


[0] Tfiles: (1-3,?,Q) : 3


                  THE OFFICIAL UNPROTECTION SCHEME LIBRARY

           original document created and compiled by "The PaperBoy"
                            and the CopyCats, Inc.
              01-21-89, 01-26-89, 01-30-89, 02-04-89, 02-06-89
-----------------------------------------------------------------------------
The following protection removal schemes took  many valuable hours of time to
create.  This file contains the procedures for  many of the  latest  software
packages  out  today.   (This  document  is updated at every new unprotection
scheme  or  schemes  we  find.)   Please  be patient if your program can't be
cracked yet.  It will be, pretty soon, we hope.

        ! Please note that these patches are for personal use only !

                      We are THE COPYCATS INCORPORATED:

                    Seymore Warez Unprotected (President)
    The PaperBoy, MasterByte, The Gigolo, The Ninjutsu, SlimeMan, Shimba,
 Grand Central Station, Didley Bop, Dr. Disk, The No Cause People In Florida

                 ** Just cracking software, byte by byte. **
                    Come on...  Ain't Got All Day!!                                                   
 Use these software unprotection schemes at own risk!   (Try with a BACKUP!)
-----------------------------------------------------------------------------
These programs have unprotection patches or fixes in this document:        29

         Accolade: 4th & Inches, Test Drive, Fast Break, Grand Prix Circuit,
                   Apollo 18
       Activision: The Last Ninja+fix, Rampage
           Sierra: Leisure Suit Larry II, King's Quest IV, Manhunter:  NYork
                   Police Quest II, Gold Rush!
        MindScape: Willow, Bop'n Wrestle, Infiltrator, Defender of the Crown,
                   Perfect College
             Epyx: The Games: Summer E, TechnoCop/fix, California Games, The
                   Games: Winter E.
   Simon&Schuster: Star Trek: The Kobayashi Alternative
         DataSoft: Bruce Lee/fix
  Electronic Arts: Advanced Flight Trainer 1.2
Spectrum Holobyte: Gato: WW2 Submarine Simulator
       Broderbund: The Print Shop, Ancient Art of War
      Cignet Tech: Little Black Book
         PowerUp!: most software
          Infocom: BattleTech!
             misc: Trivia Fever

                    Come on...  Ain't Got All Day!!                                                      /fix=fix only, no unprotection patch    +fix=fix and unprotection patch
-----------------------------------------------------------------------------
A NOTE ON COPY PROTECTION

At the CopyCats, we would like to make a statement on copy protection. We see
this  concept  as  unnecessary.  Crude disk checking and trudging through the
manuals for "key words," make it very difficult for many of the novice users,
as well as the experienced computer users.  Many  of  our  "program  hackers"
also feel  they do not promote software  piracy.  They  only  help the people
who  are  against  the  protection  schemes and use of software authorization
procedures.  And, if it continues, WE will continue.

                                               "S. W. Unprotected"
                                               President of The CopyCats, Inc
-----------------------------------------------------------------------------
LAST MINUTE HACKER'S NOTES

The  PaperBoy  here.  You may notice that many of these programs have similar
protection  scheme  instruction  codes.   If  you  have a program that has no
unprotection  scheme  here,  apply it to the program and test it.  That's how
we were able to pull most schemes down. Remember, this is for the experienced
user.  Don't mess up your originals, either.  And, use write-protect tabs for
the  scheme  checking  -  last  time,  it  erased itself due to a backfire of
the BIOS interrupt 13hex.  Smart program, but WE cracked it.  CAREFUL!
                    Come on...  Ain't Got All Day!!                                                   -----------------------------------------------------------------------------
                          THE UNPROTECTION SCHEMES!
-----------------------------------------------------------------------------
1. MOST MAJOR ACCOLADE SOFTWARE, The PaperBoy

To remove the protection schemes of 4TH & INCHES, TEST DRIVE, FAST BREAK**, &
other ACCOLADE SOFTWARE:

    Search for these bytes: 55 56 57 06 1E  (use Norton Utilities, DEBUG
       And replace it with: 31 C0 C3 06 1E    PC-Tools, or equivalent)

