Directions for Unprotecting SPOC, the Chess Master, Version 1.0.   by Independent (IND)

Directions for Unprotecting SPOC, the Chess Master, Version 1.0. What follows below is a step by step guide for unprotecting SPOC the Chess Master, Version 1.0 by Cypress Software. The proceedure requires only that you have DOS and debug (a program supplied with DOS). You do not have to be familiar with debug to copy SPOC. First I'll give you my impressions of the software and some general comments about its protection scheme. The software is designed to play Chess. It appears to be fairly smart about making it Chess moves, but then I'm not a great player. It is, however, quite dumb about talking to its opponent (you, the user). Perhaps it's written in Fortran or something. You can not take a move back. You can not ask the computer what it would do in your situation, nor can you have it play itself (which would be fun to watch on the screen). You can not set the board up in some situation before starting play (i.e., you must always start from the begining, no setting up some classic closing situation and going from there.) In fact, user interface is so bad, that when a game ends, the only way to play another game is to stop and then start SPOC up again. I'm not really sure why they bothered to copyprotect the thing. The only things you can do are change the level of play (it recognizes 9 dif- ferent levels), save a current board set-up, and stop. I also find it hard to differentiate between black and white players. Perhaps this problem is resolved when you use graphics output, but my machine lacks that capability. The software uses the following protection scheme: The program is dis- tributed on a single-sided write-protected diskette. The disk is close to a normal disk. There is one file in the directory, spoc.exe, which is most of the program. However, track 20, sector 5 is a bad sector. In what manner it is bad, I don't know, but nothing can read it. SPOC first attempts to read track 20, sector 5. If it does not get an error message from the BIOS routines, it quits. Otherwise it goes directly to the NEC disk controller to set up another read of track 20. In doing this, it basically copies (byte for byte) many of the routines in BIOS for disk I/O (interupt 13). (Interesting that it's quest for copy-protection should lead Cypress Software to copy someone else's software. In addition, the boot-record on the SPOC disk is an exact copy of the IBM PC-DOS, version 1.0, boot-record, right down to Robert O'Rear's included name.) If the NEC's read of track 20 brings back what SPOC wants to find there, it goes on to the main part of the program, which does a few more checks of its own. It checks to see if the spoc.exe file is the first thing in the directory. It checks to see if the spoc disk is write-protected (plastic over the write notch). And it checks to see if the spoc disk is a single-sided disk. Finally, it reads track 30 (and then some) of the SPOC disk for information that is needed. This part of the disk is not marked as being allocated in the directory on the disk. Unprotection Instructions: I wanted to find a way to copy SPOC without altering the program in any way, but was unable to do this. However, the changes to the program out- lined below are not extensive, and only change that part of the program concerned with copy protection. Assuming a 1 drive system. Starting from the DOS prompt: (what you type is in brackets:<>) 1.) A><diskcopy> 2.) Follow the diskcopy instructions, using the SPOC original as the source diskette and a new unused diskette as the target. The diskette must be unused, or else you will have to "unformat" the second side. 3.) A><b:debug> 4.) Put a disk with debug.com in for drive b when prompted. After the debug program has been loaded, it will display it's "-" prompt. You will now give it some instructions. 4.1.) -<l cs:100 0 a5 3> 4.2.) When prompted for diskette for drive a, put your SPOC diskette (original) in drive a. Wait for debug to come back with another prompt, then take your SPOC diskette out and put in your spoc copy (made up above). 4.3.) -<w cs:100 0 a5 3> 4.4.) -<n spoc.exe> 4.5.) Now take your spoc copy out and put the SPOC original back in. 4.6.) -<l> 5.) -<u> 6.) After you type "u" the screen should display a number of lines of data, the first of which should read as follows: xxxx:0000 EB07 JMPS 0009 The xxxx will vary from machine to machine, but write it down. You'll use it later. 7.) -<g 0e> 8.) After the above instruction to debug, the disk drive will start up and after a few seconds debug will come back with another prompt. At this point, wait until the disk drive light goes out, take out the SPOC disk and put in your copy made above. Make sure it is not write-protected at this point. Then type the following: 9.) -<w cs:01a9 0 d0 8> 10.) Wait for debug to come back with another prompt and then type: 11.) -<q> 12.) You just quit debug and are back to DOS. Continue with you spoc copy in drive A. 13.) A><ren spoc.exe spoc.bin> 14.) A><b:debug a:spoc.bin> 15.) Now insert something with debug on it in for drive b and at the prompt insert your spoc copy back into drive a. You should be back in debug. 16.) -<u xxxx:e00> 17.) The xxxx come from above, during the first encounter with debug. After typing the instruction in step 16 the screen should display information like it did before. The first line should be: xxxx:0E00 EB07 JMPS 0009 Now you are about to enter the changes to the program. 18.) -<e xxxx:e2d 06 56 be 03 00 8c c8 8e c0 bb a9 01 b4 02 b0 08 b2 00> 19.) -<e xxxx:e3f b6 00 b5 1a b1 01 cd 13 72 03 5e 07 c3 b4 00 cd 13 4e> 20.) -<e xxxx:e51 75 e6 f9 eb f3> 21.) Well that's about it, now just: 22.) -<w> 23.) -<q> 24.) You should be back in DOS now after quitting debug. 25.) A><ren spoc.bin spoc.exe> 26.) Now take out your spoc copy and put a write-protect tab on it. It should now work just like the original SPOC disk. (It won't work unless you have a write-protect tab on it.) Your spoc copy can now be copied endlessly and painlessly by following the normal DOS diskcopy routine. Randy Day. 12/5/83