596 lines
29 KiB
Plaintext
596 lines
29 KiB
Plaintext
|
|
|
|
|
|
[0] Tfiles: (1-3,?,Q) : 3
|
|
|
|
|
|
THE OFFICIAL UNPROTECTION SCHEME LIBRARY
|
|
|
|
original document created and compiled by "The PaperBoy"
|
|
and the CopyCats, Inc.
|
|
01-21-89, 01-26-89, 01-30-89, 02-04-89, 02-06-89
|
|
-----------------------------------------------------------------------------
|
|
The following protection removal schemes took many valuable hours of time to
|
|
create. This file contains the procedures for many of the latest software
|
|
packages out today. (This document is updated at every new unprotection
|
|
scheme or schemes we find.) Please be patient if your program can't be
|
|
cracked yet. It will be, pretty soon, we hope.
|
|
|
|
! Please note that these patches are for personal use only !
|
|
|
|
We are THE COPYCATS INCORPORATED:
|
|
|
|
Seymore Warez Unprotected (President)
|
|
The PaperBoy, MasterByte, The Gigolo, The Ninjutsu, SlimeMan, Shimba,
|
|
Grand Central Station, Didley Bop, Dr. Disk, The No Cause People In Florida
|
|
|
|
** Just cracking software, byte by byte. **
|
|
Come on... Ain't Got All Day!!
|
|
Use these software unprotection schemes at own risk! (Try with a BACKUP!)
|
|
-----------------------------------------------------------------------------
|
|
These programs have unprotection patches or fixes in this document: 29
|
|
|
|
Accolade: 4th & Inches, Test Drive, Fast Break, Grand Prix Circuit,
|
|
Apollo 18
|
|
Activision: The Last Ninja+fix, Rampage
|
|
Sierra: Leisure Suit Larry II, King's Quest IV, Manhunter: NYork
|
|
Police Quest II, Gold Rush!
|
|
MindScape: Willow, Bop'n Wrestle, Infiltrator, Defender of the Crown,
|
|
Perfect College
|
|
Epyx: The Games: Summer E, TechnoCop/fix, California Games, The
|
|
Games: Winter E.
|
|
Simon&Schuster: Star Trek: The Kobayashi Alternative
|
|
DataSoft: Bruce Lee/fix
|
|
Electronic Arts: Advanced Flight Trainer 1.2
|
|
Spectrum Holobyte: Gato: WW2 Submarine Simulator
|
|
Broderbund: The Print Shop, Ancient Art of War
|
|
Cignet Tech: Little Black Book
|
|
PowerUp!: most software
|
|
Infocom: BattleTech!
|
|
misc: Trivia Fever
|
|
|
|
Come on... Ain't Got All Day!! /fix=fix only, no unprotection patch +fix=fix and unprotection patch
|
|
-----------------------------------------------------------------------------
|
|
A NOTE ON COPY PROTECTION
|
|
|
|
At the CopyCats, we would like to make a statement on copy protection. We see
|
|
this concept as unnecessary. Crude disk checking and trudging through the
|
|
manuals for "key words," make it very difficult for many of the novice users,
|
|
as well as the experienced computer users. Many of our "program hackers"
|
|
also feel they do not promote software piracy. They only help the people
|
|
who are against the protection schemes and use of software authorization
|
|
procedures. And, if it continues, WE will continue.
|
|
|
|
"S. W. Unprotected"
|
|
President of The CopyCats, Inc
|
|
-----------------------------------------------------------------------------
|
|
LAST MINUTE HACKER'S NOTES
|
|
|
|
The PaperBoy here. You may notice that many of these programs have similar
|
|
protection scheme instruction codes. If you have a program that has no
|
|
unprotection scheme here, apply it to the program and test it. That's how
|
|
we were able to pull most schemes down. Remember, this is for the experienced
|
|
user. Don't mess up your originals, either. And, use write-protect tabs for
|
|
the scheme checking - last time, it erased itself due to a backfire of
|
|
the BIOS interrupt 13hex. Smart program, but WE cracked it. CAREFUL!
|
|
Come on... Ain't Got All Day!! -----------------------------------------------------------------------------
|
|
THE UNPROTECTION SCHEMES!
