PIRACY BY TEACHERS?? I was shocked that after watching a stupid Video Tape critisizing and Stating how stupid Hackers and Pirates are (Which is not true of course), that the school is using pirated software? Yes, that's right, If you will notice the next time you use Print shop in the computer room, that it says "Cracked By Mr. Krackman." So I've decided to start a column on unprotecting IBM programs... To start it off, here's one for News Room and Kings Quest III. The following debug session will alow you to copy the Newsroom files to any disk and run them from that disk. However, the Newroom program will still want you to enter the clip-art disks in drive A: and any banner, panel, or wire service disks in will also have to be put in drive A:. None of the disks need any copy protection, so therefore can be copied from disk to disk and still be run. Just follow the instructions carefully. First copy all the Newsroom files on to a clean disk. Also copy the Debug program on to the same disk. RENAME NWSRM.EXE 1 DEBUG 1 -E 691A EB 41 -E 6973 90 90 -E 6977 EB 25 90 - {THE FOLLOWING PORTION IS TELLING THE NEWSROOM DISK WHERE TO FIND CERTAIN FILES SUCH AS LOGO.PIC, NRTITLE.PIC, NRSETUP, ALONG WITH ALL THE PRINTER AND MODEM CONFIG TABLES.} AT THE FOLLOWING LOCATIONS ENTER THE APPROPRIATE HEX VALUE: FOR DRIVE A: 41 FOR DRIVE B: 42 FOR DRIVE C: 43 FOR DRIVE D: 44 -E 8F4B XX -E 92D2 XX -E 9316 XX -E 9349 XX -E 9354 XX -E 9B59 XX -E 9B66 XX -E 9B73 XX -E 9B8F XX -E 9BA5 XX -E 9CD4 XX -E 9D9D XX -E 9DAA XX -E 9DB7 XX -E 9DCE XX WHERE XX = THE DRIVE NUMBER DESIGNATED ABOVE -W -Q RENAME 1 NWSRM.EXE DEBUG NWSRM1.OVL -E 05DB 8B 46 04 89 46 FE 3B 46 04 -W -Q DEBUG NWSRM22.OVL -E 10C6 B8 05 43 -W -Q That's all there is to it. Now just copy it over to any disk you want and run it from there. Just remember that it is going to look for certain files on the drive that you told it before in the debug session. ---------------------------------------------------------------------- NPROTECTING KINGS QUEST III - IBM PC VERSION --------------------------------------------- To unprotect Kings Quest III, you will need a DOS disk with DEBUG.COM, the original master diskette 1, a freshly formatted diskette, and about 15 minutes. Boot the system with a standard DOS disk and answer the date and time prompts. Place the Kings Quest disk in the A drive and the DOS disk with DEBUG in the B drive. Enter the following lines, explanations and non key strokes are shown in parenthesis. A>B:DEBUG SIERRA.COM -G100,3E4 (during this time the KQ disk will run, you will be prompted to press ENTER twice) (remove the KQ disk and place the freshly formatted diskette in the A drive) -A100 xxxx:0100 JMP F10 xxxx:0102 (just press ENTER here) -AF10 xxxx:0F10 MOV AX,CS xxxx:0F12 MOV DS,AX xxxx:0F14 MOV ES,AX xxxx:0F16 MOV SS,AX xxxx:0F18 MOV SP,2C1 xxxx:0F1B MOV BX,9E xxxx:0F1E MOV AH,4A xxxx:0F20 INT 21 xxxx:0F22 MOV AX,1C0D xxxx:0F25 MOV BX,70 xxxx:0F28 MOV CX,1 xxxx:0F2B MOV DX,1A00 xxxx:0F2E MOV BP,0 xxxx:0F31 MOV SI,636 xxxx:0F34 MOV DI,1C1 xxxx:0F37 JMP 3E4 xxxx:0F3A (just press ENTER here) -RCX 0001:0E3A -W 0E3A Bytes Written -Q A> (Place the original KQ disk in the B drive and enter the following. COPY B:AGI COPY B:*.OVL COPY B:WORD.TOK COPY B:OBJECT COPY B:LOGDIR COPY B:SNDDIR COPY B:VIEWDIR COPY B:PICDIR COPY B:VOL.* (Have fun! KQ should also be able to be used on a hard drive with this procedure, but hasn't been tried.) ---------------------------------------------------------------------- Here's a little Tutorial on how to Crack games.. +------------------------------------------------------------------------------+ | | | Cracking Tutorial 1 | | By Captain Quazmo | | (INT 13 and DOS files) | +------------------------------------------------------------------------------+ This is a Tutorial on Cracking. Let's start out with a simple defintion for the word "CRACKING". Cracking is the art or STRIPPING the protection off a disk or file. Thus allowing that program to run on a Hard Disk or be copied freely. In the case of a whole disk, the disk must be decoded and converted into a file. This process is rather hard to do so I will discuss it in ter Tutorial. In this tutorial, I will explain how to beat the "INT13 Protection". this routine is used on most disks today. In this tutorial I will make refrence to these programs LOCKSMITH - Aplha Logic PCWATCH - IBM FSD - IBM You can use these programs or any others that do the same things. DiskMechanic will work in place of Locksmith (used for analyss of Track information.) TRAP13 will replace PCWATCH (to find where the program access INT 13h), and dos's DEBUG will surfice for FSD. Please remember that if you use DEBUG on and ".EXE" file, you will first need to rename it "filename.ZAP" and when in debug, all address are +100h. In this tutorial, We will go thru and crack "The Ancient Art of War". we will start by analyzing the disk with Locksmith and End of Changeing it with DEBUG (if you are asking why I am using debug, when I cracked it I didn't have FD.) The first thing we will do is analyze the disk with LOCKSMITH. We search both sides of the disk using the "Analyze" command in the track menu. We mark down the sector that have high SECTOR NUMBERING, WRONG N SIZE, or CRC ERRORS. Make carefull note of these numbers for we will need them in the future. Now Exit Locksmith and Enter PCwatch. EXCLUDE everything in window #1 execpt "CARRY FLAG SET", INCLUDE [F1] this. Go over to window #3 and hit PgDn until you see the INT13 options. INCLUDE "READ SECTOR". In window #2 tell it to output to printer. Now exit the program [F4]. Place the AAOW (ancient art of war) disk in drive A:. Type "A>WAR". The Game will load but slowly and the printer will run. When the game is loaded replace the AAOW disk with DOS and reboot. Take the listing and examine it. Forget about any call from [0070:xxxx] for these are used to load in the program. Now make a copy of you war disk using DISKCOPY or LOCKSMITH sector copy. This will be out work cpy. Debug the main program on the disk [WAR.EXE]. Examine the listing from PCWATCH. Find the First address [nnnn:XXXX] besides [0070:xxxx]. In AAOW it is or rather should be [nnnn:8BDA]. unassemble [U] 10 bytes back [U 8BAA]. This allows us to see the int13. The next instruction after the CD 13 [INT 13h] should either be a CMP or a JMP of some sort. In most protection routines usually have a JC or JB after their INT13. You must decide now what is needed to be done here according to the jumps seen. If a JC or JB follow INT13 then try this. Replace INT13 (2 bytes CD 13) with STC & NOP. These 2 command SET the CARRY Flag. If the program Doesn't rechange "STC" to "CLC". The CLC is one of the most used ways to get around INT13 protection. AAOW uses "CLC". It goes out and looks for a Sector. If it is not found then it has an Error. The CLC hardwires the Error. Write the file out again. You have now cracked your first program (with a little HELP.) You can use this techinque on st DOS files. Please remember, after you crack something, leave the UNPROTECT on your local board so other can use them. ---------------------------------------------------------------------- Captain Quazmo....Leader of the AT&T Underground.............. ---------------------------------------------------------------------- Here's an underground Newspaper on Kracking... +----------------------------------------------------------------------------+ | | | KRACK | | April 1986 | | Volume 1 Number 1 | | | +----------------------------------------------------------------------------+ You are reading KRAK, the official Kracking Textfile. This file is put out by the Cellar Elite. Captain Quazmo is the Head editor. If you wish to submit articals to KRACK just upload a Text file in IBM PC format to one of the official KRACK boards. Krack is for all type of computers. Apple and C/64-128 users let's get going. +----------------------------------------------------------------------------+ | | | Cracking