Added dBASE III copy-protection notes

_posts/2017-08-11-dbase-iii-copy-protection-revisited.md

@@ -0,0 +1,106 @@
+---
+layout: post
+title: dBASE III Copy Protection Revisited
+date: 2017-08-11 10:00:00
+permalink: /blog/2017/08/11/
+---
+
+One of the earliest tasks I remember tackling on an IBM PC was a basically a favor for my father-in-law, Tom Estelita.
+In 1984, he had purchased a copy of dBASE III and had become frustrated by its copy-protection.  The previous version,
+dBASE II, had no such protection, which probably added to his frustration.  At the time, he was running his own tiny
+software company, Radix 2 Software, and he certainly wasn't interested in redistributing dBASE III -- he just wanted to
+be able to back-up his software and switch between a handful of machines without the hassle or worry of relying on a
+single fragile copy-protected diskette.
+
+At that time, my day job was writing PDP-11 application software, but I really wanted to learn more about the IBM PC,
+and I had done work for Tom in the past (writing BASIC accounting software on CP/M-based machines), so he made me a
+deal: he would loan me a floppy-based IBM PC and some IBM reference manuals, in exchange for attempting to crack dBASE
+III's copy-protection.
+
+I have no recollection of how feasible I thought this challenge was, but I'm sure I jumped at the opportunity.
+Perhaps my thinking was that, after all, it's just software, so how hard could it be.  In any case, I apparently took
+the challenge very seriously, because I also made a lot of notes.
+
+I recently found [those notes](/docs/personal/#dbase-iii-copy-protection), along with copies of the
+[dBASE III disks](/disks/pcx86/apps/other/dbase3/1.0/) used.  Unfortunately, all they contained was my *patched*
+(unlocked) version of `DBASE.EXE`, and for the sake of a complete archive, I wanted the *unpatched* (locked) version as
+well.  Fortunately, my patching notes also show all the original bytes, so I reproduced the original file by reversing
+the patching process, using PCjs:
+
+	Loading /disks/pcx86/apps/other/dbase3/1.0/DBIII-100-UNLOCKED.json.......
+	FDC: Mounted diskette "dBASE III 1.0 (Unlocked)" in drive A
+	
+	A>dir
+	
+	 Volume in drive A has no label
+	 Directory of  A:\
+	
+	DBASE    EXE   112720   9-28-84   3:46p
+	DBASE    OVL   147456   6-26-84   5:36p
+	HELP     DBS    53760   6-26-84   5:36p
+	ASSIST   HLP    15223   6-26-84   5:37p
+	READ     ME      4224   6-26-84   5:37p
+	CONFIG   SYS       22   6-26-84   5:37p
+	        6 File(s)     15360 bytes free
+	
+	A>ren dbase.exe dbase.tmp
+	
+	A>b:debug dbase.tmp
+	-d 5f4 l4
+	08FF:05F4  25 39 4F 45                                       %9OE
+	-e 5f4
+	08FF:05F4  25.     39.e3   4F.c4   45.eb
+	-d a44
+	08FF:0A44  2D 26 AB 36-38 06 9C 17 1A 54 A5 4B               -&+68....T%K
+	08FF:0A50  E8 41 4C E0 AF 68 0B 07-6E 07 80 16 1B B6 BF B7   hAL`/h..n....6?7
+	08FF:0A60  4C 6B C2 39 26 DC 97 BF-3B CE C0 EB 4F BB B3 C2   LkB9&\.?;N@kO;3B
+	08FF:0A70  27 A6 90 75 F4 AF 68 93-DF 62 43 CD B7 65 AD 34   '&.ut/h._bCM7e-4
+	08FF:0A80  11 B0 85 93 29 A2 9B A4-42 74 A6 84 24 7C 17 4C   .0..)".$Bt&.$|.L
+	08FF:0A90  7B 5E F9 2C 66 0E 4E 27-B4 2F 50 4E 9C 76 CE D6   {^y,f.N'4/PN.vNV
+	08FF:0AA0  DB 51 21 D1 2C 4B 3B 73-48 EE 8E 6A 9C D7 E2 4F   [Q!Q,K;sHn.j.WbO
+	08FF:0AB0  FA B6 10 24 28 A0 45 C8-50 36 9A 5E 9F C4 A1 EC   z6.$( EHP6.^.D!l
+	08FF:0AC0  A2 51 AA B8                                       "Q*8
+	-e a44
+	08FF:0A44  2D.b0   26.5e   AB.e6   36.af   
+	08FF:0A48  38.1e   06.f1   9C.41   17.31   1A.73   54.59   A5.c1   4B.a4   
+	08FF:0A50  E8.0e   41.cd   4C.63   E0.fe   AF.c1   68.39   0B.0b   07.62   
+	08FF:0A58  6E.60   07.93   80.be   16.cf   1B.08   B6.f8   BF.4e   B7.56   
+	08FF:0A60  4C.53   6B.d3   C2.5d   39.4f   26.a3   DC.9a   97.ae   BF.14   
+	08FF:0A68  3B.c4   CE.7b   C0.dc   EB.e4   4F.ee   BB.45   B3.f9   C2.ab   
+	08FF:0A70  27.3f   A6.15   90.56   75.3d   F4.5b   AF.a3   68.a1   93.20   
+	08FF:0A78  DF.ad   62.98   43.be   CD.02   B7.c8   65.63   AD.df   34.c3   
+	08FF:0A80  11.e0   B0.2f   85.26   93.af   29.31   A2.29   9B.40   A4.4f   
+	08FF:0A88  42.86   74.98   A6.90   84.fc   24.d6   7C.76   17.e3   4C.e5   
+	08FF:0A90  7B.f1   5E.61   F9.08   2C.8a   66.20   0E.f7   4E.37   27.64   
+	08FF:0A98  B4.4f   2F.e2
+	-w
+	Writing 1B850 bytes
+	-q
+	
+	A>ren dbase.tmp dbase.exe
+	
+	A>dir
+	
+	 Volume in drive A has no label
+	 Directory of  A:\
+	
+	DBASE    EXE   112720   8-11-17   9:51a
+	DBASE    OVL   147456   6-26-84   5:36p
+	HELP     DBS    53760   6-26-84   5:36p
+	ASSIST   HLP    15223   6-26-84   5:37p
+	READ     ME      4224   6-26-84   5:37p
+	CONFIG   SYS       22   6-26-84   5:37p
+	        6 File(s)     15360 bytes free
+	
+	saving diskette /disks/pcx86/apps/other/dbase3/1.0/DBIII-100-UNLOCKED.json...
+
+I haven't examined this patch again (yet), but I will admit that it seems rather lengthy.  Usually one strives for
+a very small, surgically precise patch that's more on the order of 3 or 4 bytes, but we have to remember that I wasn't
+very familiar with either the IBM PC or the 8088 instruction set at this point -- this was also a learning exercise.
+
+And who knows, maybe Vault Corporation (the company that Ashton-Tate used to provide the copy-protection logic for
+dBASE III) wrote such sophisticated code that it was impossible to defeat so simply.  However, experience suggests
+that's unlikely. 
+
+*[@jeffpar](http://twitter.com/jeffpar)*  
+*Aug 11, 2017*