|
|
-----------------------------------------------------------------------------
|
|
1. MOST MAJOR ACCOLADE SOFTWARE, The PaperBoy
|
|
|
|
To remove the protection schemes of 4TH & INCHES, TEST DRIVE, FAST BREAK**, &
|
|
other ACCOLADE SOFTWARE:
|
|
|
|
Search for these bytes: 55 56 57 06 1E (use Norton Utilities, DEBUG
|
|
And replace it with: 31 C0 C3 06 1E PC-Tools, or equivalent)
|
|
|
|
** If you wish to patch FAST BREAK, you must modify all main FB-?.EXE files
|
|
and the FB.RTL file.
|
|
-----------------------------------------------------------------------------
|
|
2. GRAND PRIX CIRCUIT BY ACCOLADE, Two Guys
|
|
|
|
The previous ACCOLADE unprotection scheme was incompatible with its later
|
|
released game, GRAND PRIX CIRCUIT. With an updated protection, you must:
|
|
|
|
Search for these bytes ------> And replace it with
|
|
1. BE 06 00 E8 13 00 EB 16 00 EB 13 00
|
|
2. F6 C4 10 75 0B EB 0E 10 75 0B
|
|
3. 72 5F BB 90 90 BB
|
|
4. 75 47 BE 90 90 BE
|
|
Come on... Ain't Got All Day!! 5. B8 09 02 EB 0A 02
|
|
6. 75 03 E8 03 EB 03 E8 03 (GPEGA.EXE only!)
|
|
-----------------------------------------------------------------------------
|
|
3. LEISURE SUIT LARRY II BY SIERRA, Pirates-R-Us
|
|
|
|
LEISURE SUIT LARRY GOES LOOKING FOR LOVE IN SEVERAL WRONG PLACES by Sierra
|
|
On-Line has a seriously annoying protection scheme. The player must trudge
|
|
through the manual to look for girl's phone number in order to enter the
|
|
game. This patch force the program to accept any input at the prompt in the
|
|
initialization of the program.
|
|
|
|
1. Rename SIERRA.EXE to SIERRA.XXX
|
|
2. Enter DEBUG and enter the following lines.
|
|
|
|
E 0394 F6
|
|
E 4210 52 5C
|
|
E 9E1D B8 08 35 CD 21 89 1E FC 12 8C 06 FE 12 B8 24 35
|
|
E 9E2D CD 21 89 1E 00 13 8C 06 02 13 B8 24 35 CD 21 89
|
|
E 9E3D 1E 04 13 8C 06 06 13 07 1E 0E 1F BA 6B 9C B8 23
|
|
E 9E4D 25 CD 21 BA 6C 9C B8 24 35 CD 21 1F E8 5A 00 C7
|
|
E 9E5D 06 FA 12 01 00 C3 90 57 51 B9 0F 00 BF 86 BA C6
|
|
E 9E6D 05 00 83 C7 09 E2 F8 59 5F 2E C7 06 10 3F 0E 01
|
|
E 9E7D E9 8F A3 90 90 90 90 90 90 90 90 90 90 98 90 83
|
|
E 9E8D 3E FA 12 00 75 01 C3 1E 07
|
|
Come on... Ain't Got All Day!! E F676 8E D8 B1 03
|
|
W
|
|
Q
|
|
|
|
3. Rename SIERRA.XXX back to SIERRA.EXE
|
|
-----------------------------------------------------------------------------
|
|
4. STAR TREK: THE KOBAYASHI ALTERNATIVE BY SIMON & SCHUSTER, Dr. Disk
|
|
|
|
This simple protection scheme can be bypassed with Central Point Software's
|
|
NOKEY (distributed with COPY II-PC), or you can use the removal scheme below.
|
|
|
|
Search through ST.EXE for CD 13 and replace it with 90 90.
|
|
|
|
You can use this patch with most software that you use with NOKEY to bypass
|
|
its protection scheme.
|
|
-----------------------------------------------------------------------------
|
|
5. RAMPAGE AND THE LAST NINJA BY ACTIVISION, INC., The Ninjutsu
|
|
|
|
The above unprotection scheme can be used on these two ACTIVISION programs.
