target : Warzone 2100
version : 1.10
protection : cd-check
tools : WDasm 8.93 -> www.crackstore.com
Hiew -> www.crackstore.com
cracker : M.o.D.
ok, let's start.
First install warzone full , take out the cd and start our target!
select singleplayer - new game. Oh no, warzone needs a cd !
select multiplayer. Oh no, the same message!
Let's fix this!
Open wdasm, disassemble warzone.exe and click on imports.
Search for Kerne32.GetDriveTypeA and doubleclick on it.
Many games use GetDriveTypeA to find installed cd-rom drives.
The return value of these api shows what kind of drive you have,
eg 3 means hardrive, 5 means !cd-drive!.
You should see these code:
* Reference To: KERNEL32.GetDriveTypeA, Ord:0104h
|
:0040839E FF1550304F00 Call dword ptr [004F3050]
:004083A4 83F805 cmp eax, 00000005 <- !compares with cd-drive!
:004083A7 756F jne 00408418
:004083A9 83BC242C08000001 cmp dword ptr [esp+0000082C], 00000001
:004083B1 0F8481000000 je 00408438
:004083B7 8D8C2428020000 lea ecx, dword ptr [esp+00000228]
:004083BE 6800010000 push 00000100
:004083C3 8D542414 lea edx, dword ptr [esp+14]
:004083C7 51 push ecx
:004083C8 8D44242C lea eax, dword ptr [esp+2C]
After the GetDriveTypeA you should see a GetVolumeInformationA. These api returns diffrent informations (label...)about a drive in your pc; in our case about the !cd!.
The cd-check sets eax to 1 if the test was successful.(you can find that in many other games)
So we only have to do that these funtion always returns 1 in eax.
Crack:
Search for the start of these function (line: 408280,here the code is called).
Note the offset (8280), open warzone.exe in hiew, press F4 and select DECODE.
Now press F5, enter the offset and then press F3.
Enter the following text:
33C0 - clears EAX ( EAX=0)
40 - increments EAX with 1 ( EAX=1)
C3 - return from the function
Now save warzone.exe and start it. Select singleplayer- new game and ...
it runs without cd!!!!
Select multiplayer and ... oh, whats this - another cd-check!
Go back to wdasm, click on imports an search for Kernel32.GetVolumeInformationA.
Doubleclick on it several time until you see this code:
* Reference To: KERNEL32.GetVolumeInformationA, Ord:0177h
|
:00408BB8 8B1D4C304F00 mov ebx, dword ptr [004F304C]
:00408BBE 6800010000 push 00000100
:00408BC3 50 push eax
:00408BC4 51 push ecx
:00408BC5 8D442418 lea eax, dword ptr [esp+18]
.
.
.
* Possible StringData Ref from Data Obj ->"Wz2100"<-warzone cd-label
|
:00408C10 68489D4F00 push 004F9D48
:00408C15 E8C69F0E00 call 004F2BE0
:00408C1A 83C408 add esp, 00000008
:00408C1D 85C0 test eax, eax
:00408C1F 747E je 00408C9F
The same here again. If the cd-check was successful the function retuns
1 in EAX. So we have to search the part of the code where EAX is set to 0.
Mostly EAX is cleared with a " xor eax,eax". You find this at line: 00408C95.
Note the offset from this line.
Crack:
Open warzone.exe in hiew, press F4 and select DECODE. Now press F5, enter the offset(8C95) and then press F3.
Enter the following text:
40 - increments EAX with 1 ( EAX=1)
90 - no operation
Save warzone.exe start the game, select multiplayer and ... yeah, it runs!!
Congratulations!, you have cracked Warzone 2100.
If you have questions or comments then mail me : MoD_f2f@gmx.net
Ps: excuse my bad english!
Cu
M.o.D.