BE ADJUSTED. WHEN THIS IS DONE (WITH MUCH WAILING AND GNASHING OF TEETH), THE END RESULT IS A FUNCTIONAL, DOS 3.3 COMPATIBLE RDOS: RDOS 3.3. (AS A BRIEF ASIDE, THE ESSENTIAL TOOLS IN THIS TASK ARE (OF COURSE), BENEATH APPLE DOS, AND THE DOSSOURCE COMMENTED LISTING OF ALL THE DOS CODE). NOW, WE KNOW FROM PREVIOUS GAMES LIKE CRISIS MOUNTAIN AND MING'S CHALLENGE THAT WE CAN READ THE SECTORS INTO MEMORY FROM A DISK WITH MODIFIED RWTS ROUTINES BY USING ITS OWN RWTS AND THE INSPECTOR, THEN SWAPPING RWTS ROUTINES TO STANDARD DOS 3.3 AND WRITING THEM OUT AGAIN ON A FORMATTED DISK. THE PROSPECT OF DOING ALL THE SSI GAMES BY HAND BOGGLES THE MIND, HOWEVER, AND REQUIRES AN AUTOMATED APPROACH (THEY WERE SUPPOSED TO WORK FOR ->US<-, REMEMBER?). THE ANSWER TO THIS PROBLEM WAS THE PROGRAM NOW KNOWN AS COPYB - A HIGHLY MODIFIED VERSION OF COPYA WHICH DOES THE RWTS SWAP FOR YOU, AND EVEN INITIALIZES DISKS AS A BONUS. THE VERSION OF COPYB IN GENERAL CIRCULATION INCLUDES RWTS ROUTINES WHICH HAVE BEEN MODIFIED FOR READING AND WRITING RDOS. REASONABLE DIRECTIONS ARE INCLUDED ON THE DISK, SO IT SHOULD BE POSSIBLE TO BACK UP YOUR OWN SSI DISKS, USING THE ADDITIONAL INFORMATION PROVIDED BELOW. ARMED WITH RDOS 3.3 AND COPYB, IT IS NOW POSSIBLE TO BEGIN ATTACKING ONE OF THE SSI PROTECTED DISKS. SINCE RDOS IS BASED ON DOS 3.2, THE DISKS ARE ALL 13-SECTOR FORMAT, AND SINCE THE DOS IS ALL ON TRACK ZERO, YOU WANT TO BEGIN THE TRACK COPYING PROCESS WITH TRACK ONE. TO REITERATE THE COPYB INSTRUCTIONS, RUN COPYB, THE TYPE CTRL-C OR RESET WHEN THE PROMPT FOR SOURCE DISK COMES UP. GET INTO THE MONITOR AND TYPE 22E:1 TO SET THE STARTING TRACK TO 1, THEN, IF THE ADDRESS MARKER BYTES WERE D4 AA B7, BLOAD THE FILE CALLED "RDOS READ RWTS" (IT GOES INTO $8000 AS THE DEFAULT LOCATION). NEXT, BLOAD "RDOS WRITE",A$7000, THEN MOVE IT TO THE NORMAL RWTS LOCATIONS WITH B700<7000.78FFM (THIS IS NECESSARY BECAUSE YOU'RE USING THE RWTS ROUTINES TO READ IN THE FILES; WRITING ON TOP OF OPERATING CODE CAN LEAD TO VERY UNPLEASANT RESULTS). RETURN TO BASIC, DELETE LINE FIVE, AND TYPE 'RUN'. ANSWER THE QUESTION "13 SECTOR", ENTER THE APPROPRIATE SLOTS AND DRIVES, AND YOU'RE OFF AND RUNNING TO CREATE AN RDOS 3.3 COPY (WHEN YOU'RE FINISHED, YOU'LL HAVE A 16-SECTOR DISKETTE WITH ONLY 13 SECTORS OCCUPIED PER TRACK, BUT YOU WON'T NOTICE IT IN USE). SOME OF THE SSI GAMES USE THE NORMAL DOS 3.2 ADDRESS MARKER BYTES OF D5 AA B5. THESE SHOULD BE READ IN USING THE "DOS 3.2 RWTS" FILE, BUT YOU STILL NEED TO USE THE "RDOS WRITE" RWTS FOR THE WRITING ROUTINE. RDOS USES TRACK 1 FOR THE CATALOG, AND IDENTIFIES FILES VIA A 24-CHARACTER ALPHANUMERIC NAME, A LENGTH IN "BLOCKS" AS IN PASCAL, AND THE LOCATION OF THE STARTING BLOCK ON THE DISK: TRACK 01 SECTOR 0 SLOT 6 DRIVE 1 BUFFER 0800 DOS 16 2BCC ======================================= 0 1 2 3 4 5 6 7 8 9 A B C D E F --------------------------------------- 00- R D O S 2 . 