Dec 092017
 
Unprotect for various games. (Test Drive, Grand Prix, etc).
File UNP89-3.ZIP from The Programmer’s Corner in
Category Unprotects for Games and Such
Unprotect for various games. (Test Drive, Grand Prix, etc).
File Name File Size Zip Size Zip Type
UNPCC89.DOC 24336 7917 deflated

Download File UNP89-3.ZIP Here

Contents of the UNPCC89.DOC file



THE OFFICIAL PROTECTION REMOVAL SCHEME LIBRARY

original document created and compiled by "The PaperBoy"
and the CopyCats, Inc.
01-21-89, 01-26-89, 01-30-89
-----------------------------------------------------------------------------
The following protection removal schemes took many valuable hours of time to
create. This file contains the procedures for many of the latest software
packages out today. (This document is updated at every new unprotection
scheme or schemes we find.) Please be patient if your program can't be
cracked yet. It will be, pretty soon, we hope.

! Please note that these patches are for personal use only !

We are THE COPYCATS INCORPORATED:

Seymore Warez Unprotected (President)
The PaperBoy, MasterByte, The Gigolo, The Ninjutsu, SlimeMan, Shimba,
Grand Central Station, Didley Bop, Dr. Disk, The No Cause People In Florida

** Just cracking software, byte by byte. **

Use these software unprotection schemes at own risk! (Try with a BACKUP!)
-----------------------------------------------------------------------------
These programs have unprotection patches or fixes in this document: 25

Accolade: 4th & Inches, Test Drive, Fast Break, Grand Prix Circuit,
Apollo 18
Activision: The Last Ninja+fix, Rampage
Sierra: Leisure Suit Larry II, King's Quest IV, Manhunter: NY
MindScape: Willow, Bop 'n Wrestle, Infiltrator, Defender of the Crown
Epyx: The Games: Summer Edition, TechnoCop/fix, California Games
Simon&Schuster: Star Trek: The Kobayashi Alternative
DataSoft: Bruce Lee/fix
Electronic Arts: Advanced Flight Trainer 1.2
Spectrum Holobyte: Gato: WW2 Submarine Simulator
Broderbund: The Print Shop, Ancient Art of War
Cignet Tech: Little Black Book
PowerUp!: most software
Infocom: BattleTech!
misc: Trivia Fever

/fix=fix only, no unprotection patch +fix=fix and unprotection patch
-----------------------------------------------------------------------------
ON COPY PROTECTION

At the CopyCats, we would like to make a statement on copy protection. We see
this concept as unnecessary. Crude disk checking and trudging through the
manuals for "key words," make it very difficult for many of the novice users,
as well as the experienced computer users. Many of our "program hackers"
also feel they do not promote software piracy. They only help the people
who are against the protection schemes and use of software authorization
procedures. And, if it continues, WE will continue.

"S. W. Unprotected"
President of The CopyCats, Inc
-----------------------------------------------------------------------------
LAST MINUTE HACKER'S NOTES

The PaperBoy here. You may notice that many of these programs have similar
protection scheme instruction codes. If you have a program that has no
unprotection scheme here, apply it to the program and test it. That's how
we were able to pull most schemes down. Remember, this is for the experienced
user. Don't mess up your originals, either. And, use write-protect tabs for
the scheme checking - last time, it erased itself due to a backfire of
the BIOS interrupt 13hex. Smart program, but WE cracked it. CAREFUL!
-----------------------------------------------------------------------------
THE UNPROTECTION SCHEMES!
-----------------------------------------------------------------------------
1. MOST MAJOR ACCOLADE SOFTWARE, The PaperBoy

To remove the protection schemes of 4TH & INCHES, TEST DRIVE, FAST BREAK, and
other ACCOLADE SOFTWARE:

Search for these bytes: 55 56 57 06 1E (use Norton Utilities, DEBUG
And replace it with: 31 C0 C3 06 1E PC-Tools, or equivalent)
-----------------------------------------------------------------------------
2. GRAND PRIX CIRCUIT BY ACCOLADE, Two Guys

