Here are two different Print Shop unprotect schemes by Independent (IND)
1 of 1 file
the swamp fox
- Browsers may flag this download as unwanted or malicious. If unsure, scan it with VirusTotal.
-
Last modified Dec 20, 1988 3:32:14 PM
MD5 checksum 62dd26550f7ec9eae54294a5d4cb74e6
Mime type ASCII text, with CRLF line terminators
Download PRNTSHOP.UNP
Size 7 kB
1988 December 20
- Text / Guides and how-tos
- The Swamp Fox, writer credits
Here are two different PRINTSHOP unprotect schemes that I found on local
BBS's. The second version worked for me.
-------------------------------------------------------------------------
Unprotect The Print Shop by Broderbund
The Print Shop employs two sections of code to copy protect itself.
The first is embedded in PS.EXE and is exercised when the program is run
from a floppy.
The second is embedded in PSINIT.OVR and is employed when the program is
run from a hard or ram disk.
Once activated, both seek out a specially formatted track on the A: drive
and terminate the program if not found.
Both sections of code will be un-hooked here so that the program will run
from either a floppy or a hard disk.
As always, make a copy of the program code to work on so as to protect your
original. We will use the DOS supplemental program DEBUG to patch the code
so as to remove the copy protection.
DEBUG PS.ZAP Start DEBUG
S0 9000 CD 13 Search for Disk interrupt 13
XXXX:3AC6 You should find these two:
XXXX:3ADF
U 3AC6 Unassemble the code to make sure
you're in the right place :
XXXX:3AC6 INT 13 A test for any disk in A:
XXXX:3AC8 MOV BYTE PTR [0A91],02
XXXX:3ACD DEC BYTE PTR [0A91]
XXXX:3AD1 JZ 3AE6
XXXX:3AD3 MOV DH,00 \
XXXX:3AD5 MOV DL,00 | This sets up a look for the
XXXX:3AD7 MOV CH,09 | special track
XXXX:3AD9 MOV CL,0A |
XXXX:3ADB MOV AL,01 |
XXXX:3ADD MOV AH,04 |
XXXX:3AE1 CMP AH,00 If not there ... Loop then
XXXX:3AE4 JNZ 3ACD Zonk ! Terminate Program...
A 3AC6 Get rid of 1 st diskette look
XXXX:3AC6 NOP Remove the INT 13
XXXX:3AC7 NOP
XXXX:3AC8
A 3ADD Get rid of the real test :
XXXX:3ADD MOV AH,00 Give it what it wants in AH
XXXX:3ADF NOP Remove the INT 13
XXXX:3AE0 NOP
XXXX:3AE1
W Write out the changed code
Q Quit DEBUG
(The program will now run from floppy disks without further changes)
Now for the second portion of the copy protection :
DEBUG PSINIT.OVR Start DEBUG (using a copy !)
S0 2000 CD 13 Look for disk interrupt 13
XXXX:0479 You should find these three:
XXXX:0492
XXXX:04BD
U 0479
XXXX:0479 INT 13 A test for any disk in A:
XXXX:047B MOV BYTE PTR [CD57],02
XXXX:0480 DEC BYTE PTR [CD57]
XXXX:0484 JZ 04DB
XXXX:0486 MOV CL,11 \
XXXX:0488 MOV AH,04 |
XXXX:048C MOV CH,09 | This sets up a look for the
XXXX:048E MOV DL,00 | special track
XXXX:0490 MOV AL,01 |
XXXX:0492 INT 13 /
XXXX:0494 CMP AH,00 If not there ... Loop then
XXXX:0497 JNZ 0480 Zonk ! Terminate Program...
(Look familiar ?)
U 04BD
XXXX:04BD INT 13 This one's a read (same idea)
XXXX:04BF CMP AH,00
XXXX:04C2 JNZ 04A5
XXXX:04C4 ADD BX,018B
XXXX:04C8 MOV CL,05
XXXX:04CA ES:
XXXX:04CB MOV AL,[BX]
XXXX:04CD CMP AL,41
XXXX:04CF JNZ 04DB
XXXX:04D1 INC BX
XXXX:04D4 JNZ 04CA
XXXX:04D6 MOV AX,0000 This is the success exit !
XXXX:04D9 JMP 04DE
A 0479
XXXX:0479 NOP Remove INT 13
XXXX:047A NOP
XXXX:047B
A 0490
XXXX:0490 MOV AH,00 Give it what it wants in AH
XXXX:0492 NOP Remove INT 13
XXXX:0493 NOP
XXXX:0494
A 04BD
XXXX:04BD JMP 04D6 Jump to success exit code
XXXX:04BF
W Write out the changed code
Q Quit DEBUG
The program may now be run from a hard disk or floppy as desired. The hard
disk set up will ask for the master diskette to be inserted but won't do
any checking or diskette access at all.
This technique is published for the benefit of legitmate purchasers of the
product who deplore copy-protected software and wish to protect themselves
against disk failure. Undoubtably there are those who will abuse this
knowledge to trade unauthorized copies. They must live with the knowledge
that they are stealing and answer in the court of their own conscience.
The Swamp Fox
--------------------------------------------------------------------------
Print Shop unprotect procedures
The Print Shop uses an installation process which records the
physical location of the program in an overlay file. During
program initialization, a check is made to see if the location
has changed. If it has, due to a restore, a disk reorganization,
a disk optimization, or anything, the program refuses to run.
The code to do the checking is actually stored in the overlay
file. These procedures force the result to be accepted
regardless of whether the check is correct or not.
1) Install the program in the usual way, using the Print Shop
install programs.
2) Copy the files to another directory.
3) Uninstall the programs, again using the Print Shop programs.
4) Now CD to the directory which has the copied files.
5) Use DEBUG to make the following changes:
-S0 FFF 59 3B C8 75 1E This is a version check.
xxxx:024A If you don't get this number,
STOP NOW. Wrong version!
-e24d 90 90 NOP out an instruction
-s0 fff 30 e8 13 df 85 co 74 29
xxxx:0265 If you don't get this number,
STOP NOW. Wrong version!
-e26b eb Change a conditional jump to
unconditional.
-w Write the file back
-q Quit DEBUG
The Print Shop program will now run from any directory on any
disk.