39

I seem to recall from my high-school days that certain Apple ][ programs protected themselves from being listed and therefore modified.

If you tried to do it, the machine would simply reboot.

How did they achieve this, and can it be bypassed to get at the code?

39

One way was to place an in-line reboot command into the actual listing.

Apple ][ DOS had a feature that would monitor the output stream and, if it found a special character output at the start of a line, the rest of the line would be treated as a command. This character was Ctrl+D, meaning you could get a disk listing from your program with something like:

PRINT CHR$(4);"CATALOG"

You could also use the slot activation command IN#6 which would generally reboot the machine, assuming your disk controller was in slot 6 (it usually was).

But, of course, that would only work with a print command if you were running your program. For protecting against someone listing it, an extra layer of trickery was required.

To do this, you would create a line at the start of your program:

10 REM XXIN#6

and then use POKE commands to change the XX into a Ctrl+M (to start a new line) and Ctrl+D (to flag a command), before saving.

After that, an attempt to LIST the program would result in the machine rebooting. So this is probably something you wanted to do once development was done, just before shipping :-)

In order to bypass it, it's a simple matter of working out the errant line and just deleting it. In the case above, that would be acheived by just entering the stand-alone:

10

on the command line and, voila, the program is unprotected. To stop this, some developers started numbering the programs with less "normal" line numbers such as 2718. However, since the line numbers are stored in memory as well, you could PEEK at the program to work out what the first line number was, and then delete that one.

  • 3
    My recollection is that you could simply type the control-D as part of the input line. No need for poking about. One could list a program without processing such things by typing :PR#0 with a colon before it to ensure it's processed as a BASIC command rather than a DOS one. – supercat Nov 23 '18 at 2:56
  • 1
    It's been a while for me, but I seem to remember that just a chr$(4) in the middle of a line wasn't enough; it had to be the first character on the line, i.e. there had to be a chr$(13) preceding it or it would be ignored. – Mr Lister Nov 23 '18 at 11:05
  • Yes, it needed to be CR + Ctrl-D or DOS wouldn't see it. Issuing the "FP" command was probably better than rebooting, because it just quietly erased the program, leaving you to wonder what just happened. On a different note, some programs loaded up with Ctrl-G just to be annoying. Maybe they hoped the beeping and delays would be off-putting. – fadden Nov 23 '18 at 16:07
  • 2
    @fadden Ha, one of the first machine language utilities I wrote was one that intercepted the output of control chars, checked if they came from LIST output, and displayed inverse letters if so. Those were the days. – Mr Lister Nov 23 '18 at 16:24
  • 1
    Great answer. I'm literally going to hook up my Apple IIe so that I can try this. :-) – cbmeeks Nov 26 '18 at 14:10
19

If I recall correctly, there were lots of variations to implement this scheme. Besides embedding characters in the listing that would reboot, or clear the screen every so often, a particular one I remember worked roughly like this:

The listing only consisted of a single CALL. The internal structure of the BASIC program was carefully changed so the listing was stopped there, but there was a lot of stuff after this single command. This call would be to an embedded machine program somewhere in the BASIC listing, which would re-arrange the structure to make the whole program visible, and also register itself with some hooks to make it invisible again. You could defeat this protection by disassembling the machine code and running part of it. Or even by pressing RESET or something at a proper time, I forgot the details.

Not all BASIC programs that consisted of a single CALL were like this. There were also pure machine programs which disguised itself as BASIC programs in this way for some reason I never understood.

  • 1
    Possibly to use the basic loader? – Joshua Nov 23 '18 at 19:17
14

There were multiple ways of protecting the program, including:

  • order of line numbers could be altered to produce:

    • circular listings;
    • missing lines;
    • out-of-order lines;
    • out-of-bounds addressing;
  • the "resume" flag could be set such that any command could cause the program to run again;

  • the start-address for the program could be altered so that another (or none) listing would show;
  • line-linking could be altered to run "unreachable" lines;
  • the DOS interpreter accepts special characters so that slot code can be run ("PR#6" being the most common, but "DELETE HELLO" works equally well). This sounds like what you were seeing.
  • the code could be self-modifying as it ran.

There was also a modification to the KBDIN routine to point to the reset routine, so that if you achieved a prompt and tried to type something, the machine would reboot.

For a more detailed description, see section 7.20 in "A Brief Description of Some Popular Copy-Protection Techniques on the Apple ][ Platform" (http://pferrie.host22.com/papers/apple2_prot.pdf).

  • 1
    That's an impressive PDF by the way. I've only just finished reading it and it brought back some fond memories of some of the games :-) – user6464 Nov 25 '18 at 0:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy