Category : Unprotects for Games and Such
Archive   : RAIL-UNP.ZIP

Output of file : RAILTYCN.UNP contained in archive : RAIL-UNP.ZIP
Unprotect for Railroad Tycoon

Tired of looking up protection codes for that expensive program you bought.
Well we can do something about that nasty protection scheme.

Use the Norton editor (or a similar hex editor) on the hard disk copy of
GAME.EXE (as always it is inadvisable to modify your original). Search for
the following bytes (which seem to be constant no matter the version of the

50 FF 76 F8 FF 76 FA FF (this should be found around 2C613)

Move the cursor over a few bytes and make the following changes:

Original: 83 C4 0E E8 XX XX 89 46 F2 3D 0D 00 75 2A 8B 46 F6 39 46 FC 74 03
| | | |
Changes: 90 90 90 90 90 89 EB

Write the file out and you are done!

For reference this is the dump of the part of the program we are changing.
Note that we have to add 2000 to CS to get to the area of interest.


cs 1bc7

-uc713 c739

3BC7:C713 50 PUSH AX
3BC7:C714 FF76F8 PUSH [BP-08]
3BC7:C717 FF76FA PUSH [BP-06]
3BC7:C71A FF36XXXX PUSH [xxxx] ;(varies with version)
3BC7:C71E 9A21010000 CALL 0000:0121
3BC7:C723 83C40E ADD SP,+0E
3BC7:C726 E8XXXX CALL xxxx ;NOP this call (varies with
3BC7:C729 8946F2 MOV [BP-0E],AX
3BC7:C72C 3D0D00 CMP AX,000D
3BC7:C72F 752A JNZ C75B ;NOP this jump not zero
3BC7:C731 8B46F6 MOV AX,[BP-0A]
3BC7:C734 3946FC CMP [BP-04],AX ;Change this CMP to MOV
3BC7:C737 7403 JZ C73C ;Change JZ to JMP
3BC7:C739 E9AE00 JMP C7EA

Courtesy of Bad Bob

  3 Responses to “Category : Unprotects for Games and Such
Archive   : RAIL-UNP.ZIP

  1. Very nice! Thank you for this wonderful archive. I wonder why I found it only now. Long live the BBS file archives!

  2. This is so awesome! 😀 I’d be cool if you could download an entire archive of this at once, though.

  3. But one thing that puzzles me is the “mtswslnkmcjklsdlsbdmMICROSOFT” string. There is an article about it here. It is definitely worth a read: