🚀 go-pugleaf

OK, about a dozen people asked my by private e-mail how to defeat the
login protection in DR-DOS 6.0 with only a system DOS diskette and
DEBUG or Norton Utilities. Since I don't want to reply to each one of
them, I'll describe the method here. I hope that when you see how easy
it is, you will not rely on this "protection" any more...

When you boot from a DOS system diskette, the "protected" drive is not
accessible - you get an error message ("Invalid drive") if you try to
access it. This has discouraged most people, but it merely means that
the drive is not accessible to -DOS-. Fortunately, DOS is not the only
thing under the sun. Your IBM PC-compatible has a system program in
the EPROM chips, called BIOS, which is perfectly able to access an
physically connected hard disk, if it is driven by a BIOS-compatible
controller. This access is not on a file or logical sector basis, but
on a track/cylinder/sector (i.e., physical sector) basis.

DEBUG can access the disk only as logical sectors, so in order to
access it on a physical level, you'll have to write a short program,
using INT 13h - the BIOS service, used to access the disk. However,
people who know how to do that, usually don't ask why booting from a
floppy can bypass the hard disk protection, so I'll describe an easier
method, using the program Disk Editor from the Norton Utilities
package.

Once you have booted from the proverbial DOS system diskette, you
start up DE and select to access the first hard disk as a physical
drive. (You should be able to figure out how to do that from the
menus, if not - read the documentation.) You'll see that the
"protected" hard disk is perfectly accessible in this way.

Use DE to read the partition table of the first hard disk, and display
it in the appropriate (partition table) format. You'll see on the
screen a nice table, describing the partitions of your hard disk. Go
to the line that describes the bootable partition, and move the cursor
to the field that contains the partition type. This field should
contain "???" for protected DR-DOS partitions and something more
sensible (FAT-16, BIGDOS, NOVELL, UNIX, etc.) for the other partitions
(if any).

Now press F2 to display the sector, containing the partition table in
hex mode. The display will change, but the cursor will still stay on
the byte that describes the partition type. For big (>32 Mb) protected
DR-DOS 6.0 partitions, the value of this byte will be 0C6h. For
smaller partitions the low nibble might be something different than 6
(I cannot check right now), but the high nibble will still be 0Ch.

Instruct DE to be able to modify the hard disk (Tools/cOnfig/Readonly
should be set to NO), and edit the byte under the cursor - change its
value from 0C6h (or 0Csomething) to 06h (or 0something). Write the
modified sector back to the hard disk.

Now reboot the machine - from the hard disk this time. Regardless that
you still have DEVICE=LOGIN.EXE in your CONFIG.SYS, DR-DOS will not
bother to ask you for a password - since it will decide that the
partition is not protected.

That's all.

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany