Re: help with deprotecting Catalyst 3.0

["Michael J. Mahon" <mjmahon@aol.com>]

Don Bruder wrote:

<snip>

> As for how it's useful... It can be used in protection cracking because 
> you can do some fiddling with the on-the-disk values to make it load 
> where you like, and a slave also doesn't stomp all over RAM in the 
> process of relocating itself the way a master does. So you can "capture" 
> segments of the protected program that would have been wiped out by the 
> relocation process if you had done a warm reboot (three-finger salute) 
> with a Master in the drive. 
>
> I'd bet your softkey involves some variation on the old formula of boot 
> the protected disk, then when XYZ occurs, flip the drive door open, swap 
> in your DOS 3.3 slave disk and give a three-finger salute to warm boot 
> DOS. Then, as soon as DOS comes up, and before donig any further 
> tinkering, type "BSAVE filename,A$<something>,L$<something>" to grab a 
> critical part of the protected program onto a non-protected format so 
> that it can be worked with further.

You cannot _ever_ hope to recover memory contents if you use
a "three-fingered salute" to reboot, since this causes two
bytes in every page to be trashed before the reboot.

Apple added this to the Autostart ROM (and following) to make
it harder to capture RAM contents.

In general, you need to get into the monitor to re-boot without
trashing (much) RAM (the stack, text page, and locations on page
zero are still changed--hence mods like Senior PROM and copy cards).

-michael

8-voice music synthesizer using NadaNet networking!
Home page:  http://members.aol.com/MJMahon/