                             Techniques in Cracking
                            Brought to you by -TOP-
                     We are Tired of Protection. Arent You?

        The Following Information provided is a listing of some techniques the
-TOP- crackers have used in cracking Programs.  This is NOT intended as a
Cracking Tutorial but as an enhancement to people who need to know just a bit
more in order to crack a certain program.  -TOP- Crackers have spent time and
effort in comming up with these techniques. Get what information you can from
it.  It will be updated each new Issue.

Listing of Techniques
1. Goldrush
2. Space Ace
3. SimEarth
4. StarControl 1
5. Bo Jackson Baseball
6. Mike Dikta Football
7. Con>Format 1.06
8. The Summoning
9. Martian Dreams
10. Sargon V
11. Secret Weapons of the Lutewaffa
12. Crimewave
13. 3 on 3: The Dream Team.
14. JACK 4.59: Landscape Designer
15. Blue Wave Reader v 2.1
16. Giflite v 2.0
17. Veil of Darkness
<*****************************************************************************>
Unprotect for GoldRush by Sierra!

**********************************
Sierra's Doc check  AARGH!
**********************************

This one is a royal pain to do manually however, here it goes:

        Using norton DE/Pctools enter the file AGI.
        Look at the beginning of the file and start at the A
        in 'Adventure game...' and enter the numbers on the
        lefthand side of the screen.  For those interested the
        assembly code is on the right.

        90                      NOP
        9C                      PUSHF
        50                      PUSH AX
        53                      PUSH BX
        56                      PUSH SI
        8B 1E AA 00             MOV BX, [AA]
        BE E3 73                MOV SI, 73E3
        46              SCAN:   INC SI
        38 1C                   CMP [SI],BL
        75 FB                   JNZ SCAN
        8A 44 07                MOV AL, [SI+7]
        A2 F7 00                MOV [F7], AL
        5E                      POP SI
        5B                      POP BX
        58                      POP AX
        9D                      POPF
        C3                      RET


        That is only part one, part two is shorter:

        Using norton's DE or Pctools search 'AGI' for:

        8A 87 09 00 00 85 09 00
        ^^ ^^ ^^ ^^ ^^ ^^ ^^ ^^
        90 90 90 90 2E E8 15 89

        In Assembler:           NOP
                                NOP
                                NOP
                                NOP
                                CALL CS:0

***********************************************************************
TO BYPASS THE PROTECTION YOU MUST ENTER AT LEAST ONE LETTER FOLLOWED BY
                     *****THE ENTER KEY*****

The method involved:
        Sierra programs are a royal pain and even the old ones take me a
long time to crack.  This one lets you type in an answer.  I did a
search through memory to find the answer and then did a break if any
letter was read of the answer.  I followed it through and found the the
program added the letters up into a single number (at ds:f7).  I
followed this and found a compare that accessed this number.  However, I
could not find anyplace to put a crack in so I went back to find how the
answer was obtained.  What a royal pain.  I found a number that was used
to index into a block of memory that had all the answer numbers  --no
words, just numbers (started at ds:73e4).  The program would compare its
index number to sub-blocks until it found the right number.  It then
would scan a bit further until it found the number and then did its
compare.  However, it was not done until it scanned the entire block for
any other equal numbers.  So the crack involves using spare room inside
the sierra file AGI, grabbing the index number (at ds:aa) and scanning
through the memory block (starting at ds:73e4).  Once the right
sub-block was found a went a bit further and took the number there and
put it back at ds:f7--which was where the program looks for my answer.
The second part of the crack is to call the subroutine.

                                                The Mad Doctor
                                                -TOP- crack.
<*****************************************************************************>
Cracker:  The Mage
Program:  Space Ace.

        A Little Description of the Copy-Protection.  The Copy Protect was
Off of a main loop.  It was integrated into the program.  A Main screen popped
up and it went in 4 different directions.  One of these Directions led to the
Copy Protection screen which THEN let you into the game.  The Game was also in
this main loop and so Nopping out the CALL would not avail me.
        I searched the code through and through and found that it was using a
interesting comparison scheme to determine the Screens with which to load based
on 4 different variables and Combinations thereof.  This was interesting.  I
had to re-program the code to make it go to regular locations 3 out of 4 times
and the 4th time force it to jump to the game.  This required some programming
and Assembly knowledge.  The Copy Protection itself was different than any
others I have seen, or the way I got passed it was different.
<*****************************************************************************>
Cracker:  The Mage and Majik
Program: Sim Earth

        Some Background on the game..  When you load up the game it pops into a
nice menued system.  This system allowed you to mess around But on 2 different
Commands (New Planet and Load Planet I think) had a DOC check.  Now since there
was more than one CALL to the same procedure Majik had an Idea.  Since it was a
window based system and you wouldn't be expected to keep answering the DOC
check, it seemed that there must be a counter or something that checked if you
had answered the question BEFORE asking it.
        Entering Into the CALL we did some quick checking and sure enough right
at the beginning of the call was a comparision that jmped pretty much to the
end of the procedure.  Well by simply forcing this to happen you never saw the
CP again.
        A HINT to people who usually just NOP out calls.  NOP'ing out CALL's
works a lot of the time but I would suggest that you completly play the game
before you consider it cracked.  By removing the CALL statement it just removes
that current CP but it may also be called later on in the program which would
then mean additional Removals.  Look inside each CALL and see if there is a
simple way to JMP to the end of the CALL and thus eliminating that possibility.


<*****************************************************************************>

Unprotect for Starcon!

**********************************
Documentation Check
**********************************

use Pctools/Norton's DE and search STARCON.OVL for:
FE 00 75 03 E9 4C
      ^^ ^^
      EB 2A

The method involved:
        Actually not hard.  I uncompressed starcon.exe with unlzexe to
make it easier to follow through and also to find the proper bytes if I
needed to but this wasn't necessary.  By running through the code I
found the doc check.  I found right after it where the program loaded
the addresses of my answer and the programs answer with a compare
statement and conditional jump afterward.  I just made the program jump
immediately to that area.  I could have made it so the screen would not
even show up but you would have seen some garbage on the screen and it
would have been a messier crack.  Enjoy!

                                                The Mad Doctor
                                                -TOP- crack.
<*****************************************************************************>
Unprotect for The Bo Jackson Baseball!

**********************************
Pathetically simple protection
**********************************

Bo Jackson Baseball is another one of those protection checks in which
you need your manual to answer a question.

use Pctools/Nortons search for  (in BALL.EXE)
9A 4C 04
^^ ^^
EB 14

The method involved:
        The method here is so simple I am embarassed to relate it to
        you.  I ran the program once to see what the protection was.  It
        was one of those generic protection checks.  I let the
        protection kill the game and restarted it again under soft-ice.
        This time I timed it a bit and stopped the program before it got
        to the doc check.  I stepped through it with soft-ice and found
        2 calls that ran the protection.  A few steps later I found a
        conditional jump that went to the rest of the game.  So I tried
        the simplest thing.  I put a JMP statement to the rest of the
        game and it worked!  I then went into norton diskedit and
        searched for the bytes.  It wasn't there, so I searched for a
        shorter string (as above) and there was only one string like
        that in the program.  I made the changes above and it works!
        Enjoy!
                                                The Mad Doctor
                                                -TOP- crack.
<*****************************************************************************>
Unprotect for Mike Ditka Football!

