HowToCrack : Need For Speed 4 : High Stakes
by : SunGeY
The Game : Here comes another Need For Speed series fom Electronic Arts....High Stakes....with more cars to choose from, more tracks and a new type of game, Career Play to try out.....this version also has the Hot Pursuit mode...and all the standard mode like Single Race and so on....the graphic is vastly improved.....with better fogging, and better car details...but of course u need a good 3D card to enjoy all these . The installation requires 310 MB....(standard install) but the game still read musics from the CD...*doh*....that means there's no way we can listen to or favorite . CD while playing the game...that what we are going to fix....=)....
~0 Tools 0~
1) WinDASM
2) Hiew
3) A Cup of Coffee....=)
~o Steps o~
1) Do Typical install of Full install.....
2) Copy nfshs.exe to some folder.....this is yur backup copy...=)
3) Dissasamble nfshs.exe with WinDASM
4) Run the game...u will see a msg box that say...please insert game disk.....or something like that....remember this string...=)
5) Go to WinDASM ....click String Data Reference (SDR) look for that string....then double click it...
6) U will see this
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004F4756(C), :004F477D(C),
:004F4786(U), :004F47CD(U)
|
:004F475D E8BE000000 call 004F4820
:004F4762 85C0 test eax, eax
:004F4764 7522 jne 004F4788 <---
chge to 75 to EB ......we will take this jump to avoid the msg
box below
:004F4766 6A01 push 00000001
* Possible StringData Ref from Data Obj ->"Need For
Speed: High Stakes" <----the
msg box that we saw
|
:004F4768 68BC435900 push 005943BC
* Possible StringData Ref from Data Obj ->"Please Insert
Game Disk" <----- the string
|
:004F476D 68D8435900 push 005943D8
:004F4772 50 push eax
Take a look at the jump at 004F4764...click it to highlight it......... use Hiew to edit the file nfshs.exe...the real one...not the back up copy ......look at the Hex address below the WinDASM window...u will see some number...the offset number...press F5 in Hiew.......enter this number except the letter h ...press F3...chge 75 to EB and press F9.......run NFS....the CD tray is ejected....when we close it back....the game open it back....something must be wrong....back to WDASM...follow the jump tha we see above...u 'll see this.....
* Referenced by a (U)nconditional or
(C)onditional Jump at Address:
|:004F4764(C)
|
* Possible StringData Ref from Data Obj
->"D:\Data\Audio\Music\Credits.asf"
|
:004F4788 C745FCF0435900 mov [ebp-04], 005943F0
* Referenced by a (U)nconditional or (C)onditional Jump at
Address:
|:004F47A5(U)
|
:004F478F 8B45FC mov eax, dword ptr [ebp-04]
:004F4792 E8F9070500 call 00544F90
:004F4797 E814080500 call 00544FB0
:004F479C 85C0 test eax, eax
:004F479E 7507 jne 004F47A7
:004F47A0 8B45FC mov eax, dword ptr [ebp-04]
:004F47A3 FE00 inc byte ptr [eax]
:004F47A5 EBE8 jmp 004F478F
* Referenced by a (U)nconditional or (C)onditional Jump at
Address:
|:004F479E(C)
|
:004F47A7 8B45FC mov eax, dword ptr [ebp-04]
* Possible StringData Ref from Data Obj ->"rb"
|
:004F47AA BA10445900 mov edx, 00594410
:004F47AF E814BE0400 call 005405C8
:004F47B4 8945F8 mov dword ptr [ebp-08], eax
:004F47B7 8B55F8 mov edx, dword ptr [ebp-08]
:004F47BA 85D2 test edx, edx
:004F47BC 7511 jne 004F47CF <----
chge 75 to EB...we'll take this jump...we dont want the take
the JMP below
:004F47BE 52 push edx
:004F47BF 52 push edx
:004F47C0 52 push edx
* Possible StringData Ref from Data Obj ->"set cdaudio
door open"
|
:004F47C1 6813445900 push 00594413
* Reference To: WINMM.mciSendStringA, Ord:0001h <----the command that eject the CD i
guess...=)
|
:004F47C6 2EFF15A4965800 Call dword ptr cs:[005896A4]
:004F47CD EB8E jmp 004F475D <-----
back to the CD check above the msg box codes....=(
* Referenced by a (U)nconditional or (C)onditional Jump at
Address:
|:004F47BC(C)
|
:004F47CF 8B45F8 mov eax, dword ptr [ebp-08]
:004F47D2 E8A9BF0400 call 00540780
:004F47D7 833D5C8A5C0000 cmp dword ptr [005C8A5C], 00000000
:004F47DE 7405 je 004F47E5
:004F47E0 E8EBC7F2FF call 00420FD0
7) use Hiew...edit the nfs.hs.exe...make this changes :004F47BC 7511 jne 004F47CF <---- chge 75 to EB....
8) Run the game...another msg box appeared.......click SDR in WDASM....look for that string....double click it....u will see this
* Referenced by a CALL at Address:
|:004F4907
|
:00501C30 53 push ebx <----- chge
to C3......so this function will do nothing
:00501C31 51 push ecx
:00501C32 52 push edx
:00501C33 56 push esi
:00501C34 57 push edi
:00501C35 55 push ebp
:00501C36 89E5 mov ebp, esp
:00501C38 81EC40020000 sub esp, 00000240
:00501C3E B906000000 mov ecx, 00000006
:00501C43 8D7DE0 lea edi, dword ptr [ebp-20]
* Possible Indirect StringData Ref from Data Obj ->"To
play Need For Speed you must " <----the
string
->"have the game CD in the CD-ROM "
->"drive"
|
:00501C46 BE2C7B5B00 mov esi, 005B7B2C
9) Edit the file....run the game.....an error msg appear.....something like cannot read and audio file with .asf extension.....let's kill the routine that play the music.....Click Find button in the WDASM......look for this .asf u will see this...
Referenced by a CALL at Addresses:
|:0041F747 , :0041F766 , :0041F788 , :0041F7AA , :00420807
|:004208C7 , :004209A0 , :00420AAB , :00420B64 , :00420C33
|:004297C6 , :0046F3E5 , :0046F463 , :0046F702 , :0046F7FA
|:0046F842 , :0046F8A0 , :0046F8F3 , :00490E0B , :004E653C
|:005172F6
|
:0041F950 51 push ecx <------
chge to C3...so the routine will do nothing next time....
:0041F951 57 push edi
:0041F952 55 push ebp
:0041F953 89E5 mov ebp, esp
:0041F955 83EC14 sub esp, 00000014
-----------large chunk of codes--------....
* Referenced by a (U)nconditional or (C)onditional Jump at
Address:
|:0041F9D8(C)
|
-- another chunk of codes --
* Possible StringData Ref from Data Obj
->"%smenu1.asf"
|
:0041FA1B 6833C05800 push 0058C033
:0041FA20 68908A5C00 push 005C8A90
:0041FA25 E806091200 call 00540330
U can see many .asf strings in this section ...that means this is the routines that play the music.....so we will kill this routine....do the change indicated above......and run NFS......YAY...u cracked NFS HS!!!!!!.......
*Any comment, suggestion or question...just mail me at luqmanz@hotmail.com*
Jan 13, 2001