Deprotection information for: Music Studio, Deluxe Paint //, PaintWorks Plus, Writer's Choice Elite, Top Draw, Print Shop GS, 816 Paint, Draw Plus, SoftSwitch, Odyssey This information is provided only for use on legally purchasedly software for the express use of making archival backups. The University and the U-M Apple User's Group do not condone software piracy and provide this information for its responsible users. Music Studio Here's how to make a working backup copy of Music Studio that does not ask you to insert the master disk. In order to make an unprotected copy you need: 1) Any disk copy program that will ignore bad blocks on the disk. Copy II+ and Glen Bredon's volume copy program from Prosel will work fine. 2) A ProDOS block/sector editor. Block Warden (Prosel), Copy II+ sector editor, or the Bag of Tricks II Zap program will work. If you don't have access to one of these programs, a program that will do the job can be found in DL3 in the file PBE.EXE. The documentation for this program is in the file PBE.DOC. To make the working copy: 1) Copy the original program disk to another 3.5" disk, telling the copy program to ignore the error on block 7. 2) Use the block editor to find byte $14 in block $44D (1101). You can also search the disk for the byte sequence: 0C 00 C9 01 00 F0, which will uniquely find the the proper byte. 3) Change the byte from F0 to 80. 4) Write the block back to the disk. 5) You now have a de-protected copy of Music Studio! Several people have had trouble getting this program to work on a hard disk. Here are some tips to help out: 1) Make sure that you boot into ProDOS 16 from the hard disk. 2) Copy any files from the Music Studio /SYSTEM subdirectory that don't exist on the hard disk to the appropriate subdirectory on the hard disk. Make sure to delete the /SYSTEM subdirectory in the Music Studio subdirectory, as having two systems on the hard disk can cause problems. 3) If all else fails, the program should run from the root directory of the hard drive. I would like to stress that these instructions are provided to allow archival backups only. Deluxe Paint // Backup Well, can you believe I found a common denominator in the Electronic Arts protection scheme that envolves Prodos 16 and Super Hi-Res Graphics...... Any way here is how to remove the protection on Deluxe Paint ][ 1. Copy the program key disk with Copy ][ Plus full disk copy (note you will have to format the target disk first). 2. Get out a sector editor like Prosel's Block Warden and get it up and running and working on your copy of Deluxe Paint ][. Make it so that it will be reading and writing to that disk. 3. Read in Block $412 4. Enter the Edit mode and move the cursor to Byte $169 5. It should be over a byte that reads $A8.... Change this to $EA 6. Exit the Edit mode by pressing ESC and Write this block back out to the disk. 7. You now have a copy of Deluxe Paint ][ that you can back-up using the normal copy programs for the 3.5 drives. Remember, this is only for making a working backup for yourself. Paintworks Plus Here's how to make a working backup copy of Paintworks Plus that does not ask you to insert the master disk. In order to make an unprotected backup you need: 1) Any disk copy program that will ignore bad blocks on the disk. Copy II+ and Glen Bredon's volume copy program from Prosel will work fine. 2) A ProDOS block/sector editor. Block Warden (Prosel), Copy II+ sector editor, or the Bag of Tricks II Zap program will work. If you don't have access to one of these programs, a program that will do the job can be found the PC5 library in the file UT.DISKWORKS. It is Shareware from Living Legends. To make the working copy: 1) Copy the original program disk to another 3.5" disk, telling the copy program to ignore the error on block 7. 2) Use the block editor to find the sequence of bytes: C9 06 09 D0 01. This sequence is in block $291 (657). You can also have the program search the entire disk for these bytes. 3) Change the five bytes to EA's (NOP, or no-operation instructions). 4) Write the block back to the disk. 5) You now have a de-protected copy of Paintworks Plus! Several people have had trouble getting this program to work on a hard disk. Here are some tips to help out: 1) Make sure that you boot into ProDOS 16 from the hard disk. 2) Copy any files from the Paintworks /SYSTEM subdirectory that don't exist on the hard disk to the appropriate subdirectory on the hard disk. Make sure to delete the /SYSTEM subdirectory in the Paintworks subdirectory, as having two systems in the hard disk can cause problems. 3) If all else fails, the program should run from the root directory of the hard drive. I would like to stress that these instructions are provided to allow archival backups only. Writer's Choice Elite The following document describes the method for making a backup copy of Writer's Choice elite that does not require the use of the master (key) disk. To complete the archival backup procedure, you will need: 1) A disk copy program that is capable of ignoring bad blocks on a disk. Copy II+ and Glen Bredon's volume copy program from Prosel will do the trick. 