**********************************
Documentation Checks and Checksums
**********************************

Mike Ditka football has the standard documentation checks but also has
some checksums early on that also have to be fixed.  This is a 3 part
unprotect.

use Pctools/Nortons search for  (in MDFB.EXE)
Part 1:    75 6B 05 00
           ^^ ^^
           90 90

re-search MDFB.exe for:
Part 2:    75 12 8E 46
           ^^ ^^
           90 90

now look in DAT101.DAT for:
part 3:    E8 A1 B7 B8 01
           ^^ ^^ ^^
           90 90 90

The method involved:
           This program uses the doc check which is not too difficult to
           find.  If you let the program run and then stop it with
           soft-ice just prior to when the doc check pops up you will
           find a call routine that calls the doc check up.  If you NOP
           it out you then go right to the main menu.  OK, now we go to
           norton's diskedit and make the changes and run the program.
           Drat! the program says bad overlay--obviously someone put a
           checksum to prevent exactly what I did.  No problem, lets go
           back into soft-ice and run the program using the soft-ice
           again and stopping the program before it gets to that
           bad overlay statement.  I then find a call routine that makes
           the statement and 2 conditional jumps that will lead up to
           that call.  So, I NOP them out and it works.  I then went
           back to diskedit and made the changes.  Now, it works.  Enjoy!

                                                The Mad Doctor
                                                -TOP- crack.

Addendum:  This program was already supposedly cracked by others.  It is
interesting that their crack works when I use soft-ice but does not work
without it.  This crack works period.

<*****************************************************************************>
Another fine patch courtesy of Majik..
Con>Format is a fine product, but the opening banner is a pain in the you
know what, and requires a keypress, which kinda ruins putting it in
autoexec.bat....(I use loadhi from QEMM so it's always there but uses no
conventional memory).
ok, here is  a step-by-step for version 1.06
1st!!!!! Run the configuration program to setup your system
2. debug confmt.com
-r   ;To display registers upon entry - write down cx's value

AX=0000  BX=0000  CX=3560  DX=0000  SP=FFFE  BP=0000  SI=0000  DI=0000
DS=24FE  ES=24FE  SS=24FE  CS=24FE  IP=0100   NV UP EI PL NZ NA PO NC
24FE:0100 E93F35        JMP     3642
keep pressing p (to proceed) until you see the following...

24FE:365C FF264036      JMP     [3640]                          DS:3640=266A
-                                                      write this down ^^^^^
-p                                                                     |
This has just completed the de-cryption algorithm for the TSR.         |
So we will code around that for future start-up.                       |
-a cs:100                                                              |
24FE:0100 jmp 266a <--- This should be what you wrote down up here  -> |
24FE:0103  <ENTER>
Now to get rid of that opening screen...
24FE:2697 E8B40D        CALL    344E  This is the call to the opening screen
-e 2697
24FE:2697  E8.90       So we will NOP it out....
24FE:2698  B4.90   0D.90
-r cx
CX 0000
:3560                 Enter the value from step 2 above.
-n cf.com             Rename the working program to whatever you like
-w                    Write it to disk
writing 3560 bytes
-q                    Enjoy.... Majik
<*****************************************************************************>
Unprotect for The Summoning!

**********************************
Graphical documentation check
**********************************

use Pctools/Norton's DE and search 'CODE.1' for:
A3 CC 0C 56 57 0E
         ^^ ^^
         EB 16

The method involved:
        I ran the program with Soft-Ice and saw what the protection
looked like on the screen.  I then went back, ran the program and
stopped it early to see what was going on.  The program is fairly
straightforward with individual call routines doing individual things.
I quickly got to the protection portions and found two calls that
brought up the protection screen and the second actually did the test
for the answer and returned back where it checked ax to see if it was
zero or not.  If it wasn't zero it wouldn't let you continue with the
game.  I just jumped past the entire section and it worked!  Enjoy!

                                                The Mad Doctor
                                                -TOP- crack.

<*****************************************************************************>
Unprotect for Martian Dreams!

Use your PC Tools or Norton Diskedit on the file game.exe

search for the hex string:
74 08 8b 5e 0a
^^                 replace the 74 with:
eb
When the protection check comes up just press enter and it will work!