|
|
Search the main EXE files for CD 13 and replace it with 90 90.
|
|
-----------------------------------------------------------------------------
|
|
6. MANHUNTER: NEW YORK BY SIERRA, Bart Montgomery
|
|
|
|
Search the file MHVOL.1 for these bytes: 41 06 7A
|
|
Come on... Ain't Got All Day!! and replace them with these bytes: 7F C3 00
|
|
-----------------------------------------------------------------------------
|
|
7. FIX FOR BRUCE LEE BY DATASOFT, The PaperBoy (FOR DISK VERSION ONLY)
|
|
|
|
First, Bruce Lee is an excellent product. It's just that (aaarrrggghhh)
|
|
you have no `falls' left, and you feel yourself quite near the finish of the
|
|
game. Suddenly, one of those little dots floating on floor taps your foot and
|
|
you get zapped. You see the sign "Game Over" and you feel pretty pissed, and
|
|
wish you could open the drive and rip the disk to shreds, but that would be
|
|
a waste. So, fix it! One thing you could do is play option C, one player vs.
|
|
your opponent played by the other player. But this time, play alone, and make
|
|
sure the second joystick is calibrated wrong. If the computer sees that the
|
|
Yamo isn't moving, it will take over, so a wrong calibration will make it
|
|
move always. So, you're playing, but that stupid ninja is in your way and it
|
|
won't let you win. Alternative? Eliminate him. And this is how you do it.
|
|
Get a disk utility, preferably Norton Utilities. Zap the Bruce Lee disk,
|
|
with the following information.
|
|
|
|
Sector 271 Sector 271
|
|
Offset 139 and Offset 354
|
|
Change 09(hex) to 63(hex) Change 09(hex) to 63(hex)
|
|
|
|
That's all there is to it. Now you play, the Green Yamo flying around
|
|
crazily, and the ninja... hmm... the ninja seems to appear for a quick second
|
|
Come on... Ain't Got All Day!! then disappear. Now, he's never gonna touch you!
|
|
-----------------------------------------------------------------------------
|
|
8. GATO: WORLD WAR 2-CLASS SUBMARINE SIMULATOR BY SPECTRUM HOLOBYTE, SlimeMan
|
|
|
|
To unprotect GATO, use the following table below.
|
|
|
|
Sector Offset Contents Change To
|
|
|
|
53 0E 72 11 90 90
|
|
53 13 72 0C 90 90
|
|
53 53 72 EB
|
|
53 65 75 EB
|
|
-----------------------------------------------------------------------------
|
|
9. TRIVIA FEVER, Grand Central Station
|
|
|
|
To unprotect TRIVIA FEVER, follow the steps below.
|
|
|
|
1. Rename TF.EXE to TF.XXX
|
|
2. Enter DEBUG and type in the lines below.
|
|
-E 257E <ENTER>
|
|
-75.90 03.90 <ENTER>
|
|
-W <ENTER>
|
|
-Q <ENTER>
|
|
3. Rename TF.XXX back to TF.EXE
|
|
Come on... Ain't Got All Day!! -----------------------------------------------------------------------------
|
|
10. THE GAMES: SUMMER EDITION BY EPYX, Dr. Disk
|
|
|
|
To unprotect THE GAMES, use the following patch below.
|
|
|
|
Search for these bytes: E8 87 00 59 C6
|
|
And replace it with: 59 59 5F EB 55
|
|
-----------------------------------------------------------------------------
|
|
11. LITTLE BLACK BOOK BY CIGNET TECHNOLOGIES, The Gigolo
|
|
|
|
To unprotect your LITTLE BLACK BOOK, search the file BOOK.EXE and patch:
|
|
|
|
Search for these bytes: ----> and replace it with these bytes:
|
|
3D 00 00 74 07 C6 06 03 01 B8 00 00 74 07 C6 06 03 00
|
|
CD 13 B8 01 02 CD 13 72 0E 90 90 90 90 90 90 90 EB 0E
|
|
EB F5 F6 C4 06 75 06 EB F5 F6 C4 06 EB 06
|
|
|
|
Now, search in the file LBB.EXE and patch:
|
|
|
|
Search for these bytes: ----> and replace it with these bytes:
|
|
3D 00 00 74 07 C6 06 76 04 01 B8 00 00 74 07 C6 06 76 04 00
|
|
CD 13 B8 01 02 CD 13 72 0E 90 90 90 90 90 90 90 EB 0E
|
|
EB F5 F6 C4 06 75 06 EB F5 F6 C4 06 EB 06
|
|
-----------------------------------------------------------------------------
|
|
Come on... Ain't Got All Day!! 12. KING'S QUEST IV: THE PERILS OF ROSELLA BY SIERRA ON-LINE, Pirates-R-Us
|
|
|
|
To completely bypass the documentational protection on KING'S QUEST IV, use
|
|
the procedure below.
|
|
|
|
1. First, search your Quality Assurance file for the correct edition date.
|
|
It is found in the ????????.QA file.
|
|
2. If you do not have your version dated 09-19-88 nor 09-24-88, you cannot
|
|
proceed with this patch. Sorry!
|
|
3. Rename SIERRA.EXE to SIERRA.XXX.
|
|
4. Enter DEBUG and type the following lines below.
|
|
|
|
(if you have the 09-19-88 version, use this patch)
|
|
E 0394 82
|
|
E 0CB4 90 E8 38 98
|
|
E A4A9 B8 08 35 CD 21 89 1E 7E 12 8C 06 80 12 B8 24 35 CD 21 89 1E
|
|
E A4BD 82 12 8C 06 84 12 B8 24 35 CD 21 89 1E 86 12 8C 06 88 12 07
|
|
E A4D1 1E 0E 1F BA F7 A2 B8 24 35 CD 21 BA F8 A2 B8 24 35 CD 21 1F
|
|
E A4E5 E8 5A 00 C7 06 7C 12 01 00 C3 90 80 FB 98 75 16 C7 04 32 95
|
|
E A4F9 C6 44 02 00 2E C7 06 B4 09 FF 97 2E C7 06 B6 09 A0 01 FF A7
|
|
E A50D A0 01 90 90 90 90 90 90 90 90 90 83 3E 7C 12 00 75 01 C3 1E
|
|
E A521 07
|
|
W
|
|
Q
|
|
Come on... Ain't Got All Day!!
|
|
(if you have the 09-24-88 version, use this patch)
|
|
E 0394 74
|
|
E 0CB4 90 E8 2A 98
|
|
E A49B B8 08 35 CD 21 89 1E 5E 12 8C 06 60 12 B8 23 35 CD 21 89 1E
|
|
E A4AF 62 12 8C 06 64 12 B8 24 35 CD 21 89 1E 66 12 8C 06 68 12 07
|
|
E A4C3 1E 0E 1F BA E9 A2 B8 23 25 CD 21 BA EA A2 B8 24 25 CD 21 1F
|
|
E A4D7 E8 5A 00 C7 06 5C 12 01 00 C3 90 80 FB 98 75 16 C7 04 32 99
|
|
E A4EB C6 44 02 00 2E C7 06 B4 09 FF 97 2E C7 06 B6 09 0A 05 FF A7
|
|
E A4FF 0A 05 90 90 90 90 90 90 90 90 90 83 3E 5C 12 00 75 01 C3 1E
|
|
E A513 07
|
|
W
|
|
Q
|
|
|
|
5. Rename SIERRA.XXX back to SIERRA.EXE.
|
|
-----------------------------------------------------------------------------
|
|
13. CALIFORNIA GAMES BY EPYX, Jonathan Millhouse
|
|
|
|
To override the disk protection scheme in CALIFORNIA GAMES, enter Norton
|
|
Utilities or your favorite disk/file editor and open CALGAMES.EXE.
