The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / pc / crack / crak4.doc < prev next >

Wrap

Text File | 2003-06-11 | 12.2 KB | 312 lines

Chapter 4 Cracking Self Booters ------------------------------------------------------------- Now we'll take a look at cracking self booters. A few compa- nies have found this to be the best copy protection scheme for them, one of which is DataEast, makers of Ikari Warriors, Victory Road, Lock-On, Karnov, etc... This posses a special problem to the Amateur Cracker, since they seldom use stan- dard DOS formats. So let's jump right in! ------------------------------------------------------------- This is the area where a "Higher than Normal" knowledge of Assembly Language and DOS Diskette structures, so first of all, the Basic's. The Disk's Physical Structure Data is recorded on a disk in a series of concentric circles, called Tracks. Each track if further divided into segments, called Sectors. The standard double-density drives can record 40 tracks of data, while the new quad-density drives can record 80 tracks. However, the location, size, and number of the sectors within a track are under software control. This is why the PC's diskettes are known as soft-sectored. The characteristics of a diskette's sectors (Their size, and the number per track) are set when each track is formatted. Disk Formatting can be done either by the operating system or by the ROM-BIOS format service. A lot of self booters and almost all forms of copy protection create unusual formats via the ROM-BIOS diskette services. The 5 1/4-inch diskettes supported by the standard PC BIOS may have sectors that are 128,256,512, or 1,024 bytes in size. DOS, from versions 1.00 through 4.01 has consistently used sectors of 512 bytes, and it is quite possible that this will continue. Here is a table displaying 6 of the most common disk formats: _____________________________________________________________ Type Sides Sectors Tracks Size(bytes) _____________________________________________________________ S-8 1 8 40 160K D-8 2 8 40 320K S-9 1 9 40 180K D-9 2 9 40 360K QD-9 2 9 80 720K QD-15 2 15 80 1,200K _____________________________________________________________ S - Single Density D - Double Density QD - Quad Density Of all these basic formats, only two are in widespread use: S-8 and D-9. The newer Quad Density formats are for the 3 1/2" and 5 1/4" high density diskettes. The Disk's Logical Structure So, as we have already mentioned, the 5 1/4-inch diskette formats have 40 tracks, numbered from 0 (the outside track) through 39 (the inside track, closest to the center). On a double sided diskette, the two sides are numbered 0 and 1 (the two recording heads of a double-sided disk drive are also numbered 0 and 1). The BIOS locates the sectors on a disk by a three-dimensional coordinate composed of a track number (also referred to as the cylinder number), a side number (also called the head number), and a sector number. DOS, on the other hand, lo- cates information by sector number, and numbers the sectors sequentially from the outside to inside. We can refer to particular sectors either by their three-dimensional coordinates or by their sequential order. All ROM-BIOS operations use the three-dimensional coordinates to locate a sector. All DOS operations and tools such as DE- BUG use the DOS sequential notation. The BASIC formula that converts the three-dimensional coordi- nates used by the ROM-BIOS to the sequential sector numbers used by DOS is as follows: DOS.SECTOR.NUMBER = (BIOS.SECTOR - 1) + DIOS.SIDE * SECTORS.PER.SIDE + BIOS.TRACK * SECTORS.PER.SIDE * SIDES.PER.DISK And here are the formulas for converting sequential sector numbers to three-dimensional coordinates: BIOS.SECTOR = 1 + DOS.SECTOR.NUMBER MOD SECTORS.PER.SIDE BIOS.SIDE = (DOS.SECTOR.NUMBER \ SECTORS.PER.SIDE) MOD SIDE.PER.DISK BIOS.TRACK = DOS.SECTOR.NUMBER \ (SECTORS.PER.SIDE * SIDES.PER.DISK) (Note: For double-sided nine-sector diskettes, the PC's most common disk format, the value of SECTORS.PER.SIDE is 9 and the value of SIDES.PER.DISK is 2. Also note that sides and tracks are numbered differently in the ROM-BIOS numbering system: The sides and tracks are num- bered from 0, but the sectors are numbered from 1.) Diskette Space Allocation The formatting process divides the sectors on a disk into four sections, for four different uses. The sections, in the order they are stored, are the boot record, the file alloca- tion table (FAT), the directory, and the data space. The size of each section varies between formats, but the struc- ture and the order of the sections don't vary. The Boot Record: This section is always a single sector located at sector 1 of track 0, side 0. The boot record contains, among other things, a short program to start the process of loading the operating system on it. All diskettes have the boot record on them even if they don't have the operating system. Asisde from the start-up program, the exact contents of the boot record vary from format to format. The File Allocation Table: The FAT follows the boot record, usually starting at sector 2 of track 0, side 0. The FAT contains the official record of the disk's format and maps out the location of the sectors used by the disk files. DOS uses the FAT to keep a record of the data-space usage. Each entry in the table con- tains a specific code to indicate what space is being used, what space is available, and what space is unusable (Due to defects on the disk). The File Directory: The file directory is the next item on the disk. It is used as a table of contents, identifying each file on the disk with a directory entry that contains several pieces of information, including the file's name and size. One part of the entry is a number that points to the first group of sec- tors used by the file (this number is also the first entry for this file in the FAT). The Data Space: Occupies the bulk of the diskette (from the directory through the last sector), is used to store data, while the other three sections are used to support the data space. Sectors in the data space are allocated to files on an as-needed basis, in units known as clusters. The clusters are one sector long and on double-sided diskettes, they are a pair of adjacent sectors. (From here on I'll continue to describe the basics of DOS disk structures, and assembly language addressing technics. ------------------------------------------------------------- Here is a simple routine to just make a backup copy of the Flight Simulator Version 1.0 by Microsoft. I know the latest version is 3.x but this version will serve the purpose of demonstrating how to access the data and program files of a selfbooter. ------------------------------------------------------------- By: PTL Title: Microsoft Flight Simulator 1.00 Unprotect This procedure will NOT convert the Flight Simulator disk to files that can be loaded on a hard drive. But... it will read off the data from the original and put it onto another floppy. And this should give you an idea of how to read data directly from a disk and write it back out to another disk. First of all take UNFORMATTED disk and place it in drive B:. This will be the target disk. Now place your DOS disk (which has Debug) into drive A:, or just load Debug off you hard disk. A>DEBUG Then we are going to enter (manually) a little program to load the FS files off the disk. -E CS:0000 B9 01 00 BA 01 00 BB 00 01 0E 07 06 1F 88 E8 53 5F AA 83 C7 03 81 FF 1C 01 76 F6 B8 08 05 CD 13 73 01 90 FE C5 80 FD 0C 76 E1 90 CD 20 -E CS:0100 00 00 01 02 00 00 02 02 00 00 03 02 00 00 04 02 00 00 05 02 00 00 06 02 00 00 07 02 00 00 08 02 Next we'll [R]eset the IP Register by typing. -R IP And then typing four zeros after the address prefix. xxxx:0000 Next insert the original Flight Simulator disk into drive A: and we'll run our little loader. -G =CS:0000 CS:22 CS:2A Now enter a new address to load from. -E CS:02 0E -E CS:27 19 And run the Loader again. -G =CS:0000 CS:22 CS:2A New address -E CS:02 27 -E CS:27 27 Run Loader -G =CS:0000 CS:22 CS:2A Here we'll do some [L]oading directly from the disk our- selves. -L DS:0000 0 0 40 And the in turn, write it back out to the B: (1) drive -W DS:0000 1 0 40 Etc... -L DS:0000 0 40 28 -W DS:0000 1 70 30 -L DS:0000 0 A0 30 -W DS:0000 1 A0 30 -L DS:0000 0 138 8 -W DS:0000 1 138 8 When we are all through, [Q]uit from debug and you should have a backup copy of the Flight Simulator. -Q And that's all there is to it. END. /////////////////////////////////////////////////////// // The PIRATES' HOLLOW // // 415-236-2371 // // over 12 Megs of Elite Text Files // // ROR-ALUCARD // // Sysop: Doctor Murdock // // C0-Sysops: That One, Sir Death, Sid Gnarly & Finn // // // // "The Gates of Hell are open night and day; // // Smooth is the Descent, and Easy is the way.." // /////////////////////////////////////////////////////// Which G-file (Q=Quit) ? Another file downloaded from: NIRVANAnet(tm) & the Temple of the Screaming Electron 415-935-5845 Just Say Yes 415-922-1613 Rat Head 415-524-3649 Cheez Whiz 408-363-9766 Reality Check 415-474-2602 Specializing in conversations, obscure information, high explosives, arcane knowledge, political extremism, diversive sexuality, insane speculation, and wild rumours. ALL-TEXT BBS SYSTEMS. Full access for first-time callers. We don't want to know who you are, where you live, or what your phone number is. We are not Big Brother. "Raw Data for Raw Nerves"