                                Example Cracks



     -------------------------------------------------------------
     OK,  now let's put some of this information into practice  by
     examining a few cracks of some common programs.   First we'll
     look at a Crack for Mean-18 Golf by Accolade.   Accolade  has
     been one of those companies that has a fervent belief in Copy
     Protection.
     -------------------------------------------------------------




     Title:         MEAN-18 UnProtect For CGA/EGA Version


     This crack works by eliminating the code that tests for known
     bad  sectors  on the original diskette to see if  it  is  the
     genuine article or an illegal copy.   The code begins with an
     INT 13 (CD 13 HEX),  a DOS BIOS disk service routine followed
     a few bytes later by another INT 13 instruction.  The program
     then checks the returned value for the bit configuration that
     signifies the bad sectors and, if all is as expected, contin-
     ues on with program execution.

     The code that needs to be patched is in the GOLF.EXE file and
     in the ARCH.EXE file.  It is identical in both files and lies
     near the end of each file.

     In the following steps,  you'll locate the start of the  test
     code and patch it by replacing it with NOP instructions  (HEX
     90).   The  method described uses the DOS DEBUG  utility  but
     Norton's Utility (NU) works too.

     Copy  all  of the files from the MEAN-18 disk  onto  a  fresh
     floppy  using  the DOS COPY command and place  your  original
     diskette out of harm's way.

     Assuming DEBUG is in the A:  drive and the floppy  containing
     the files to be unlocked is in the B: drive , proceed as fol-
     lows:

     First  REName  the  GOLF.EXE  file  so  it  has  a  different
     EXTension other than .EXE.

                    REN GOLF.EXE GOLF.DEB


     Next  load the file GOLF.DEB into DEBUG and displays the  "-"
     DEBUG prompt.

                    A:> DEBUG B:GOLF.EXE

                                  13
     Search for the beginning of the code to be patched by typing:


                    - S CS:100 FFFF CD 13

     Searches  the file for the two byte INT 13  instruction.   If
     all goes well, two addresses should appear on the screen.

                    XXXX:019C
                    XXXX:01A8

     XXXX indicates that the numbers preceeding the ":"  vary from
     system  to system but the numbers following the ":"  are  the
     same on all systems.

     The  next  step is to use the "U"  command  as  indicated  to
     un-assemble  a few bytes in order to verify your position  in
     the file)

                    - U CS:019C

     (Un-assembles  32 bytes of code.   Verify the  following  se-
     quence of instructions:

                    INT       13
                    JB        01E9
                    MOV       AL,[BX+01FF]
                    PUSH      AX
                    MOV       AX,0201
                    INT       13
                    POP       AX
                    JB        01E9
                    CMP       AL,F7
                    JNZ       01B5

     These are the instructions you'll be patching out in the fol-
     lowing step)

                    - A CS:019C

     This command assembles the new instructions you enter at  the
     keyboard into the addresses shown.  Beginning at CS:019C, and
     for the next 21 bytes, ending with and including CS:01B0, en-
     ter  the no op command "NOP" (90h) followed by a <return>  or
     <enter>.   Just hit <enter> at address XXXX:01B1 to  end  the
     assemble command.)

                    XXXX:019C  NOP <enter>
                    XXXX:019D  NOP <enter>
                               .
                               .
                               .
                    XXXX:01AE  NOP <enter>
                    XXXX:01AF  NOP <enter>

                                  14
                    XXXX:01B0  NOP <enter>
                    XXXX:01B1 <enter>

     This just wipes out the section of code containing the INT 13
     check.

     Now  do  a HEX dump and verify that bytes 019C  through  01B0
     have been set to 90 HEX.

                    - D CS:019C

     If they have, write the patched file to the disk as follows)

                    - W

     This    writes    the    patched    file    back    to    the

     disk where it can be run by typing    GOLF just as before but
     now,  it  can be run from any drive,  including  the     hard
     drive)

     Now just [Q]uit or exit back to DOS.  This command can be ex-
     ecuted at any "-" DEBUG prompt if you get lost.  No modifica-
     tion will be made to the file on the disk until you issue the
     "W" command.

                    - Q

     The process is the same for the ARCH.EXE file but because  it
     is a different length, the segment address, (XXXX part of the
     address),  will be different.   You should find the first INT
     13  instruction  at address XXXX:019C and the second  one  at
     XXXX:01A8 as before.

     You  will again be patching 21 bytes and you will start  with
     019C and end with 01B0 as before.   After doing the HEX  dump
     starting  at address 019C,  you again write the file back  to
     the disk with a "W" command then "Q" uit.