 ** If you wish to patch FAST BREAK, you must modify all main FB-?.EXE files
    and the FB.RTL file.
-----------------------------------------------------------------------------
2. GRAND PRIX CIRCUIT BY ACCOLADE, Two Guys
 
The  previous  ACCOLADE  unprotection  scheme was incompatible with its later
released game, GRAND PRIX CIRCUIT.  With an updated protection, you must:

          Search for these bytes   ------>   And replace it with
         1. BE 06 00 E8 13 00                EB 16 00 EB 13 00
         2.    F6 C4 10 75 0B                EB 0E 10 75 0B
         3.          72 5F BB                90 90 BB
         4.          75 47 BE                90 90 BE
                    Come on...  Ain't Got All Day!!                                                            5.          B8 09 02                EB 0A 02
         6.       75 03 E8 03                EB 03 E8 03    (GPEGA.EXE only!)
-----------------------------------------------------------------------------
3. LEISURE SUIT LARRY II BY SIERRA, Pirates-R-Us

LEISURE SUIT LARRY GOES LOOKING FOR LOVE  IN SEVERAL WRONG PLACES  by  Sierra
On-Line  has  a  seriously annoying protection scheme. The player must trudge
through  the  manual  to  look for  girl's phone number in order to enter the
game.  This  patch force the program to accept any input at the prompt in the
initialization of the program.

   1. Rename SIERRA.EXE to SIERRA.XXX
   2. Enter DEBUG and enter the following lines.

             E 0394 F6
             E 4210 52 5C
             E 9E1D B8 08 35 CD 21 89 1E FC 12 8C 06 FE 12 B8 24 35
             E 9E2D CD 21 89 1E 00 13 8C 06 02 13 B8 24 35 CD 21 89
             E 9E3D 1E 04 13 8C 06 06 13 07 1E 0E 1F BA 6B 9C B8 23
             E 9E4D 25 CD 21 BA 6C 9C B8 24 35 CD 21 1F E8 5A 00 C7
             E 9E5D 06 FA 12 01 00 C3 90 57 51 B9 0F 00 BF 86 BA C6
             E 9E6D 05 00 83 C7 09 E2 F8 59 5F 2E C7 06 10 3F 0E 01
             E 9E7D E9 8F A3 90 90 90 90 90 90 90 90 90 90 98 90 83
             E 9E8D 3E FA 12 00 75 01 C3 1E 07
                    Come on...  Ain't Got All Day!!                                                                E F676 8E D8 B1 03
             W
             Q

   3. Rename SIERRA.XXX back to SIERRA.EXE
-----------------------------------------------------------------------------
4. STAR TREK: THE KOBAYASHI ALTERNATIVE BY SIMON & SCHUSTER, Dr. Disk

This  simple  protection scheme can be bypassed with Central Point Software's
NOKEY (distributed with COPY II-PC), or you can use the removal scheme below.

         Search through ST.EXE for CD 13 and replace it with 90 90.

You  can  use this patch with most software that you use with NOKEY to bypass
its protection scheme.
-----------------------------------------------------------------------------
5. RAMPAGE AND THE LAST NINJA BY ACTIVISION, INC., The Ninjutsu

The above unprotection scheme can be used on these two ACTIVISION programs.
Search the main EXE files for CD 13 and replace it with 90 90.
-----------------------------------------------------------------------------
6. MANHUNTER: NEW YORK BY SIERRA, Bart Montgomery

            Search the file MHVOL.1 for these bytes: 41 06 7A
                    Come on...  Ain't Got All Day!!                                                                     and replace them with these bytes: 7F C3 00
-----------------------------------------------------------------------------
7. FIX FOR BRUCE LEE BY DATASOFT, The PaperBoy (FOR DISK VERSION ONLY)

     First, Bruce Lee is an excellent product.  It's just that (aaarrrggghhh)
you have no  `falls' left, and you feel yourself quite near the finish of the
game. Suddenly, one of those little dots floating on floor taps your foot and
you get zapped.  You see the sign "Game Over" and you feel pretty pissed, and
wish  you  could open the drive and rip the disk to shreds, but that would be
a waste.  So, fix it! One thing you could do is play option C, one player vs.
your opponent played by the other player. But this time, play alone, and make
sure  the  second joystick is calibrated wrong. If the computer sees that the
Yamo  isn't  moving,  it  will take over, so a wrong calibration will make it
move always.  So, you're playing, but that stupid ninja is in your way and it
won't  let you win.  Alternative?  Eliminate him.  And this is how you do it.
Get  a  disk  utility,  preferably Norton Utilities.  Zap the Bruce Lee disk,
with the following information.