NewsRoom | | IBM-PC format | | | | Captain Quazmo | | | +----------------------------------------------------------------------------+ There are a couple of unprotects going around for this piece of software. This one is rather short but others make you change 51 other bytes that seem to be unneeded. You will need DEBUG for you dos diskette and a Copy (doesn't matter if it works) of NewsRoom. At Dos: A> Ren nwsrm.exe nwsrm.zap A> Debug nwsrm.zap -E 691A EB 41 -E 6973 90 90 -E 6977 EB 25 90 -W -Q A> Ren nwsrm.zap nwsrm.exe A> Debug nwsrm1.ovl -E 05db 8B 46 04 89 46 FE 3B 46 04 -W -Q A> Debug nwsrm22.ovl -10C6 B8 05 43 -W -Q You now have a working copy of newsroom. The only not is that all file most reside on drive A:. Assign can be use to allow this program to work on a hard drive. +----------------------------------------------------------------------------+ | | | Defeating Prolock | | from the Locksmith Procedures manual | | | +----------------------------------------------------------------------------+ You will need: Dos DEBUG A formatted Blank diskette A non working copy of the program This tutorial show how defeat prolock on dBASE III but can be used for most prolocked disks. A> Debug DBASE.exe -R You will now see whats in the registers. Record the values -U -U Look for a LOOP instruction. The next instruction will be a XCHG. Using the Address in the first column [091B:XXXX 92 XCHG DX,AX] enter -G XXXX -S 100 3000 83 c4 08 Some address will be listed. Take the last address 091b:XXXX and -A XXXX XOR AX,AX RET Press Return twice until the "-" prompt. enter -S 100 3000 C0 45 F8 This will display a single value [091B:XXXX]. use it and enter -E XXXX 0B 46 -M 0:c f 0:200 Prolock will test for the original diskette enter -R BX 0001 -R CX When prompted enter the original value of CX -N TEMP -S 100 3000 4D 5A Several values will be displayed. Remove the program disk and insert the black disk and type -W 1A50 -Q A> Ren temp dbase.exe +----------------------------------------------------------------------------+ | | | LockSmith Instructions | | IBMpc Format | | | +----------------------------------------------------------------------------+ Locksmith is in my oppion the BEST copy program for the IBMpc. Using Special Parameters Locksmith can copy almost anything. I hope to explain to all you PC Pirates how to use this great program. This is first in a 2 part series on the use of locksmith. LOCKSMITH MAIN SCREEN Status Line Drives: A: > B: DRIVE TRACK SECTOR OPTIONS MISC QUIT Locksmith/PC Ver. 0.0 ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ TRACK: 0000000000000001111111111111112222222222 ³ Sector: 00 ³ 123456789ABCDEF012345678ABCDEF0123456789 ³ T H S N Stat % ³ Head 0: ................Window #1............... ³ ³ Head 1: ........................................ ³ 00 0 1 2 0000 09 ³ ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ´ 00 0 2 2 0000 09 ³ [0000] 0 1 2 3 4 5 6 7 8 9 A B C D E F³ 00 0 3 2 0000 11 ³ 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00³ 00 0 4 2 0000 -11 ³ 0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00³ 00 0 5 2 0000 12 ³ 0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00³ 00 0 6 2 0000 14 ³ 0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00³ 00 0 7 2 0000 00 ³ 0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00³ 00 0 8 2 0000 -02 ³ 0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00³ 00 0 9 2 0000 11 ³ 0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00³ 00 0 A 2 0000 29 ³ 0070 W i n d o w # 3 ³ ³ 0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00³ ³ 0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00³ ³ 00A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00³ ³ 00B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00³ ³ 00C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00³ Window #2 ³ 00D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00³ ³ 00E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00³ ³ 00F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00³ ³ Status Line - This line show all messages from Locksmith. I give discriptions In the main and secondary menu modes. Drives: A: > B: - The first letter [A:] is the Source drive and the second letter is the Target drive Drive - Change Drive information Letter - Change the Source & Target drives Controller - Change the FDC control codes Track - Track Utilitys Analyze - Analyze the selected track showing their N value and any Errors. Backup - Copy selected track from Source to Target drives Format - Format selected track in Regular/IrRegular formats Erase - Erase selected track to the Fill Byte Hidden - Search for irregular sector sizes and number Read - Read in a selected track Write - Write out a selected track Compare - Compare tracks with information in BUFFER Print - Print out Track Buffer Secoter - Sector Utilitys Backup - Fast copy [35 sec.] Read - Read in sectors Write - Write out sectors Compare - Compare sectors with memory Options - Set up Locksmith's parameters Misc - Misc. Functions Reset - Reset all information to Default PrintSetup - Redefine the print tables Search - Define a string to Search for Quit - Quit to DOS [A>] Window #1: Current Track Window. This window is used for selecting what Tracks are to be used. To get to this window press the [F1] key. If a number (Track) has a "." under it then it is to be used. The SPACEBAR is used to toggle a single Track. The "+" key is used to toggle the whole side of a disk. Left and Right Arrows keys are used to move the cursor. Window #2: This is the Sector window. Here you will find the Size (N) and the Error in the sector if any and the percent of the track taken up by that sector. By examine the sector's number you can find out how how the sectors are really numbered because some protection schemes use abnormal sector numbering. HOME will take you to the top of the screen to the Number of sectors [SECTORS: 00] prompt. This is used in creating your own protection schemes which will be explained in the next issue of KRACK: [F2] get this window Window #3: The data window can be used to examine, edit and create data to be written out to the disk. So protection schemes need certain bytes to be changed. [F3] get you here while [F9] toggle Ascii/Hex display. If a search string has been entered then [F10] will start the search. Copying something with locksmith is pretty easy. If the disk is unprotected then use the BACKUP in the SECTOR utilitys. If the disk is protected then you must use the BACKUP in the TRACK utilitys. The best way to copy a protected diskette is the first to Slow Copy the whole disk [TRACK utilitys] then write down any odd tracks (more sectors than the other errors etc.). Use Fast copy [SECTOR utilitys] to copy similar track then use Slow copy to copy the Fuckup tracks. =-=-=-=-=-=-=-=-=-=-=-=-=-=-LockSmith Parameters-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Lotus 123: Slow Copy Side 0 tracks 3,7 and Side 1 track 4. Fast copy the rest Harvard Project Manager v 1.1: Fast Copy all track the Analyze side 1 track 1A Edit buffer and change address 0F46 to 01 Office Writer: Fast copy all track. Copy tracks 28,29 both sides Super Cala: Fast Copy all Tracks Infocom: Slow copy all tracks WordStar 2000: Fast copy all tracks XYWrite II: Fast copy all tracks +----------------------------------------------------------------------------+ | | | Official KRACK Boards | | | +----------------------------------------------------------------------------+ Do you want your board to be an official Krack board. Just leave a message on one of the current Krack Boards. Spectrum 007 [24 hours]........................................[914]-338-8837 Outer Limit [24 hours]........................................[914]-462-0363 Thief World [Midnight-6am]....................................[914]-462-2256 Cap' Quazmo P.S. Call Ninja's Palace (914)297-0334 300/1200 baud ------------------------------------------------------------------------------- -By Underground #2