Документ взят из кэша поисковой машины. Адрес оригинального документа : http://crydee.sai.msu.ru/ftproot/pub/rec/games/Cracks-Solutions-Cheats/F-15/f-15se.hnt Дата изменения: Wed Jun 3 23:01:38 1987 Дата индексирования: Mon Dec 24 11:10:56 2007 Кодировка: Поисковые слова: п п п п п п п п п п п п п п п п п п п п п п п п п п п п п п п п п п п п п р п

Unprotecting MicroProse's F-15 Strike Eagle
by Ralph and The Computer Pike (03Jun87)

Written by The Computer Pike

Materials

1) The ORIGINAL program diskette.
2) A blank un-formatted diskette.
3) The program DISKCOPY.COM.
4) The program DEBUG.COM.

Both DISKCOPY and DEBUG are programs provided with DOS.


Overview

The copy protection scheme of F-15 Strike Eagle was very
interesting, but easy when found. The scheme consisted of a 16-
sector verification on track 10. This was found by utilizing the
tracing features of DEBUG.COM. When the address of the disk I/O
was located, the area of which the verification routine was also
located. The routine provided 3 tries of checking for the
sectors in track 10. When found, it would execute the rest of
the program normally. But, if the error counter reaches zero, a
JZ instruction (jump on zero) would cause the eventual execution
of a continuous loop consisting of a CLI instruction (clear
interrupt). This instruction is the culprit of the keyboard
locking up on attempted copies of the program diskette after
choosing to begin the flight simulation. The address of this
instruction was the key point of unprotecting the program. The
JZ instruction was replaced by a JMP instruction (unconditional
jump) so that the verification routine was totally bypassed.

After the address alteration, the program diskette was run,
but, again, did not work. The program still hung up after
attempting to start the simulation. After more tracing of disk
I/O in the program, another address was found. After unassembl-
ing the area of the address, it was found that a duplicate of the
verification routine was found. The same alterations were done,
and the disk was re-run. Finally, the program ran with no
problems, whatsoever. The diskette was totally DISKCOPYable for
archival purposes.


Procedure

There are two versions of F-15 Strike Eagle. Those versions
are IBM and Tandy. The difference between the two versions deal
with graphical enhancements in favor of Tandy, but the protection
scheme is the same. Unprotection procedures for both versions
are noted on the next page.


IBM version:

1) Make a copy of F-15 Strike Eagle using DISKCOPY
provided with DOS. (Ignore any read/write errors
in the process.)

2) Put away the ORIGINAL program diskette. Use the
copy made by DISKCOPY for the unprotection. Set
the copy aside for now. (Make sure the write
protect tab is not covered.)

3) Put the diskette containing DEBUG.COM into drive
A:. Making sure that the DOS prompt is A>, enter
DEBUG.

4) After loading, there should be a hyphen prompt on
the next line. Remove the diskette containing
DEBUG.COM in drive A: and replace it with the COPY
of F-15 Strike Eagle made earlier.

5) Enter the following information after each hyphen
prompt ( means to press RETURN):

L 200 0 37 1
E 353 EB 14
E 3CB EB 14
W 200 0 37 1
Q

You should now be in the A> DOS prompt.

6) The diskette in drive A: is now an unprotected,
working copy of F-15 Strike Eagle. It can be
DISKCOPYed for an exact duplicate.


Tandy version:

All steps in the IBM version procedure are the same for
the Tandy version, except for step 5. It is as follows:

5) Enter the following information after each hyphen
prompt ( means to press RETURN):

L 200 0 37 1
E 2F9 EB 14
E 371 EB 14
W 200 0 37 1
Q

You should now be in the A> DOS prompt.


Conclusion

Hopefully, this document will aide in maintaining a way
of creating archival copies of F-15 Strike Eagle by MicroProse.
Of course, after the above changes, all functions to the program
(in both versions) worked perfectly. Good luck in removing
the copy protection and shoot a couple of those SU-22's down for
me!!!