     Sector 271                             Sector 271
     Offset 139                     and     Offset 354
     Change 09(hex) to 63(hex)              Change 09(hex) to 63(hex)
     
     That's all there  is  to it.  Now you play, the Green Yamo flying around
crazily, and the ninja... hmm... the ninja seems to appear for a quick second
                    Come on...  Ain't Got All Day!!                                                   then disappear.  Now, he's never gonna touch you!
-----------------------------------------------------------------------------
8. GATO: WORLD WAR 2-CLASS SUBMARINE SIMULATOR BY SPECTRUM HOLOBYTE, SlimeMan

              To unprotect GATO, use the following table below.

                  Sector    Offset    Contents  Change To

                    53        0E        72 11     90 90
                    53        13        72 0C     90 90
                    53        53        72        EB
                    53        65        75        EB
-----------------------------------------------------------------------------
9. TRIVIA FEVER, Grand Central Station

To unprotect TRIVIA FEVER, follow the steps below.

   1. Rename TF.EXE to TF.XXX
   2. Enter DEBUG and type in the lines below.
         -E 257E       <ENTER>
         -75.90 03.90  <ENTER>
         -W            <ENTER>
         -Q            <ENTER>
   3. Rename TF.XXX back to TF.EXE
                    Come on...  Ain't Got All Day!!                                                   -----------------------------------------------------------------------------
10. THE GAMES: SUMMER EDITION BY EPYX, Dr. Disk

To unprotect THE GAMES, use the following patch below.

               Search for these bytes: E8 87 00 59 C6
                  And replace it with: 59 59 5F EB 55
-----------------------------------------------------------------------------
11. LITTLE BLACK BOOK BY CIGNET TECHNOLOGIES, The Gigolo

To unprotect your LITTLE BLACK BOOK, search the file BOOK.EXE and patch:

         Search for these bytes:  ---->  and replace it with these bytes:
      3D 00 00 74 07 C6 06 03 01         B8 00 00 74 07 C6 06 03 00
      CD 13 B8 01 02 CD 13 72 0E         90 90 90 90 90 90 90 EB 0E
            EB F5 F6 C4 06 75 06         EB F5 F6 C4 06 EB 06

Now, search in the file LBB.EXE and patch:

         Search for these bytes:  ---->  and replace it with these bytes:
   3D 00 00 74 07 C6 06 76 04 01         B8 00 00 74 07 C6 06 76 04 00
      CD 13 B8 01 02 CD 13 72 0E         90 90 90 90 90 90 90 EB 0E
            EB F5 F6 C4 06 75 06         EB F5 F6 C4 06 EB 06
-----------------------------------------------------------------------------
                    Come on...  Ain't Got All Day!!                                                   12. KING'S QUEST IV: THE PERILS OF ROSELLA BY SIERRA ON-LINE, Pirates-R-Us

To  completely  bypass the documentational protection on KING'S QUEST IV, use
the procedure below.

   1. First, search your Quality Assurance file for the correct edition date.
      It is found in the ????????.QA file.
   2. If you do not have your version dated 09-19-88 nor 09-24-88, you cannot
      proceed with this patch.  Sorry!
   3. Rename SIERRA.EXE to SIERRA.XXX.
   4. Enter DEBUG and type the following lines below.
   
