- 1988 December 20
- Independent (IND)
- Text Guides and how-tos
Dec 20, 1988 3:32:14 PM
ASCII text (DOS/Windows format)
Here are two different PRINTSHOP unprotect schemes that I found on local BBS's. The second version worked for me. ------------------------------------------------------------------------- Unprotect The Print Shop by Broderbund The Print Shop employs two sections of code to copy protect itself. The first is embedded in PS.EXE and is exercised when the program is run from a floppy. The second is embedded in PSINIT.OVR and is employed when the program is run from a hard or ram disk. Once activated, both seek out a specially formatted track on the A: drive and terminate the program if not found. Both sections of code will be un-hooked here so that the program will run from either a floppy or a hard disk. As always, make a copy of the program code to work on so as to protect your original. We will use the DOS supplemental program DEBUG to patch the code so as to remove the copy protection. DEBUG PS.ZAP Start DEBUG S0 9000 CD 13 Search for Disk interrupt 13 XXXX:3AC6 You should find these two: XXXX:3ADF U 3AC6 Unassemble the code to make sure you're in the right place : XXXX:3AC6 INT 13 A test for any disk in A: XXXX:3AC8 MOV BYTE PTR [0A91],02 XXXX:3ACD DEC BYTE PTR [0A91] XXXX:3AD1 JZ 3AE6 XXXX:3AD3 MOV DH,00 \ XXXX:3AD5 MOV DL,00 | This sets up a look for the XXXX:3AD7 MOV CH,09 | special track XXXX:3AD9 MOV CL,0A | XXXX:3ADB MOV AL,01 | XXXX:3ADD MOV AH,04 | XXXX:3AE1 CMP AH,00 If not there ... Loop then XXXX:3AE4 JNZ 3ACD Zonk ! Terminate Program... A 3AC6 Get rid of 1 st diskette look XXXX:3AC6 NOP Remove the INT 13 XXXX:3AC7 NOP XXXX:3AC8 A 3ADD Get rid of the real test : XXXX:3ADD MOV AH,00 Give it what it wants in AH XXXX:3ADF NOP Remove the INT 13 XXXX:3AE0 NOP XXXX:3AE1 W Write out the changed code Q Quit DEBUG (The program will now run from floppy disks without further changes) Now for the second portion of the copy protection : DEBUG PSINIT.OVR Start DEBUG (using a copy !) S0 2000 CD 13 Look for disk interrupt 13 XXXX:0479 You should find these three: XXXX:0492 XXXX:04BD U 0479 XXXX:0479 INT 13 A test for any disk in A: XXXX:047B MOV BYTE PTR [CD57],02 XXXX:0480 DEC BYTE PTR [CD57] XXXX:0484 JZ 04DB XXXX:0486 MOV CL,11 \ XXXX:0488 MOV AH,04 | XXXX:048C MOV CH,09 | This sets up a look for the XXXX:048E MOV DL,00 | special track XXXX:0490 MOV AL,01 | XXXX:0492 INT 13 / XXXX:0494 CMP AH,00 If not there ... Loop then XXXX:0497 JNZ 0480 Zonk ! Terminate Program... (Look familiar ?) U 04BD XXXX:04BD INT 13 This one's a read (same idea) XXXX:04BF CMP AH,00 XXXX:04C2 JNZ 04A5 XXXX:04C4 ADD BX,018B XXXX:04C8 MOV CL,05 XXXX:04CA ES: XXXX:04CB MOV AL,[BX] XXXX:04CD CMP AL,41 XXXX:04CF JNZ 04DB XXXX:04D1 INC BX XXXX:04D4 JNZ 04CA XXXX:04D6 MOV AX,0000 This is the success exit ! XXXX:04D9 JMP 04DE A 0479 XXXX:0479 NOP Remove INT 13 XXXX:047A NOP XXXX:047B A 0490 XXXX:0490 MOV AH,00 Give it what it wants in AH XXXX:0492 NOP Remove INT 13 XXXX:0493 NOP XXXX:0494 A 04BD XXXX:04BD JMP 04D6 Jump to success exit code XXXX:04BF W Write out the changed code Q Quit DEBUG The program may now be run from a hard disk or floppy as desired. The hard disk set up will ask for the master diskette to be inserted but won't do any checking or diskette access at all. This technique is published for the benefit of legitmate purchasers of the product who deplore copy-protected software and wish to protect themselves against disk failure. Undoubtably there are those who will abuse this knowledge to trade unauthorized copies. They must live with the knowledge that they are stealing and answer in the court of their own conscience. The Swamp Fox -------------------------------------------------------------------------- Print Shop unprotect procedures The Print Shop uses an installation process which records the physical location of the program in an overlay file. During program initialization, a check is made to see if the location has changed. If it has, due to a restore, a disk reorganization, a disk optimization, or anything, the program refuses to run. The code to do the checking is actually stored in the overlay file. These procedures force the result to be accepted regardless of whether the check is correct or not. 1) Install the program in the usual way, using the Print Shop install programs. 2) Copy the files to another directory. 3) Uninstall the programs, again using the Print Shop programs. 4) Now CD to the directory which has the copied files. 5) Use DEBUG to make the following changes: -S0 FFF 59 3B C8 75 1E This is a version check. xxxx:024A If you don't get this number, STOP NOW. Wrong version! -e24d 90 90 NOP out an instruction -s0 fff 30 e8 13 df 85 co 74 29 xxxx:0265 If you don't get this number, STOP NOW. Wrong version! -e26b eb Change a conditional jump to unconditional. -w Write the file back -q Quit DEBUG The Print Shop program will now run from any directory on any disk.