The previous ACCOLADE unprotection scheme was incompatible with its later
released game, GRAND PRIX CIRCUIT. With an updated protection, you must:

Search for these bytes ------> And replace it with
1. BE 06 00 E8 13 00 EB 16 00 EB 13 00
2. F6 C4 10 75 0B EB 0E 10 75 0B
3. 72 5F BB 90 90 BB
4. 75 47 BE 90 90 BE
5. B8 09 02 EB 0A 02
6. 75 03 E8 03 EB 03 E8 03 (GPEGA.EXE)
-----------------------------------------------------------------------------
3. LEISURE SUIT LARRY II BY SIERRA, Anonymous

LEISURE SUIT LARRY GOES LOOKING FOR LOVE IN SEVERAL WRONG PLACES by Sierra
On-Line has a seriously annoying protection scheme. The player must trudge
through the manual to look for girl's phone number in order to enter the
game. This patch force the program to accept any input at the prompt in the
initialization of the program.

1. Rename SIERRA.EXE to SIERRA.XXX
2. Enter DEBUG and enter the following lines.

E 0394 F6
E 4210 52 5C
E 9E1D B8 08 35 CD 21 89 1E FC 12 8C 06 FE 12 B8 24 35
E 9E2D CD 21 89 1E 00 13 8C 06 02 13 B8 24 35 CD 21 89
E 9E3D 1E 04 13 8C 06 06 13 07 1E 0E 1F BA 6B 9C B8 23
E 9E4D 25 CD 21 BA 6C 9C B8 24 35 CD 21 1F E8 5A 00 C7
E 9E5D 06 FA 12 01 00 C3 90 57 51 B9 0F 00 BF 86 BA C6
E 9E6D 05 00 83 C7 09 E2 F8 59 5F 2E C7 06 10 3F 0E 01
E 9E7D E9 8F A3 90 90 90 90 90 90 90 90 90 90 98 90 83
E 9E8D 3E FA 12 00 75 01 C3 1E 07
E F676 8E D8 B1 03
W
Q

3. Rename SIERRA.XXX back to SIERRA.EXE
-----------------------------------------------------------------------------
4. STAR TREK: THE KOBAYASHI ALTERNATIVE BY SIMON & SCHUSTER, Dr. Disk

This simple protection scheme can be bypassed with Central Point Software's
NOKEY (distributed with COPY II-PC), or you can use the removal scheme below.

Search through ST.EXE for CD 13 and replace it with 90 90.

You can use this patch with most software that you use with NOKEY to bypass
its protection scheme.
-----------------------------------------------------------------------------
5. RAMPAGE AND THE LAST NINJA BY ACTIVISION, INC., The Ninjutsu

The above unprotection scheme can be used on these two ACTIVISION programs.
Search the EXE files for CD 13 and replace it with 90 90.
-----------------------------------------------------------------------------
6. MANHUNTER: NEW YORK BY SIERRA, Bart Montgomery

Search the file MHVOL.1 for these bytes: 41 06 7A
and replace them with these bytes: 7F C3 00
-----------------------------------------------------------------------------
7. FIX FOR BRUCE LEE BY DATASOFT, The PaperBoy (FOR DISK VERSION ONLY)

First, Bruce Lee is an excellent product. It's just that (aaarrrggghhh)
you have no `falls' left, and you feel yourself quite near the finish of the
game. Suddenly, one of those little dots floating on floor taps your foot and
you get zapped. You see the sign "Game Over" and you feel pretty pissed, and
wish you could open the drive and rip the disk to shreds, but that would be
a waste. So, fix it! One thing you could do is play option C, one player vs.
your opponent played by the other player. But this time, play alone, and make
sure the second joystick is calibrated wrong. If the computer sees that the
Yamo isn't moving, it will take over, so a wrong calibration will make it
move always. So, you're playing, but that stupid ninja is in your way and it
won't let you win. Alternative? Eliminate him. And this is how you do it.
Get a disk utility, preferably Norton Utilities. Zap the Bruce Lee disk,
with the following information.

