Category : Unprotects for Games and Such
Archive   : CARRIER.ZIP
Filename : CARRIER.UNP

-------------------------
Carrier Command unprotect

By the MAD VANDAL
-------------------------

Well, ANOTHER doc check. At least they were explicit about it. It can
be removed like most by a small change.

For norton users search the file CARRIER.EXE for the byte pattern C2 00 74 AB
and change the 74 AB to 90 90.

DEBUG method. DEBUG is assumed to be in the current path or dir.

1. REN CARRIER.EXE CARRIER.ZAP

2. DEBUG CARRIER.ZAP

3. At the DEBUG '-' prompt enter E FBB9 90 90

4. Enter 'W' to save it

5. Enter 'Q' to quit

6. REN CARRIER.ZAP CARRIER.EXE

For those interested, the program changes are shown below:

BEFORE

XXXX:FB66 FF0E82C2 DEC WORD PTR [C282] <- Count down tries
XXXX:FB6A 785F JS FBCB <- Jump if no tries left
XXXX:FB6C B87200 MOV AX,0072 <
XXXX:FB6F BB9A00 MOV BX,009A <
XXXX:FB72 B9DE00 MOV CX,00DE <
XXXX:FB75 BAAD00 MOV DX,00AD <
XXXX:FB78 E846F9 CALL F4C1 <
XXXX:FB7B E84300 CALL FBC1 <
XXXX:FB7E BE9457 MOV SI,5794 <
XXXX:FB81 C60400 MOV BYTE PTR [SI],00 <
XXXX:FB84 83EE02 SUB SI,+02 <
XXXX:FB87 8B34 MOV SI,[SI] <- Entire copy protection
XXXX:FB89 B82000 MOV AX,0020 < routine
XXXX:FB8C BB1000 MOV BX,0010 <
XXXX:FB8F B97800 MOV CX,0078 <
XXXX:FB92 BAA100 MOV DX,00A1 <
XXXX:FB95 E8C087 CALL 8358 <
XXXX:FB98 C6067FC200 MOV BYTE PTR [C27F],00 <
XXXX:FB9D C6067EC200 MOV BYTE PTR [C27E],00 <
XXXX:FBA2 FF1E3C0D CALL FAR [0D3C] <
XXXX:FBA6 E84687 CALL 82EF <
XXXX:FBA9 FF16CC0A CALL [0ACC] <
XXXX:FBAD 803E7FC200 CMP BYTE PTR [C27F],00 <
XXXX:FBB2 74EE JZ FBA2 <
XXXX:FBB4 803E7EC200 CMP BYTE PTR [C27E],00 <- Check entry
XXXX:FBB9 74AB JZ FB66 <- Jump if entry is wrong
XXXX:FBBB C606BD0EFF MOV BYTE PTR [0EBD],FF <- Set flag
XXXX:FBC0 C3 RET <- leave routine and play
XXXX:FBC1 C6067510FF MOV BYTE PTR [1075],FF
XXXX:FBC6 FF16CC0A CALL [0ACC]
XXXX:FBCA C3 RET
XXXX:FBCB BAAAED MOV DX,EDAA <- Jumps here is you run out of
XXXX:FBCE 81C2A302 ADD DX,02A3 tries, clears memory, setup,
XXXX:FBD2 E9EC07 JMP 03C1 and returns to DOS
XXXX:FBD5 BB5957 MOV BX,5759
XXXX:FBD8 8147395F26 ADD WORD PTR [BX+39],265F
XXXX:FBDD 81C6AD0C ADD SI,0CAD
XXXX:FBE1 E8C790 CALL 8CAB
XXXX:FBE4 253F00 AND AX,003F
XXXX:FBE7 B106 MOV CL,06
XXXX:FBE9 D3E5 SHL BP,CL

AFTER

XXXX:FB66 FF0E82C2 DEC WORD PTR [C282] <- Count down tries
XXXX:FB6A 785F JS FBCB <- Jump if no tries left
XXXX:FB6C B87200 MOV AX,0072 <
XXXX:FB6F BB9A00 MOV BX,009A <
XXXX:FB72 B9DE00 MOV CX,00DE <
XXXX:FB75 BAAD00 MOV DX,00AD <
XXXX:FB78 E846F9 CALL F4C1 <
XXXX:FB7B E84300 CALL FBC1 <
XXXX:FB7E BE9457 MOV SI,5794 <
XXXX:FB81 C60400 MOV BYTE PTR [SI],00 <
XXXX:FB84 83EE02 SUB SI,+02 <
XXXX:FB87 8B34 MOV SI,[SI] <- Entire copy protection
XXXX:FB89 B82000 MOV AX,0020 < routine
XXXX:FB8C BB1000 MOV BX,0010 <
XXXX:FB8F B97800 MOV CX,0078 <
XXXX:FB92 BAA100 MOV DX,00A1 <
XXXX:FB95 E8C087 CALL 8358 <
XXXX:FB98 C6067FC200 MOV BYTE PTR [C27F],00 <
XXXX:FB9D C6067EC200 MOV BYTE PTR [C27E],00 <
XXXX:FBA2 FF1E3C0D CALL FAR [0D3C] <
XXXX:FBA6 E84687 CALL 82EF <
XXXX:FBA9 FF16CC0A CALL [0ACC] <
XXXX:FBAD 803E7FC200 CMP BYTE PTR [C27F],00 <
XXXX:FBB2 74EE JZ FBA2 <
XXXX:FBB4 803E7EC200 CMP BYTE PTR [C27E],00 <- Check entry
XXXX:FBB9 90 NOP <- Do nothing and do not
XXXX:FBBA 90 NOP <- jump
XXXX:FBBB C606BD0EFF MOV BYTE PTR [0EBD],FF <- Set flag
XXXX:FBC0 C3 RET <- leave routine and play
XXXX:FBC1 C6067510FF MOV BYTE PTR [1075],FF
XXXX:FBC6 FF16CC0A CALL [0ACC]
XXXX:FBCA C3 RET
XXXX:FBCB BAAAED MOV DX,EDAA <- Jumps here is you run out of
XXXX:FBCE 81C2A302 ADD DX,02A3 tries, clears memory, setup,
XXXX:FBD2 E9EC07 JMP 03C1 and returns to DOS
XXXX:FBD5 BB5957 MOV BX,5759
XXXX:FBD8 8147395F26 ADD WORD PTR [BX+39],265F
XXXX:FBDD 81C6AD0C ADD SI,0CAD
XXXX:FBE1 E8C790 CALL 8CAB
XXXX:FBE4 253F00 AND AX,003F
XXXX:FBE7 B106 MOV CL,06
XXXX:FBE9 D3E5 SHL BP,CL

Once again, money and time was wasted on the trash shown above. Now it's
useless.