56 lines
2.7 KiB
Plaintext
56 lines
2.7 KiB
Plaintext
|
The copy-protection scheme used in ULTIMA II is also used by
|
|||
|
|
PROKEY 3.0 and several other programs. The approach I outline
|
|||
|
|
here works with any of these that are in COM file format. If
|
|||
|
|
anyone can improve it to work for EXE files PLEASE post it.
|
|||
|
|
This general copy scheme uses a short sector of 256 bytes to
|
|||
|
|
store an essential piece of the program code. On startup, location
|
|||
|
|
100H contains a JMP instruction to the code which reads this
|
|||
|
|
short sector. Locations 103H - 110H contain HLT instructions (hex F4).
|
|||
|
|
After the sector is read, its contents are overlayed onto locations
|
|||
|
|
100H - 110H, replacing the dummy instruction codes. A branch to 100H
|
|||
|
|
then begins the actual program.
|
|||
|
|
All we need to do is to stop execution after the changes are
|
|||
|
|
made and write down the contents of 100H - 110H; reloading the
|
|||
|
|
program and POKEing these changes results in an unprotected program.
|
|||
|
|
Here's how its done:
|
|||
|
|
(1) Put PROTECTED disk in A: (you can write-protect it for safety)
|
|||
|
|
and a disk containing DEBUG in B:
|
|||
|
|
(2) A: Make A: the default.
|
|||
|
|
(3) B:DEBUG ULTIMAII.COM (or PKLOAD.COM, LAYOUT.COM...)
|
|||
|
|
(4) -u 0100 Tell DEBUG to disassemble 0100-0120
|
|||
|
|
DEBUG responds with:
|
|||
|
|
0100 JMP 88A0 (or whatever)
|
|||
|
|
0103 HLT
|
|||
|
|
0104 HLT ...etc.
|
|||
|
|
(5) -u 88A0 Look at short-sector decrypting code.
|
|||
|
|
DEBUG responds with:
|
|||
|
|
88A0 JMPS 88A7 Next "statements" are data locations; ignore.
|
|||
|
|
(6) -u 88A7 Now look for where program restarts at 100H.
|
|||
|
|
DEBUG responds with:
|
|||
|
|
88A7 CALL 88C4
|
|||
|
|
88AA CALL 892E
|
|||
|
|
88AD JC 88BF (If Carry is set, the disk is a copy. Go to DOS!)
|
|||
|
|
...
|
|||
|
|
88BA MOV AX,0100
|
|||
|
|
88BD JMP AX Paydirt! If you got this far, the program has
|
|||
|
|
... written the REAL code into 0100 - 0120H.
|
|||
|
|
(7) -g 88BD Tell DEBUG to run the program, stop here.
|
|||
|
|
(8) -d 0100 011F Dump out the changed code.
|
|||
|
|
DEBUG responds with:
|
|||
|
|
8C C8 05 25 07 8E D8 05-10 03 8E D0... Two lines. WRITE DOWN for (12)
|
|||
|
|
(9) -q Get out of DEBUG. You must reload to deprotect.
|
|||
|
|
(10) Make a copy of the disk; you can use copy *.* Put copy in A:
|
|||
|
|
(11) B:DEBUG ULTIMAII.COM load copy
|
|||
|
|
(12) -e 0100 Patch locations 0100 - 011F with what you
|
|||
|
|
wrote down above. Follow each entry with
|
|||
|
|
a SPACE until last entry; then hit ENTER.
|
|||
|
|
(13) -w Write out new version of ULTIMAII.COM
|
|||
|
|
(14) -q You've done it!
|
|||
|
|
|
|||
|
|
I've been detailed because this works generally for any COM file.
|
|||
|
|
This method doesn't work for EXE files because while DEBUG can load
|
|||
|
|
relocatable modules and execute them with breakpoints (step 7 above),
|
|||
|
|
you cannot use debug to write an EXE file in relocatable form.
|
|||
|
|
Any suggestions?
|
|||
|
|
L.Brenkus
|
|||
|
|
|