Re: help with deprotecting Catalyst 3.0

[Don Bruder <dakidd@sonic.net>]

In article <170620051949243891%lockar@apple2forever.DOTorg>,
 Lockar <lockar@apple2forever.DOTorg> wrote:

>       I'm not sure if I am in the right newsgroup so bare with me
> here...
> 
>           I've been reading the Hardcore Computist issues on the CD I
> got from Mike (Thanks Mike!) and saw there is a softkey on deprotecting
> Catalyst 3.0
> 
>               Hardcore Computist Issue 44 page 10.
> 
>       I have Catalyst 3.0 on 3 1/2 floppies (I have 4 orignal disks and
> two sets of the 3 1/2 book) and 5 1/4 floppies.  
> 
>       I was reading the softkey and it says I need a DOS 3.3 slave
> disk.  What is a DOS 3.3 slave disk and how does that help me when it
> comes to writing the changes back to the copy.

Basically, there are two "flavors" of DOS 3.3 disk - "Master" and 
"Slave". A Master will boot any Apple II, from "plain" to "//gs", with 
RAM from the "base" 8K (or was it 16K?) of an original Apple II"Plain", 
to the 48K of RAM that's "visible" without bank-switching in a maxed out 
//GS, or anything in between. This is because it doesn't load 
"directly", but instead bootstraps itself into a low range of memory 
($1000 and up, if I recall rightly) that *ALL* Apple II class machines 
have, then runs a relocator routine to move itself as high in main RAM 
as is possibe for the amount of RAM present in the machine that's 
booting it.

A slave, on the other hand, can be thought of as a "snapshot" of the 
machine after DOS has finished the "relocate to the top" step - It has 
no relocation code in the image, bootstraps itself directly to the 
"final location", and can only be booted on a machine that has at least 
the amount of memory that existed on the machine where the "INIT HELLO" 
command was given to create the disk. If the machine booting a slave has 
more RAM than the machine that created the slave in the first place, any 
"extra" RAM above the last location that it would have loaded to on the 
smaller machine is effectively nonexistent for anything that plays 
within the rules of DOS. You can, of course, drop to the monitor with a 
CALL -151 (or whatever your favorite method is) and access it, or 
POKE/PEEK to/from it from BASIC, or even run some program of your own 
that will use it by "going around" DOS, but for "normal" purposes (such 
as program and variable storage in Applesoft) it doesn't exist.

As for how it's useful... It can be used in protection cracking because 
you can do some fiddling with the on-the-disk values to make it load 
where you like, and a slave also doesn't stomp all over RAM in the 
process of relocating itself the way a master does. So you can "capture" 
segments of the protected program that would have been wiped out by the 
relocation process if you had done a warm reboot (three-finger salute) 
with a Master in the drive. 

I'd bet your softkey involves some variation on the old formula of boot 
the protected disk, then when XYZ occurs, flip the drive door open, swap 
in your DOS 3.3 slave disk and give a three-finger salute to warm boot 
DOS. Then, as soon as DOS comes up, and before donig any further 
tinkering, type "BSAVE filename,A$<something>,L$<something>" to grab a 
critical part of the protected program onto a non-protected format so 
that it can be worked with further.

-- 
Don Bruder - dakidd@sonic.net - New Email policy in effect as of Feb. 21, 2004.
Short form: I'm trashing EVERY E-mail that doesn't contain a password in the
subject unless it comes from a "whitelisted" (pre-approved by me) address.
See <http://www.sonic.net/~dakidd/main/contact.html> for full details.