The method involved:
        The difficulty in breaking this game wathat the program seemed
        to be using the same sets of code no matter what it did and this
        was extremely frustrating.  I was trying to stop the protection
        routine from even coming up.  I was unable to do this so I went
        for the next best thing, I inactivated the doc check.  Here's
        how:  when you try to get out of the spaceship with the prybar
        is when the protection springs up.  Tesla asks you a question
        from the manual.  I filled in a word and then stopped the
        program with soft-ice and searched for it in memory.  I found it
        at:    4161:eca8
        I then put a watch on it with the bpmb command in S-I.  By
        following what the program was doing with my answer I found that
        it moved it to another location:
               4161:fe6e
        I then stopped by other watch and followed this memory location.
        Lo and behold I found it was comparing my answer to a memory
        location with the answer!
               4161:ec8e
        I figured this out by changing my answer to the word found at
        this location and the program worked.  However, I needed more
        than this.  So, I started again and followed the location of the
        answer until I got to a section of the code where there was a
        comparison between my answer and their answer followed by a
        conditional jump.
               POP CX     (not obvious here but now one register has one
               POP DX      letter or my answer and one of the real answer)
               CMP DX,AX  (if they are not the same then you lose)
               JNZ 004C   (this is what I changed to a JMP statement so it
                           doesn't matter what your answer is now)
        I just changed that conditional jump to a regular jump and it works.
        Enjoy!


                                                The Mad Doctor
                                                -TOP- crack.

<*****************************************************************************>
Unprotect for Sargon 5

*******************
Documentation Check
*******************

Using Norton's Diskedit or PCTools:

Search the file  sargon5.exe for the following:

8e d6 eb a8
^^ ^^
d1 17

and that's it!

The method involved:

        Sargon 5 uses a standard documentation check.  If you run the
program under soft-ice and break it prior to the doc check you will find
the call statement that will call the doc check routine.  On my setup:
        program start 1a66:0
        call routine  2fba:32be
I ran through the call routine and input some letters.  Instead of
running the entire doc check I set soft-ice to look for my letters and
stop the program when accessed.  This brought me near the end of the
routine.  I went a bit farther and noticed a compare statement followed
by a conditional jump (at 2fba:4a92).  I changed the condition of the jump
and lo! it worked.  However, I didn't like this crack (too much work for
the gamer) and went back to the jump.  After the conditional jump there
were 2 mov statements and a return.  So, I went back to the call routine
and made the call go just to the end of the protection routine where the
mov statements were and that was it.  Now I had to find it by
diskedit--however it wasn't there.  So, since I knew where I wanted to
change memory I put soft-ice watching the spot.  Soft-ice stopped the
program and I saw a movsb statement which had the area I wanted.  That's
it--this was a more in depth discussion than usual, it wasn't hard at
all.  Bye!
          
                                                The Mad Doctor
                                                -TOP- crack.

<*****************************************************************************>
                    Secret Weapons of the Lutwaffe Unprotect
                              Cracked By The Mage

Type of Check:  Doc Check in the Beginning of the Game.
What was done:  Enabled it to press Enter 3 Times and you are into the Game.
   Very Sloppy, but works perfectly.  Not bad for a 15 minute crack.

Method Involved.
        While talking to The Mad Doctor and while we were working on Tony
Larussa's Ultimate Baseball he showed me a new technique for cracking that I
had not thought of..  simple and easier.  Anyways, At the DOC check you type in
a Name (any name, I use MAGE) and then you search memory for the name.  Search
from the first program block on up into memory.  You them in SOFT-ICE put a
Break point on Memory Access and Read.  You then continue the program and press
enter to finish the check.  You will have reads on the memory and chances are
you will find a CMP to that memory location and a simple jmp afterwards.  This
also helps you stay in the Copy Protection routines.  Well It wasn't as simple
as all that and what I had to do was jump over a lot of checking code.  I found
a JMP to a far location and used it by taking a much earlier JAE and changing
it to JMP to the far location and whammo bypassed the code and enabled you to
get into the program.  Since it was doing overlays I wasn't sure where the call
was to the whole program so I left it at hitting enter 3 times and into the
game you go.