Sector 271 Sector 271
Offset 139 and Offset 354
Change 09(hex) to 63(hex) Change 09(hex) to 63(hex)

That's all there is to it. Now you play, the Green Yamo flying around
crazily, and the ninja... hmm... the ninja seems to appear for a quick second
then disappear. Now, he's never gonna touch you!
-----------------------------------------------------------------------------
8. GATO: WORLD WAR 2-CLASS SUBMARINE SIMULATOR BY SPECTRUM HOLOBYTE, SlimeMan

To unprotect GATO, use the following table below.

Sector Offset Contents Change To

53 0E 72 11 90 90
53 13 72 0C 90 90
53 53 72 EB
53 65 75 EB
-----------------------------------------------------------------------------
9. TRIVIA FEVER, Grand Central Station

To unprotect TRIVIA FEVER, follow the steps below.

1. Rename TF.EXE to TF.XXX
2. Enter DEBUG and type in the lines below.
-E 257E
-75.90 03.90
-W
-Q
3. Rename TF.XXX back to TF.EXE
-----------------------------------------------------------------------------
10. THE GAMES: SUMMER EDITION BY EPYX, Dr. Disk

To unprotect THE GAMES, use the following patch below.

Search for these bytes: E8 87 00 59 C6
And replace it with: 59 59 5F EB 55
-----------------------------------------------------------------------------
11. LITTLE BLACK BOOK BY CIGNET TECHNOLOGIES, The Gigolo

To unprotect your LITTLE BLACK BOOK, search the file BOOK.EXE and patch:

Search for these bytes: ----> and replace it with these bytes:
3D 00 00 74 07 C6 06 03 01 B8 00 00 74 07 C6 06 03 00
CD 13 B8 01 02 CD 13 72 0E 90 90 90 90 90 90 90 EB 0E
EB F5 F6 C4 06 75 06 EB F5 F6 C4 06 EB 06

Now, search in the file LBB.EXE and patch:

Search for these bytes: ----> and replace it with these bytes:
3D 00 00 74 07 C6 06 76 04 01 B8 00 00 74 07 C6 06 76 04 00
CD 13 B8 01 02 CD 13 72 0E 90 90 90 90 90 90 90 EB 0E
EB F5 F6 C4 06 75 06 EB F5 F6 C4 06 EB 06
-----------------------------------------------------------------------------
12. KING'S QUEST IV: THE PERILS OF ROSELLA BY SIERRA ON-LINE, Pirates-R-Us

To completely bypass the documentational protection on KING'S QUEST IV, use
the procedure below.

1. First, search your Quality Assurance file for the correct edition date.
It is found in the ????????.QA file.
2. If you do not have your version dated 09-19-88 nor 09-24-88, you cannot
proceed with this patch. Sorry!
3. Rename SIERRA.EXE to SIERRA.XXX.
4. Enter DEBUG and type the following lines below.

(if you have the 09-19-88 version, use this patch)
E 0394 82
E 0CB4 90 E8 38 98
E A4A9 B8 08 35 CD 21 89 1E 7E 12 8C 06 80 12 B8 23 35 CD 21 89 1E
E A4BD 82 12 8C 06 84 12 B8 24 35 CD 21 89 1E 86 12 8C 06 88 12 07
E A4D1 1E 0E 1F BA F7 A2 B8 23 25 CD 21 BA F8 A2 B8 24 25 CD 21 1F
E A4E5 E8 5A 00 C7 06 7C 12 01 00 C3 90 80 FB 98 75 16 C7 04 32 95
E A4F9 C6 44 02 00 2E C7 06 B4 09 FF 97 2E C7 06 B6 09 A0 01 FF A7
E A50D A0 01 90 90 90 90 90 90 90 90 90 83 3E 7C 12 00 75 01 C3 1E
E A521 07
W
Q