1 C O P Y R I G 10- H T 1 9 8 1 B 1A0010 001A0000 20- S Y S T E M B O O T 30- T 0100B1 00011A00 40- R E G 1 / B 0A6009 DC091B00 / / \ / \ /\ / / FILE TYPE \/ \/ \/ PROGRAM A,T,B / / FIRST NAME / / BLOCK / NUMBER STARTING OF LOCATION BLOCKS THE STARTING BLOCK IS EQUAL TO THE TRACK NUMBER MULTIPLIED BY 13 PLUS THE SECTOR NUMBER (1A00 IS REALLY 001A, WHICH IS DECIMAL 26, OR TRACK 2, SECTOR 0). IF YOU LOOK THROUGH THE CATALOG TRACK WITH THE INSPECTOR, YOU FIND THE BEGINNING OF THE CATALOG AS EXPECTED IN T1,S0. LOOKING FOR THE CONTINUATION IN T1,S1, HOWEVER, BRINGS YOU TO THE NEXT SURPRISE HELD BY RDOS: THERE IS NO SECTOR INTERLEAVING IN SOFTWARE; IT IS ALL DONE BY THE SECTOR NUMBER SEQUENCING DURING SSI'S INITIALIZE ROUTINE. THE IMPORTANCE OF SECTOR INTERLEAVING IS DISCUSSED IN "BAG OF TRICKS", AND IN A SOFTALK ARTICLE ABOUT A YEAR AGO BY WORTH AND LECHNER. (DOS USES A LOOKUP TABLE AT $BFA8 TO CHANGE THE SECTOR NUMBER READ FROM THE VALUE READ OFF THE DISK ("PHYSICAL SECTOR") TO THE NUMBER IT THINKS IT SHOULD BE ("LOGICAL SECTOR"). SSI USES AN "ASCENDING 7" INTERLEAVE SCHEME, WHICH MEANS THAT THE SEQUENCE OF SECTORS ON THE DISK, AS READ BY DOS 3.3 WITH ITS INTERLEAVE TABLE, IS: 0,7,E,6,D,5,C,4,B,3,A,2,9,1,8,F. THE SECOND CATALOG SECTOR, THEN, APPEARS TO BE SECTOR 7. IF YOU INTEND TO DO ANY AMOUNT OF PLAYING AROUND WITH ONE OF THESE DISKS, USE THE "RDOS WRITE" RWTS FROM THE COPYB DISK, OR CHANGE BYTES $BE2A-BE2D TO $EA'S WITH THE INSPECTOR. THIS OMITS THE TABLE LOOKUP AND MAKES THE SECTOR NUMBERS FOLLOW THE SEQUENCE AS USED BY RDOS. NEXT, COPY THE FILE CALLED RDOS 3.3 FROM THE COPYB DISK (OR TRACK 0 OF ANY OF THE RECENTLY UNPROTECTED SSI SERIES) ONTO TRACK ZERO, SECTORS 0-D. YOU WOULD EXPECT TO HAVE A WORKING COPY OF THE GAME AT THIS POINT, BUT THERE ARE STILL A COUPLE OF SURPRISES IN STORE FOR YOU (I SAID IT WAS A CHALLENGE!). THERE ARE SEVERAL DIFFERENT SECONDARY PROTECTION SCHEMES USED TO DEFEAT VARIOUS COPIERS, USUALLY GOING UNDER THE INNOCUOUS NAME OF "QWERTY". THE MOST COMMON OF THESE READS IN AN ADDRESS FIELD FROM TRACK 0, DELAYS A BIT, AND LOOKS FOR AN $EE AS THE NEXT BYTE ON THE TRACK. IF IT FINDS IT, A 0 IS STORED IN LOCATION 0, OTHERWISE THE DISK SPINS FOREVER. BY CHANGING BYTES $28-29 TO A9 00, THIS ANNOYANCE IS REMOVED. A SIMILAR ROUTINE, SEEN ONLY ONCE OR TWICE, IS CALLED @WERTY, LOOKS FOR AN $AA FOLLOWING THE ADDRESS FIELD ON ANY TRACK, AND REBOOTS IF IT'S NOT FOUND. THE REMEDY HERE IS TO PUT A9 00 IN BYTES $20-21. RECENTLY, A MUCH MORE SOPHISTICATED TECHNIQUE HAS BEEN USED (GALACTIC GLADIATORS, ROAD TO GETTYSBURG), WHICH DOES THE SSI EQUIVALENT OF "QUARTER-TRACKING" OR "SPIRALLING". THIS VERSION OF QWERTY READS IN FOUR PAGES OF SEQUENCIAL