Getting Started:

First of all I 'll asume you have the iso version of tribes 2 with the unwraped exe allready. I dont know if its even protected with a comercial protection cause iv just got a cracked iso version. But the CDCHECK is still in tack :)

The usal quick BP 's to use didnt work for me at first so puzzled, I alt-tabbed back into windows and loaded filemon.
Went back into the game and click OK. When it failed the cd check again i went into filemon, stoped its monitoring and had a look at what tribes 2 was doing. Here we find this interesting bit of information:

12:10:12 AM Tribes2 Ioctl A: NOTREADY Subfunction: 0Dh
12:10:13 AM Tribes2 Ioctl C: SUCCESS Subfunction: 0Dh
12:10:13 AM Tribes2 FindOpen C:\*.* SUCCESS CRK
12:10:13 AM Tribes2 FindClose C:\*.* SUCCESS
12:10:13 AM Tribes2 Ioctl D: SUCCESS Subfunction: 0Dh
12:10:13 AM Tribes2 FindOpen D:\*.* SUCCESS D
12:10:13 AM Tribes2 FindClose D:\*.* SUCCESS
12:10:13 AM Tribes2 Ioctl E: GENFAILURE Subfunction: 0Dh
12:10:13 AM Tribes2 Ioctl F: GENFAILURE Subfunction: 0Dh

CRK is my C:\ label and D is my D:\ label. So from this we can see there is a label check. If you check out the Tribes 2 cd you will noticed its label is 'T2 INSTALL '. You could either set your harddrive label to this to bypass the check or check out the EXE itself :)
Get back into the game and in softice type: 'bpx getvolumeinformationa '. Now Click the OK button again and sice should popup. Your now looking at this code:

:0054A97E FF15A0E67A00 Call GetVolumeInformation
:0054A984 85C0 test eax, eax
:0054A986 0F8484000000 je 0054AA10 < -If there is no label JUMP
:0054A98C 8D85A8FCFFFF lea eax, dword ptr [ebp+FFFFFCA8]
:0054A992 50 push eax < -Put this HARDDRIVES label into EAX (does each drive)
:0054A993 FF750C push [ebp+0C]
:0054A996 E865530000 call 0054FD00 < -Label Check. If you trace into here and into another call you will see the comparision is a simple HEX compair. We wont go into it because its easy enough to understand anyway. If the check is successfull EAX will equal NILL.
:0054A99B 85C0 test eax, eax
:0054A99D 59 pop ecx
:0054A99E 59 pop ecx
:0054A99F 756F jne 0054AA10 < -Bad jump
:0054A9A1 837D1000 cmp dword ptr [ebp+10], 00000000
:0054A9A5 740E je 0054A9B5 < -Jump is check succeeds
:0054A9A7 8B85A4FAFFFF mov eax, dword ptr [ebp+FFFFFAA4]
:0054A9AD 3B85A8FEFFFF cmp eax, dword ptr [ebp+FFFFFEA8]
:0054A9B3 755B jne 0054AA10

There is another check that checks the CD for the location of Tribes2.exe. If it doesnt find it it gathers your not using the CD. Set a breakpoint on FindFirstFileA. When sice breaks you will see this short code:

:0054A9FB FF158CE67A00 Call FindFirstFileA
:0054AA01 83F8FF cmp eax, FFFFFFFF < -FF means it didnt find the exe
:0054AA04 740A je 0054AA10 < -Bad jump
:0054AA06 8D65F4 lea esp, dword ptr [ebp-0C]
:0054AA09 B001 mov al, 01
:0054AA0B 5F pop edi
:0054AA0C 5E pop esi
:0054AA0D 5B pop ebx
:0054AA0E 5D pop ebp
:0054AA0F C3 ret

Conclusion:

So this sums up the tutorial. Tribes 2 CDCHECK is piss easy. Nop the jump at 0054A99F and make the jump at 0054A9A5 non-conditional (EB). Try not to patch jump, rather experiment with moving values into the registers :). And at the file check simply change the cmp value from FF to EF. That way its never going to jump :). You can probely tell this tutorial is rushed, its currently 1am and im dying to get to bed ;)
ThrawN out......

Any questions? Mail me: thrawnc@hotmail.com
Visit my Home Page

Greetings fly out to:
y0ke (Thanks for letting me use this template) , iSTiNCT, DiSTiNCT, eMINENCE, R!SC, M_, MrFrost, SP33D, Seifer666, Warezpup, BuLLeT, Carpathia, and the rest i couldnt be boffered inserting here.