disks/pcx86/apps/other/dbase3/1.0/README.md

@@ -7,30 +7,38 @@ permalink: /disks/pcx86/apps/other/dbase3/1.0/
 dBASE III v1.0
 --------------
 
-The first two PCjs disks shown below:
+Two of the PCjs disks shown below:
 
-- [dBASE III 1.0 (Unlocked)](#directory-of-dbase-iii-10-unlocked)
+- [dBASE III 1.0 (Patched)](#directory-of-dbase-iii-10-patched)
 - [dBASE III 1.0 (Samples)](#directory-of-dbase-iii-10-samples)
 
-are from our private collection and should be exact copies of the original dBASE III v1.0 distribution disks, with
+are from our private collection and should be exact copies of the original dBASE III v1.0 distribution disks, with the
-the exception of `DBASE.EXE`, which was patched to eliminate copy-protection checks.  If possible, details on that
+exception of `DBASE.EXE`, which was patched to eliminate copy-protection checks.  Details of that patch are available
-patch will be provided at a later date.
+in our collection of [Personal Documents of Dubious Historical Interest](/docs/personal/#dbase-iii-copy-protection),
+along with this [blog post](/blog/2017/08/11/).
 
-The other disks:
+Also, for completeness, the original `DBASE.EXE` has been recreated by "unpatching" it and saving it on the
+[Locked](#directory-of-dbase-iii-10-locked) disk image.  However, we don't have the original distribution disk, which
+would include additional copy-protection characteristics, so running the original (locked) version of `DBASE.EXE` will
+immediately fail with:
+
+	Unauthorized Duplicate
+
+Another variation of the dBASE III disks come from the [WinWorld](https://winworldpc.com/product/dbase/iii-v10) archive:
 
 - [dBASE III 1.0 (Disk 1)](#directory-of-dbase-iii-10-disk-1)
 - [dBASE III 1.0 (Disk 2)](#directory-of-dbase-iii-10-disk-2)
 
-come from [WinWorld](https://winworldpc.com/product/dbase/iii-v10).  With the exception of `DBASE.EXE`, the files on
+and, with the exception of `DBASE.EXE`, the files on [Disk 1](#directory-of-dbase-iii-10-disk-1) match the files on our
-the "Disk 1" image match the files on our "Unlocked" disk; the newer dates probably only reflect when Ashton-Tate and/or
+[Patched](#directory-of-dbase-iii-10-patched) disk; the newer dates probably just reflect an update by Vault Corporation
-Vault Corporation updated the copy-protection code in `DBASE.EXE`.  However, the "Disk 2" image contains more files
+to the copy-protection code in `DBASE.EXE`.  However, [Disk 2](#directory-of-dbase-iii-10-disk-2) contains more files
-than our "Samples" disk, and WinWorld's README admits that:
+than our [Samples](#directory-of-dbase-iii-10-samples) disk, and WinWorld's README admits that:
 
 	Some of the sample programs have been run/changed.
 
-so overall, the PCjs disks may be more authentic.
+so overall, the disks from our private collection may be more authentic.
 
-### Directory of dBASE III 1.0 (Unlocked)
+### Directory of dBASE III 1.0 (Patched)
 
 	 Volume in drive A has no label
 	 Directory of  A:\
@@ -105,6 +113,19 @@ so overall, the PCjs disks may be more authentic.
 	PAYROLL  PRG    13056   6-15-84   4:50p