(if you have the 09-24-88 version, use this patch)
E 0394 74
E 0CB4 90 E8 2A 98
E A49B B8 08 35 CD 21 89 1E 5E 12 8C 06 60 12 B8 23 35 CD 21 89 1E
E A4AF 62 12 8C 06 64 12 B8 24 35 CD 21 89 1E 66 12 8C 06 68 12 07
E A4C3 1E 0E 1F BA E9 A2 B8 23 25 CD 21 BA EA A2 B8 24 25 CD 21 1F
E A4D7 E8 5A 00 C7 06 5C 12 01 00 C3 90 80 FB 98 75 16 C7 04 32 99
E A4EB C6 44 02 00 2E C7 06 B4 09 FF 97 2E C7 06 B6 09 0A 05 FF A7
E A4FF 0A 05 90 90 90 90 90 90 90 90 90 83 3E 5C 12 00 75 01 C3 1E
E A513 07
W
Q

5. Rename SIERRA.XXX back to SIERRA.EXE.
-----------------------------------------------------------------------------
13. CALIFORNIA GAMES BY EPYX, Jonathan Millhouse

To override the disk protection scheme in CALIFORNIA GAMES, enter Norton
Utilities or your favorite disk/file editor and open CALGAMES.EXE.

Search for these bytes: FA FC 55 56 57
And replace it with these bytes: 00 00 31 C0 C3
-----------------------------------------------------------------------------
14. CHUCK YEAGER'S ADVANCED FLIGHT TRAINER BY ELECTRONIC ARTS, Tony Elliott

(Version 1.2 only)

1. Rename AFT.EXE to AFT.XXX
2. Enter DEBUG with AFT.XXX open for editing.
3. At the DEBUG "-" prompt, type

U 0DBB

Several lines with be displayed on screen. You are interested in the first
two. They should look EXACTLY like this:

xxxx:0DBB E9A3A7 JMP B561
xxxx:0DBE C3 RET

The "xxxx" represents any four hexadecimal numbers. If you have a match,
on to the next step. If not, you probably have the wrong version. Sorry!

4. At the "-" prompt again, type

U 0E38

Several lines of code will again be displayed on screen. Look at the first
two following the "U 0E38" command. They should also match exactly with the
following:

xxxx:0E38 880E5005 MOV [0550],CL
xxxx:0Exx 8A0E4D05 MOV CL,[054d]

If you have a match here, then you should have a compatible version of the
AFS program. If not, sorry!

5. At the "-" prompt, type the following:

E 0DBB 90 90 90
E 0E38 C3 90 90 90
W
Q

You should now be back in DOS. Only one more step left.

6. Rename AFT.XXX back to AFT.EXE

That's it! You now have an unprotected copy of AFT.
-----------------------------------------------------------------------------
15. POWER-UP! SOFTWARE, The No Cause People in Florida

To unprotect any programs from POWER-UP!, load the main EXE file with Norton
Utilities or such.

Search for the bytes: E8 48 FF
And replace it with: 90 90 90
-----------------------------------------------------------------------------
16. THE PRINT SHOP BY BR0DERBUND, Swamp Fox

The Print Shop employs two sections of code to copy protect itself. The first
is embedded in PS.EXE and is exercised when the program is run from a floppy.
The second is embedded in PSINIT.OVR and is employed when the program is run
from a hard or ram disk. Once activated, both seek out a specially formatted
track on the A: drive and terminate the program if not found.

Both sections of code will be un-hooked here so that the program will run
from either a floppy or a hard disk.