|
|
|
|
Search for these bytes: FA FC 55 56 57
|
|
And replace it with these bytes: 00 00 31 C0 C3
|
|
-----------------------------------------------------------------------------
|
|
Come on... Ain't Got All Day!! 14. CHUCK YEAGER'S ADVANCED FLIGHT TRAINER BY ELECTRONIC ARTS, Tony Elliott
|
|
|
|
(Version 1.2 only)
|
|
|
|
1. Rename AFT.EXE to AFT.XXX
|
|
2. Enter DEBUG with AFT.XXX open for editing.
|
|
3. At the DEBUG "-" prompt, type
|
|
|
|
U 0DBB <ENTER>
|
|
|
|
Several lines with be displayed on screen. You are interested in the first
|
|
two. They should look EXACTLY like this:
|
|
|
|
xxxx:0DBB E9A3A7 JMP B561
|
|
xxxx:0DBE C3 RET
|
|
|
|
The "xxxx" represents any four hexadecimal numbers. If you have a match,
|
|
on to the next step. If not, you probably have the wrong version. Sorry!
|
|
|
|
4. At the "-" prompt again, type
|
|
|
|
U 0E38 <RETURN>
|
|
|
|
Several lines of code will again be displayed on screen. Look at the first
|
|
Come on... Ain't Got All Day!! two following the "U 0E38" command. They should also match exactly with the
|
|
following:
|
|
|
|
xxxx:0E38 880E5005 MOV [0550],CL
|
|
xxxx:0Exx 8A0E4D05 MOV CL,[054d]
|
|
|
|
If you have a match here, then you should have a compatible version of the
|
|
AFS program. If not, sorry!
|
|
|
|
5. At the "-" prompt, type the following:
|
|
|
|
E 0DBB 90 90 90 <ENTER>
|
|
E 0E38 C3 90 90 90 <ENTER>
|
|
W <ENTER>
|
|
Q <ENTER>
|
|
|
|
You should now be back in DOS. Only one more step left.
|
|
|
|
6. Rename AFT.XXX back to AFT.EXE
|
|
|
|
That's it! You now have an unprotected copy of AFT.
|
|
-----------------------------------------------------------------------------
|
|
15. POWER-UP! SOFTWARE, The No Cause People in Florida
|
|
|
|
Come on... Ain't Got All Day!! To unprotect most programs from POWER-UP!, load the main EXE file with Norton
|
|
Utilities or such.
|
|
|
|
Search for the bytes: E8 48 FF
|
|
And replace it with: 90 90 90
|
|
-----------------------------------------------------------------------------
|
|
16. THE PRINT SHOP BY BR0DERBUND, Swamp Fox
|
|
|
|
The Print Shop employs two sections of code to copy protect itself. The first
|
|
is embedded in PS.EXE and is exercised when the program is run from a floppy.
|
|
The second is embedded in PSINIT.OVR and is employed when the program is run
|
|
from a hard or ram disk. Once activated, both seek out a specially formatted
|
|
track on the A: drive and terminate the program if not found.
|
|
|
|
Both sections of code will be un-hooked here so that the program will run
|
|
from either a floppy or a hard disk.
|
|
|
|
RENAME PS.EXE PS.ZAP Rename for DEBUG
|
|
|
|
DEBUG PS.ZAP Start DEBUG
|
|
|
|
S0 9000 CD 13 Search for Disk interrupt 13
|
|
|
|
XXXX:3AC6 You should find these two:
|
|
Come on... Ain't Got All Day!! XXXX:3ADF
|
|
|
|
U 3AC6 Unassemble code to make sure
|
|
you're in the right place :
|
|
|
|
XXXX:3AC6 INT 13 A test for any disk in A:
|
|
XXXX:3AC8 MOV BYTE PTR [0A91],02
|
|
XXXX:3ACD DEC BYTE PTR [0A91]
|
|
XXXX:3AD1 JZ 3AE6
|
|
XXXX:3AD3 MOV DH,00 \
|
|
XXXX:3AD5 MOV DL,00 | This sets up a look for the
|
|
XXXX:3AD7 MOV CH,09 | special track
|
|
XXXX:3AD9 MOV CL,0A |
|
|
XXXX:3ADB MOV AL,01 |
|
|
XXXX:3ADD MOV AH,04 |
|
|
XXXX:3ADF INT 13 /
|
|
XXXX:3AE1 CMP AH,00 If not there ... Loop then
|
|
XXXX:3AE4 JNZ 3ACD Zonk! Terminate Program...
