KANAL23 Tutorial

http://www.kanal23.net

	Welcome to my 8'th tut on cracking.
	In this tut we are going to crack the Cd protection scheme of a game.What game?Read on if u want to find out .
	Let my explaine myself why i'm writing this tut:
1.Maybe some newbie will find it usefull(who knows?)
2.The protection is very easy to defeat(u'll see)
3.Because sometimes(very rare) i'm too tired to crack so i try to relax myself playing some,less or more good,games.
	Here we go:

	I bot this game couple of days ago and like the curios cracker that y am i wanted to find out if y could defeat his
 annoyng Cd check.So here y am:
	Install the game with the full option.Done?Good
	Remove the Cd from your Cd-drive and try to play the game:"Cd copy protection check failed..."
	Remember this message.
	Load the target in W32dasm.Ready?Good for u.
	Look in string ref. for our message.Found it?Good then u must be here:
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040B264(C)
|
:0040B275 53                      push ebx
:0040B276 E875B90F00              call 00506BF0
:0040B27B 83C404                  add esp, 00000004
:0040B27E 84C0                    test al, al
:0040B280 7420                    je 0040B2A2		-->jump if Cd is in drive!!

* Possible StringData Ref from Data Obj ->"CD copy protection check failed. "
                                        ->" Please insert an official Tony "
                                        ->"Hawk's Pro Skater 3 CD and restart "
                                        ->"the application."
                                  |
:0040B282 8B0D605E5B00            mov ecx, dword ptr [005B5E60]
:0040B288 6A30                    push 00000030
:0040B28A 53                      push ebx
:0040B28B 51                      push ecx
:0040B28C 53                      push ebx
	The jump at 0040b280 is our last conditional jump before the bad cracker message apears.So  if we don't want to see
 the message we must make to jump always(either the cd is in drive or not).
	So in hiew look for the addres of the jump and then reverse it
je-->jmp.
	Save the result.Overwrite the good target with the patched one.Does it work?Why shouldn'tit?
	Doesn't matter!!
	This tut now closes.Bye bye!!

Untill next time keep on grasping!! See you..(or not)

Groups:Kanal23
Individuals: Acid_Cool_178, +Orc, +Fravia and all the crackers from which i've learned something!!

This Document is copyrighted to kanal23 and its members. Please mail the author of this document for complains and those things.
Kanal23 are signing out for now.