RENAME PS.EXE PS.ZAP Rename for DEBUG

DEBUG PS.ZAP Start DEBUG

S0 9000 CD 13 Search for Disk interrupt 13

XXXX:3AC6 You should find these two:
XXXX:3ADF

U 3AC6 Unassemble code to make sure
you're in the right place :

XXXX:3AC6 INT 13 A test for any disk in A:
XXXX:3AC8 MOV BYTE PTR [0A91],02
XXXX:3ACD DEC BYTE PTR [0A91]
XXXX:3AD1 JZ 3AE6
XXXX:3AD3 MOV DH,00 \
XXXX:3AD5 MOV DL,00 | This sets up a look for the
XXXX:3AD7 MOV CH,09 | special track
XXXX:3AD9 MOV CL,0A |
XXXX:3ADB MOV AL,01 |
XXXX:3ADD MOV AH,04 |
XXXX:3ADF INT 13 /
XXXX:3AE1 CMP AH,00 If not there ... Loop then
XXXX:3AE4 JNZ 3ACD Zonk! Terminate Program...


A 3AC6 Get rid of 1 st diskette look

XXXX:3AC6 NOP Remove the INT 13
XXXX:3AC7 NOP
XXXX:3AC8

A 3ADD Get rid of the real test:

XXXX:3ADD MOV AH,00 Give it what it wants in AH
XXXX:3ADF NOP Remove the INT 13
XXXX:3AE0 NOP
XXXX:3AE1

W Write out the changed code

Q Quit DEBUG

RENAME PS.ZAP PS.EXE Rename for running program

(The program will now run from floppy disks without further changes)

Now for the second portion of the copy protection :

DEBUG PSINIT.OVR Start DEBUG (using a copy !)

S0 2000 CD 13 Look for disk interrupt 13

XXXX:0479 You should find these three:
XXXX:0492
XXXX:04BD

U 0479

XXXX:0479 INT 13 A test for any disk in A:
XXXX:047B MOV BYTE PTR [CD57],02
XXXX:0480 DEC BYTE PTR [CD57]
XXXX:0484 JZ 04DB
XXXX:0486 MOV CL,11 \
XXXX:0488 MOV AH,04 |
XXXX:048A MOV DH,00 |
XXXX:048C MOV CH,09 | This sets up a look for the
XXXX:048E MOV DL,00 | special track
XXXX:0490 MOV AL,01 |
XXXX:0492 INT 13 /
XXXX:0494 CMP AH,00 If not there ... Loop then
XXXX:0497 JNZ 0480 Zonk ! Terminate Program...

(Look familiar ?)

U 04BD

XXXX:04BD INT 13 This one's a read (same idea)
XXXX:04BF CMP AH,00
XXXX:04C2 JNZ 04A5
XXXX:04C4 ADD BX,018B
XXXX:04C8 MOV CL,05
XXXX:04CA ES:
XXXX:04CB MOV AL,[BX]
XXXX:04CD CMP AL,41
XXXX:04CF JNZ 04DB
XXXX:04D1 INC BX
XXXX:04D2 DEC CL
XXXX:04D4 JNZ 04CA
XXXX:04D6 MOV AX,0000 This is the success exit !
XXXX:04D9 JMP 04DE

A 0479

XXXX:0479 NOP Remove INT 13
XXXX:047A NOP
XXXX:047B

A 0490

XXXX:0490 MOV AH,00 Give it what it wants in AH
XXXX:0492 NOP Remove INT 13
XXXX:0493 NOP
XXXX:0494

A 04BD

XXXX:04BD JMP 04D6 Jump to success exit code
XXXX:04BF

W Write out the changed code

Q Quit DEBUG


The program may now be run from a hard disk or floppy as desired. The hard
disk set up will ask for the master diskette to be inserted but won't do
any checking or diskette access at all.
-----------------------------------------------------------------------------
17. THE ANCIENT ART OF WAR BY BR0DERBUND, Didley Bop

Load up Norton Utilities with WAS.EXE and search for these bytes: E8 F8 32.
Replace them with B8 01 00. Now, it's unprotected!
-----------------------------------------------------------------------------
18. FIX FOR BATTLETECH BY INFOCOM, The PaperBoy