|
|
|
|
|
|
A 3AC6 Get rid of 1 st diskette look
|
|
|
|
XXXX:3AC6 NOP Remove the INT 13
|
|
XXXX:3AC7 NOP
|
|
Come on... Ain't Got All Day!! XXXX:3AC8
|
|
|
|
A 3ADD Get rid of the real test:
|
|
|
|
XXXX:3ADD MOV AH,00 Give it what it wants in AH
|
|
XXXX:3ADF NOP Remove the INT 13
|
|
XXXX:3AE0 NOP
|
|
XXXX:3AE1
|
|
|
|
W Write out the changed code
|
|
|
|
Q Quit DEBUG
|
|
|
|
RENAME PS.ZAP PS.EXE Rename for running program
|
|
|
|
(The program will now run from floppy disks without further changes)
|
|
|
|
Now for the second portion of the copy protection :
|
|
|
|
DEBUG PSINIT.OVR Start DEBUG (using a copy !)
|
|
|
|
S0 2000 CD 13 Look for disk interrupt 13
|
|
|
|
XXXX:0479 You should find these three:
|
|
Come on... Ain't Got All Day!! XXXX:0492
|
|
XXXX:04BD
|
|
|
|
U 0479
|
|
|
|
XXXX:0479 INT 13 A test for any disk in A:
|
|
XXXX:047B MOV BYTE PTR [CD57],02
|
|
XXXX:0480 DEC BYTE PTR [CD57]
|
|
XXXX:0484 JZ 04DB
|
|
XXXX:0486 MOV CL,11 \
|
|
XXXX:0488 MOV AH,04 |
|
|
XXXX:048A MOV DH,00 |
|
|
XXXX:048C MOV CH,09 | This sets up a look for the
|
|
XXXX:048E MOV DL,00 | special track
|
|
XXXX:0490 MOV AL,01 |
|
|
XXXX:0492 INT 13 /
|
|
XXXX:0494 CMP AH,00 If not there ... Loop then
|
|
XXXX:0497 JNZ 0480 Zonk ! Terminate Program...
|
|
|
|
(Look familiar ?)
|
|
|
|
U 04BD
|
|
|
|
XXXX:04BD INT 13 This one's a read (same idea)
|
|
Come on... Ain't Got All Day!! XXXX:04BF CMP AH,00
|
|
XXXX:04C2 JNZ 04A5
|
|
XXXX:04C4 ADD BX,018B
|
|
XXXX:04C8 MOV CL,05
|
|
XXXX:04CA ES:
|
|
XXXX:04CB MOV AL,[BX]
|
|
XXXX:04CD CMP AL,41
|
|
XXXX:04CF JNZ 04DB
|
|
XXXX:04D1 INC BX
|
|
XXXX:04D2 DEC CL
|
|
XXXX:04D4 JNZ 04CA
|
|
XXXX:04D6 MOV AX,0000 This is the success exit !
|
|
XXXX:04D9 JMP 04DE
|
|
|
|
A 0479
|
|
|
|
XXXX:0479 NOP Remove INT 13
|
|
XXXX:047A NOP
|
|
XXXX:047B
|
|
|
|
A 0490
|
|
|
|
XXXX:0490 MOV AH,00 Give it what it wants in AH
|
|
XXXX:0492 NOP Remove INT 13
|
|
Come on... Ain't Got All Day!! XXXX:0493 NOP
|
|
XXXX:0494
|
|
|
|
A 04BD
|
|
|
|
XXXX:04BD JMP 04D6 Jump to success exit code
|
|
XXXX:04BF
|
|
|
|
W Write out the changed code
|
|
|
|
Q Quit DEBUG
|
|
|
|
|
|
The program may now be run from a hard disk or floppy as desired. The hard
|
|
disk set up will ask for the master diskette to be inserted but won't do
|
|
any checking or diskette access at all.
|
|
-----------------------------------------------------------------------------
|
|
17. THE ANCIENT ART OF WAR BY BR0DERBUND, Didley Bop
|
|
|
|
Load up Norton Utilities with WAS.EXE and search for these bytes: E8 F8 32.
|
|
Replace them with B8 01 00. Now, it's unprotected!
|
|
-----------------------------------------------------------------------------
|
|
18. FIX FOR BATTLETECH BY INFOCOM, The PaperBoy
|
|
|
|
Come on... Ain't Got All Day!! You don't have enough C-Bills? Well, this will help. Save your game and run
|
|
Norton Utilities or such with the GAME# (#=number of the save game) ready.