      (if you have the 09-19-88 version, use this patch)
      E 0394 82
      E 0CB4 90 E8 38 98
      E A4A9 B8 08 35 CD 21 89 1E 7E 12 8C 06 80 12 B8 24 35 CD 21 89 1E
      E A4BD 82 12 8C 06 84 12 B8 24 35 CD 21 89 1E 86 12 8C 06 88 12 07
      E A4D1 1E 0E 1F BA F7 A2 B8 24 35 CD 21 BA F8 A2 B8 24 35 CD 21 1F
      E A4E5 E8 5A 00 C7 06 7C 12 01 00 C3 90 80 FB 98 75 16 C7 04 32 95
      E A4F9 C6 44 02 00 2E C7 06 B4 09 FF 97 2E C7 06 B6 09 A0 01 FF A7
      E A50D A0 01 90 90 90 90 90 90 90 90 90 83 3E 7C 12 00 75 01 C3 1E
      E A521 07
      W
      Q
                    Come on...  Ain't Got All Day!!                                                         
      (if you have the 09-24-88 version, use this patch)
      E 0394 74
      E 0CB4 90 E8 2A 98
      E A49B B8 08 35 CD 21 89 1E 5E 12 8C 06 60 12 B8 23 35 CD 21 89 1E
      E A4AF 62 12 8C 06 64 12 B8 24 35 CD 21 89 1E 66 12 8C 06 68 12 07
      E A4C3 1E 0E 1F BA E9 A2 B8 23 25 CD 21 BA EA A2 B8 24 25 CD 21 1F
      E A4D7 E8 5A 00 C7 06 5C 12 01 00 C3 90 80 FB 98 75 16 C7 04 32 99
      E A4EB C6 44 02 00 2E C7 06 B4 09 FF 97 2E C7 06 B6 09 0A 05 FF A7
      E A4FF 0A 05 90 90 90 90 90 90 90 90 90 83 3E 5C 12 00 75 01 C3 1E
      E A513 07
      W
      Q

   5. Rename SIERRA.XXX back to SIERRA.EXE.
-----------------------------------------------------------------------------
13. CALIFORNIA GAMES BY EPYX, Jonathan Millhouse

To override the disk protection scheme in CALIFORNIA GAMES, enter Norton
Utilities or your favorite disk/file editor and open CALGAMES.EXE.

                Search for these bytes: FA FC 55 56 57
       And replace it with these bytes: 00 00 31 C0 C3
-----------------------------------------------------------------------------
                    Come on...  Ain't Got All Day!!                                                   14. CHUCK YEAGER'S ADVANCED FLIGHT TRAINER BY ELECTRONIC ARTS, Tony Elliott

(Version 1.2 only)

          1.  Rename AFT.EXE to AFT.XXX
          2.  Enter DEBUG with AFT.XXX open for editing.
          3.  At the DEBUG "-" prompt, type

              U 0DBB <ENTER>

Several  lines  with  be displayed on screen. You are interested in the first
two.  They should look EXACTLY like this:

              xxxx:0DBB  E9A3A7         JMP   B561
              xxxx:0DBE  C3             RET

The "xxxx" represents any four  hexadecimal  numbers.   If  you have a match,
on  to  the next step.  If not, you probably have the wrong version.  Sorry!

          4.  At the "-" prompt again, type

              U 0E38 <RETURN>

Several lines of code will again be displayed on screen.  Look  at  the first
                    Come on...  Ain't Got All Day!!                                                   two following  the "U 0E38" command.  They should also match exactly with the
following:

              xxxx:0E38  880E5005       MOV  [0550],CL
              xxxx:0Exx  8A0E4D05       MOV  CL,[054d]

If you have a match here, then you should  have  a  compatible version of the
AFS program.  If not, sorry!

          5.  At the "-" prompt, type the following:

              E 0DBB 90 90 90 <ENTER>
              E 0E38 C3 90 90 90 <ENTER>
              W <ENTER>
              Q <ENTER>

You should now be back in DOS.  Only one more step left.

          6.  Rename AFT.XXX back to AFT.EXE

That's it!  You now have an unprotected copy of AFT.
-----------------------------------------------------------------------------
15. POWER-UP! SOFTWARE, The No Cause People in Florida

                    Come on...  Ain't Got All Day!!                                                   To unprotect most programs from POWER-UP!, load the main EXE file with Norton
Utilities or such.

          Search for the bytes: E8 48 FF
           And replace it with: 90 90 90
-----------------------------------------------------------------------------
16. THE PRINT SHOP BY BR0DERBUND, Swamp Fox

The Print Shop employs two sections of code to copy protect itself. The first
is embedded in PS.EXE and is exercised when the program is run from a floppy.
The second is  embedded in PSINIT.OVR and is employed when the program is run
from a hard or ram disk. Once activated,  both seek out a specially formatted
track on the A: drive and terminate the program if not found.

