Re: help with deprotecting Catalyst 3.0

["Bryan Parkoff" <nospam@nospam.com>]

>      So basicly I would ']init hello' a black disk to get a DOS 3.3
> slave disk.  Then boot ProDOS do the call bring up the code,  then do a
> Open-Apple-Control-Reset to boot the slave disk.  Then save the code on
> the salve disk? (I get the rest, it's just this part was confusing
> me.).
    There is a possibility that Open-Apple-Control-Reset can wipe memory 
with all zeroes to boot slave disk from ProDOS.  It is because RESET vector 
is located in $3F0 to $3FF (I can't remember which one).  If you are lucky 
to have Apple II with monitor ROM which it does not have AutoStart ROM, it 
would be much easier to deprotect all copy protected disks.  Monitor ROM 
does not wipe memory with all zeroes.  You can only hit RESET key, it 
prompts "*" as assembly prompt.  It does nothing without going through any 
routines like BASIC to overwrite memory.
    Some hackers can be able to crack using Apple II with monitor ROM, but 
it can be very difficult on Apple //e.  I hope that it helps.

Bryan Parkoff


>
>   And you are right it done like you state.
>
>      -Lockar
>
>
> In article <fYJse.1143$p%3.8883@typhoon.sonic.net>, Don Bruder
> <dakidd@sonic.net> wrote:
>
>
>>
>> Basically, there are two "flavors" of DOS 3.3 disk - "Master" and
>> "Slave". A Master will boot any Apple II, from "plain" to "//gs", with
>> RAM from the "base" 8K (or was it 16K?) of an original Apple II"Plain",
>> to the 48K of RAM that's "visible" without bank-switching in a maxed out
>> //GS, or anything in between. This is because it doesn't load
>> "directly", but instead bootstraps itself into a low range of memory
>> ($1000 and up, if I recall rightly) that *ALL* Apple II class machines
>> have, then runs a relocator routine to move itself as high in main RAM
>> as is possibe for the amount of RAM present in the machine that's
>> booting it.
>>
>> A slave, on the other hand, can be thought of as a "snapshot" of the
>> machine after DOS has finished the "relocate to the top" step - It has
>> no relocation code in the image, bootstraps itself directly to the
>> "final location", and can only be booted on a machine that has at least
>> the amount of memory that existed on the machine where the "INIT HELLO"
>> command was given to create the disk. If the machine booting a slave has
>> more RAM than the machine that created the slave in the first place, any
>> "extra" RAM above the last location that it would have loaded to on the
>> smaller machine is effectively nonexistent for anything that plays
>> within the rules of DOS. You can, of course, drop to the monitor with a
>> CALL -151 (or whatever your favorite method is) and access it, or
>> POKE/PEEK to/from it from BASIC, or even run some program of your own
>> that will use it by "going around" DOS, but for "normal" purposes (such
>> as program and variable storage in Applesoft) it doesn't exist.
>>
>> As for how it's useful... It can be used in protection cracking because
>> you can do some fiddling with the on-the-disk values to make it load
>> where you like, and a slave also doesn't stomp all over RAM in the
>> process of relocating itself the way a master does. So you can "capture"
>> segments of the protected program that would have been wiped out by the
>> relocation process if you had done a warm reboot (three-finger salute)
>> with a Master in the drive.
>>
>> I'd bet your softkey involves some variation on the old formula of boot
>> the protected disk, then when XYZ occurs, flip the drive door open, swap
>> in your DOS 3.3 slave disk and give a three-finger salute to warm boot
>> DOS. Then, as soon as DOS comes up, and before donig any further
>> tinkering, type "BSAVE filename,A$<something>,L$<something>" to grab a
>> critical part of the protected program onto a non-protected format so
>> that it can be worked with further.