The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / zines / n_z / pirate3.006 < prev next >

Wrap

Text File | 2003-06-11 | 16.8 KB | 471 lines

! *************************************************** *** Pirate Magazine Issue III-3 / File 6 of 9 *** *** Cracking Tips (Part 4) *** *************************************************** In this file: Memory shift 2.1 Lotus 123 ver 1a Multilink ver 2.06 Chartmaster Enable ver. 1.00 EZWriter ver. 1.1 Flight Simulator 1.00 How to Unprotect MEMORY-SHIFT, Version 2.1 A>FORMAT b:/s/v With Memory Shift Master in drive A: and your fresh diskette in B: A>COPY A:*.*,B: Replace the Memory Shift Master in drive A: with your DOS diskette A>RENAME B:MS.EXE,B:MS.XXX A>DEBUG B:MS.XXX -s 0 l 8000 e8 22 00 72 <- look for this string in memory xxxx:7F68 <- one occurance should be found -e 7F68 xxxx:7F68 E8.eb 22.08 <CR> -e 80ec xxxx:80EC AD.e9 AB.9e AD.fe <CR> -e 7f8d xxxx:7F8D 06.b8 1E.00 B8.01 xxxx:7F90 40.ab 00.b8 8E.f0 D8.ff BF.01 3E.d8 00.ab 8A.b8 xxxx:7F98 95.d0 04.40 00.89 80.c1 E2.b8 03.b8 8E.03 46.e9 xxxx:7FA0 00.54 33.01 -w Writing 8000 bytes -q A>RENAME B:MS.XXX,B:MS.EXE That is all there is to it! December 28, 1983 <> <> <> <> <> <> <> <> <> <> <> I have just seen a new copy of Lotus 1-2-3 v1a that has a modified protection scheme for which the currently published unprotect scheme will not work. Here is a modified unprotect that will work properly with both the old and new v1a releases ..... 1) Rename 123.exe to 123.xyx 2) Type (to DOS) the command C> debug 123.xyx 3) Type (to debug) the command -s 100 efff cd 13 (The "-" is a prompt from debug.) 4) Debug should respond with something like: xxxx:ABA9 where xxxx is a hex number that may vary 5) Type -e aba9 fb f9 (Use whatever debug gave you in the -w last step instead of "aba9" if it is -q different.) 6) Rename 123.xyx to 123.exe For those of you who want to understand this, it is replacing an "INT 13" instruction that checks the disk in drive A: for some funny stuff with STI, STC instructions A little while ago, there was a patch for 123.EXE listed here that effectively unprotected the copy-protected disk and allowed hard-disk to run without the floppy. I just received the new version of Lotus 123 and retrofitted the patch (it is a different technique). To unprotect 123.EXE Version 1A, 1. Rename 123.EXE 123.XYZ 2. DEBUG 123.XYZ 3. type U ABA9 4. you should see INT 13 at that address 5. type E ABA9 90 90 6. type W 7. type Q 8. Rename 123.XYZ 123.EXE That's it. Good Luck. <> <> <> <> <> <> <> <> <> <> <> The following is a method to unprotect MultiLink Ver 2.06 to allow booting directly from hard disk without the need to insert the MultiLink distribution disk. ENTER COMMENTS ------------------------- --------------------------------------- C>copy mlink.com mlink.bak Make a backup first! C>debug mlink.com Start debug session. -u 2dfa Unassemble from address 2DFA. You should see: xxxx:2DFA CALL 2F01 xxxx:2DFD JNB 2E10 xxxx:2DFF MOV CX,2908 xxxx:2E02 CALL 2F01 xxxx:2E05 JNB 2E10 xxxx:2E07 DEC BYTE PTR [2E0F] xxxx:2E0B JG 2DF2 xxxx:2E0D JMP 07C4 xxxx:2E10 XOR BYTE PTR [2E0D],32 xxxx:2E15 MOV AX,[23C4] xxxx:2E18 CMP [2705],AX If you don't see this, you have another version. If so, enter 'q' to quit the debug session. Otherwise, continue. The instructions at xxxx:2dfa, xxxx:2e02, and xxxx:2e1c need to be replaced. -e 2dfa f8 90 90 CALL 2F01 is replaced by CLC, NOP, NOP -e 2e02 f8 90 90 CALL 2F01 is replaced by CLC, NOP, NOP -e 2e1c 90 90 JNZ 2E0D is replaced by NOP, NOP -w Save the changes to disk -q End the debug session. <> <> <> <> <> <> <> <> <> <> <> In the spirit of a recent patch to unprotect LOTUS 1-2-3, I discovered the same logic can be applied to unprotect MEMORY/SHIFT. 1. Rename MS.EXE MS.XYZ 2. DEBUG MS.XYZ 3. type U 1565 4. you should see INT 21 at that address 5. type E 1565 90 90 type E 1567 90 90 6. type W 7. type Q 8. Rename MS.XYZ MS.EXE Finally, make sure command.com resides on the disk where MEMORY/ SHIFT is initiated. 65399 '** DONE - PRESS ENTER TO RETURN TO MENU ** There is another version of Lotus 123 also called Release 1A but with a different copy-protection technique. It can be identified by an "*" that displays on the first screen under the "s" in the word "Release" Release 1A * To unprotect this version so it can be run on a hard disk without requiring the SYSTEM DISK in drive A, do the following: 1. RENAME 123.EXE 123.XYZ 2. DEBUG 123.XYZ 3. Type U AB8C press ENTER You should see MOV CX,0002 if you don't, something is different and this won't work. 4. Type E AB8C C3 press ENTER 5. Type W 6. Type Q 7. RENAME 123.XYZ 123.EXE That's it. It will now run from any drive. As always, this patch is provided so that honest people don't have to suffer the inconvienences imposed upon them by software manufacturers. FOR THE USERS THAT HAVE 'CHARTMASTER' VER 6.04 <> <> <> <> <> <> <> <> <> <> <> ------------------------------------------------------------------- FROM : THE A.S.P ; (Against Software Protection) DATED : OCT 18,1984 (FIRST RELEASE) ORIGINALLY SUBMITTED TO ASA FULTONS BBS (THE SHINING SUN -305-273-0020) AND TO LEE NELSONS BBS (PC-FORUM -404-761-3635) PLEASE NOTE THAT THESE UNPROTECT PROCEDURES INVOLVE FROM 4 HOURS TO 40 OR MORE HOURS ( 4+ HOURS FOR 'CHARTMASTER' ) OF SINGLE STEPPING THRU CODE AND FIGURING OUT THE INTENT OF THE ORIGINAL CODE.. SO I WOULD APPRECIATE IT WHEN U PASS THIS ON TO OTHER BOARDS YOU DO NOT ALTER THIS OR TRY TO TAKE CREDIT FOR MY LOST SLEEP.... THE A.S.P... (J.P. TO HIS FRIENDS) OH, AS A FURTHER NOTE. I SEE SOME BBS'S ARE NOW CHARGING U TO BE REGISTERED TO USE THEIR SYSTEM. FIRST OF ALL I GIVE U FROM 4 TO 60 HOURS OF MY TIME AT NO COST TO YOU AND I DO NOT LOOK TO KINDLY TO SUCH BBS'S PUTTING ON MY PROCEDURES AND THEN CHARGING U TO GET ACCESS TO THEM. THEY