HOW TO CRACK:
Mortyr v RC1 Beta

Introduction: Mortyr is another 1st person shooter that uses the Unreal engine to great effect for the reflections and lighting, there is some stunning architecture and reflection effects in the many churches and cathederals in the game. The gane is based around finding various parts of a time machine and is set in Nazi Germany therefore the weaponary is from that era, no plasma rifles here until you get into the future, i'm afraid. I have played it for a couple of days and it's really very good.

The Protection: I received a copy of this game and it kept asking for the CD after playing the opening intro AVIs as it did on 3 other machines but on another friends' machine it worked perfectly ok. Hmmmm, so I don't know whether it had been tampered with previously or not. Anyway, let's get on with it.

The Crack: After the initial opening sequence you are (well lots of my friends were) asked for the Mortyr CD. A message box appears with the message 'Data file error.......Mortyr CD not found', even though the movies played from the CD at first. Looks quite straight forward this one. Do a full install and remember to change the path in the 'CDROM.STD' file to point to your installed path.

Tools needed:WDASM & a hex editor

 

Load the mortyr.exe (700416 bytes) into WDASM and wait a short while........
We need to search for the message 'Mortyr cd not found' so look under the 'Refs' menu and select 'String data references' and you will see a reference to it, double click on it, there is only one reference to it in the code. You should be looking at the following code.


:00485178 81F99A020000 cmp ecx, 0000029A --------------------------------------> checking ecx for a value of 666
:0048517E 740D je 0048518D -------------------------------------------------> If equal to 666 then carry on normally

* Possible StringData Ref from Data Obj ->"Mortyr CD not found." --------> here's our line
|
:00485180 68D86A4A00 push 004A6AD8 --------------------------------------------> we don't want to reach this line
:00485185 E8A600F8FF call 00405230
:0048518A 83C404 add esp, 00000004
:0048518D 5E pop esi ----------------------------------------------------------------------> good guy jump here
:0048518E C3 ret


As you can see, a check is made on a value of 666 in ecx and if the value is not 666 then the message box is called and the 'Mortyr cd not found' message is displayed. So by forcing a JuMP at 48517E we can beat the dodgy cd-check. The offset is 8517E in the mortyr.exe file and the byte you want to replace with is EB which is JMP instead of JE (Jump if Equal). I have played the game for a while like this and haven't had any problems at all yet.....................that's it, hope you learned something.

Home

 

UPDATE:23/8/99
The game crashes on a level in the future (the droid factory). While escaping in the elevator from this level the game tries to load a file from the huge archive file 'main.hal' and subsequently returns to windows with a 'missing file' error. The file in question is 'gadka1.wav' (found out using Filemon) so you need to search for thereference to this file and rename it to 'gadka2.wav'. This seems to have fixed the problem so far....................i'm still playing it.