Name : Need for Speed 3 Target : nfs3.exe Tools : W32Dasm Hiew Brain Cracker : LW2000 Tutorial : No.30 --- DISCLAIMER For educational purposes only! I hold no responsibility of the mis-used of this material! --- 1. Ok, install the full Installation of NFS3. Try to play without the CD. *BOOM* error message. Note the text and caption. Then disassemble nfs3.exe with W32Dasm. Click on the SDR Button and search for our text. Text not found? Then search for the caption of the window. Possible StringData Ref from Data Obj ->"Need for Speed 3" 004B637A 683CFE5300 push 0053FE3C 004B637F 8B5485DC mov edx, dword ptr [ebp+4*eax-24] 004B6383 52 push edx 004B6384 6A00 push 00000000 Reference To: USER32.MessageBoxA, Ord:001Fh 004B6368 2EFF1564475300 call dword ptr cs:[00534764] 004B638D 31C0 xor eax, eax 004B638F E870990200 call 004DFD04 Reference by a (U)nconditional or (C)onditional Jump at Adress: 004B6362(C) 004B6394 E807FFFFFF call 004B62A0 004B6399 85C0 test eax, eax 004B639B 755A jne 004B63F7 004B639D 31D2 xor edx, edx 004B639F EB19 jmp 004B63BA Reference by a (U)nconditional or (C)onditional Jump at Adress: 004B63C3(C) 004B63A1 88D0 mov al, dl 004B63A3 0441 add al, 41 004B63A5 8845F4 mov byte ptr [ebp-0C], al 004B63A8 8D45F4 lea eax, dword ptr [ebp-0C] 04B63AB E8809F0300 call 004F0330 <<-- cd check call 004B63B0 85C0 test eax, eax <<-- check 004B63B2 7543 jne 004B63F7 <<-- bad boy !!! Reference by a (U)nconditional or (C)onditional Jump at Adress: 004B63C5(U) 004B63B4 42 inc edx 004B63B5 83FA1A cmp edx, 0000001A 004B63B8 7D0D jge 004B63C7 Reference by a (U)nconditional or (C)onditional Jump at Adress: 004B639F(U) 004B63BA 89DO mov eax, edx 004B63BC E84F300400 call 004F9410 004B63C1 85C0 test eax, eax 004B63C3 75DC jne 004B63A1 004B63C5 EBED jmp 004B63B4 Reference by a (U)nconditional or (C)onditional Jump at Adress: 004B63B8(C) 004B63C7 B906000000 mov ecx, 00000006 004B63CC 8D7DC4 lea edi, dword ptr [ebp-3C] 004B63CF BEAC564B00 mov esi, 004B56AC 004B63D4 6A30 push 00000030 004B63D6 A1503A7A00 mov eax, dword ptr [007A3A50] 004B63DB F3 repz 004B63DC A5 movsd Possible StringData Ref from Data Obj ->"Need for Speed 3" 004B63DD 683CFE5300 push 0053FE3C 004B63E2 E84F300400 mov ecx, dword ptr [ebp+4*eax-3c] 004B63E6 85C0 push ecx 004B63E7 75DC push 00000000 Reference To: USER32.MessageBoxA, Ord:001Fh 004B63E9 2EFF1564475300 call dword ptr cs:[00534764] 004B63F0 31C0 xor eax, eax 004B63F2 E80D990200 call 004DFD04 <<-- fine ... Reference by a (U)nconditional or (C)onditional Jump at Adress: 004B639B(C), :004B63B2(C) 004B63F7 89EC mov esp, ebp <<-- here we go if the cd is inside 004B63F9 5D pop ebp 004B63FA 5F pop edi 004B63FB 5E pop esi 004B63FC 5A pop edx 004B63FD 59 pop ecx 004B63FE 5B pop ebx 004B63FF C3 ret 2. Take a close look at all jumps. mhmm, 004B63B2 7543 jne let's change the jne to jmp. I think this should be no real problem for you... Open the exe with hiew and change the 7543 to EB43. (EB is for JMP). The CD Check is beaten, but what's this shit? Abort message: openhandlea-OPEN FAILED ON D:\GameData\Audio\pc\show(x).map (x is any number) No prob, we copy this folder into our nfs3 folder. Copy the files from the CD Folder GameData\Audio into your local folder on your HD. Then open insatll.win (it insiede the nfs3 dir) and change the path's like this: .\GameData\ .\GameData\Tracks\ .\GameData\Tracks\Tutor\ .\GameData\CarModel\ .\GameData\Render\pc\ .\GameData\DashHud\ .\GameData\Audio\pc\ .\GameData\Audio\SFX\ .\GameData\Audio\Speech\English\ .\GameData\Audio\Speech\German\ .\GameData\Audio\Speech\French\ .\GameData\Audio\Speech\Spanish\ .\GameData\Audio\Speech\Italian\ .\FeData\art\ .\FeData\text\ .\FeData\text\ .\FeData\save\ .\FeData\stats\ .\FeData\config\ .\FeData\audio\ .\FeData\Art\Slides\ .\FeData\Art\Track\ .\FeData\Art\Showcase\ .\FeData\movies\ .\FeData\stats\prh\ Save your work and try NFS3 without CD. Congratulation! You have done it! FINISH! Easy, or? cu LW2000 Any comments? Mail me LW2000@gmx.net !!! ---- tKC, thx for your tutors! I started with tutor 1 and i still read them... they are the best!