166 lines
7.8 KiB
Plaintext
166 lines
7.8 KiB
Plaintext
|
GCLISP.UNP Breaking GCLISP (Sofguard version 2.00)
|
|||
|
|
Special thanks to by The Lone Victor
|
|||
|
|
|
|||
|
|
Programs that are protected by the Softguard system are distingished
|
|||
|
|
by the fileS CML0200.HCL and VDF0200.VDW which are hidden in the root
|
|||
|
|
directory when you install the program on your fixed disk. The 0200
|
|||
|
|
part of the file names is the Softguard version (2.00) while CML stands
|
|||
|
|
for Common Loader and VDF is the Volume Descriptor File. The extentions
|
|||
|
|
HCL and VDW stand for Hard Common Loader and Verify Descriptor Working
|
|||
|
|
copy. In addition, there will be a hidden root file with a .EXE or .LOD
|
|||
|
|
extention. This is the REAL program, which has been encrypted and hidden.
|
|||
|
|
|
|||
|
|
The program <FILE>.COM, in the product directory is the Softguard mini-
|
|||
|
|
loader. All it does is call the Common Loader. For example, when you run
|
|||
|
|
dbase, the program GCLISP.COM loads CML0200.HCL high in memory and runs it.
|
|||
|
|
CML decrypts itself and reads VDF0200.VDW. The VDF file contains some code
|
|||
|
|
and data from the fixed disk FAT at the time of installation. By comparing
|
|||
|
|
the information in the VDF file with the current FAT, CML can tell if the
|
|||
|
|
CML, VDF, and GCLISP.EXE files are in the same place on the disk where they
|
|||
|
|
were installed. If they have moved, say from a backup & restore, then GCLISP
|
|||
|
|
will not run.
|
|||
|
|
|
|||
|
|
This text file is designed to let you unprotect ANY of the programs
|
|||
|
|
using the Softguard 2.00 system. We will use GCLISP as an example,
|
|||
|
|
but values for other programs will be included in a table.
|
|||
|
|
|
|||
|
|
The DBASE III compiler named CLIPPER uses Softguard 2.03 (i.e. has
|
|||
|
|
CML0203.HCL, etc.) Many of the code addresses are different in this
|
|||
|
|
version. This text will not, currently, unprotect any programs using
|
|||
|
|
Softguard 2.03.
|
|||
|
|
|
|||
|
|
This table is an experiment designed to keep down the number of files
|
|||
|
|
uploaded to BBS's. When I started it, this text file was named SOFTG1.UNP.
|
|||
|
|
Whenever you add a product to the table (including your "name" if desired)
|
|||
|
|
increment the file name by one and upload it to your local BBS. Don't worry
|
|||
|
|
about the fact that others will be doing the same. Higher versions of
|
|||
|
|
SOFTGxxx.UNP will not INSURE that they contain all the tabulated products,
|
|||
|
|
but will be MORE LIKELY to contain them all. Eventually we'll get them all
|
|||
|
|
collected.
|
|||
|
|
|
|||
|
|
If you find a new program to add to the table, just enter the name of
|
|||
|
|
the encrypted, hidden file in the root directory, and it's size converted
|
|||
|
|
to HEX. Try it out before you upload it to your BBS.
|
|||
|
|
|
|||
|
|
If you have any comments on this unprotect routine or the PROLOCK.UNP
|
|||
|
|
routine, please leave them on the Atlanta PCUG BBS (404) 634-5731.
|
|||
|
|
|
|||
|
|
The Lone Victor - 6/26/85
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
TABLE OF VALUES FOR VARIOUS PROTECTED PROGRAMS
|
|||
|
|
|
|||
|
|
FILE FINAL
|
|||
|
|
PRODUCT VERSION NAME EXT SIZE: BX= CX= CONTRIBUTOR
|
|||
|
|
------------------------------------------------------------------------
|
|||
|
|
|
|||
|
|
dBase III 1.10 DBASE EXE BX = 1 CX = AC00 The Lone Victor 4/15/85
|
|||
|
|
Framework 1.10 FW EXE BX = 2 CX = F400 Q-1367
|
|||
|
|
(I question this next file size - L.V.)
|
|||
|
|
WordStar 1.00 WS2000 EXE BX = 1 CX = AC00 Gerald Lee
|
|||
|
|
Double DOS ? DOUBLEDO EXE BX = ? CX = ? Big Al & Coffee Man
|
|||
|
|
Spot Light ? SL EXE BX = 0 CX = 6700
|
|||
|
|
Golden Common Lisp GCLISP EXE BX = 2 CX = 3E00 MIT CRACKER
|
|||
|
|
|
|||
|
|
|
|||
|
|
The following instructions show you how to bypass the SoftGuard copy
|
|||
|
|
protection scheme using GCLISP as an example. To use it
|
|||
|
|
with other products, simply substitute the values in the table above for
|
|||
|
|
the values given below. The only things that change are the file name,
|
|||
|
|
and the size that goes in the BX:CX register pair.
|
|||
|
|
|
|||
|
|
First, using your valid, original GCLISP diskette, install it on
|
|||
|
|
a fixed disk. You cannot use this text to unprotect the floppy directly!
|
|||
|
|
Softguard hides three files in your fixed disk root directory: CML0200.HCL,
|
|||
|
|
VDF0200.VDW, and GCLISP.EXE. It also copies GCLISP.COM into your chosen GCLISP
|
|||
|
|
directory. GCLISP.EXE is the real GCLISP program, encrypted. (This file
|
|||
|
|
might also be named GCLISP.LOD, but is the same thing.)