Both sections of code will be un-hooked here so that the program will run
from either a floppy or a hard disk.

RENAME PS.EXE PS.ZAP                            Rename for DEBUG

DEBUG PS.ZAP                                    Start DEBUG

S0 9000 CD 13                                   Search for Disk interrupt 13

XXXX:3AC6                                       You should find these two:
                    Come on...  Ain't Got All Day!!                                                   XXXX:3ADF

U 3AC6                                          Unassemble code to make sure
                                                you're in the right place :

XXXX:3AC6       INT     13                      A test for any disk in A:
XXXX:3AC8       MOV     BYTE PTR [0A91],02
XXXX:3ACD       DEC     BYTE PTR [0A91]
XXXX:3AD1       JZ      3AE6
XXXX:3AD3       MOV     DH,00                   \
XXXX:3AD5       MOV     DL,00                    | This sets up a look for the
XXXX:3AD7       MOV     CH,09                    | special track
XXXX:3AD9       MOV     CL,0A                    |
XXXX:3ADB       MOV     AL,01                    |
XXXX:3ADD       MOV     AH,04                    |
XXXX:3ADF       INT     13                      /
XXXX:3AE1       CMP     AH,00                   If not there ... Loop then
XXXX:3AE4       JNZ     3ACD                    Zonk! Terminate Program...


A 3AC6                                          Get rid of 1 st diskette look

XXXX:3AC6       NOP                             Remove the INT 13
XXXX:3AC7       NOP
                    Come on...  Ain't Got All Day!!                                                   XXXX:3AC8

A 3ADD                                          Get rid of the real test:

XXXX:3ADD       MOV     AH,00                   Give it what it wants in AH
XXXX:3ADF       NOP                             Remove the INT 13
XXXX:3AE0       NOP
XXXX:3AE1

W                                               Write out the changed code

Q                                               Quit DEBUG

RENAME PS.ZAP PS.EXE                            Rename for running program

(The program will now run from floppy disks without further changes)

Now for the second portion of the copy protection :

DEBUG PSINIT.OVR                                Start DEBUG (using a copy !)

S0 2000 CD 13                                   Look for disk interrupt 13

XXXX:0479                                       You should find these three:
                    Come on...  Ain't Got All Day!!                                                   XXXX:0492
XXXX:04BD

U 0479

XXXX:0479       INT     13                      A test for any disk in A:
XXXX:047B       MOV     BYTE PTR [CD57],02
XXXX:0480       DEC     BYTE PTR [CD57]
XXXX:0484       JZ      04DB
XXXX:0486       MOV     CL,11                   \
XXXX:0488       MOV     AH,04                    |
XXXX:048A       MOV     DH,00                    |
XXXX:048C       MOV     CH,09                    | This sets up a look for the
XXXX:048E       MOV     DL,00                    |   special track
XXXX:0490       MOV     AL,01                    |
XXXX:0492       INT     13                      /
XXXX:0494       CMP     AH,00                   If not there ... Loop then
XXXX:0497       JNZ     0480                       Zonk ! Terminate Program...

                                                (Look familiar ?)

U 04BD

XXXX:04BD       INT     13                      This one's a read (same idea)
                    Come on...  Ain't Got All Day!!                                                   XXXX:04BF       CMP     AH,00
XXXX:04C2       JNZ     04A5
XXXX:04C4       ADD     BX,018B
XXXX:04C8       MOV     CL,05
XXXX:04CA       ES:
XXXX:04CB       MOV     AL,[BX]
XXXX:04CD       CMP     AL,41
XXXX:04CF       JNZ     04DB
XXXX:04D1       INC     BX
XXXX:04D2       DEC     CL
XXXX:04D4       JNZ     04CA
XXXX:04D6       MOV     AX,0000                 This is the success exit !
XXXX:04D9       JMP     04DE

A 0479

XXXX:0479       NOP                             Remove INT 13
XXXX:047A       NOP
XXXX:047B

A 0490

XXXX:0490       MOV     AH,00                   Give it what it wants in AH
XXXX:0492       NOP                             Remove INT 13
                    Come on...  Ain't Got All Day!!                                                   XXXX:0493       NOP
XXXX:0494