|
|
Edit the bytes at offset 05D5hex and 05D6hex and replace it with 00 70. That
|
|
should give you about 28672 C-Bills when you return to the game. You may go
|
|
as high as FF 7F, which will total 32767, but I wouldn't want to go higher
|
|
than that, or there could be a program interpretation screwup.
|
|
-----------------------------------------------------------------------------
|
|
19. FIX FOR TECHNOCOP BY US GOLD AND EPYX, Shimba
|
|
|
|
If you start with only 5 lives and must go through 11 levels of harsh battle,
|
|
I don't think you'll make it, unless you are lucky and fast enough to get
|
|
extra lives. Save your game, enter NU and change the byte at offset 5hex to
|
|
05. This will return you to 5 lives. I tried fixing it with FF, but I found
|
|
out that it doesn't work - I lose as if I had no lives left. You can attempt
|
|
to screw around with other bytes and hopefully get more lives than five.
|
|
-----------------------------------------------------------------------------
|
|
20. WILLOW BY MINDSCAPE/CINEMAWARE, Hacker Joe
|
|
|
|
Open WILLOW.EXE with your hex file editor and perform these operations:
|
|
|
|
Search for these bytes: ----> And replace with:
|
|
CD 13 59 90 90 59
|
|
74 02 EB E6 EB 02 EB E6
|
|
75 04 3C 00 EB 18 3C 00
|
|
Come on... Ain't Got All Day!! 3C F8 75 14 3C F8 EB 14
|
|
73 0C 33 C0 EB 0C 33 C0
|
|
-----------------------------------------------------------------------------
|
|
21. BOP 'N WRESTLE BY MINDSCAPE, SlimeMan
|
|
|
|
Prepare BOP.EXE for editing with NU or compatible program. Search for these
|
|
bytes: B8 00 19 CD and replace them with: 31 C0 EB 2F.
|
|
-----------------------------------------------------------------------------
|
|
22. FIX FOR THE LAST NINJA BY ACTIVISION, The Ninjutsu
|
|
|
|
Not enough lives? Well, save your game and enter your hex-style editor with
|
|
that save game file open for editing. Change the byte at offset 59hex to any
|
|
hex number from 00 to FF. FF will obviously give you 255 lives, so why want
|
|
the 00? Your screen will be lined up with those damn apples on the bottom
|
|
status screen, but they won't effect the game.
|
|
-----------------------------------------------------------------------------
|
|
23. INFILTRATOR BY MINDSCAPE, MasterByte
|
|
|
|
This unprotection scheme was very similar to that of BOP 'N WRESTLE. Here's
|
|
its own version. ** Make sure you change all EXE files (except INSTALL)! **
|
|
|
|
Search for these bytes: 31 C0 19 CD
|
|
And replace it with: EB 33 19 CD
|
|
-----------------------------------------------------------------------------
|
|
Come on... Ain't Got All Day!! 24. APOLLO 18 BY ACCOLADE, Two Guys
|
|
|
|
To unprotect APOLLO 18, use Norton Utilities or PC-Tools and...
|
|
|
|
Search for these bytes: 9A 29 00
|
|
And replace it with: EB 1B 00
|
|
-----------------------------------------------------------------------------
|
|
25. DEFENDER OF THE CROWN BY MINDSCAPE/CINEMAWARE, The Doctor of MASH
|
|
|
|
To unprotect DEFENDER OF THE CROWN, use DEBUG for this one. Rename the file
|
|
DOC.EXE to DOC.XXX and follow the instructions below.
|
|
|
|
DEBUG DOC.XXX <CR>
|
|
-S 0 FFFF B8 00 A0 50 FF 36 0A 45 <CR> ; search for beginning of routine.
|
|
xxxx:3BCC ; addresses may be different
|
|
xxxx:3BF2
|
|
-A3BCC <CR> ; assemble at first address
|
|
xxxx:3BCC JMP 3BF2 <CR> ; jump to second address
|
|
xxxx:3BCE <CR>
|
|
-W <CR> ; write the edited file back to disk
|
|
Writing 11600 bytes
|
|
-Q <CR> ; quit, return to DOS
|
|
|
|
Now, rename DOC.XXX back to DOC.EXE. It's unprotected.
