Software Vault: The Gold Collection

home *** CD-ROM | disk | FTP | other *** search

/ Software Vault: The Gold Collection / Software Vault - The Gold Collection (American Databankers) (1993).ISO / cdr12 / toplib50.zip / METHODS.TXT < prev next >

Wrap

Text File | 1993-06-01 | 32KB | 637 lines

Techniques in Cracking Brought to you by -TOP- We are Tired of Protection. Arent You? The Following Information provided is a listing of some techniques the -TOP- crackers have used in cracking Programs. This is NOT intended as a Cracking Tutorial but as an enhancement to people who need to know just a bit more in order to crack a certain program. -TOP- Crackers have spent time and effort in comming up with these techniques. Get what information you can from it. It will be updated each new Issue. Listing of Techniques 1. Goldrush 2. Space Ace 3. SimEarth 4. StarControl 1 5. Bo Jackson Baseball 6. Mike Dikta Football 7. Con>Format 1.06 8. The Summoning 9. Martian Dreams 10. Sargon V 11. Secret Weapons of the Lutewaffa 12. Crimewave 13. 3 on 3: The Dream Team. 14. JACK 4.59: Landscape Designer 15. Blue Wave Reader v 2.1 16. Giflite v 2.0 17. Veil of Darkness <*****************************************************************************> Unprotect for GoldRush by Sierra! ********************************** Sierra's Doc check AARGH! ********************************** This one is a royal pain to do manually however, here it goes: Using norton DE/Pctools enter the file AGI. Look at the beginning of the file and start at the A in 'Adventure game...' and enter the numbers on the lefthand side of the screen. For those interested the assembly code is on the right. 90 NOP 9C PUSHF 50 PUSH AX 53 PUSH BX 56 PUSH SI 8B 1E AA 00 MOV BX, [AA] BE E3 73 MOV SI, 73E3 46 SCAN: INC SI 38 1C CMP [SI],BL 75 FB JNZ SCAN 8A 44 07 MOV AL, [SI+7] A2 F7 00 MOV [F7], AL 5E POP SI 5B POP BX 58 POP AX 9D POPF C3 RET That is only part one, part two is shorter: Using norton's DE or Pctools search 'AGI' for: 8A 87 09 00 00 85 09 00 ^^ ^^ ^^ ^^ ^^ ^^ ^^ ^^ 90 90 90 90 2E E8 15 89 In Assembler: NOP NOP NOP NOP CALL CS:0 *********************************************************************** TO BYPASS THE PROTECTION YOU MUST ENTER AT LEAST ONE LETTER FOLLOWED BY *****THE ENTER KEY***** The method involved: Sierra programs are a royal pain and even the old ones take me a long time to crack. This one lets you type in an answer. I did a search through memory to find the answer and then did a break if any letter was read of the answer. I followed it through and found the the program added the letters up into a single number (at ds:f7). I followed this and found a compare that accessed this number. However, I could not find anyplace to put a crack in so I went back to find how the answer was obtained. What a royal pain. I found a number that was used to index into a block of memory that had all the answer numbers --no words, just numbers (started at ds:73e4). The program would compare its index number to sub-blocks until it found the right number. It then would scan a bit further until it found the number and then did its compare. However, it was not done until it scanned the entire block for any other equal numbers. So the crack involves using spare room inside the sierra file AGI, grabbing the index number (at ds:aa) and scanning through the memory block (starting at ds:73e4). Once the right sub-block was found a went a bit further and took the number there and put it back at ds:f7--which was where the program looks for my answer. The second part of the crack is to call the subroutine. The Mad Doctor -TOP- crack. <*****************************************************************************> Cracker: The Mage Program: Space Ace. A Little Description of the Copy-Protection. The Copy Protect was Off of a main loop. It was integrated into the program. A Main screen popped up and it went in 4 different directions. One of these Directions led to the Copy Protection screen which THEN let you into the game. The Game was also in this main loop and so Nopping out the CALL would not avail me. I searched the code through and through and found that it was using a interesting comparison scheme to determine the Screens with which to load based on 4 different variables and Combinations thereof. This was interesting. I had to re-program the code to make it go to regular locations 3 out of 4 times and the 4th time force it to jump to the game. This required some programming and Assembly knowledge. The Copy Protection itself was different than any others I have seen, or the way I got passed it was different. <*****************************************************************************> Cracker: The Mage and Majik Program: Sim Earth Some Background on the game.. When you load up the game it pops into a nice menued system. This system allowed you to mess around But on 2 different Commands (New Planet and Load Planet I think) had a DOC check. Now since there was more than one CALL to the same procedure Majik had an Idea. Since it was a window based system and you wouldn't be expected to keep answering the DOC check, it seemed