Purple Saturn Day unprotect   by Independent (IND)

--------------------------- Purple Saturn Day unprotect By the MAD VANDAL --------------------------- I guess we can all count on Epyx being one of the last companies around except Microprose that use disk based copy protection. Epyx usually hides it pretty well, but not here. They made a pretty lame attempt to hide the INT 13's as INT 21's, which is revealed in the first lines of the program. A guess not much time was spent on hiding it, and was instead spent on the game, which is a good sign. This program will require several alterations to the file PURPLE.EXE. For norton users I am going list the offsets and values instead of search patterns because of the number of changes. In the file PURPLE.EXE go to the following offsets and enter the data shown. Note that all offsets are in hex, not decimal. At offset 1281 change the 13 to 90 At offset 12D0 change the CD to 90 At offset 12E4 change the 75 to EB At offset 1302 change the 72 43 to 90 90 At offset 131B change the 75 2A to 90 90 At offset 132A change the 75 1B to 90 90 At offset 133B change the CD to 90 At offset 13A9 change the CD to 90 DEBUG method. DEBUG is assumed to be in the current path or dir. 1. REN PURPLE.EXE PURPLE.ZAP 2. DEBUG PURPLE.ZAP 3. At the DEBUG '-' prompt enter the following lines: E 1381 90 E 13D0 90 E 13E4 EB E 1402 90 90 E 141B 90 90 E 142A 90 90 E 143B 90 E 13A9 90 4. Enter 'W' to save it 5. Enter 'Q' to quit 6. REN PURPLE.ZAP PURPLE.EXE For those interested, the program changes are shown below: BEFORE XXXX:136F 0E PUSH CS XXXX:1370 07 POP ES XXXX:1371 89260400 MOV [0004],SP XXXX:1375 C70600000102 MOV WORD PTR [0000],0201 XXXX:137B B000 MOV AL,00 XXXX:137D A20800 MOV [0008],AL XXXX:1380 B013 MOV AL,13 <- 13 to change INT 21's to INT 13's XXXX:1382 A2DC00 MOV [00DC],AL < XXXX:1385 A24A01 MOV [014A],AL <- make the INT 21 to INT 13 changes XXXX:1388 A27100 MOV [0071],AL < XXXX:138B B90727 MOV CX,2707 XXXX:138E 51 PUSH CX XXXX:138F B1F1 MOV CL,F1 XXXX:1391 E80C00 CALL 13A0 XXXX:1394 B90827 MOV CX,2708 XXXX:1397 51 PUSH CX XXXX:1398 B1DE MOV CL,DE XXXX:139A E80300 CALL 13A0 XXXX:139D E9B400 JMP 1454 XXXX:13A0 58 POP AX XXXX:13A1 A30600 MOV [0006],AX XXXX:13A4 51 PUSH CX XXXX:13A5 CD11 INT 11 XXXX:13A7 25C000 AND AX,00C0 XXXX:13AA B106 MOV CL,06 XXXX:13AC D3E8 SHR AX,CL XXXX:13AE FEC0 INC AL XXXX:13B0 FEC0 INC AL XXXX:13B2 A20200 MOV [0002],AL XXXX:13B5 8D366501 LEA SI,[0165] XXXX:13B9 8D5C20 LEA BX,[SI+20] XXXX:13BC 59 POP CX XXXX:13BD 8A160800 MOV DL,[0008] XXXX:13C1 80FA00 CMP DL,00 XXXX:13C4 752F JNZ 13F5 XXXX:13C6 33D2 