A 04BD

XXXX:04BD       JMP     04D6                    Jump to success exit code
XXXX:04BF

W                                               Write out the changed code

Q                                               Quit DEBUG


The program may   now  be run from a hard disk or floppy as desired. The hard
disk  set up will  ask  for  the  master diskette to be inserted but won't do
any checking or diskette access at all.
-----------------------------------------------------------------------------
17. THE ANCIENT ART OF WAR BY BR0DERBUND, Didley Bop

Load  up  Norton Utilities with WAS.EXE and search for these bytes: E8 F8 32.
Replace them with B8 01 00.  Now, it's unprotected!
-----------------------------------------------------------------------------
18. FIX FOR BATTLETECH BY INFOCOM, The PaperBoy

                    Come on...  Ain't Got All Day!!                                                   You don't have enough C-Bills?  Well, this will help.  Save your game and run
Norton  Utilities  or  such with the GAME# (#=number of the save game) ready.
Edit the bytes at offset 05D5hex and 05D6hex and replace it with 00 70.  That
should give you about 28672 C-Bills when you return to the game.  You may  go
as  high  as  FF 7F, which will total 32767, but I wouldn't want to go higher
than that, or there could be a program interpretation screwup.
-----------------------------------------------------------------------------
19. FIX FOR TECHNOCOP BY US GOLD AND EPYX, Shimba

If you start with only 5 lives and must go through 11 levels of harsh battle,
I  don't  think  you'll  make it, unless you are lucky and fast enough to get
extra  lives.  Save your game, enter NU and change the byte at offset 5hex to
05.  This will return you to 5 lives.  I tried fixing it with FF, but I found
out that it doesn't work - I lose as if I had no lives left.  You can attempt
to screw around with other bytes and hopefully get more lives than five.
-----------------------------------------------------------------------------
20. WILLOW BY MINDSCAPE/CINEMAWARE, Hacker Joe

Open WILLOW.EXE with your hex file editor and perform these operations:

           Search for these bytes:  ---->  And replace with:
           CD 13 59                        90 90 59
           74 02 EB E6                     EB 02 EB E6
           75 04 3C 00                     EB 18 3C 00
                    Come on...  Ain't Got All Day!!                                                              3C F8 75 14                     3C F8 EB 14
           73 0C 33 C0                     EB 0C 33 C0
-----------------------------------------------------------------------------
21. BOP 'N WRESTLE BY MINDSCAPE, SlimeMan

Prepare  BOP.EXE for editing with NU or compatible program.  Search for these
bytes: B8 00 19 CD and replace them with: 31 C0 EB 2F.
-----------------------------------------------------------------------------
22. FIX FOR THE LAST NINJA BY ACTIVISION, The Ninjutsu

Not enough lives?  Well,  save your game and enter your hex-style editor with
that save game file open for editing.  Change the byte at offset 59hex to any
hex number  from 00 to FF.  FF will obviously give you 255 lives, so why want
the 00?  Your  screen  will  be lined up with those damn apples on the bottom
status screen, but they won't effect the game.
-----------------------------------------------------------------------------
23. INFILTRATOR BY MINDSCAPE, MasterByte

This unprotection scheme was very similar to that of  BOP 'N WRESTLE.  Here's
its own version.  ** Make sure you change all EXE files (except INSTALL)! **

                Search for these bytes: 31 C0 19 CD
                   And replace it with: EB 33 19 CD
-----------------------------------------------------------------------------
                    Come on...  Ain't Got All Day!!                                                   24. APOLLO 18 BY ACCOLADE, Two Guys

To unprotect APOLLO 18, use Norton Utilities or PC-Tools and...

                Search for these bytes: 9A 29 00
                   And replace it with: EB 1B 00
-----------------------------------------------------------------------------
25. DEFENDER OF THE CROWN BY MINDSCAPE/CINEMAWARE, The Doctor of MASH

To unprotect DEFENDER OF THE CROWN,  use DEBUG for this one.  Rename the file
DOC.EXE to DOC.XXX and follow the instructions below.

