Btukfyl

I seem to recall from my high-school days that certain Apple ][ programs protected themselves from being listed and therefore modified.

If you tried to do it, the machine would simply reboot.

How did they achieve this, and can it be bypassed to get at the code?

One way was to place an in-line reboot command into the actual listing.

Apple ][ DOS had a feature that would monitor the output stream and, if it found a special character, the rest of the line would be treated as a command. This character was a CTRL-D, meaning you could get a disk listing from your program with something like:

PRINT CHR$(4);"CATALOG"

You could also use the slot activation command IN#6 which would generally reboot the machine, assuming your disk controller was in slot 6 (it usually was).

But, of course, that would only work with a print command if you were running your program. For protecting against someone listing it, an extra layer of trickery was required.

You would create a line at the start of your program:

10 REM XIN#6

and then use POKE 99999, 4 to change the X into a CTRL-D, adjusting the 99999 to point to the actual X character of course.

After that, an attempt to LIST the program would result in the machine rebooting. So this is probably something you wanted to do once development was done, just before shipping :-)

In order to bypass it, it's a simple matter of working out the errant line and just deleting it. In the case above, that would be acheived by just entering the stand-alone:

10

on the command line and, voila, the program is unprotected. To stop this, some developers started numbering the programs with less "normal" line numbers such as 2718. However, since the line numbers are stored in memory as well, you could PEEK at the program to work out what the first line number was, and then delete that one.

IIRC, there were lots of variations to implement this scheme. Besides embedding characters in the listing that would reboot, or clear the screen every so often, a particular one I remember worked roughly like this:

The listing only consisted of a single CALL. The internal structure of the BASIC rogram was carefully changed so the listing was stopped there, but there was a lot of stuff after this single command. This call would be to an embedded machine program somewhere in the BASIC listing, which would re-arrange the structure to make the whole program visible, and also register itself with some hooks to make it invisible again. You could defeat this protection by disassembling the machine code and running part of it. Or even by pressing RESET or something at a proper time, I forgot the details.

Not all BASIC programs that consisted of a single CALL were like this. There were also pure machine programs which disguised itself as BASIC programs in this way for some reason I never understood.