Category : Unprotects for Games and Such
Archive   : CB-UNP.ZIP
Filename : CB-UNP.TXT

Unprotect for Colonel's BeQuest
By Sierra


BE SURE TO BACKUP YOUR DISK BEFORE STARTING AND USE THE
BACK UP FOR THE UNPROTECT.
Modify only the backup copy!!!

First you should rename the file or files
SCIV.EXE TO SCIV


Ex. C>rename sciv.exe sciv

Next Load program into debug...

Ex. C>debug sciv

Then Follow the sample debug session:


-e 0B15 0E B8 2A 11 1E 50 B8 1F 08 CB

-r : Get the value of the CS register

AX=???? BX=???? CX=???? DX=???? SP=???? BP=???? SI=???? DI=????
DS=???? ES=???? SS=???? CS=WWWW IP=???? ?? ?? ?? ?? ?? ?? ?? ??
WWWW:???? ?? ??? ??

XXXX=WWWW+1000 : Add 1000 hex to value
(These numbers are in hex. If you are
unfamiliar with the adding of hex
numbers don't attempt this patch)

-e XXXX:293E 50 AD
-e XXXX:2940 01 C6 AC 88 C3 81 E3 FE 00 50 B8 84 EA 39 06 22
-e XXXX:2950 9F 74 02 58 CB C6 06 1C 9F 00 C6 06 1E 9F 00 C6
-e XXXX:2960 06 35 11 CB 58 CB

Now write the new sciv game back to the disk:

-w

Writing XXXX bytes

Then Quit Debug:

-q

Now it is time to rename sciv back to sciv.exe

C>ren sciv sciv.exe

Now try to run the new (Hopefully) unprotected version of Colonel's BeQuest
When asked to identify fingerprint select 'CELIE'

C>sierra

**************************************************************************
* * * * S P E C I A L A N N O U N C E M E N T * * * *

Now the debugging tool used by "Super Dave" is available to you.
The software that enabled the the breaking of this program and others like,

Indiana Jones & the Last Crusade - De-protected in 3hrs using D86
Police Quest II - De-protected in 2hrs using DOS's Debug
Leasure Suit Larry III - De-protected in 1hr using DOS's Debug
Colonel's BeQuest - De-protected in .5hr using DOS's Debug
Monday Night Football - De-protected in .5hr using DOS's Debug
Sargon IV - De-protected in .5hr using D86

just to name a few.

All you need is a PC-AT compatible, the HOT_BRK software and your
favorite debugger. With it you can break into your debugger at anytime,
just as if you had a hardware debugging tool (even if the program re-vectors
the video, keyboard & break point vectors.
No more single stepping through the program trying to find the point when
if asks for the protection, just run the program normally and when the
protection is encountered break into your debugger and single step through it.
This tool is also great for debugging your own software. When the software
locks up break into the debugger to find out why, stop at any point to
examine memory or change values on the fly.
And as if all this weren't enough the registered version of AT-SLOW is
built in. Now you can slow down those games that run to fast on your
286/386/486 machine. Drop back to DOS in those programs that normally lockup
your computer and require a re-boot.

All this is available to you for only $40 including shipping. Just send a
check or money order to:

David Keil
10 W. Wilburn Ave.
Greenville, SC 29611

or call:

(803) 295-4971 or (803) 859-6868

for more information or to place your order using your credit card through
Summit Computers. We take MC/Visa/AMEX and Discover.

or leave me mail on my BBS listed below.

Note:
This software is only a tool. If you have never de-protected software and
don't know assembler or how to use a dynamic debugger this software will not
on its own enable you to de-protect software.
If however you have de-protected software and/or have assembler experience
this software will enable you to debug and de-protect software that you never
thought possible faster and easer than you thought possible. Let the list
of broken software above prove its worth.

--------------------------------------------------------------------------

Unprotect Brought to you courtesy of Super Dave

Super Dave can be reached at:

Hackers Paradise BBS (On-line 10-01-89)
(803) 269-7899
10 W. Wilburn Ave.
Greenville, SC 29611