|
|
Come on... Ain't Got All Day!! -----------------------------------------------------------------------------
|
|
26. PERFECT COLLEGE, Dr. Disk
|
|
|
|
This unprotection scheme is very similar to that of unprotection scheme #1,
|
|
the ACCOLADE schemes. However, the program places a RETF (far return)
|
|
instruction instead of the normal RET. So, ready COLLEGE.EXE for edit, and:
|
|
|
|
Search for these bytes: 55 56 57 06 1E
|
|
And replace it with: 31 C0 CB 06 1E
|
|
-----------------------------------------------------------------------------
|
|
27. POLICE QUEST II: THE VENGEANCE BY SIERRA, Pirates-R-Us
|
|
|
|
The new line of SIERRA software protected with the documentational check have
|
|
almost identical patches to the main EXE file. This one was no sweat.
|
|
|
|
Rename SIERRA.EXE to SIERRA.XXX and load DEBUG. Enter these lines:
|
|
|
|
E 0394 74
|
|
E 7FDB 05 1F
|
|
E 9E9B B8 08 35 CD 21 89 1E 38 13 8C 06 3A 13 B8 24 35
|
|
E 9EAB CD 21 89 1E 3C 13 8C 06 3E 13 B8 24 35 CD 21 89
|
|
E 9EBB 1E 40 13 8C 06 42 13 07 1E 0E 1F BA E9 9C B8 23
|
|
E 9ECB 25 CD 21 BA EA 9C B8 24 35 CD 21 1F E8 5A 00 C7
|
|
E 9EDB 06 36 13 01 00 C3 90 57 51 B9 38 00 BF B8 AB C6
|
|
Come on... Ain't Got All Day!! E 9EEB 05 00 47 E2 FA 2E C7 06 DB 7C 5B 01 59 5F E9 DE
|
|
E 9EFB E0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83
|
|
E 9F0B 3E 36 13 00 75 01 C3 1E 07
|
|
W
|
|
Q
|
|
|
|
Rename SIERRA.XXX back to SIERRA.EXE and your unprotection is complete.
|
|
-----------------------------------------------------------------------------
|
|
28. GOLD RUSH! BY SIERRA, Sir Graham
|
|
|
|
To avoid the 80-page manual for the keywords, prepare the file GRDIR for
|
|
DEBUG and enter the following lines:
|
|
|
|
E 28C CC
|
|
E 28D 7A
|
|
W
|
|
Q
|
|
-----------------------------------------------------------------------------
|
|
29. THE GAMES: WINTER EDITION BY EPYX, Super Dave
|
|
|
|
To unprotect THE GAMES: WINTER EDITION, follow these steps below:
|
|
|
|
1. Rename GAMES.EXE to GAMES.XXX.
|
|
2. Enter DEBUG with GAMES.XXX ready for modifications.
|
|
Come on... Ain't Got All Day!! 3. Type "S 0000 FFFF 0B C0 74 01" to search for the protection pattern.
|
|
4. The computer should respond with only one address. If none or more
|
|
than one is given, this unprotection scheme may not work. Sorry!
|
|
5. Take the address given (in the form of XXXX:YYYY) and subract 5 from
|
|
the YYYY address. The numbers are in hexidecimal. Do not attempt
|
|
this patch if you do not understand hex.
|
|
6. Use the subracted number (ZZZZ) and enter it in DEBUG as follows:
|
|
"E ZZZZ EB 03 90 90 90 31 C0" to NOP the protection scheme.
|
|
7. Save the modified file by entering "W", then entering "Q" to exit to
|
|
DOS.
|
|
8. Rename the file GAMES.XXX back to GAMES.EXE.
|
|
-----------------------------------------------------------------------------
|
|
This file is updated every week. Watch out for new unprotection schemes!
|
|
Please upload this file archived as "UNP89-#.ARC," where # is the edition
|
|
number. For instant cracks on software, call 1-312-ZAP-DISK and ask for Vic!
|
|
|
|
[3] Tfiles: (1-3,?,Q) : |