Anyways Get out DiskEdit/Pctools andd search
the file NOTCAMP.OVL
Search for: 73 74 8B 5E
Change to : E9 64 02
            ^^ ^^ ^^

And that is it!

Thanks and greets go to everyone in -TOP-.  thanks to The Mad Doctor for the
new Technique in my collection.
                                                The Mage
<*****************************************************************************>
                       Unprotect for Crime Wave by Access
                              Cracked by The Mage
                                    --------

Type of Protection:  Doc check at the Beginning of the program.
What was done:  A JZ changed to JMP.
Method Involved.
        Well I loaded this sucker up and the program was using interupts to
process strings so I could not search through memory for a sample string
that I inputed.  Since at the Doc check itself it was sitting in DOS and I/O
system blocks of memory I put in a bad value and got a PRESS ESC or SPACE BAR
message from the program.  I then traced to where it compared to a space
like CMP AH,20 and set this to true.  Then a Simple trace to where it compared
the answer after the Interupt and a change and simple..  all of 7 minutes while
talking on the phone..  <grin>  Very Very Easy.  I tried taking out the call
completely but was unable to do so without extensive work.

Get out Norton/Pcshell
Search the File CW.EXE
Search for: 80 3D 00 74 05
Change to:  -- -- -- EB --

And save it and press enter at the DOC check.  You are in!
                                                        The Mage

<*****************************************************************************>
---------                         By Gron                           -----------
---------     3 on 3 Basketball : The Dream Team by Data East       -----------
        Protection : Doc Check

        Search : DREAM.EXE

        Locate : 7D 00 75 55 C6 06                 
        Replace:       EB
        
        Method : After loading the game into memory, I ran the program
                 until the doc check popped up.  I then kicked out to
                 Soft-Ice and traced until I found where it was looking
                 for a compare to 0D which is the ENTER key.  I then traced 
                 until it failed the protection.  This brought me back to
                 the original CALL which was used to get keyboard input, 
                 followed by a conditional jump.  Since the program did not
                 jump with my bogus input, I changed the conditional jump
                 to an unconditional one.  This worked beautifully.  However,
                 the protection scheme still came up and forced the user to 
                 enter three numbers before it would go on.  

                 Therefor, I looked back in the code and discovered that
                 immediately before the CALL which asked for input there were
                 a series of CALLs and jumps.  I noted the address of the 
                 last jump in that series which jumped just beyond where the
                 conditional jump I had changed earlier was jumping.  I 
                 reloaded the program and ran to the address I had noted.  The
                 protection scheme had yet to come up.  I changed the
                 conditional jump to an unconditional one and continued 
                 running the program.  It went right to the main menu, 
                 bypassing the protection entirely.  After playing the game 
                 for an hour or so, the protection never again surfaced nor 
                 did any noticeable side-effects of the change.
               
<*****************************************************************************>
                            Unprotect for JACK 4.59
                          Cracked by The Mage and Gron
                                 --------------

Type of Protection:  Password Entry
What was done:  Removed Protection entirely
Method:
        It came up with a screen to hit enter before the copy protection was
shown.  Broke into the code and just traced until the call to the copy
Protection.  Noped it out and it ran like a champ.  Problem arose in that the
call was a CALL FAR and this could not be found when Hex Searching.  So traced
1 statement into the CALL and JMP'd to the RETF (end of the CALL) and this was
in the Hex Search.  One Note:  This Program Sucks.

Anyways Search the File JACK1.EXE
Search for : CD 3F 14 10
Change to  : E9 8D 01 90

You are done
                                                                Later
                                                                The Mage

<*****************************************************************************>
-------------------------------------------------------------------------------
---------                  Another -TOP- unprotect                  -----------   
---------                         By Gron                           -----------
---------                                                           -----------
---------    Blue Wave Offline Mail Reader 2.10 by Cutting Edge     -----------
-------------------------------------------------------------------------------

