How did Apple II BASIC programs protect against listing?

Question

I seem to recall from my high-school days that certain Apple II programs protected themselves from being listed and therefore modified.

If you tried to do it, the machine would simply reboot.

How did they achieve this, and can it be bypassed to get at the code?

Answer 1

One way was to place an in-line reboot command into the actual listing.

Apple II DOS had a feature that would monitor the output stream and, if it found a special character output at the start of a line, the rest of the line would be treated as a command. This character was Ctrl+D, meaning you could get a disk listing from your program with something like:

PRINT CHR$(4);"CATALOG"

You could also use the slot activation command IN#6 which would generally reboot the machine, assuming your disk controller was in slot 6 (it usually was).

But, of course, that would only work with a print command if you were running your program. For protecting against someone listing it, an extra layer of trickery was required.

To do this, you would create a line at the start of your program:

10 REM XXIN#6

and then use POKE commands to change the XX into a Ctrl+M (to start a new line) and Ctrl+D (to flag a command), before saving.

After that, an attempt to LIST the program would result in the machine rebooting. So this is probably something you wanted to do once development was done, just before shipping :-)

In order to bypass it, it's a simple matter of working out the errant line and just deleting it. In the case above, that would be achieved by just entering the stand-alone:

10

on the command line and, voila, the program is unprotected. To stop this, some developers started numbering the programs with less "normal" line numbers such as 2718. However, since the line numbers are stored in memory as well, you could PEEK at the program to work out what the first line number was, and then delete that one.

Answer 2

If I recall correctly, there were lots of variations to implement this scheme. Besides embedding characters in the listing that would reboot, or clear the screen every so often, a particular one I remember worked roughly like this:

The listing only consisted of a single CALL. The internal structure of the BASIC program was carefully changed so the listing was stopped there, but there was a lot of stuff after this single command. This call would be to an embedded machine program somewhere in the BASIC listing, which would re-arrange the structure to make the whole program visible, and also register itself with some hooks to make it invisible again. You could defeat this protection by disassembling the machine code and running part of it. Or even by pressing RESET or something at a proper time, I forgot the details.

Not all BASIC programs that consisted of a single CALL were like this. There were also pure machine programs which disguised itself as BASIC programs in this way for some reason I never understood.

Answer 3

There were multiple ways of protecting the program, including:

• order of line numbers could be altered to produce:

• circular listings;

• missing lines;

• out-of-order lines;

• out-of-bounds addressing;

• the "resume" flag could be set such that any command could cause the program to run again;

• the start-address for the program could be altered so that another (or none) listing would show;

• line-linking could be altered to run "unreachable" lines;

• the DOS interpreter accepts special characters so that slot code can be run ("PR#6" being the most common, but "DELETE HELLO" works equally well). This sounds like what you were seeing.

• the code could be self-modifying as it ran.

There was also a modification to the KBDIN routine to point to the reset routine, so that if you achieved a prompt and tried to type something, the machine would reboot.

For a more detailed description, see section 7.20 in "A Brief Description of Some Popular Copy-Protection Techniques on the Apple ][ Platform".