 	       55 File(s)     75776 bytes free
 
+### Directory of dBASE III 1.0 (Locked)
+
+	 Volume in drive A has no label
+	 Directory of  A:\
+	
+	DBASE    EXE   112720   8-11-17   9:51a
+	DBASE    OVL   147456   6-26-84   5:36p
+	HELP     DBS    53760   6-26-84   5:36p
+	ASSIST   HLP    15223   6-26-84   5:37p
+	READ     ME      4224   6-26-84   5:37p
+	CONFIG   SYS       22   6-26-84   5:37p
+	        6 File(s)     15360 bytes free
+
 ### Directory of dBASE III 1.0 (Disk 1)
 
 	 Volume in drive A has no label

disks/pcx86/apps/other/dbase3/1.0/manifest.xml

@@ -95,8 +95,17 @@
 		<file size="1024" time="1984-11-06 03:12:54" attr="0x20">WHO.NDX</file>
 		<file size="1024" time="1984-11-13 08:23:36" attr="0x20">ZIP.NDX</file>
 	</disk>
-	<disk id="disk03" size="368640" chs="40:2:9" img="archive/DBIII-100-UNLOCKED.img" href="/disks/pcx86/apps/other/dbase3/1.0/DBIII-100-UNLOCKED.json" md5="c291c4175ee9f5b983a5bb0168421a92" md5json="3d7bc6010f165cb5c41592c9c05e15f2">
+	<disk id="disk03" size="368640" chs="40:2:9" img="archive/DBIII-100-LOCKED.img" href="/disks/pcx86/apps/other/dbase3/1.0/DBIII-100-LOCKED.json" md5="e7c73904362b5298b49a67402d2b00a5" md5json="7940716852d3d71ab64d68e1ac846960">
-		<name>dBASE III 1.0 (Unlocked)</name>
+		<name>dBASE III 1.0 (Locked)</name>
+		<file size="15223" time="1984-06-26 17:37:02" attr="0x20">ASSIST.HLP</file>
+		<file size="22" time="1984-06-26 17:37:08" attr="0x20">CONFIG.SYS</file>
+		<file size="112720" time="2017-08-11 09:51:22" attr="0x20">DBASE.EXE</file>
+		<file size="147456" time="1984-06-26 17:36:48" attr="0x20">DBASE.OVL</file>
+		<file size="53760" time="1984-06-26 17:36:58" attr="0x20">HELP.DBS</file>
+		<file size="4224" time="1984-06-26 17:37:06" attr="0x20">READ.ME</file>
+	</disk>
+	<disk id="disk04" size="368640" chs="40:2:9" img="archive/DBIII-100-PATCHED.img" href="/disks/pcx86/apps/other/dbase3/1.0/DBIII-100-PATCHED.json" md5="c291c4175ee9f5b983a5bb0168421a92" md5json="3d7bc6010f165cb5c41592c9c05e15f2">
+		<name>dBASE III 1.0 (Patched)</name>
 		<file size="15223" time="1984-06-26 17:37:02" attr="0x20">ASSIST.HLP</file>
 		<file size="22" time="1984-06-26 17:37:08" attr="0x20">CONFIG.SYS</file>
 		<file size="112720" time="1984-09-28 15:46:34" attr="0x20">DBASE.EXE</file>
@@ -104,7 +113,7 @@
 		<file size="53760" time="1984-06-26 17:36:58" attr="0x20">HELP.DBS</file>
 		<file size="4224" time="1984-06-26 17:37:06" attr="0x20">READ.ME</file>
 	</disk>
-	<disk id="disk04" size="368640" chs="40:2:9" img="archive/DBIII-100-SAMPLES.img" href="/disks/pcx86/apps/other/dbase3/1.0/DBIII-100-SAMPLES.json" md5="919393aa18749389e54ebbb07c83c424" md5json="e2ff2cead7607519001d4357bb9a8439">
+	<disk id="disk05" size="368640" chs="40:2:9" img="archive/DBIII-100-SAMPLES.img" href="/disks/pcx86/apps/other/dbase3/1.0/DBIII-100-SAMPLES.json" md5="919393aa18749389e54ebbb07c83c424" md5json="e2ff2cead7607519001d4357bb9a8439">
 		<name>dBASE III 1.0 (Samples)</name>
 		<file size="1408" time="1984-04-30 09:08:58" attr="0x20">ACCOUNTS.PRG</file>
 		<file size="1280" time="1984-06-15 15:26:20" attr="0x20">BIG.PRG</file>

