home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Fritz: All Fritz
/
All Fritz.zip
/
All Fritz
/
FILES
/
GAMEECTS
/
UNPROT4.LZH
/
SQ2.DOC
< prev
next >
Wrap
Text File
|
1989-03-28
|
2KB
|
52 lines
SPACE QUEST II UNPROTECTED BY SINBAD ON 8-29-88.
THE FILE SIERRA.COM CONTAINED A LOAD AND EXECUTION OF A FILE CALLED CPC.COM
(COPY PROTECTION CHECK?) WHICH NOT ONLY CHECKED FOR THE REQUIRED BAD SECTORS
ON THE ORIGINAL DISK, BUT ALSO WROTE AN $80-BYTE 'MASK' FILE TO BE XOR'D WITH
YET ANOTHER FILE TO FORM A VECTOR TABLE. THE MASK WAS WRITTEN TO 199B:0038
AND THE MASK WAS THEN MOVED TO DS:0141. THIS WAS THEN XOR'D WITH $80 BYTES
AT 179A:0000 TO FORM THE TABLE. BY NO-OPing LOCATIONS $3C1-$3C3, YOU AVOID
THE CALL WHICH WOULD ASK FOR THE DISKS, LOAD AND EXECUTE CPC.COM, AND MOVE
THE MASK.
THE PROCEDURE TO UNPROTECT THE DISK IS AS FOLLOWS:
1. FORMAT A REGULAR 360K DISK AND USE COPY *.* TO TRANSFER ALL
FILES TO THE WORK DISK.
2. USING DEBUG, CALL UP THE FILE SIERRA.COM WHICH, IF YOU DUMP
CS:100, WOULD BE VERSION 3.0 OF THE LOADER.
i.e. DEBUG SIERRA.COM
D CS:100
3. MAKE A NOTE OF THE BX AND CX REGISTERS(SHOULD BE BX=0 AND
CX=0C31) USING R<RET>.
4. NOW NO-OP THE LOCATIONS $3C1-$3C3 WITH THE EXAMINE COMMAND
E CS:3C1 WHICH FIRST DISPLAYS THE VALUE AT LOCATION $3C1.
CS:3C1 TO CS:3C3 CONTAIN E8 2E 04, WHICH IS A CALL TO $07F2.
TYPE IN $90 AND HIT THE SPACE BAR TO ADVANCE TO THE NEXT
LOCATION. AFTER THREE NO-OPS, HIT RETURN. THIS ELIMINATES
THE CALL.
5. NEXT LOAD THE MASK DATA FILE CALLED SQ2.DAT AS FOLLOWS:
N SQ2.DAT<RET>
L 141<RET>
THIS LOADS THE MASK DIRECTLY INTO THE AREA DS:141 (TO WHICH IT IS
NORMALLY RELOCATED AFTER CPC.COM IS RUN).
6. NEXT RENAME THE FILE BACK TO SIERRA.COM, RESET THE CX REGISTER TO
$0C31, AND WRITE TO DISK:
N SIERRA.COM<RET>
RCX<RET>
(ENTER 0C31)<RET>
W
THAT COMPLETES THE UNPROTECT. CPC.COM IS NOT NEEDED. IN DUMPING SOME OF THE
DATA AREAS, I NOTICED REFERENCE TO FOILA@CRYPTER WHICH I TAKE TO MEAN THIS
FORM OF ENCRYPTING THE TABLE DATA.