DIDNT SPEND TIME AND COST (SAY 'X' HOURS * $40+) TO MAKE THE PROCEDURES AVAIL. , SO I WOULD APPRECIATE THAT SUCH BOARDS DID NOT USE ANY OF THE 'A.S.P'S' PROCEDURES, UNLESS THEY ARE WILLING TO PUT THEIR WORKS TRULY IN THE PUBLIC DOMAIN.. ENOUGH SAID.. THANK YOU. IF YOU HAVE A HARD DISK OR WANT TO CREATE A BACKUP COPY THAT IS NOT TIED INTO THE 'CHARTMASTER' DISKETTE...IN CASE YOUR ONLY COPY GOES BAD . THIS PATCH WILL REMOVE THE COPY PROTECTION COMPLETELY. AS ALWAYS THIS IS FOR YOUR PERSONAL PEACE OF MIND ONLY IT IS NOT MEANT TO BYPASS ANY COPYRIGHTS..YOU ARE BY LAW BOUND BY YOUR PURCHASE LICENSE AGREEMENT. IF YOU HAVE A HARD DISK AND WANT TO PUT THE PROGRAM ON SUCH WHY SHOULD YOU BE TIED TO A FLOPPY. YOU HAD TO GIVE UP A LOT OF 'BIG MACS' TO GET YOUR HARD DISK. FORMAT 1 SYSTEM DISK UNDER DOS 2.0 OR 2.1 OR 3.0 LABEL IT ACCORDING TO THE ORIGINAL 'CHARTMASTER' SYSTEM DISKETTE COPY THE (UNHIDDEN) FILES FROM THE ORIGINAL DISKETTE TO THE CORRESPONDING 2.X OR 3.X FORMATTED DISKETTE I WONT TELL U HOW TO USE DEBUG OR ANY 'PATCHER' PROGRAMS ON THE BBS'S, I ASSUME U HAVE A BASIC UNDERSTANDING. RENAME CM1.EXE CM1 DEBUG CM1 D CS:A67 YOU SHOULD SEE 75 03 E9 09 00 E CS:A67 90 90 E9 F7 01 D CS:D139 YOU SHOULD SEE 5F E CS:D139 CB W Q RENAME CM1 CM1.EXE OTHER NOTES: ------------------------------------------------------------------------- CHECKS FOR SPECIALLY FORMATTED TRACKS COMPLETELY REMOVED U MAY LOAD ALL THE FILES ON THE NEWLY FORMATTED AND UNPROTECTED DISKETTE DIRECTLY TO HARD OR RAM DISK, IN ANY SUB-DIRECTORY U SET UP SOMEONE WANTED TO KNOW WHY I USED UPPER CASE FOR EVERYTHING. FIRST AFTER ABOUT 8 TO 20 HOURS OF STARING AT THE TUBE., I AM NOT ABOUT TO SHIFT THE CHARACTERS, AND SECONDLY I AM SO EXCITED , AFTER DOING SOMETHING THAT AT FIRST SEEMED IMPOSSIBLE, AND IN A HURRY TO GET IT OUT ON A BBS, SO THAT U MAY USE THE NEWLY GLEAMED KNOWLEDGE. ALSO IN SOME CASES THE PROGRAM STILL TRIES TO GO TO THE "A" AND "B" DRIVES, SO I USED AN ASSIGN TO ASSIGN THEM TO THE 'C'. THIS PROBABLY CAN BE OVERCOME WITH THE CORRECT CONFIGURATION PARAMETERS. ENJOY YOUR NEW FOUND FREEDOM..HARD DISKS FOREVER!!!!! <> <> <> <> <> <> <> <> <> <> <> This is the procedure to unprotect the intregrated software package called ENABLE , Vers 1.00 If you have a hard disk or want to create a backup copy that is not tied to the original ENABLE system disk, this will remove the copy protection completly. This procedure is to be used by legitimate owners of ENABLE only, as you are entitled to make a back up for archive purposes only. You are bound by your licence agreement. Format a blank disk using DOS 2 or 2.1 (Do not use the /s option.) Label it the same as the original ENABLE system disk. Copy the files from the original ENABLE system to the formatted blank disk using *.* . Place DOS system disk containing DEBUG in drive A: Place the new copy of ENABLE in drive B: DEBUG B:SYSTEM.TSG S CS:0 L EFFF B8 01 04 (You should see) XXXX:069C XXXX:XXXX < this one doest matter! (If you dont - type q and enter - you have a different version!) (If you do) E 69C (enter) B. EB 01.2D 04.90 (enter) W Q Now all the copy protection has been removed, and you may copy the files as required. All checks for specially formatted tracks has been removed. Disk needs no longer to be in the A drive on start up. ***** UNPROTECT EZWRITER 1.1 ***** BY JPM - ORLANDO FLA THIS PROGRAM IS TO HELP ALL OF YOU THAT HAVE FOUND THAT YOU COPIED YOUR EZWRITER 1.1 BACKUP TO SINGLE SIDED DISKETTE AND NOW YOU HAVE A DOUBLE SIDED DRIVE OR FIXED DISK, OR RAM DISK AND YOU ARE UP THE I/O CHANNEL WITHOUT A BYTE. THE WAY THE EZWRITER PROTECTION WORKS IS: <> <> <> <> <> <> <> <> <> <> <> 1). A BAD TRACK IS CREATED ON THE DISKETTE (LAST TRACK) SO THAT DISK COPY WOULD NOT WORK. IT REALLY DOES WORK THOUGH, BUT THE BAD TRACK IS IS NOT COPIED. THIS BAD TRACK IS THE KEY. WITH OUT THE BAD TRACK , WHICH EZWRITE NEEDS TO READ THE PROGRAM WILL NOT RUN. 2). EW1.COM IS READ IN (YOU DO THIS). EW1.COM INTURN LOADS "IBM88VMI.COM", WHICH INTURN LOADS "TARGET.COM". TARGET.COM IS THE GUTS OF EZWRITER. "IBM88VMI.COM" CHECKS FOR THE BAD TRACK, AND IF IT IS THERE LOADS "TARGET.COM" OTHERWISE BYE-BYE. WHAT THIS SIMPLE PROGRAM DOES IS TELLS "IBM88VMI.COM" TO IGNORE THE RESULTS OF THE CHECK FOR THE BAD TRACK. THIS WAY AFTER YOU DO A "COPY *.*" OR "DISKCOPY" YOU CAN THE USE AND MOVE THE EZWRITER PROGRAM TO ANY MAGNETIC STORAGE MEDIA. *************************************************************** TO MAKE A UNPROTECTED COPY OF EZWRITER: 1). PUT THE ORIGINAL OR BACKUP IN DRIVE "A" 2). PUT A FORMATED (SINGLE OR DOUBLE) DISKETTE IN DRIVE "B:" 3). COPY *.* B: 4). REMOVE EZWRITER FROM DRIVE "A:" 5). LOAD BASIC FROM "A:" AND ONCE IN BASIC LOAD THIS PROGRAM 6). RUNTHIS PROGRAM , LOW AND BEHOLD THE COPIED EZWRITER DISKETTE IN DRIVE "B: SHOULD NOW BE UNPROTECTED AND TRANSPORTABLE AS WELL AS TOTALLY FUNCTIONAL. 7). AS ALWAYS PUT YOUR BACKUP DISKETTES IN A SAFE PLACE IN CASE OF PROBLEMS WITH THE COPIES. SINCE YOU NOW HAVE A UNPROTECTED VERSION OF EZWRITER THE COPIES SHOULD BE FOR YOUR USE ONLY. YOU ARE STILL BOUND BY THE LICENSE AGREEMENT WHEN YOU PURCHASED THE PACKAGE. CLS CLOSE DEFINT A-Z YOU SHOULD NOP RECORD(BYTE) 390 AND 391 THEY CONTAIN HEX(CD20) WHICH IS A BRANCH IF BAD TRACK NOT FOUND THIS ONE LITTLE INSTRUCTION KEEPS YOU FROM RUNNING THERE IS NO ERROR CHECKING DONE , SUCH AS FOR MISSING FILE, WRITE PROTECTED DISKETTE OR OTHER POSSIBLE I/O ERRORS. NOP$=CHR$(144) BRANCH.BYTE1$=CHR$(205) BRANCH.BYTE2$=CHR$(32) OPEN "B:IBM88VMI.COM" AS #1 LEN=1 GET #1,390 FIELD 1,1 AS A$ BYTE$=A$ PRINT "VAULE READ FOR BYTE 390 WAS ";ASC(BYTE$) IF BYTE$<>BRANCH.BYTE1$ THEN GOTO 770 LSET A$=NOP$ PUT 1,390 GET #1,391 FIELD 1,1 AS A$ BYTE$=A$ PRINT "VALUE READ FOR BYTE 391 WAS ";ASC(BYTE$) IF BYTE$<>BRANCH.BYTE2$ THEN GOTO 770 LSET A$=NOP$ PUT 1,391 CLOSE END PRINT "THE BYTE YOU WERE TRYING TO NOP WAS ";ASC(BYTE$) PRINT "THE BYTE SHOULD HAVE BEEN EITHER 32 OR 205" PRINT "IF THE BYTE READ WAS 144 YOU HAVE PROBABLY" PRINT "UNPROTECTED THE PROGRAM ONCE BEFORE" PRINT "IF PROBLEMS GOTO YOUR BACKUP DISKETTES" <> <> <> <> <> <> <> <> <> <> <> To make a backup of Microsoft Flight Simulator 1.00, do the following: *Take un UNFORMATTED (never used) disk and place it in drive B. *Place your DOS disk (which has DEBUG) into drive A. A>DEBUG -E CS:0000 B9 01 00 BA 01 00 BB 00 01 0E 07 06 1F 88 E8 53 5F AA 83 C7 03 81 FF 1C 01 76 F6 B8 08 05 CD 13 73 01 90 FE C5 80 FD 0C 76 E1 90 CD 20 -E CS:0100 00 00 01 02 00 00 02 02 00 00 03 02 00 00 04 02 00 00 05 02 00 00 06 02 00 00 07 02 00 00 08 02 -R IP xxxx :0000 <-- YOU ENTER THIS, NOW INSERT FLT. SIM DISK INTO A: -G =CS:0000 CS:22 CS:2A -E CS:02 0E -E CS:27 19 -G =CS:0000 CS:22 CS:2A -E CS:02 27 -E CS:27 27 -G =CS:0000 CS:22 CS:2A -L DS:0000 0 0 40 -W DS:0000 1 0 40 -L DS:0000 0 40 28 -W DS:0000 1 70 30 -L DS:0000 0 A0 30 -W DS:0000 1 A0 30 -L DS:0000 0 138 8 -W DS:0000 1 138 8 -Q A> *Now write protect the new disk. *This procedure may not work on the version which has color on RGB monitors. To make a backup of Microsoft Flight Simulator 1.00, do the following: *Take un UNFORMATTED (never used) disk and place it in drive B. *Place your DOS disk (which has DEBUG) into drive A. A>DEBUG -E CS:0000 B9 01 00 BA 01 00 BB 00 01 0E 07 06 1F 88 E8 53 5F AA 83 C7 03 81 FF 1C 01 76 F6 B8 08 05 CD 13 73 01 90 FE C5 80 FD 0C 76 E1 90 CD 20 -E CS:0100 00 00 01 02 00 00 02 02 00 00 03 02 00 00 04 02 00 00 05 02 00 00 06 02 00 00 07 02 00 00 08 02 -R IP xxxx :0000 <-- YOU ENTER THIS, NOW INSERT FLT. SIM DISK INTO A: -G =CS:0000 CS:22 CS:2A -E CS:02 0E -E CS:27 19 -G =CS:0000 CS:22 CS:2A -E CS:02 27 -E CS:27 27 -G =CS:0000 CS:22 CS:2A -L DS:0000 0 0 40 -W DS:0000 1 0 40 -L DS:0000 0 40 28 -W DS:0000 1 70 30 -L DS:0000 0 A0 30 -W DS:0000 1 A0 30 -L DS:0000 0 138 8 -W DS:0000 1 138 8 -Q A> *Now write protect the new disk. *This procedure may not work on the version which has color on RGB monitors. The following fix will eliminiate the bothersome requirement to insert the FOCUS "activator" diskette in the A-drive everytime you bring FOCUS up. This change was made to a version of FOCUS that had file dates of 05/11/84. Be sure that you verify the code that is in place before applying this zap. RENAME FCPCINIT.EXE FCPCINIT.XXX DEBUG FCPCINIT.XXX U 22AB L 5 (You should see "9A C5 02 14 02 CALL 0214:02C5" display on the screen) E 22AB 90 90 90 90 90 W Q RENAME FCPCINIT.XXX FCPCINIT.EXE That all there is to it. Have fun. The Ancient Mariner Note added 6 DEC 84 Same procedure continues to work, only 5 bytes want to no-op are at location 0C57:23E0 What you see at that location is CALL 021C:02C5 <-----<<END>>-----> ++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++++++++ !