DEBUG DOC.XXX <CR>
-S 0 FFFF B8 00 A0 50 FF 36 0A 45 <CR> ; search for beginning of routine.
xxxx:3BCC                              ; addresses may be different
xxxx:3BF2
-A3BCC <CR>                            ; assemble at first address
xxxx:3BCC JMP 3BF2 <CR>                ; jump to second address
xxxx:3BCE <CR>
-W <CR>                                ; write the edited file back to disk
Writing 11600 bytes
-Q <CR>                                ; quit, return to DOS

Now, rename DOC.XXX back to DOC.EXE.  It's unprotected.
                    Come on...  Ain't Got All Day!!                                                   -----------------------------------------------------------------------------
26. PERFECT COLLEGE, Dr. Disk

This  unprotection  scheme is very similar to that of unprotection scheme #1,
the  ACCOLADE  schemes.  However,  the  program  places  a  RETF (far return)
instruction instead of the normal RET.  So, ready COLLEGE.EXE for edit, and:

        Search for these bytes: 55 56 57 06 1E
           And replace it with: 31 C0 CB 06 1E
-----------------------------------------------------------------------------
27. POLICE QUEST II: THE VENGEANCE BY SIERRA, Pirates-R-Us

The new line of SIERRA software protected with the documentational check have
almost identical patches to the main EXE file.  This one was no sweat.

Rename SIERRA.EXE to SIERRA.XXX and load DEBUG.  Enter these lines:

            E 0394 74
            E 7FDB 05 1F
            E 9E9B B8 08 35 CD 21 89 1E 38 13 8C 06 3A 13 B8 24 35
            E 9EAB CD 21 89 1E 3C 13 8C 06 3E 13 B8 24 35 CD 21 89
            E 9EBB 1E 40 13 8C 06 42 13 07 1E 0E 1F BA E9 9C B8 23
            E 9ECB 25 CD 21 BA EA 9C B8 24 35 CD 21 1F E8 5A 00 C7
            E 9EDB 06 36 13 01 00 C3 90 57 51 B9 38 00 BF B8 AB C6
                    Come on...  Ain't Got All Day!!                                                               E 9EEB 05 00 47 E2 FA 2E C7 06 DB 7C 5B 01 59 5F E9 DE
            E 9EFB E0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83
            E 9F0B 3E 36 13 00 75 01 C3 1E 07
            W
            Q

Rename SIERRA.XXX back to SIERRA.EXE and your unprotection is complete.
-----------------------------------------------------------------------------
28. GOLD RUSH! BY SIERRA, Sir Graham

To  avoid  the  80-page  manual  for the keywords, prepare the file GRDIR for
DEBUG and enter the following lines:

            E 28C CC
            E 28D 7A
            W
            Q
-----------------------------------------------------------------------------
29. THE GAMES: WINTER EDITION BY EPYX, Super Dave

To unprotect THE GAMES: WINTER EDITION, follow these steps below:

    1. Rename GAMES.EXE to GAMES.XXX.
    2. Enter DEBUG with GAMES.XXX ready for modifications.
                    Come on...  Ain't Got All Day!!                                                       3. Type "S 0000 FFFF 0B C0 74 01" to search for the protection pattern.
    4. The  computer should respond with only one address.  If none or more
       than one is given, this unprotection scheme may not work.  Sorry!
    5. Take the address given (in the form of XXXX:YYYY) and subract 5 from
       the  YYYY  address.  The numbers are in hexidecimal.  Do not attempt
       this patch if you do not understand hex.
    6. Use the subracted number (ZZZZ) and enter it in DEBUG as follows:
       "E ZZZZ EB 03 90 90 90 31 C0" to NOP the protection scheme.
    7. Save the modified file by entering "W", then entering "Q" to exit to
       DOS.
    8. Rename the file GAMES.XXX back to GAMES.EXE.
-----------------------------------------------------------------------------
  This file is updated every week.  Watch out for new unprotection schemes!
Please  upload  this  file  archived as "UNP89-#.ARC," where # is the edition
number.  For instant cracks on software, call 1-312-ZAP-DISK and ask for Vic!

[3] Tfiles: (1-3,?,Q) : 