     Norton's utilities can also be used to make this patch.   Be-
     gin  by searcing the GOLF.EXE or ARCH.EXE files for  the  two
     byte  combination  CD  13 (remember to  enter  these  as  HEX
     bytes).  Once located, change the 21 bytes, starting with the
     first "CD"  byte, to 90 (a NOP instruction).  As a check that
     you  are in the right place, the byte sequence in both  files
     is  CD 13 72 49 8A 87 FF 01 50 B8 01 02 CD 13 58 72 3C 3C  F7
     75 04.   After modifying the bytes,  write the modified  file
     back to the disk.  It can then be run from any drive.

     END.






                                  15
     ------------------------------------------------------------
     That was the first the tutorial cracks,  here's another crack
     based on the same ideas but using Norton's Utilities instead.
     The  following  is an unprotect method  for  Eypx  Submarine.
     Eypx is another one of those companies bent on protecting the
     world.
     ------------------------------------------------------------


     By:            Assembler Magic
     Title:         EPYX Submarine Unprotect


       You  will  only need to make one modification to  the  main
     executable program of Submarine, SUB.EXE.  I will assume that
     your  computer  has a hard disk and that you have a  path  to
     DOS. It's time to fire up DEBUG as follows:

                    DEBUG SUB.EXE<cr>

       The computer should respond with a "-" prompt.  Now look at
     the  registers,  just to make sure everything came  up  okay.
     Type the letter "R"  immediately after the prompt.   The com-
     puter should respond with a few lines of info as follows:

     AX=0000  BX=0001  CX=6103  DX=0000  SP=0080  BP=0000  SI=0000
     DI=0000  DS=12CE ES=12CE SS=37B2 CS=27FC IP=0010 NV UP EI  PL
     NZ NA PO NC
          27FC:0010 8CC0       MOV     AX,ES
     -

       Note  the value of CS is "27FC".   That is the  hexadecimal
     segment address for the beginning of the program code in your
     computer's memory.   It is highly probable that the value you
     see for CS will differ from mine.   Whatever it is,  write it
     down.  Also, the values you see for DS, ES and SS will almost
     certainly differ from mine and should not cause you  concern.
     The other registers should show the same values mine do,  and
     the flags should start with the same values.

       Next,  we will do a search for Interrupt 13's.   These  are
     BIOS  (not DOS) Interrupts built into the program  which  are
     used  to ensure that the original disk is being used  to  run
     the program. The whole key to this unprotect scheme is to by-
     pass these Interrupts in the program code.   The tricky  part
     of this unprotect is to find them!   They are not in the seg-
     ment  of  program code starting at the value of CS  equal  to
     "27FC".   They are closer to the beginning of the program  in
     memory.   Easy enough!   Reset the value of CS to  equal  the
     value  of DS as follows; type immediately after  Debug's  "-"
     prompt:

                    RCS<cr>


                                  16
     Debug will prompt you for the new value of CS with:

                    CS:27FC:

       You  respond  by typing the value of DS you  saw  when  you
     dumped the registers the first time.   For example,  I  typed
     "12CE<cr>".   The  value you type will be  different.   Debug
     will  again respond with the "-"  prompt which means  we  are
     ready to do our search.   Type in the following after the "-"
     prompt:

                    S CS:0 FFFF CD 13<cr>

       The computer should respond with three lines of information
     which are the addresses of the three Interrupt 13 calls built
     into the program.   The first four digits are the segment ad-
     dress  and will equal to the value of CS you have  just  set.
     The second four digits following the colon are the offset ad-
     dresses which are of primary interest to us.   On my  machine
     they came back as follows:

                    12CE:4307
                    12CE:431F
                    12CE:4335

       The segment addresses will be identical and the three  off-
     set  addresses should all be relatively close together.   Now
     look at the first offset address.  (As you can see,  mine was
     "4307".) Write it down.  Now we do a bit of Unassembly.

       Type "U4307<cr>"  which is the letter "U", followed immedi-
     ately  (with no blank spaces) by whatever your  first  offset
     address turned out to be, followed by a carriage return.   If
     you are not familiar with unassembled machine code,  it  will
     look like lines of gibberish as follows:

                    12CE:4307 CD13        INT      13
                    12CE:4309 4F          DEC      DI
                    12CE:430A 744C        JZ       4358
                              .
                              .
                    12CE:431F CD13        INT      13
                    12CE:4321 4F          DEC      DI
                              .
                              .
                    12CE:4324 BF0400      MOV      DI,0004
                    12CE:4326 B80102      MOV      AX,0201

       In  my computer,  Unassemble will automatically  output  16
     lines of code to the screen.  Yours may differ.  Note, in the
     abbreviated list I have shown above, the addresses at the be-
     ginning  of  the two lines which contain the  Interrupt  13's
     (INT  13) correspond to the first two addresses we  found  in
     our search.  Now we continue the unassemble, and here comes

                                  17
     another  tricky part.   Just type in "U<cr>"  after  the  "-"
     prompt.

       You'll get sixteen more lines of code with the third Inter-
     rupt 13 on a line which begins with the address (CS):4335  if
     you  have  the same version of Submarine as I do.   It's  not
     terribly  important  to  this  exercise,   but  it  will   at
     least show you that things are proceeding okay.   Now type in
     "U<cr>"  again  after the prompt.  You are  now  looking  for
     three key lines of code.   On my program they appear as  fol-
     lows:

                    12CE:4335 07          POP      ES
                    12CE:4356 5D          POP      BP
                    12CE:4357 CB          RETF

     The true key is the instruction "POP ES".   This  instruction
     begins  the normal return sequence after the program has  ex-
     ecuted its Interrupt 13 instructions and accompanying checks.
     If  Debug on your machine prints fewer than 16 lines of  code
     at a shot, you may have to type in "U" more than twice at the
     "-" to find these instructions.  (If you haven't found any of
     this stuff, either get help on the use of Debug or go back to
     using your diskette version!)  Write down the offset  address
     of  the "POP ES"  instruction; the four digits following  the
     colon,  which in my example is "4354".   You're well on  your
     way now, so please persevere.

       The  next step is to modify the program to JUMP around  the
     code which executes the Interrupt 13's and go immediately  to
     the  instruction  which  begins the  normal  return  sequence
     (again,  it's the "POP ES".  Type in the  following  instruc-
     tions carefully:

                    A4307<cr>

       This first bit tells Debug that new Assembler code will  be
     inserted at the address of the first Interrupt 13.   If  your
     first  Interrupt 13 is at an address other that  "4307",  use
     the correct address,  not mine.  The computer will prompt you

     with the address:

                    12CE:4307

     After which you will immediately type:

                    JMP 4354<cr>

     This instruction jumps the program immediately to the  normal
     return code instructions.  Again, at the risk of being redun-
     dant, if your "POP ES" instruction is at a different address,
     use that address, not "4354"!

     The computer will prompt you with the address of the next in-

                                  18
     struction  if  all went well.   MAKE SURE you  just  hit  the
     carriage  return at this point.  Debug will then  return  the
     familiar "-" prompt.

     Now  it's  time  to examine your  handiwork.   Let's  do  the
     unassemble again starting at the address of what had been the
     first Interrupt 13 instruction, but which is now the Jump in-
     struction.  Type in "U4307<cr>" or "U" followed by the appro-
     priate address and a carriage return.   The first line begin-
     ning with the address should appear as follows:

                    12CE:4307 EB4B        JMP      4354

     The key here is the four bytes immediately following the  ad-
     dress.   In my example they are "EB4B".   Yours may  not  be.
     But,  they are VERY IMPORTANT because they represent the  ac-
     tual machine code which is the Jump instruction.  WRITE THESE
     FOUR BYTES DOWN AND MAKE SURE THEY ARE CORRECT.

       Now  if  you want to have some fun before we go  on,  reset
     register  CS to its original value by first typing  "RCS<cr>"
     at  the "-"  prompt.   Then type in the original value of  CS
     that I asked you to write down.   Using my example,  I  typed
     "27FC<cr>".  Next, you will type "G<cr>" after the "-" prompt
     which  means GO!   If all went well,  SUB should run at  this
     point.   At  least it will if you put all  of  the  Submarine
     files  onto the diskette or into the hard  disk  subdirectory
     where youre working.   If it didn't run, you may have made an
     error. Check through what you have done.

     Don't give up at this point if it does not run.  Your version
     of Debug may simply have not tolerated our shenanigans.  When
     you are done playing, quit Submarine ("Alt-Q<cr>") and type a
     "Q<cr>" after the Debug prompt "-" appears.

     Now  comes  the tough part.   I can't walk you  through  this
     phase  in complete detail,  because you may be using  one  of
     several programs available to modify the contents of SUB.EXE.
     Debug is not the way to go,  because it can't write out  .EXE
     files, only .COM files.

     -------------------------------------------------------------
     Note:  Another method of doing this is to REName the  SUB.EXE
     file  so it has a different extension other than .EXE  before
     you enter DEBUG.   That way after you've made the change  you
     can then [W]rite then changes out to the file right in DEBUG.
     Then one drawback is that you can't run the program in  DEBUG
     once you've changed the name.
     -------------------------------------------------------------

     You have to get into your sector modification package (NORTON
     works good) and work on the SUB.EXE file on your new diskette
     or your hard disk.  Remember, I warned you that doing this on
     your hard disk is dangerous if you are not fully aware of

                                  19
     what you are doing.  So, IF YOU MESS UP, it's YOUR OWN FAULT!