that there must be a counter or something that checked if you had answered the question BEFORE asking it. Entering Into the CALL we did some quick checking and sure enough right at the beginning of the call was a comparision that jmped pretty much to the end of the procedure. Well by simply forcing this to happen you never saw the CP again. A HINT to people who usually just NOP out calls. NOP'ing out CALL's works a lot of the time but I would suggest that you completly play the game before you consider it cracked. By removing the CALL statement it just removes that current CP but it may also be called later on in the program which would then mean additional Removals. Look inside each CALL and see if there is a simple way to JMP to the end of the CALL and thus eliminating that possibility. <*****************************************************************************> Unprotect for Starcon! ********************************** Documentation Check ********************************** use Pctools/Norton's DE and search STARCON.OVL for: FE 00 75 03 E9 4C ^^ ^^ EB 2A The method involved: Actually not hard. I uncompressed starcon.exe with unlzexe to make it easier to follow through and also to find the proper bytes if I needed to but this wasn't necessary. By running through the code I found the doc check. I found right after it where the program loaded the addresses of my answer and the programs answer with a compare statement and conditional jump afterward. I just made the program jump immediately to that area. I could have made it so the screen would not even show up but you would have seen some garbage on the screen and it would have been a messier crack. Enjoy! The Mad Doctor -TOP- crack. <*****************************************************************************> Unprotect for The Bo Jackson Baseball! ********************************** Pathetically simple protection ********************************** Bo Jackson Baseball is another one of those protection checks in which you need your manual to answer a question. use Pctools/Nortons search for (in BALL.EXE) 9A 4C 04 ^^ ^^ EB 14 The method involved: The method here is so simple I am embarassed to relate it to you. I ran the program once to see what the protection was. It was one of those generic protection checks. I let the protection kill the game and restarted it again under soft-ice. This time I timed it a bit and stopped the program before it got to the doc check. I stepped through it with soft-ice and found 2 calls that ran the protection. A few steps later I found a conditional jump that went to the rest of the game. So I tried the simplest thing. I put a JMP statement to the rest of the game and it worked! I then went into norton diskedit and searched for the bytes. It wasn't there, so I searched for a shorter string (as above) and there was only one string like that in the program. I made the changes above and it works! Enjoy! The Mad Doctor -TOP- crack. <*****************************************************************************> Unprotect for Mike Ditka Football! ********************************** Documentation Checks and Checksums ********************************** Mike Ditka football has the standard documentation checks but also has some checksums early on that also have to be fixed. This is a 3 part unprotect. use Pctools/Nortons search for (in MDFB.EXE) Part 1: 75 6B 05 00 ^^ ^^ 90 90 re-search MDFB.exe for: Part 2: 75 12 8E 46 ^^ ^^ 90 90 now look in DAT101.DAT for: part 3: E8 A1 B7 B8 01 ^^ ^^ ^^ 90 90 90 The method involved: This program uses the doc check which is not too difficult to find. If you let the program run and then stop it with soft-ice just prior to when the doc check pops up you will find a call routine that calls the doc check up. If you NOP it out you then go right to the main menu. OK, now we go to norton's diskedit and make the changes and run the program. Drat! the program says bad overlay--obviously someone put a checksum to prevent exactly what I did. No problem, lets go back into soft-ice and run the program using the soft-ice again and stopping the program before it gets to that bad overlay statement. I then find a call routine that makes the statement and 2 conditional jumps that will lead up to that call. So, I NOP them out and it works. I then went back to diskedit and made the changes. Now, it works. Enjoy! The Mad Doctor -TOP- crack. Addendum: This program was already supposedly cracked by others. It is interesting that their crack works when I use soft-ice but does not work without it. This crack works period. <*****************************************************************************> Another fine patch courtesy of Majik.. Con>Format is a fine product, but the opening banner is a pain in the you know what, and requires a keypress, which kinda ruins putting it in autoexec.bat....(I use loadhi from QEMM so it's always there but uses no conventional memory). ok, here is a step-by-step for version 1.06 1st!!!!! Run the configuration program to setup your system 2. debug confmt.com -r ;To display registers upon entry - write down cx's value AX=0000 BX=0000 CX=3560 DX=0000 SP=FFFE BP=0000 SI=0000 DI=0000 DS=24FE ES=24FE SS=24FE CS=24FE IP=0100 NV UP EI PL NZ NA PO NC 24FE:0100 E93F35 JMP 3642 keep pressing p (to proceed) until you see the following... 24FE:365C FF264036 JMP [3640] DS:3640=266A - write this down ^^^^^ -p | This has just completed the de-cryption algorithm for the TSR. | So we will code around that for future start-up. | -a cs:100 | 24FE:0100 jmp 266a <--- This should be what you wrote down up here -> | 24FE:0103 <ENTER> Now to get rid of that opening screen... 24FE:2697 E8B40D CALL 344E This is the call to the opening screen -e 2697 24FE:2697 E8.90 So we will NOP it out.... 24FE:2698 B4.90 0D.90 -r cx CX 0000 :3560 Enter the value from step 2 above. -n cf.com Rename the working program to whatever you like -w Write it to disk writing 3560 bytes -q Enjoy.... Majik <*****************************************************************************> Unprotect for The Summoning! ********************************** Graphical documentation check ********************************** use Pctools/Norton's DE and search 'CODE.1' for: A3 CC 0C 56 57 0E ^^ ^^ EB 16 The method involved: I ran the program with Soft-Ice and saw what the protection looked like on the screen. I then went back, ran the program and stopped it early to see what was going on. The program is fairly straightforward with individual call routines doing individual things. I quickly got to the protection portions and found two calls that brought up the protection screen and the second actually did the test for the answer and returned back where it checked ax to see if it was zero or not. If it wasn't zero it wouldn't let you continue with the game. I just jumped past the entire section and it worked! Enjoy! The Mad Doctor -TOP- crack. <*****************************************************************************> Unprotect for Martian Dreams! Use your PC Tools or Norton Diskedit on the file game.exe search for the hex string: 74 08 8b 5e 0a ^^ replace the 74 with: eb When the protection check comes up just press enter and it will work! The method involved: The difficulty in breaking this game wathat the program seemed to be using the same sets of code no matter what it did and this was extremely frustrating. I was trying to stop the protection routine from even coming up. I was unable to do this so I went for the next best thing, I inactivated the doc check. Here's how: when you try to get out of the spaceship with the prybar is when the protection springs up. Tesla asks you a question from the manual. I filled in a word and then stopped the program with soft-ice and searched for it in memory. I found it at: 4161:eca8 I then put a watch on it with the bpmb command in S-I. By following what the program was doing with my answer I found that it moved it to another location: 4161:fe6e I then stopped by other watch and followed this memory location. Lo and behold I found it was comparing my answer to a memory location with the answer! 4161:ec8e I figured this out by changing my answer to the word found at this location and the program worked. However, I needed more than this. So, I started again and followed the location of the answer until I got to a section of the code where there was a comparison between my answer and their answer followed by a conditional jump. POP CX (not obvious here but now one register has one POP DX letter or my answer and one of the real answer) CMP DX,AX (if they are not the same then you lose) JNZ 004C (this is what I changed to a JMP statement so it doesn't matter what your answer is now) I just changed that conditional jump to a regular jump and it works. Enjoy! The Mad Doctor -TOP- crack. <*****************************************************************************> Unprotect for Sargon 5 ******************* Documentation Check ******************* Using Norton's Diskedit or PCTools: Search the file sargon5.exe for the following: 8e d6 eb a8 ^^ ^^ d1 17 and that's it! The method involved: Sargon 5 uses a standard documentation check. If you run the program under soft-ice and break it prior to the doc check you will find the call statement that will call the doc check routine. On my setup: program start 1a66:0 call routine 2fba:32be I ran through the call routine and input some letters. Instead of running the entire doc check I set soft-ice to look for my letters and stop the program when accessed. This brought me near the end of the routine. I went a bit farther and noticed a compare statement followed by a conditional jump (at 2fba:4a92). I changed the condition of the jump and lo! it worked. However, I didn't like this crack (too much work for the gamer) and went back to the jump. After the conditional jump there were 2 mov statements and a return. So, I went back to the call routine and made the call go just to the end of the protection routine where the mov statements were and that was it. Now I had to find it by diskedit--however it wasn't there. So, since I knew where I wanted to change memory I put soft-ice watching the spot. Soft-ice stopped the program and I saw a movsb statement which had the area I wanted. That's