        Protection : Registration Number

        Search : BWAVE.EXE

        Locate : 06 A2 00 00 5E 8B
        Replace:          01
        
        Method : After loading the program into memory, I traced until I 
                 found the CALL that brought up the UNREGISTERED screen. 
                 Immediately before this CALL was a CMP AX,0000 and a
                 JNZ XXXX which jumped over the offending CALL.  I looked
                 a bit further back in the code and found a MOV AL,[XXXX]
                 and a MOV AH,00.  I reloaded the program and placed a 
                 breakpoint (BPMB) on the DS:XXXX address from earlier.
                 It eventually popped out where it was moving a 00 into that
                 location.  I looked back a bit in code and found a JNZ that
                 had jumped over a MOV that would have placed a 01 into the
                 location.  Rather than change the jump, I simply changed
                 the MOV BYTE PTR [XXXX],00 to a 01.  Since every registered
                 function in the program checked this address, all features
                 are now enabled, as well as any name and registration number
                 will work.

<*****************************************************************************>
-------------------------------------------------------------------------------
---------                  Another -TOP- unprotect                  -----------   
---------                         By Gron                           -----------
---------                                                           -----------
---------            GifLite 2.00 by White River Software           -----------
-------------------------------------------------------------------------------

        Protection : Registration #

        Search : GIFLITE.EXE (UnPklite)

        Locate : C6 06 F3 00 01 C4
        Replace:             00
        
        Method : I loaded the program into memory with no options and 
                 traced through until I found the CALL that brought up
                 the shareware notice.  I then reloaded and traced until
                 I found the series of CALLs that drew each line of the
                 screen.  I then traced until I found a conditional jump
                 immediately preceding a CALL which would draw some 
                 shareware info.  I noted the address being checked, and 
                 changed the JZ to JMP to see what happened.  Sure enough,
                 that shareware section was skipped, but the rest was drawn.

                 At this point, I reloaded the program and put a BPMB (Break
                 Point on Memory Byte) on the address I noted earlier.  I 
                 then ran the program until it popped out at a 
                        MOV BYTE PTR [00F3],01
                 Since the compare had been against 00 earlier, I changed the
                 MOV to MOV BYTE PTR [00F3],00.  That was all she wrote.  

                 At this point, search the GIFLITE.EXE for "null" and change
                 it to whoever you want the program registered to.  I could
                 have changed the built-in registration (which I probably
                 should have done) to accept any name and registration number, 
                 but I didnt really feel like taking the trouble since I didnt 
                 find it unil I was half-way through this method.

<*****************************************************************************>
-------------------------------------------------------------------------------
---------                  Another -TOP- unprotect                  -----------   
---------                         By Gron                           -----------
---------                                                           -----------
---------      Veil of Darkness by Strategic Simulations Inc.       -----------
-------------------------------------------------------------------------------

        Protection : Doc Check

        Search : CODE.2

        Locate : 26 FE 47 0B 0E E8
        Replace:          0A
        
        Method : I loaded the program into memory and broke into Soft-Ice
                 right before the doc check screen was to come up.  I then
                 traced until I found the CALL to the protection scheme.
                 Immediately before the CALL was a 
                        CMP BYTE PTR ES:[BX+0A],01
                        JZ  XXXX  (beyond the CALL)
                 where ES:[BX+0A] was equal to 00.  I tried changing the
                 01 to a 00 which worked at first.  However, when I attempted
                 to leave the first room in the game, the protection popped
                 up again using the same method as above.  I set a breakpoint
                 (BPMB) on the ES address and reloaded the program.  I didnt
                 find what I was looking for, but I did notice that ES:[BX+0B]
                 was being incremented to 01 a few lines before the first 
                 doc check.  I changed the 0B to a 0A and all the protection
                 disappeared.

<*****************************************************************************>
<*****************************************************************************>
<*****************************************************************************>
<*****************************************************************************>
<*****************************************************************************>
<*****************************************************************************>
<*****************************************************************************>
<*****************************************************************************>
<*****************************************************************************>
<*****************************************************************************>
<*****************************************************************************>
End Methods File.