2) A ProDOS block/sector editor. The Copy II+ sector editor, Prosel's Block Warden or Beagle Bros' Pro-Byter will work. To make the de-protected backup: 1) Copy the original program disk to a blank 3.5" disk. If you use Copy II+, version 7.0 or higher and copy straight from the master disk to the new backup, it will automatically ignore the block 7 error. If you are using another copy program, you may have to manually force the error to be ignored. 2) Use the block editor to locate the sequence of Hex bytes: C9 07 00 D0 01. This sequence can be found in block $523 (1315), byte $73 (115). If the block/sector editor is capable of searching for hex bytes, you could have it search the entire disk for this sequence. 3) Change the five bytes to EA's (NOP, or No Operation instructions). 4) Write the block back to the disk. 5) You have now created a de-protected copy of Writer's Choice elite. This procedure is intended to produce an archival backup copy ONLY of Writer's Choice elite. NOTE: If you like the fonts used in Writer's Choice elite, and you are using MultiScribe GS or DeluxePaint II, you can interchange the fonts between programs simply by copying each font file to the /SYSTEM/FONTS subdirectory of the program disk you want them on. Top Draw How to make an Archival copy of Top Draw. This information is furnished for the purposes of making a Backup of YOUR copy of the program. First off make a copy of your program disk using any program that ignores block errors like Copy II+ Now search for HEX string 90 05 C9 11 00 F0 E6 AD 11 45 D0 EE This was found in block $394 or for you Diskworks fans, #0916. Change the EE to 00... Seems to work great with the new desktop v3.1 PRINT SHOP GS This information is offered for the purpose of helping those who PURCHASE a legitimate copy of Print Shop GS to make a backup for their own use, or to install Print Shop GS on a hard disk, so that it no longer requires a "master disk." It is a good (very good) program, reasonably priced, and worth consideration if you have a need for this type of program. Giving away copies of the program is not fair to the authors and publisher, who have produced a quality program, and deserve a fair return for their effort. If I ever get the idea that the information I am offering here is being misused, I will cease to upload any more help with de-protection of programs. Admittedly, I am as opposed to copy-protection as anyone I know, since it makes the programs so protected less valuable and useful; and, I do not appreciate publishers who use it, and believe it is time they start clearly labeling their boxes that their software is copy-protected. Yet there are reasons these publishers "protect" their disks, and I equally disapprove of unethical use of information, such as that I offer here, to "distribute" copyrighted programs. That said, there is little difficulty in making a durable, normal backup of Print Shop GS. Write-protect your original disk and copy it using ProSEL, Copy //+, or the System Utilities which came with your computer. There are no bad blocks on the disk, so the copying will go smoothly and quickly. It is not necessary to think in hexadecimal to ferret out protection code. It often begins with a PHA ($48) instruction, and will be found in either a loader type file or the main program file. The file MF on the Print Shop disk contains the protection. It begins with a PHA instruction, and terminates with the message "Please insert your master disk into the drive." I found it by searching the disk for the string "Please insert your master." METHOD I: Often a disk can be normalized by replacing the first instruction of the protection routine with a RTS ($60), and this is exactly what I did with Print Shop, and that proved sufficient to normalize it. I found the $48 in block $2F (dec=47), and used Block Warden to replace it with a $60. If it isn't there you can search your disk for the byte string $48 C9 05 00 F0 0F. Check to see that the routine ends with the "Insert" message, and zap out the $48 with a $60. This method makes one cosmetic sacrifice, as far as the program's operation is concerned. (Thanks to Walt Mossberg for pointing it out to me, as well as a typographical error in the hexadecimal notation of block #47, which is corrected in this upload.) The graphic image which normally is displayed with each menu choice when it is highlighted, never appears. You won't see the picture of the gs when "Setup" is highlighted, for instance, or the card with "Greeting Card." Instead, you get a blank gray rectangle. METHOD II: Leave the $48 at location $37 alone, or if you have changed it to $60 (using Method I), restore it to its original value. By doing this you are letting part of the protection routine run, because it initializes the graphics (and the way the mouse cursor interacts with them) which appear in the box on the main menu. The critical instruction, as far as the protection goes, is the JSR $674F, which appears at location $7F in block $2F. The exact code reads $20 4F 67. The code at $674F, which is the subroutine byte $7F calls when Print Shop is run, reads as follows: 674F: 20 5E 67 (JSR $675E) 6752: 20 5E 67 (JSR $675E) 6755: 20 5E 67 (JSR $675E) 6758: 20 5E 67 (JSR $675E) 675B: 4C 57 68 (JMP $6857) The