it--this was a more in depth discussion than usual, it wasn't hard at all. Bye! The Mad Doctor -TOP- crack. <*****************************************************************************> Secret Weapons of the Lutwaffe Unprotect Cracked By The Mage Type of Check: Doc Check in the Beginning of the Game. What was done: Enabled it to press Enter 3 Times and you are into the Game. Very Sloppy, but works perfectly. Not bad for a 15 minute crack. Method Involved. While talking to The Mad Doctor and while we were working on Tony Larussa's Ultimate Baseball he showed me a new technique for cracking that I had not thought of.. simple and easier. Anyways, At the DOC check you type in a Name (any name, I use MAGE) and then you search memory for the name. Search from the first program block on up into memory. You them in SOFT-ICE put a Break point on Memory Access and Read. You then continue the program and press enter to finish the check. You will have reads on the memory and chances are you will find a CMP to that memory location and a simple jmp afterwards. This also helps you stay in the Copy Protection routines. Well It wasn't as simple as all that and what I had to do was jump over a lot of checking code. I found a JMP to a far location and used it by taking a much earlier JAE and changing it to JMP to the far location and whammo bypassed the code and enabled you to get into the program. Since it was doing overlays I wasn't sure where the call was to the whole program so I left it at hitting enter 3 times and into the game you go. Anyways Get out DiskEdit/Pctools andd search the file NOTCAMP.OVL Search for: 73 74 8B 5E Change to : E9 64 02 ^^ ^^ ^^ And that is it! Thanks and greets go to everyone in -TOP-. thanks to The Mad Doctor for the new Technique in my collection. The Mage <*****************************************************************************> Unprotect for Crime Wave by Access Cracked by The Mage -------- Type of Protection: Doc check at the Beginning of the program. What was done: A JZ changed to JMP. Method Involved. Well I loaded this sucker up and the program was using interupts to process strings so I could not search through memory for a sample string that I inputed. Since at the Doc check itself it was sitting in DOS and I/O system blocks of memory I put in a bad value and got a PRESS ESC or SPACE BAR message from the program. I then traced to where it compared to a space like CMP AH,20 and set this to true. Then a Simple trace to where it compared the answer after the Interupt and a change and simple.. all of 7 minutes while talking on the phone.. <grin> Very Very Easy. I tried taking out the call completely but was unable to do so without extensive work. Get out Norton/Pcshell Search the File CW.EXE Search for: 80 3D 00 74 05 Change to: -- -- -- EB -- And save it and press enter at the DOC check. You are in! The Mage <*****************************************************************************> --------- By Gron ----------- --------- 3 on 3 Basketball : The Dream Team by Data East ----------- Protection : Doc Check Search : DREAM.EXE Locate : 7D 00 75 55 C6 06 Replace: EB Method : After loading the game into memory, I ran the program until the doc check popped up. I then kicked out to Soft-Ice and traced until I found where it was looking for a compare to 0D which is the ENTER key. I then traced until it failed the protection. This brought me back to the original CALL which was used to get keyboard input, followed by a conditional jump. Since the program did not jump with my bogus input, I changed the conditional jump to an unconditional one. This worked beautifully. However, the protection scheme still came up and forced the user to enter three numbers before it would go on. Therefor, I looked back in the code and discovered that immediately before the CALL which asked for input there were a series of CALLs and jumps. I noted the address of the last jump in that series which jumped just beyond where the conditional jump I had changed earlier was jumping. I reloaded the program and ran to the address I had noted. The protection scheme had yet to come up. I changed the conditional jump to an unconditional one and continued running the program. It went right to the main menu, bypassing the protection entirely. After playing the game for an hour or so, the protection never again surfaced nor did any noticeable side-effects of the change. <*****************************************************************************> Unprotect for JACK 4.59 Cracked by The Mage and Gron -------------- Type of Protection: Password Entry What was done: Removed Protection entirely Method: It came up with a screen to hit enter before the copy protection was shown. Broke into the code and just traced until the call to the copy Protection. Noped it out and it ran like a champ. Problem arose in that the call was a CALL FAR and this could not be found when Hex Searching. So traced 1 statement into the CALL and JMP'd to the RETF (end of the CALL) and this was in the Hex Search. One Note: This Program Sucks. Anyways Search the File JACK1.EXE Search for : CD 3F 14 10 Change to : E9 8D 01 90 You are done Later The Mage <*****************************************************************************> ------------------------------------------------------------------------------- --------- Another -TOP- unprotect ----------- --------- By Gron ----------- --------- ----------- --------- Blue Wave Offline Mail Reader 2.10 by Cutting Edge ----------- ------------------------------------------------------------------------------- Protection : Registration Number Search : BWAVE.EXE Locate : 06 A2 00 00 5E 8B Replace: 01 Method : After loading the program into memory, I traced until I found the CALL that brought up the UNREGISTERED screen. Immediately before this CALL was a CMP AX,0000 and a JNZ XXXX which jumped over the offending CALL. I looked a bit further back in the code and found a MOV AL,[XXXX] and a MOV AH,00. I reloaded the program and placed a breakpoint (BPMB) on the DS:XXXX address from earlier. It eventually popped out where it was moving a 00 into that location. I looked back a bit in code and found a JNZ that had jumped over a MOV that would have placed a 01 into the location. Rather than change the jump, I simply changed the MOV BYTE PTR [XXXX],00 to a 01. Since every registered function in the program checked this address, all features are now enabled, as well as any name and registration number will work. <*****************************************************************************> ------------------------------------------------------------------------------- --------- Another -TOP- unprotect ----------- --------- By Gron ----------- --------- ----------- --------- GifLite 2.00 by White River Software ----------- ------------------------------------------------------------------------------- Protection : Registration # Search : GIFLITE.EXE (UnPklite) Locate : C6 06 F3 00 01 C4 Replace: 00 Method : I loaded the program into memory with no options and traced through until I found the CALL that brought up the shareware notice. I then reloaded and traced until I found the series of CALLs that drew each line of the screen. I then traced until I found a conditional jump immediately preceding a CALL which would draw some shareware info. I noted the address being checked, and changed the JZ to JMP to see what happened. Sure enough, that shareware section was skipped, but the rest was drawn. At this point, I reloaded the program and put a BPMB (Break Point on Memory Byte) on the address I noted earlier. I then ran the program until it popped out at a MOV BYTE PTR [00F3],01 Since the compare had been against 00 earlier, I changed the MOV to MOV BYTE PTR [00F3],00. That was all she wrote. At this point, search the GIFLITE.EXE for "null" and change it to whoever you want the program registered to. I could have changed the built-in registration (which I probably should have done) to accept any name and registration number, but I didnt really feel like taking the trouble since I didnt find it unil I was half-way through this method. <*****************************************************************************> ------------------------------------------------------------------------------- --------- Another -TOP- unprotect ----------- --------- By Gron ----------- --------- ----------- --------- Veil of Darkness by Strategic Simulations Inc. ----------- ------------------------------------------------------------------------------- Protection : Doc Check Search : CODE.2 Locate : 26 FE 47 0B 0E E8 Replace: 0A Method : I loaded the program into memory and broke into Soft-Ice right before the doc check screen was to come up. I then traced until I found the CALL to the protection scheme. Immediately before the CALL was a CMP BYTE PTR ES:[BX+0A],01 JZ XXXX (beyond the CALL) where ES:[BX+0A] was equal to 00. I tried changing the 01 to a 00 which worked at first. However, when I attempted to leave the first room in the game, the protection popped up again using the same method as above. I set a breakpoint (BPMB) on the ES address and reloaded the program. I didnt find what I was looking for, but I did notice that ES:[BX+0B] was being incremented to 01 a few lines before the first doc check. I changed the 0B to a 0A and all the protection disappeared. <*****************************************************************************> <*****************************************************************************> <*****************************************************************************> <*****************************************************************************> <*****************************************************************************> <*****************************************************************************> <*****************************************************************************> <*****************************************************************************> <*****************************************************************************> <*****************************************************************************> <*****************************************************************************> End Methods File.