Category : Lotus and other Spreadsheets
Archive   : LNC10.ZIP
Filename : LOTUSNC.DOC

Name Changer for Lotus 1-2-3 Release 3.1

Written by Kent Briggs
ver 1.0 12/22/90

This routine allows you to change the user name, company name and
serial number on the Lotus 1-2-3 Release 3.1 opening screen. When
you install 1-2-3 for the first time, you are prompted for this
information only once with no opportunity to change it later.

This routine only works on Release 3.1.

The names and serial number are stored in a scrambled format in
a file call INSTEXT.RI starting at offset 9902h. LOTUSNC.EXE will
unscramble the current names, display them, allow you to change them,
rescramble, and store them back in INSTEXT.RI. No patches are made
to any of the executable files.

** Instructions **

1. Backup INSTEXT.RI in case you need to restore the original names:

COPY INSTEXT.RI INSTEXT.BAK

2. Put LOTUSNC.EXE in your Lotus directory:

COPY LOTUSNC.EXE C:\123R3 (your directory may be different)

3. Execute program:

CD \123R3
LOTUSNC

4. Old names are displayed. Enter changes as needed. Use cursor
keys to move between names. Use SPACE to blank out characters.

5. Press F1 to save changes or Esc to quit without saving.

6. Run 123.EXE to confirm changes.




Technical Information


When you install Lotus 1-2-3 for the first time, you are prompted
for your name and company. This information is stored back on the
install disk and displayed on the screen every time 1-2-3 is executed.
You cannot change the names after they are entered, so if you misspelled
your company's name, you look like an idiot every time 1-2-3 is used.
Any future re-installation will automatically copy the same names to
the hard drive. This is the so-called "copy protection by embarrassment"
scheme. If you install a copy of your company's 1-2-3 on your PC at home,
all of your friends will know that you didn't pay for it.

After spending a weekend using Turbo Debugger (thank you, Borland),
I figured out where and how the user/company names are stored. Lotus
scrambles this data to keep people (like me) from finding it. If you
try to modify any of this data, it will fail an integrity check and
1-2-3 will not execute.

My routine (LOTUSNC.EXE) works by scrambling names exactly like the
Lotus INSTALL program does. It also calculates and stores the checksums
so 1-2-3 will execute normally.

Starting at offset 9902h in the file INSTEXT.RI is the user name (up to
30 characters) followed by a 00 byte. Following this is the company name
(also up to 30 characters) and another 00 byte. Then comes the serial
number (usually 15 characters, but there is room for 17) and a 00 byte.
The remaining bytes are filled with 00's for a total of 80 bytes.

The next 16-bit word is an XOR checksum of the first 80 bytes. Starting
with a base value of 0EEFh, the data is XOR'ed together 16 bits at a
time but with an 8-bit overlap. Now all 82 bytes are scrambled using
a byte-for-byte XOR. The bytes used in the scrambling routine are not
stored sequentially, but are always accessed in the same order. I just
wrote them down and stored them in my own array. Finally, another 16-bit
XOR checksum is calculated on the scrambled data and tacked onto the end
of the scrambled 82 bytes. The initial base value is 332Dh this time.

What a mess! Lotus programmers probably spent weeks dreaming this up.

I have successfully tested this routine on several copies of 1-2-3. If
you have any comments, please leave me a message on one of the following
BBS's:

Channel 1 (Boston) 617-354-8873
Exec-PC (Milwaukee) 414-789-4210