SPACE QUEST II UNPROTECTED BY SINBAD ON 8-29-88. THE FILE SIERRA.COM CONTAINED A LOAD AND EXECUTION OF A FILE CALLED CPC.COM (COPY PROTECTION CHECK?) WHICH NOT ONLY CHECKED FOR THE REQUIRED BAD SECTORS ON THE ORIGINAL DISK, BUT ALSO WROTE AN $80-BYTE 'MASK' FILE TO BE XOR'D WITH YET ANOTHER FILE TO FORM A VECTOR TABLE. THE MASK WAS WRITTEN TO 199B:0038 AND THE MASK WAS THEN MOVED TO DS:0141. THIS WAS THEN XOR'D WITH $80 BYTES AT 179A:0000 TO FORM THE TABLE. BY NO-OPing LOCATIONS $3C1-$3C3, YOU AVOID THE CALL WHICH WOULD ASK FOR THE DISKS, LOAD AND EXECUTE CPC.COM, AND MOVE THE MASK. THE PROCEDURE TO UNPROTECT THE DISK IS AS FOLLOWS: 1. FORMAT A REGULAR 360K DISK AND USE COPY *.* TO TRANSFER ALL FILES TO THE WORK DISK. 2. USING DEBUG, CALL UP THE FILE SIERRA.COM WHICH, IF YOU DUMP CS:100, WOULD BE VERSION 3.0 OF THE LOADER. i.e. DEBUG SIERRA.COM D CS:100 3. MAKE A NOTE OF THE BX AND CX REGISTERS(SHOULD BE BX=0 AND CX=0C31) USING R. 4. NOW NO-OP THE LOCATIONS $3C1-$3C3 WITH THE EXAMINE COMMAND E CS:3C1 WHICH FIRST DISPLAYS THE VALUE AT LOCATION $3C1. CS:3C1 TO CS:3C3 CONTAIN E8 2E 04, WHICH IS A CALL TO $07F2. TYPE IN $90 AND HIT THE SPACE BAR TO ADVANCE TO THE NEXT LOCATION. AFTER THREE NO-OPS, HIT RETURN. THIS ELIMINATES THE CALL. 5. NEXT LOAD THE MASK DATA FILE CALLED SQ2.DAT AS FOLLOWS: N SQ2.DAT L 141 THIS LOADS THE MASK DIRECTLY INTO THE AREA DS:141 (TO WHICH IT IS NORMALLY RELOCATED AFTER CPC.COM IS RUN). 6. NEXT RENAME THE FILE BACK TO SIERRA.COM, RESET THE CX REGISTER TO $0C31, AND WRITE TO DISK: N SIERRA.COM RCX (ENTER 0C31) W THAT COMPLETES THE UNPROTECT. CPC.COM IS NOT NEEDED. IN DUMPING SOME OF THE DATA AREAS, I NOTICED REFERENCE TO FOILA@CRYPTER WHICH I TAKE TO MEAN THIS FORM OF ENCRYPTING THE TABLE DATA.