routine at $675E is a long one, which looks like a timing check to me. Whatever it is, it must be avoided if you do not wish to insert your master disk everytime you run Print Shop GS. To accomplish this task the instruction at location $7F in block $2F must be changed from JSR $674F to JSR $6857. This will require that you zap two bytes. Change the byte at location $80 to $57. Then change the byte at location $81 to $68. DO NOT CHANGE THE BYTE AT $7F!!!!! There you have it, your cake and eating it too, so to speak. If you do not find these bytes at the above locations, search your disk for the hex string $20 61 42 20 4F 67. The last two bytes are the ones you must change. Share your enthusiasm for Print Shop GS, not your program disk. 816 PAINT Before I give you the specifics, I want to remind anyone who uses this information that it is offered soley for the purpose of helping those who PURCHASE a legitimate copy of 816 Paint to make a backup for their own use. It is the easiest to use of the full featured paint programs. And it is the quickest, as well, because the code is very compact. It is an excellent program, reasonably priced, and worth consideration if you have a need for this type program. Giving away copies of 816 Paint is not fair to the authors, who have produced a quality program, and deserve a fair return for their effort. If I ever get the idea that the information I am offering here is being misused, I will cease to upload any more help with de-protection of programs. Admittedly, I am as opposed to copy-protection as anyone I know, since it makes the programs so protected less valuable and useful; and, I do not appreciate publishers who use it, and believe it is time they start clearly labeling their boxes that their software is copy-protected. Yet there are reasons these publishers "protect" their disks, and I equally disapprove of unethical use of information, such as that I offer here, to "distribute" copyrighted programs. Deprotecting 816 Paint: The protection is in each of the two main program files, PAINT.320.SUPER and PAINT.640.SUPER. Baudville normally "disguises" the key elements of their protection code, changing MLI call commands from another place in the program, so that the call you see on the disk is not the call which is actually executed. In this case, what 816 Paint does is "attempt" to read a block(s) form the bad cylinder deliberately placed in the second position of the disk (Blocks #12 - #23). Currently, there are no copy programs available which will avoid formatting some of the blocks on a disk, so a disk like 816 Paint cannot be duplicated with the requisite bad blocks in place. If the read returns an error then the disk "passes muster" and the program runs. If it does not return an error, the program locks up. "Normal" code for such a check would start with the hex string $22 A8 00 E1 22 00. Another routine apparently checks to see if the disk is larger than 800k, and if that is the case, ignores the signature check, so that the files can be run as is, from large capacity storage devices, such as hard drives, without inserting a "master disk." Baudville told me this when I ordered the disk, and it worked just as they represented it. I suppose, but have not actually tried, that a large enough RAM card would also enjoy this privilege. Baudville is to be commended, by the way, for allowing this. It represents a real step forward in copy protection schemes that are "somewhat" friendly to the purchaser. (The company is also very good about service.) If all you want to do is run 816 Paint from a HD, there is no reason to bother with what I am about to go into, unless you just want an extra backup for peace of mind. But, if you intend to run 816 from an 800k floppy, there is no substitute for doing so from a normalized backup. So, looking for: 22 A8 00 E1 JSL PD16MLI ;entry point 22 00 DC $0022 ;Read Block command bytes etc. will not usually get the job done with Baudville. You must look for PD MLI calls that are odd, and displaced from purposeful and/or related code. On Award Maker Plus (PD8, not 16) the key call is an "Allocate Interrupt" call involving a bogus directory block!! They don't make it easy, but remember they could make it much tougher too. So don't pass copies of their program around, and maybe they won't esculate the protection wars. STEP BY STEP: Of course, don't use your block editor until you have made a copy of the disk, with a copy program such as proSEL or Copy //+, which ignores read errors. Then, to deprotect PAINT.320.SUPER read block $0276 (#630) into a block editor and find: 05E: 22 A8 00 E1 JSL PD16MLI 062: 06 00 (get info) 064: CE AA 00 00 068: AE 80 AF LDX $AF80 06B: 6B RTL Change the byte at location $5E to $6B (= RTL), so that the routine never runs, no matter how the command code is altered by other parts of the program, as I can assure you they are. If this code is not in block $0276, search the disk for it, and change it if you find it. For PAINT.640.SUPER read block $02DE (#734) into a block editor and find: 028: 22 A8 00 E1 JSL PD16MLI 02C: 06 00 (get info) 02E: 90 AC 00 00 032: AE 4A B1 LDX $B14A 035: 6B RTL Change the byte at location $28 to $6B (= RTL), so