XOR DX,DX XXXX:13C8 51 PUSH CX XXXX:13C9 C606030000 MOV BYTE PTR [0003],00 XXXX:13CE 33C0 XOR AX,AX XXXX:13D0 CD21 INT 21 <- This becomes INT 13 XXXX:13D2 B90114 MOV CX,1401 XXXX:13D5 E8C800 CALL 14A0 XXXX:13D8 59 POP CX XXXX:13D9 C606030010 MOV BYTE PTR [0003],10 XXXX:13DE E8BF00 CALL 14A0 XXXX:13E1 F6C410 TEST AH,10 XXXX:13E4 750B JNZ 13F1 <- Jump if original copy in drive XXXX:13E6 FEC2 INC DL XXXX:13E8 3A160200 CMP DL,[0002] XXXX:13EC 72DA JB 13C8 <- Jump back for a few more tries XXXX:13EE EB57 JMP 1447 <- Copy protection failed, exit routine XXXX:13F0 90 NOP XXXX:13F1 88160800 MOV [0008],DL <- Begin some more tests XXXX:13F5 8BE9 MOV BP,CX XXXX:13F7 8D1C LEA BX,[SI] XXXX:13F9 59 POP CX XXXX:13FA C606030000 MOV BYTE PTR [0003],00 XXXX:13FF E89E00 CALL 14A0 XXXX:1402 7243 JB 1447 <- Jump if copy protection test failed XXXX:1404 8D5C20 LEA BX,[SI+20] XXXX:1407 8BCD MOV CX,BP XXXX:1409 C606030010 MOV BYTE PTR [0003],10 XXXX:140E E88F00 CALL 14A0 XXXX:1411 8DBCAC00 LEA DI,[SI+00AC] XXXX:1415 B91000 MOV CX,0010 XXXX:1418 FC CLD XXXX:1419 F3 REPZ XXXX:141A A7 CMPSW XXXX:141B 752A JNZ 1447 <- Jump if copy protection test failed XXXX:141D 8D366501 LEA SI,[0165] XXXX:1421 8D3E5D01 LEA DI,[015D] XXXX:1425 B90400 MOV CX,0004 XXXX:1428 F3 REPZ XXXX:1429 A7 CMPSW XXXX:142A 751B JNZ 1447 <- Jump if copy protection test failed XXXX:142C 8BCD MOV CX,BP XXXX:142E B101 MOV CL,01 XXXX:1430 B800F0 MOV AX,F000 XXXX:1433 8EC0 MOV ES,AX XXXX:1435 BE0300 MOV SI,0003 XXXX:1438 B80902 MOV AX,0209 XXXX:143B CD21 INT 21 <- This becomes INT 13 XXXX:143D 7303 JNB 1442 XXXX:143F 4E DEC SI XXXX:1440 75F6 JNZ 1438 XXXX:1442 A10600 MOV AX,[0006] XXXX:1445 50 PUSH AX XXXX:1446 C3 RET <- Exit routine and play game XXXX:1447 E83D00 CALL 1487 <- Jumps here if any of the tests XXXX:144A 8B260400 MOV SP,[0004] fail and exits you to DOS XXXX:144E 2BC9 SUB CX,CX XXXX:1450 58 POP AX XXXX:1451 50 PUSH AX XXXX:1452 EB0B JMP 145F XXXX:1454 E83000 CALL 1487 XXXX:1457 B90000 MOV CX,0000 XXXX:145A 8CC8 MOV AX,CS XXXX:145C 05FAFE ADD AX,FEFA XXXX:145F FD STD XXXX:1460 FA CLI XXXX:1461 AB STOSW XXXX:1462 8BC1 MOV AX,CX XXXX:1464 AB STOSW XXXX:1465 47 INC DI XXXX:1466 B90D00 MOV CX,000D XXXX:1469 8D363D01 LEA SI,[013D] XXXX:146D F3 REPZ XXXX:146E A4 MOVSB XXXX:146F FC CLD XXXX:1470 47 INC DI XXXX:1471 06 PUSH ES XXXX:1472 57 PUSH DI XXXX:1473 0E PUSH CS XXXX:1474 07 POP ES XXXX:1475 8BCF MOV CX,DI XXXX:1477 2BFF SUB DI,DI XXXX:1479 D1E9 SHR CX,1 XXXX:147B 2BC0 SUB AX,AX XXXX:147D 8CCB MOV BX,CS XXXX:147F 81C30000 ADD BX,0000 XXXX:1483 BA0001 MOV DX,0100 XXXX:1486 CB RETF XXXX:1487 16 PUSH SS XXXX:1488 07 POP ES XXXX:1489 8B3E0400 MOV DI,[0004] XXXX:148D 83EF58 SUB DI,+58 XXXX:1490 C3 RET XXXX:1491 F3 REPZ XXXX:1492 AB STOSW XXXX:1493 1F POP DS XXXX:1494 07 POP ES XXXX:1495 58 POP AX XXXX:1496 59 POP CX XXXX:1497 8ED3 MOV SS,BX XXXX:1499 8BE2 MOV SP,DX XXXX:149B 51 PUSH CX XXXX:149C 9D POPF XXXX:149D EA27011E07 JMP 071E:0127 XXXX:14A2 56 PUSH SI XXXX:14A3 BE0600 MOV SI,0006 XXXX:14A6 A10000 MOV AX,[0000] XXXX:14A9 CD21 INT 21 <- This becomes INT 13, another test XXXX:14AB 730E JNB 14BB of some sort XXXX:14AD F6C480 TEST AH,80 XXXX:14B0 7509 JNZ 14BB XXXX:14B2 84260300 TEST AH,[0003] XXXX:14B6 7503 JNZ 14BB XXXX:14B8 4E DEC SI XXXX:14B9 75EB JNZ 14A6 XXXX:14BB 5E POP SI XXXX:14BC C3 RET AFTER XXXX:1369 9C PUSHF XXXX:136A 50 PUSH AX XXXX:136B 1E PUSH DS XXXX:136C 06 PUSH ES XXXX:136D 0E PUSH CS XXXX:136E 1F POP DS XXXX:136F 0E PUSH CS XXXX:1370 07 POP ES XXXX:1371 89260400 MOV [0004],SP XXXX:1375 C70600000102 MOV WORD PTR [0000],0201 XXXX:137B B000 MOV AL,00 XXXX:137D A20800 MOV [0008],AL XXXX:1380 B090 MOV AL,90 <- Put NOP's in instead of 13 XXXX:1382 A2DC00 MOV [00DC],AL <- Plug NOPs in program. Does XXXX:1385 A24A01 MOV [014A],AL < nothing now because NOPs are XXXX:1388 A27100 MOV [0071],AL < already there XXXX:138B B90727 MOV CX,2707 XXXX:138E 51 PUSH CX XXXX:138F B1F1 MOV CL,F1 XXXX:1391 E80C00 CALL 13A0 XXXX:1394 B90827 MOV CX,2708 XXXX:1397 51 PUSH CX XXXX:1398 B1DE MOV CL,DE XXXX:139A E80300 CALL 13A0 XXXX:139D E9B400 JMP 1454 XXXX:13A0 58 POP AX XXXX:13A1 A30600 MOV [0006],AX XXXX:13A4 51 PUSH CX XXXX:13A5 CD11 INT 11 XXXX:13A7 25C000 AND AX,00C0 XXXX:13AA B106 MOV CL,06 XXXX:13AC D3E8 SHR AX,CL XXXX:13AE FEC0 INC AL XXXX:13B0 FEC0 INC AL XXXX:13B2 A20200 MOV [0002],AL XXXX:13B5 8D366501 LEA SI,[0165] XXXX:13B9 8D5C20 LEA BX,[SI+20] XXXX:13BC 59 POP CX XXXX:13BD 8A160800 MOV DL,[0008] XXXX:13C1 80FA00 CMP DL,00 XXXX:13C4 752F JNZ 13F5 XXXX:13C6 33D2 XOR DX,DX XXXX:13C8 51 PUSH CX XXXX:13C9 C606030000 MOV BYTE PTR [0003],00 XXXX:13CE 33C0 XOR AX,AX XXXX:13D0 90 NOP <- Fomerly an INT 21 that changes to XXXX:13D1 90 NOP < INT 13 XXXX:13D2 B90114 MOV CX,1401 XXXX:13D5 E8C800 CALL 14A0 XXXX:13D8 59 POP CX XXXX:13D9 C606030010 MOV BYTE PTR [0003],10 XXXX:13DE E8BF00 CALL 14A0 XXXX:13E1 F6C410 TEST AH,10 XXXX:13E4 EB0B JMP 13F1 <- Always jumps, Always right XXXX:13E6 FEC2 INC DL XXXX:13E8 3A160200 CMP DL,[0002] XXXX:13EC 72DA JB 13C8 XXXX:13EE EB57 JMP 1447 XXXX:13F0 90 NOP XXXX:13F1 88160800 MOV [0008],DL <- Do some more tests XXXX:13F5 8BE9 MOV BP,CX XXXX:13F7 8D1C LEA BX,[SI] XXXX:13F9 59 POP CX XXXX:13FA C606030000 MOV BYTE PTR [0003],00 XXXX:13FF E89E00 CALL 14A0 XXXX:1402 90 NOP <- Nevers jumps, test never fails XXXX:1403 90 NOP XXXX:1404 8D5C20 LEA BX,[SI+20] XXXX:1407 8BCD MOV CX,BP XXXX:1409 C606030010 MOV BYTE PTR [0003],10 XXXX:140E E88F00 CALL 14A0 XXXX:1411 8DBCAC00 LEA DI,[SI+00AC] XXXX:1415 B91000 MOV CX,0010 XXXX:1418 FC CLD XXXX:1419 F3 REPZ XXXX:141A A7 CMPSW XXXX:141B 90 NOP <- Nevers jumps, test never fails XXXX:141C 90 NOP XXXX:141D 8D366501 LEA SI,[0165] XXXX:1421 8D3E5D01 LEA DI,[015D] XXXX:1425 B90400 MOV CX,0004 XXXX:1428 F3 REPZ XXXX:1429 A7 CMPSW XXXX:142A 90 NOP <- Nevers jumps, test never fails XXXX:142B 90 NOP XXXX:142C 8BCD MOV CX,BP XXXX:142E B101 MOV CL,01 XXXX:1430 B800F0 MOV AX,F000 XXXX:1433 8EC0 MOV ES,AX XXXX:1435 BE0300 MOV SI,0003 XXXX:1438 B80902 MOV AX,0209 XXXX:143B 90 NOP <- Another one of the changing INT's XXXX:143C 90 NOP XXXX:143D 7303 JNB 1442 XXXX:143F 4E DEC SI XXXX:1440 75F6 JNZ 1438 XXXX:1442 A10600 MOV AX,[0006] XXXX:1445 50 PUSH AX XXXX:1446 C3 RET XXXX:1447 E83D00 CALL 1487 XXXX:144A 8B260400 MOV SP,[0004] XXXX:144E 2BC9 SUB CX,CX XXXX:1450 58 POP AX XXXX:1451 50 PUSH AX XXXX:1452 EB0B JMP 145F XXXX:1454 E83000 CALL 1487 XXXX:1457 B90000 MOV CX,0000 XXXX:145A 8CC8 MOV AX,CS XXXX:145C 05FAFE ADD AX,FEFA XXXX:145F FD STD XXXX:1460 FA CLI XXXX:1461 AB STOSW XXXX:1462 8BC1 MOV AX,CX XXXX:1464 AB STOSW XXXX:1465 47 INC DI XXXX:1466 B90D00 MOV CX,000D XXXX:1469 8D363D01 LEA SI,[013D] XXXX:146D F3 REPZ XXXX:146E A4 MOVSB XXXX:146F FC CLD XXXX:1470 47 INC DI XXXX:1471 06 PUSH ES XXXX:1472 57 PUSH DI XXXX:1473 0E PUSH CS XXXX:1474 07 POP ES XXXX:1475 8BCF MOV CX,DI XXXX:1477 2BFF SUB DI,DI XXXX:1479 D1E9 SHR CX,1 XXXX:147B 2BC0 SUB AX,AX XXXX:147D 8CCB MOV BX,CS XXXX:147F 81C30000 ADD BX,0000 XXXX:1483 BA0001 MOV DX,0100 XXXX:1486 CB RETF XXXX:1487 16 PUSH SS XXXX:1488 07 POP ES XXXX:1489 8B3E0400 MOV DI,[0004] XXXX:148D 83EF58 SUB DI,+58 XXXX:1490 C3 RET XXXX:1491 F3 REPZ XXXX:1492 AB STOSW XXXX:1493 1F POP DS XXXX:1494 07 POP ES XXXX:1495 58 POP AX XXXX:1496 59 POP CX XXXX:1497 8ED3 MOV SS,BX XXXX:1499 8BE2 MOV SP,DX XXXX:149B 51 PUSH CX XXXX:149C 9D POPF XXXX:149D EA27011E07 JMP 071E:0127 XXXX:14A2 56 PUSH SI XXXX:14A3 BE0600 MOV SI,0006 XXXX:14A6 A10000 MOV AX,[0000] XXXX:14A9 90 NOP <- Some other INT 13, wasn't needed XXXX:14AA 90 NOP XXXX:14AB 730E JNB 14BB XXXX:14AD F6C480 TEST AH,80 XXXX:14B0 7509 JNZ 14BB XXXX:14B2 84260300 TEST AH,[0003] XXXX:14B6 7503 JNZ 14BB XXXX:14B8 4E DEC SI XXXX:14B9 75EB JNZ 14A6 XXXX:14BB 5E POP SI XXXX:14BC C3 RET Well that's it. Where do they get people that write this copy protection crap?