|
|||
|
|
|
|||
|
|
Second, un-hide the three files in the root directory. You can do
|
|||
|
|
this with the programs ALTER.COM or FM.COM found on any BBS.
|
|||
|
|
|
|||
|
|
Make copies of the three files, and of GCLISP.COM, into some other
|
|||
|
|
directory.
|
|||
|
|
|
|||
|
|
Hide the three root files again using ALTER or FM.
|
|||
|
|
|
|||
|
|
Following the GCLISP instructions, UNINSTALL GCLISP . You can now
|
|||
|
|
put away your original GCLISP diskette. We are done with it.
|
|||
|
|
|
|||
|
|
Next we will make some patches to CML0200.HCL to allow us to trace
|
|||
|
|
through the code in DEBUG. These patches will keep it from killing our
|
|||
|
|
interrupt vectors.
|
|||
|
|
|
|||
|
|
debug cml0200.hcl
|
|||
|
|
e 3F9 <CR> 2A.4A <CR> ; change the 2A to 4A
|
|||
|
|
e 49D <CR> F6.16 <CR> ; if any of these numbers don't show up
|
|||
|
|
e 506 <CR> E9.09 <CR> ; it's not working.
|
|||
|
|
e A79 <CR> 00.20 <CR> ;
|
|||
|
|
e AE9 <CR> 00.20 <CR> ;
|
|||
|
|
e 73C 97 FA FA F4 F1 7E <CR> ; this is an encrypted call to 0:300
|
|||
|
|
w ; write out the new CML file
|
|||
|
|
q ; quit debug
|
|||
|
|
|
|||
|
|
|
|||
|
|
Now copy your four saved files back into the root directory and
|
|||
|
|
hide the CML0200.HCL, VDF0200.VDW, and GCLISP.EXE files using ALTER or FM.
|
|||
|
|
|
|||
|
|
We can now run GCLISP.COM using DEBUG, trace just up to the point
|
|||
|
|
where it has decrypted GCLISP.EXE, then write that file out.
|
|||
|
|
|
|||
|
|
**** USE THE FILE NAME LISTED IN THE TABLE ABOVE ****
|
|||
|
|
**** E.G. USE FW.COM INSTEAD OF GCLISP.COM FOR FRAMEWORK ****
|
|||
|
|
|
|||
|
|
debug GCLISP.com ; name of file that runs the product
|
|||
|
|
r <CR> ; dump debug's registers
|
|||
|
|
|
|||
|
|
**** WRITE DOWN THE VALUE OF DS FOR USE BELOW. ****
|
|||
|
|
**** THIS VALUE IS DEPENDENT ON YOUR PARTICULAR MACHINE. ****
|
|||
|
|
|
|||
|
|
a 0:300 <CR> ; we must assemble some code here
|
|||
|
|
pop ax
|
|||
|
|
cs:
|
|||
|
|
mov [320],ax ; save return address
|
|||
|
|
pop ax
|
|||
|
|
cs:
|
|||
|
|
mov [322],ax
|
|||
|
|
push es ; set up stack the way we need it
|
|||
|
|
mov ax,20
|
|||
|
|
mov es,ax
|
|||
|
|
mov ax,0
|
|||
|
|
cs:
|
|||
|
|
jmp far ptr [320] ; jump to our return address
|
|||
|
|
<CR>
|
|||
|
|
g 406 ; now we can trace CML
|
|||
|
|
t
|
|||
|
|
g 177 ; this stuff just traces past some
|
|||
|
|
g 1E9 ; encryption routines.
|
|||
|
|
t
|
|||
|
|
g 54E ; wait while reading VDF & FAT
|
|||
|
|
g=559 569
|
|||
|
|
g=571 857 ; GCLISP.EXE has been decrypted
|
|||
|
|
|
|||
|
|
**** USE THE FILE SIZE LISTED IN THE TABLE ABOVE ****
|
|||
|
|
**** THE VALUES HERE ARE FOR GCLISP ONLY ****
|
|||
|
|
|
|||
|
|
rBX <CR>
|
|||
|
|
:2 ; set BX to 1 for GCLISP
|
|||
|
|
rCX <CR>
|
|||
|
|
:3E00 ; set CX to AC00 for GCLISP
|
|||
|
|
|
|||
|
|
**** USE THE FILE NAME LISTED IN THE TABLE ABOVE ****
|
|||
|
|
|
|||
|
|
nGCLISP.bin ; name of file to write to
|
|||
|
|
w XXXX:100 ; where XXXX is the value of DS that
|
|||
|
|
; you wrote down at the begining.
|
|||
|
|
q ; quit debug
|
|||
|
|
|
|||
|
|
Last, unhide and delete the three root files CML0200.HCL, VDF0200.VDW,
|
|||
|
|
and GCLISP.EXE. Delete GCLISP.COM and rename GCLISP.BIN to GCLISP.EXE. This is
|
|||
|
|
the real GCLISP program without any SoftGuard code or encryption. It
|
|||
|
|
requires only the INIT.LSP file to run. Every protected program I have seen
|
|||
|
|
has the .EXE extention, but it is possible to use Softguard to encrypt .COM
|
|||
|
|
files too. See the table above for the proper extention to put on the de-
|
|||
|
|
crypted file.
|
|||
|
|
|