that the routine never runs, again, no matter how the command code is altered. Remember, each of these files does its own check for the presence of bad blocks, so each must be de-protected. Share your enthusiasm for 816 Paint, not their copyrighted code. Draw Plus Use a Volume copy program such as Prosel, Copy II plus, Diversi- Copy or whatever you like to make a copy of the Draw Plus disk. NEVER MAKE ANY CHANGES TO THE ORIGINAL DISK!!!!!!!!! Ignore any bad block errors - these are the 'signature' blocks which will not be required by the back-up. Using a BLOCK-editor (NOT a sector editor - this must be done using a 3.5" disk which is in the Pro-Dos format), scan for the following bytes (All values are in given in Hex NOT Decimal!): 1) $2B AD E8 0C C9 - I found this string at Block $516 location $2D Change the $2B to $00. 2) $23 AD 84 00 48 - I found this string at Block $516 location $35 Change the $23 to $00. 3) $02 AB 60 E2 20 - I found this string at Block $516 location $56 Change the $02 to $00. 4) $18 FB C2 30 0B - I found this string at Block $516 location $A9 Change the $18 to 6B. Now write Block $516 back to disk. You now have an un-locked back-up of Draw Plus. This version may now be installed on a Ram-disk or a Hard drive. Roger Wagner's SoftSwitch The following is a method to free your GS from the copy protection scheme that RWP has seen fit to inflict on users of its new program SoftSwitch. This CP scheme is especially upsetting as it writes to a reserved area of your battery ram and comes from a company that has previously shunned CP. Each time you cold or warm boot ProDOS 16, it runs certain files. When you install SoftSwitch a file called TOOL.SETUP.2 is installed in your SYSTEM/SYSTEM.SETUP subdirectory. This file, along with TOOL.SETUP is always run at boot time. An ID byte (or bytes) is also installed in the reserved area of your battery ram by the install program. After installation, each time you boot, the file TOOL.SETUP.2 looks for the ID byte. If it doesn't find it, SS will not be installed in the desk accessories menu. This makes the program only run on systems that have run the copy-protected install routine. The key byte is $FB which is the very last byte of reserved battery ram. This byte is changed from a normal $FF to $FE. In order to test out the theory that SS used battery ram as an ID check, I needed a routine that would read battery ram and place it in an area of memory that I could look at and modify. I also needed a routine to poke any changed bytes back into battery ram. The routines BRAMPEEK and BRAMPOKE [available on PC5 as UT.BRAMPEEK & UT.BRAMPOKE] give these capabilities: 1) BRAMPEEK This routine will read the 256 bytes of battery ram from your system and put it in $2000 thru $20FF. I would suggest that you save these original 256 bytes to another file called BRAM.PARMS before you change anything (BSAVE BRAM.PARMS,A$2000,L$100) just in case you want to return everything to its original state. 2) BRAMPOKE This routine pokes 252 bytes from $2000 forward plus a four byte checksum back into battery ram. I don't recommend that you change anything other than those bytes in reserved areas that SS modifies unless you want to risk inflicting a serious hangover on your machine during the next cold boot. Both of the above routines are intended to be executed by the AppleSoft "-" command after which you can enter the monitor by a CALL-151. After running BRAMPEEK, look at the area from $2052 thru $207F and from $20A2 thru $20FB. These are the reserved areas of battery ram. If values in this range are anything but $FF, SS has altered your system. Change all the modified bytes back to what they should be and apply the following patch to the TOOL.SETUP.2 file: 1) Search for the following bytes: $A9 FB 00 2) Change $A9 to $80 and $FB to $51 This should let your system install SS each time you boot independent of any value of battery ram. If you find this patch useful, I hope you will take the time to tell RWP what you think about their SS CP scheme and urge them to remove CP from this and all future GS products. Thanks. Odyssey: The Compleat Adventure When I bought my Apple (early 1980), Odyssey and Zork I were the best games available. But you couldn't play Odyssey without Integer BASIC or 64K, so I never did until Softdisk put it on a disk in Applesoft ($10 - $5 coupon if you are a Softdisk contributor). The game is still fun, but just too hard. I needed help. Like my drill sergeant said, "If you ain't cheating, you ain't trying." To cheat I had to defeat Softdisk's wimpy protection. Anyway, if you have Demuffin Plus: 1. Initialize a disk. 2. Write a sector starting with 01 AD E8 C0 4C 59 FF or something to stop the drive & halt bootup to T0 S0. 3. Boot Odyssey. 4. Put in the noboot disk & press reset. It will load T0S0 to $800-8FF, but won't overwrite the protected DOS. 5. *2000<9000.BFFFM Move DOS out of way 6. Boot normal disk. 7. ]BLOAD DEMUFFIN PLUS,A$803 8. ]CALL-151 9. *9000<2000.4FFFM Move protected DOS back 10. *803G 11. Copy all files to blank disk with wildcard =. To cheat, interrupt the program at any point with a ctrl-C, change variables (ie FM = men, BG & BI & Bsomething else control inventory)