disks/pcx86/compiled/library.xml

@@ -384,7 +384,8 @@
 		<disk path="/disks/pcx86/apps/other/dbase2/2.4/DBII-240-SCED.json">dBASE II 2.4 (EDITOR)</disk>
 		<disk path="/disks/pcx86/apps/other/dbase3/1.0/DBIII-100-DISK1.json">dBASE III 1.0 (Disk 1)</disk>
 		<disk path="/disks/pcx86/apps/other/dbase3/1.0/DBIII-100-DISK2.json">dBASE III 1.0 (Disk 2)</disk>
-		<disk path="/disks/pcx86/apps/other/dbase3/1.0/DBIII-100-UNLOCKED.json">dBASE III 1.0 (Unlocked)</disk>
+		<disk path="/disks/pcx86/apps/other/dbase3/1.0/DBIII-100-LOCKED.json">dBASE III 1.0 (Locked)</disk>
+		<disk path="/disks/pcx86/apps/other/dbase3/1.0/DBIII-100-PATCHED.json">dBASE III 1.0 (Patched)</disk>
 		<disk path="/disks/pcx86/apps/other/dbase3/1.0/DBIII-100-SAMPLES.json">dBASE III 1.0 (Samples)</disk>
 		<disk path="/disks/pcx86/apps/other/omniview/4.30/OMNIVIEW386-430.json">Omniview 386 4.30</disk>
 		<disk path="/disks/pcx86/apps/other/sc2/1.00/SC2_V100.json">SuperCalc2 1.00</disk>

docs/personal/README.md

@@ -8,7 +8,7 @@ Personal Documents of Dubious Historical Interest
 -------------------------------------------------
 
 I'm kicking off this new section of the site with a couple of documents I created in 1984, detailing one of my early
-adventures in PC debugging: decoding and removing [dBASE III Copy-Protection](#dbase-iii-copy-protection).
+adventures in PC debugging: decoding and disabling [dBASE III Copy-Protection](#dbase-iii-copy-protection).
 
 ---
 
@@ -17,7 +17,7 @@ adventures in PC debugging: decoding and removing [dBASE III Copy-Protection](#d
 * [dBASE III Debugging Notes](/docs/personal/1984-09-16--DBASE_III_DEBUG.pdf)
 * [dBASE III Patching Procedure](/docs/personal/1984-09-25--DBASE_III_PATCH.pdf)
 
-NOTE: Copies of the [dBASE III](/disks/pcx86/apps/other/dbase3/) disks can be found in our [IBM PC Disk Library](/disks/pcx86/).
+NOTE: Copies of the [dBASE III](/disks/pcx86/apps/other/dbase3/1.0/) disks can be found in our [IBM PC Disk Library](/disks/pcx86/).
 
 *[@jeffpar](http://twitter.com/jeffpar)*  
 *Last Update: Aug 11, 2017*