174 lines
9.8 KiB
Erlang
174 lines
9.8 KiB
Erlang
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
|
||
>> <<
|
||
>> AN INTRODUCTION TO CRACKING <<
|
||
>> <<
|
||
>> A treatise for the neophytes in the Apple world, <<
|
||
>> who are full of questions with no one to answer <<
|
||
>> them. <<
|
||
>> <<
|
||
>> by The Necromancer <<
|
||
>> <<
|
||
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
|
||
|
||
|
||
Greetings to all, and welcome to the wonderful world of Apple software
|
||
unprotection! Those of you who are long-established hackers and crackers, you
|
||
will probably not find a lot herein to spark your interest (although you can
|
||
never be sure) -- this is especially for those new to the field.
|
||
|
||
This does not necessarily mean that you don't know how to program -- there are
|
||
many people who are experienced programmers, but have never really gotten into
|
||
the unprotection racket. In fact, knowing how to program is necessary if you're
|
||
going to get very far in cracking software. There is no help for it, since the
|
||
whole point is undoing something that someone else did!
|
||
|
||
There are a few 'tools of the trade' which, although not absolutely necessary,
|
||
will make your life a whole lot easier if you have them around. These tools
|
||
include as one of the most helpful items a monitor ROM. Like I said, it is not
|
||
*absolutely* necessary, for basic cracking. But if you're going to get a whole
|
||
lot done, it will become needed. In order to have a monitor ROM, however, you
|
||
do *not* have to own an Apple II. Those of you with an Apple II+ or Apple //e
|
||
can come by one in several ways.
|
||
|
||
The first of these is putting a monitor ROM image in a language card, and
|
||
write-protecting the language card. This is a somewhat involved hardware
|
||
modification that I will not go into here, but instructions for it can be found
|
||
in numerous places.
|
||
|
||
Another way to get a monitor ROM is by simply buying one and installing it on
|
||
your motherboard in place of your old Autostart ROM. Or, a similar
|
||
modification, you can put it on your language card. Some of you may not know
|
||
that your language card contains an Autostart ROM image, which actually takes
|
||
precedence over the ROM on the motherboard. However, you can easily construct a
|
||
switch, which will allow you to choose between your motherboard ROM and your
|
||
language card ROM. Thus, you can put a monitor ROM on your language card and an
|
||
Autostart ROM on your motherboard, and switch between them as you like. This is
|
||
very handy indeed, since you can have either one you want, whenever you want,
|
||
simply by flicking a switch. The uses of a monitor ROM will be discussed later
|
||
on.
|
||
|
||
In any case, the other handy items are all software. The most important of
|
||
these is a disk Zap program, some utility for editing a disk sector-by-sector.
|
||
The best one of these that I have come across is Zap, from Bag of Tricks.
|
||
|
||
The other useful utilities are a variety of cracking utilities, from the
|
||
various Muffin-type programs to other disk-viewing programs. The Muffins are
|
||
for copying programs from protected disks to normal disks, and the disk viewers
|
||
are for deciphering what on Earth these people have done to their disks.
|
||
|
||
Now then, down to business. What good is a monitor ROM, some of you may be
|
||
asking? Well, you should know that when you press reset on an Apple with an
|
||
Autostart ROM, you are at the mercy of a few memory locations in page 3 of
|
||
memory. These locations are $3F2-$3F4 (we are going to stick with hexadecimal
|
||
numbers here -- get used to them, you'll be seein3fqof them!). $3F2 and $3F3
|
||
contain the address (lo-byte, hi-byte) to jump to when reset is pressed, and
|
||
$3F4 contains the exclusive-or of the value in $3F3 with an $A5. This third
|
||
byte is used by the Apple for checking whether it has just been turned on. If
|
||
this byte does not contain the XOR of $3F3 with an $A5, when you press reset the
|
||
monitor will perform a cold start. This is how you can make the machine reboot
|
||
on a reset, by the way -- simply poke a value like zero into either $3F3 or
|
||
$3F4.
|
||
|
||
Anyway, what does all this have to do with a monitor ROM? Well, this
|
||
dependency of the Autostart ROM makes it easy on software protectors. All they
|
||
have to do is tell the Apple where to go when the reset key is pressed. With a
|
||
monitor ROM, you will always go to the same place -- the monitor -- when the
|
||
reset key is pressed. This means that you are free to go on in and wade about
|
||
in their code, to decipher what they're doing.
|
||
|
||
By the way, for reference's sake, there is another location which is handy to
|
||
know about, which is the Applesoft run flag at $D6. If this is set, any command
|
||
given to the DOS parser will cause the program in memory to be run. This is a
|
||
common location to set, so if you are attempting to crack a basic program, it is
|
||
likely to be set. To defeat it, simply set it to any value less than 128.
|
||
|
||
With a monitor ROM, some programs become a cinch to crack. Basically, any
|
||
single-loading program (usually games) can almost always be cracked simply by
|
||
pressing reset and rebooting onto another disk. Some notes, however...
|
||
|
||
Before you can do anything with it, you have to know how it runs. Say you've
|
||
got Program X, and you've pressed reset into the monitor. It is a
|
||
single-loading game, so all of it is in memory there somewhere. Where does it
|
||
start? Good question.
|
||
|
||
A frequent place is at $800, or sometimes $7FD, three bytes before $800. Try
|
||
an 800G in the monitor. If it starts up, great! If not, time to look again.
|
||
Try the various page boundaries, particularly $2000, $4000, $6000, etc. Check
|
||
the hires pages with a C050 <c/r>, C057 <c/r> to see the first hi-res page. If
|
||
it has a title picture, the program isn't there. Try C055 <c/r> to see page 2
|
||
of hi-res. If there is a picture on page one and not on page two, $4000 is a
|
||
very possible starting location.
|
||
|
||
There are hints for finding the starting location of a program. Look for a
|
||
sequence that will turn on the hi-res pages for display -- look for addresses
|
||
like $C050, $C055, $C052, the graphics soft switches. Look for a keyboard read
|
||
-- games will often show a title picture and wait for a keypress, reading the
|
||
strobe at $C000. If none of these turns up an9thing, then it may be necessary
|
||
to try some likely places at random -- it can turn up useful information
|
||
sometimes, although it's not exactly recommended practice. Look for
|
||
initialization routines, or jump tables.
|
||
|
||
If all of this fails, then perhaps the protectors have tried some sneakier
|
||
tricks, which will be gone into in later columns.
|
||
|
||
Once you have found the starting location, then what? Then it's time to
|
||
transfer the program to your own disk. Remember one of the prime rules of
|
||
cracking -- when working, always have one or two blank, initialized disks handy,
|
||
with a normal slave DOS on them.
|
||
|
||
Let's say you have found the starting location to Program X -- what to do?
|
||
Well, let's look at memory for a moment. Free memory starts, basically, at
|
||
$800, above the text page (it is possible to use this area, but that's a subject
|
||
for later), and goes until $9600, on a normal disk.
|
||
|
||
However, it is more than likely that this disk you're cracking has no DOS.
|
||
That upper limit of $9600 is for a disk with normal DOS. Assuming this program
|
||
is a single-loading game, it undoubtedly has no DOS. Thus, this program is free
|
||
to go until $BFFF, really.
|
||
|
||
But if you boot your slave disk now, it will wipe out memory from $800 to
|
||
$900, and $9600-$BFFF. Therefore, we must split Program X into smaller pieces.
|
||
The first piece is from $800-$4000. To put it onto your disk, first move it up
|
||
to protect it from your booting. Move it up to $4000 with a *4000<800.3FFFM.
|
||
This moves everything from 800 to 3FFF to 4000 up. Then do a 6<control-P> to
|
||
reboot.
|
||
|
||
Now save segment one of the program to disk, after moving it down:
|
||
|
||
CALL -151
|
||
800<4000.7800M
|
||
BSAVE PROGRAM X (800-3FFF),A$800,L$3800
|
||
|
||
And you have a good part of the program. Now reboot the Program X disk, and
|
||
press reset again. Now to save the rest. We are going to assume that Program X
|
||
only goes up to $9600, to make life easy for now. So just reboot4again, and
|
||
save part two of Program X with a BSAVE PROGRAM X (4000-9600),A$4000,L$5600.
|
||
|
||
At this point, test your Program X by BLOADing the two pieces and running it.
|
||
If it still works, you're in business. If not, the likelihood is that the
|
||
program requires some other pieces of memory. Either the piece it needs is
|
||
below $800, or above $9600, obviously. Try checking the code near the entry
|
||
point, and see if you can find any clues to what locations it might access. In
|
||
either case, though, it becomes more complicated, since you can't just BRUN
|
||
something that requires memory below $400 or above $9600. If it does not use
|
||
memory much above $9600, note that you can save over 1K with a maxfiles command,
|
||
since from $9600 to $9D00 are the DOS buffers.
|
||
|
||
Assuming the program works, you just have the chore of cutting down the size
|
||
by figuring out what is really necessary of what you just saved. Once you have
|
||
done that, you can just save the whole thing into a single file, give yourself
|
||
credit, and give the program to everyone you know.
|
||
|
||
One more item: if the program becomes greater than $7FFF in length, DOS will
|
||
not let you save it in one file. Change location A964 in DOS to $FF and you
|
||
won't have any problems (why this restriction is there, *I* don't know!).
|
||
|
||
Next time I will get into DOS and what modifications there are to help in
|
||
cracking........
|
||
|
||
May your cracks be forever successful!
|
||
|
||
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>The Necromancer<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
|
||
>> <<
|
||
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>The Cracker's Guild<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
|
||
|