BYTES FROM EACH OF THE FOUR ADJACENT HALF-TRACKS FROM 20.5 TO 22.0, STORING THEM AT $1000-1FFF. THE THREE BYTES FOLLOWING THE FOUR PAGES WORTH ARE USED AS THE ADDRESS MARKER FOR THE DATA ON THE NEXT HALF-TRACK (AS WITH ALL THESE PROTECTION TECHNIQUES, THE "SECTORS" ARE SKEWED SO THAT THERE IS NEVER VALID DATA OVERLAPPING ON ADJACENT HALF-TRACKS). THIS APPROACH EFFECTIVELY DEFEATS COPIERS LIKE NA II AND LOCKSMITH, WHICH WRITE AN ENTIRE TRACK AND OBLITERATE DATA ON ANY ADJACENT HALF-TRACK. AFTER READING IN THE DATA, THE MEMORY VALUES ARE EXCLUSIVE-ORED WITH THE ADDRESS (1000 CONTAINS 00, 1001 CONTAINS 01, ETC.), AND IF AN ERROR IS FOUND, IT REBOOTS THE DISK. PLACING AN RTS ($60) AT THE ENTRY POINT OF $A0F0 WILL AVOID THE ENTIRE ISSUE AND MAKE THE COPYA VERSION RUN. THE FINAL (I HOPE) HURDLE TO USING RDOS 3.3 IS THE PROGRAM WHICH INITIALIZES A SAVE GAME DISKETTE IN AN RDOS-COMPATIBLE FORMAT. IT IS CALLED SSI.INIT AND LOADS INTO $800-AFF (IT IS USUALLY ACCESSED VIA A 'CALL 2800' FROM A BASIC PROGRAM). SINCE IT ONLY WRITES ADDRESS FIELDS, AND NOT DATA SECTORS (WITH NO VERIFY), IT IS A VERY FAST INIT. ALL THAT'S NECESSARY TO GENERATE A DISK COMPATIBLE WITH RDOS 3.3 IS TO REPLACE THE D4 AA B7 (OR D5 AA B5) ADDRESS MARKER BYTE WITH D5 AA 96: CHANGE BYTES $8F5 TO $D5 AND $8FF TO $96. NOW FOR THE BAD NEWS: WHILE RDOS IS FAST, PRIMARILY BECAUSE ALL FILES ARE STORED IN SEQUENCIAL BLOCKS, RDOS 3.3 IS SLOW BECAUSE OF THE SECTOR INTERLEAVE USED BY SSI (THE DISK MUST MAKE AN ALMOST AN ENTIRE REVOLUTION FOR EACH SECTOR THAT IS READ IN). IT IS FAIRLY EASY TO ADD AN INTERLEAVE LOOKUP TABLE TO RDOS 3.3 (IT'S CALLED RDOS 3.3A ON THE DISK), BUT BAD THINGS HAPPENED DURING MY ATTEMPTS TO INCORPORATE IT INTO THE SSI.INIT PROGRAM. THE CODE FROM $851 TO $86B NEEDS MORE ALTERATION THAN I HAD PATIENCE FOR (THERE'S ROOM FOR A PATCH IN $9D7-9FF), AND WOULD BE WORTH THE EFFORT IF SOME AMBITIOUS KRACKIST OUT THERE COULD FIND THE TIME... FINALLY, AS A TYPICAL EXAMPLE OF MURPHY'S LAW ("IF ANYTHING CAN GO WRONG, IT WILL, AND AT THE WORST POSSIBLE MOMENT), THAT AFTER DOING ALL THIS AND CONVERTING SOME 20 GAMES, THE VERY LAST ONE I TRIED WAS GERMANY 1985. THIS IS A FAIRLY RECENT PUBLICATION OF SSI WHICH IS COMPLETELY WRITTEN IN MACHINE LANGUAGE, DOES NOT USE RDOS AT ALL, AND WILL REQUIRE A TOTALLY DIFFERENT APPROACH TO UNPROTECTION. IN THE WORDS OF RICKY SKAGGS ("HEARTBROKE", FROM HIS "HIGHWAYS AND HEARTACHES" ALBUM): "PRIDE, WHEN YOU'RE RICH, IS A BORE WHEN YOU'RE LONELY, STILL MADNESS PREVAILS UPON REASON TO YIELD. BUT ALL IS NOT LOST, IT IS ONLY MISTAKEN, IT'S A SMALL CONSOLATION, BUT I KNOW JUST HOW YOU FEEL. NOBODY SAID IT WAS GOING TO BE EASY, WE ALL HAVE OUR WEAK SIDES AND NEED SOME GOOD TOUCHIN'. NOBODY SAID THAT IT WOULD NOT BE WORTH IT, THE HUMAN CONDITIONS -- CONTINUE AS SUCH."