You don't have enough C-Bills? Well, this will help. Save your game and run
Norton Utilities or such with the GAME# (#=number of the save game) ready.
Edit the bytes at offset 05D5hex and 05D6hex and replace it with 00 70. That
should give you about 28672 C-Bills when you return to the game. You may go
as high as FF 7F, which will total 32767, but I wouldn't want to go higher
than that, or there could be a program interpretation screwup.
-----------------------------------------------------------------------------
19. FIX FOR TECHNOCOP BY US GOLD AND EPYX, Shimba

If you start with only 5 lives and must go through 11 levels of harsh battle,
I don't think you'll make it, unless you are lucky and fast enough to get
extra lives. Save your game, enter NU and change the byte at offset 5hex to
05. This will return you to 5 lives. I tried fixing it with FF, but I found
out that it doesn't work - I lose as if I had no lives left. You can attempt
to screw around with other bytes and hopefully get more lives than five.
-----------------------------------------------------------------------------
20. WILLOW BY MINDSCAPE/CINEMAWARE, Hacker Joe

Open WILLOW.EXE with your hex file editor and perform these operations:

Search for these bytes: ----> And replace with:
CD 13 59 90 90 59
74 02 EB E6 EB 02 EB E6
75 04 3C 00 EB 18 3C 00
3C F8 75 14 3C F8 EB 14
73 0C 33 C0 EB 0C 33 C0
-----------------------------------------------------------------------------
21. BOP 'N WRESTLE BY MINDSCAPE, SlimeMan

Prepare BOP.EXE for editing with NU or compatible program. Search for these
bytes: B8 00 19 CD and replace them with: 31 C0 EB 2F.
-----------------------------------------------------------------------------
22. FIX FOR THE LAST NINJA BY ACTIVISION, The Ninjutsu

Not enough lives? Well, save your game and enter your hex-style editor with
that save game file open for editing. Change the byte at offset 59hex to any
hex number from 00 to FF. FF will obviously give you 255 lives, so why want
the 00? Your screen will be lined up with those damn apples on the bottom
status screen, but they won't effect the game.
-----------------------------------------------------------------------------
23. INFILTRATOR BY MINDSCAPE, MasterByte

This unprotection scheme was very similar to that of BOP 'N WRESTLE. Here's
its version. ** Make sure you change all EXE files (except INSTALL)! **

Search for these bytes: 31 C0 19 CD
And replace it with: EB 33 19 CD
-----------------------------------------------------------------------------
24. APOLLO 18 BY ACCOLADE, Two Guys

To unprotect APOLLO 18, use Norton Utilities or PC-Tools and...

Search for these bytes: 9A 29 00
And replace it with: EB 1B 00
-----------------------------------------------------------------------------
25. DEFENDER OF THE CROWN BY MINDSCAPE/CINEMAWARE, The Doctor of MASH

To unprotect DEFENDER OF THE CROWN, use DEBUG for this one. Rename the file
DOC.EXE to DOC.XXX and follow the instructions below.

DEBUG DOC.XXX
-S 0 FFFF B8 00 A0 50 FF 36 0A 45 ; search for beginning of routine.
xxxx:3BCC ; addresses may be different
xxxx:3BF2
-A3BCC ; assemble at first address
xxxx:3BCC JMP 3BF2 ; jump to second address
xxxx:3BCE
-W ; write the edited file back to disk
Writing 11600 bytes
-Q ; quit, return to DOS

Now, rename DOC.XXX back to DOC.EXE. It's unprotected.
-----------------------------------------------------------------------------
This file is updated every week. Watch out for new unprotection schemes!
Please upload this file archived as "UNP89-#.ARC," where # is the edition
number. For instant cracks on software, call 1-312-ZAP-DISK and ask for Vic!


 December 9, 2017  Add comments

Leave a Reply