131 lines
5.1 KiB
Plaintext
131 lines
5.1 KiB
Plaintext
FRMWRK2.UNP Breaking Framework II's Softguard 2.03 Protection
|
||
by The Lone Victor
|
||
|
||
Adapted to Framework II by
|
||
George V. Hartmann / David Jelen
|
||
|
||
United States copyright law SPECIFICALLY grants you the right to
|
||
make copies of programs you buy on magnetic media. Programs are copy
|
||
protected IN VIOLATION OF YOUR RIGHTS UNDER U.S. LAW.
|
||
|
||
Programs that are protected by the Softguard system are distinguished
|
||
by the files CML0203.HCL and VDF0203.VDW which are hidden in the root
|
||
directory when you install the program on your fixed disk. The 0203
|
||
part of the file names is the Softguard version (2.03) while CML stands
|
||
for Common Loader and VDF is the Volume Descriptor File. The extensions
|
||
HCL and VDW stand for Hard-disk Common Loader and Verify Descriptor Working
|
||
copy. In addition, there will be a hidden root file with a .EXE or .LOD
|
||
or some other extension. This is the REAL program, which has been
|
||
encrypted and hidden.
|
||
|
||
The program FW.COM, in the product directory is the Softguard
|
||
miniloader. All it does is call the Common Loader. For example, when you
|
||
run FW, the program FW.COM loads CML0203.HCL high in memory and
|
||
runs it. CML decrypts itself and reads VDF0203.VDW. The VDF file contains
|
||
some code and data from the fixed disk FAT at the time of installation. By
|
||
comparing the information in the VDF file with the current FAT, CML can
|
||
tell if the CML, VDF, and FW.A26 files are in the same place on the disk
|
||
where they were installed. If they have moved, say from a backup &
|
||
restore,then CLIPPER will not run.
|
||
|
||
This text file is designed to let you unprotect the most current
|
||
version of Framework, Framework II, which is protected by a variation of
|
||
Softguard 2.03. (not 2.03A)
|
||
|
||
-- INSTRUCTIONS --
|
||
|
||
First, using your valid, original FRAMEWORK diskette, install it on a
|
||
fixed disk. You cannot use this text to unprotect the floppy directly!
|
||
Softguard hides three files in your fixed disk root directory: CML0203.HCL,
|
||
VDF0203.VDW, and FW.A26. It also copies FW.COM into your chosen
|
||
FRAMEWORK directory. FW.A26 is the real FRAMEWORK program, encrypted. The
|
||
extension of this file does not matter. It is really an encrypted .EXE
|
||
file.
|
||
|
||
Second, un-hide the three files in the root directory. You can do
|
||
this with the programs ALTER.COM or FM.COM found on any BBS.
|
||
|
||
Make copies of the three files, and of FW.COM, into some other
|
||
directory.
|
||
|
||
Hide the three root files again using ALTER or FM.
|
||
|
||
Following the FRAMEWORK instructions, UNINSTALL FRAMEWORK. You can
|
||
now put away your original FRAMEWORK diskette. We are done with it.
|
||
|
||
Now copy your four saved files back into the root directory and hide
|
||
the CML0203.HCL, VDF0203.VDW, and FW.A26 files using ALTER or FM.
|
||
|
||
We can now run FW.COM using DEBUG, trace just up to the point where it
|
||
has decrypted FW.EXE, then write that file out.
|
||
|
||
LET 'ER RIP!
|
||
|
||
Instructions Comments
|
||
|
||
|
||
debug CLIPPER.com ; name of file that runs the product
|
||
r <CR> ; dump debug's registers
|
||
|
||
**** WRITE DOWN THE VALUE OF DS FOR USE BELOW. ****
|
||
**** THIS VALUE IS DEPENDENT ON YOUR PARTICULAR MACHINE. ****
|
||
|
||
g 4D7 ; now we can trace CML
|
||
t
|
||
g 1B5
|
||
t
|
||
e cs:A2
|
||
74.EB ; debug reports the 74 here, you enter EB
|
||
e cs:127 ;
|
||
E8.90 ; you enter the 90's followed by a space, and
|
||
D1.90 05.90 <CR> ; a carriage retirn after the 3rd 90 (no space).
|
||
g 127
|
||
a 185
|
||
jmp 1C5
|
||
<CR> ; this second CR gets you out of the assembler
|
||
a 22B
|
||
jmp 265
|
||
<CR>
|
||
a 41F
|
||
mov ax,22
|
||
<CR>
|
||
e cs:42F
|
||
01.89 ; debug reports the 01, you enter 89
|
||
a 4CE
|
||
mov bl,7A
|
||
<CR>
|
||
g 4DF
|
||
g 281
|
||
t
|
||
g 24D
|
||
t
|
||
g 5A6 ; wait while reading VDF & FAT
|
||
g=5B1 5C1
|
||
g=5C9 9DA ; FW.EXE has been decrypted
|
||
|
||
d cs:1E7 L8 ; just for grins, here's the password
|
||
|
||
rBX <CR>
|
||
:3 ; set BX to 3
|
||
rCX <CR>
|
||
:7600 ; set CX to 7600
|
||
|
||
n fw.bin ; name of file to write to
|
||
w XXXX:100 ; where XXXX is the value of DS that
|
||
; you wrote down at the beginning.
|
||
q ; quit debug
|
||
|
||
REN FW.BIN FW.EXE
|
||
|
||
Now unhide and delete the files FW.A26, VDF0203.VDW and CML0203.HCL.
|
||
FW.COM should also be deleted from the root directory and the product
|
||
directory. Copy FW.EXE from the root directory to the product directory
|
||
and you are done. (And so is Ashton-Tate)
|
||
|
||
NOTE: The Lone Victor is the author of this method to unprotect
|
||
Softguard protected products, and deserves all the credit. I adapted his
|
||
method to Framework II and "cleaned-up" a "chain-letter" unprotection file
|
||
that some novices would have had trouble fathoming. Robert White and Steve
|
||
Diamond had nothing to do with this. GVH
|
||
|
||
|