     You  are looking for the first occurrence of an Interrupt  13
     (the "CD 13") using the search facility in your program.   If
     you  don't have the ability to search for the two-byte  hexa-
     decimal code "CD 13" directly, then you will have to manually
     search.

     -------------------------------------------------------------
     Note:  Norton 4.x now has a search utility.   When you get to
     the  point of typing in the search text,  just press the  TAB
     key, and you can type in the actual hexadecimal code "CD 13".
     -------------------------------------------------------------

     Start  at the beginning of SUB.EXE and proceed.   Again,  you
     want to find the first of the three (first from the beginning
     of the program).

     I  will give you a hint.   I found it in NORTON  at  location
     4407  hexadecimal  which is location 17,415  decimal  in  the
     SUB.EXE program file.   DOS standard sectors are 512  decimal
     bytes.  Replace  the two bytes "CD 13"  with the "EB  4B"  or
     whatever  your Jump instruction turned out to be.   Write  or
     save the modified file.

     That's ALL there is to modifying SUB.EXE.   You can go  ahead
     and execute your program.   If you have followed my  instruc-
     tions, it should run fine.  Get help if it doesn't.  Now, you
     should be all set.  You can load onto your hard disk,  if you
     haven't already.  You can run it from a RAM disk using a  BAT
     file if you really want it to hum.   Or,  if you have the fa-
     cilities,  you can copy it from 5-1/4" floppy to 3-1/2"  dis-
     kette and run it on machines which accept that medium if  you
     upgrade to a new computer.

     END.
                                  20
     -------------------------------------------------------------
     Now let's take a look at a newer crack on the program,  Space
     Station Oblivion by Eypx.  At a first [S]earch with Debug and
     Norton's  Utility no CD 13's could be found,  and yet it  was
     using them... So a different approach had to be taken...
     -------------------------------------------------------------


     By:            PTL
     Title:         Space Station Oblivion Crack


     First of all,  you must determine which file the INT 13's are
     in,  in this case it had to be the file OBLIVION.EXE since it
     was the main program and probably contained the INT 13's.  So
     then rename it to a different EXTension and load it into  De-
     bug.

     Then do a [S]earch for INT 13's.

                    -S 100 FFFF CD 13

     Which will promptly turned up nothing.  Hmmm...

     Next you might decide that, maybe, the code was modifying it-
     self.   So quit from Debug and load up PC-Watch,  include all
     the  INT  13  Calls.   For those of  you  not  familiar  with
     PC-Watch,  it is a memory resident program that can be set to
     look  for  any type of BIOS call.   When that  call  is  made
     PC-Watch prints to the screen the contents of all the  regis-
     ters  and the current memory location that the call was  made
     from.

     After PC-Watch is initialized, then run the OBLIVION.EXE file
     from the hard disk,  leaving the floppy drive door open,  and
     sure  enough,  when the red light comes on in   the  diskette
     drive,  PC-Watch  will report the address's of  some  INT  13
     calls.  Which you should then write down.

     From  there,  quit the game, reboot,  (To dump PC-Watch  from
     memory) and load the OBLIVION.EXE into Debug and issue a [G]o
     command with a breakpoint.  What address should you use for a
     breakpoint?   You guessed it, the same address PC-Watch gives
     you.

     Well,  it locked up did'nt it?  Which is quite common in this
     line of work so don't let that discourage you.   So next  re-
     loaded  it into debug and this time [U]nassemble the  address
     that you got from PC-Watch.   But instead of finding the  INT
     13's you'll find harmless INT 21's.

     Hmm...  could  it be that the program was converting  the  CD
     21's to CD 13's during the run?   Well,  to test the idea as-
     semble an INT 20 (Program Terminate) right after the first

                                  21
     INT 21. Then I run the program, and yes immediately after the
     red light comes on the drive, the program will terminate nor-
     mally.

     Then [U]nassemble that same area of memory,  and low and  be-
     hold,  some  of the INT 21's have magically turned  into  INT
     13's.  How clever...

     So,  then it is just a matter of locating the address of  the
     routine that it jumped (JMP) to if the correct disk was found
     in  drive A:.   Once you have that address,  just go  to  the
     start of all this nonsense and [A]ssemble a JMP XXXX command.
     Where  XXXX was the address to jump to if the  original  disk
     was in drive A:.

     Then  just [W]rite the file back out to the disk  and  [Q]uit
     debug,   and  then  REName  the  file  back  to  OBLIVION.EXE
     afterwhich it should work fine.


     END.


