Game Cracker (Expanded Edition)

home *** CD-ROM | disk | FTP | other *** search

/ Game Cracker (Expanded Edition) / Game Cracker (Expanded Edition).iso / cracks / SV_THOTD.ZIP / House of Dead.txt < prev next >

Wrap

Text File | 1998-09-13 | 18.5 KB | 371 lines

Free Information Xchange '98 presents: The House of the Dead - CD crack by Static Vengeance - Sep 7, 1998 Requirements: Hex editor and full game install W32Dasm if you wish to follow along The House of the Dead (HOD) is a newer arcade shooter from Sega. This game is more like Virtua Squad (1 & 2) then a Doom type first person shooter. Although there is some ability to choose your paths most of the movement is predesigned into the game. The game is fun to play if you like the "blood splattering shooter" type of games, which I do. So I wanted a cracked version on my hard drive to play anytime I wanted to without having to dig out the original CD. When I installed the game I started thinking about possible aproches to crack this one without even running it yet! Right clicking on subdirectories and selecting properties from the context menu I started comparing the number of files and space required for each subdirectory that was copied to what was on the CD. One thing I noticed right away was that some key files are not copied to your hard drive. Most notably the blood color .vmc files and a file called "bigger.vmc" It's the bigger.vmc which is THE critcal file for the game, coming in at 52.6 megs. So I copied all the files from g:\art\stage1\ creature ("g" being my actual CD-Rom drive letter) to the same directory in the HOD game directory. Now I have all the needed files on the hard drive. Next I needed to modify the exe file to run completly of the hard drive and NOT require the CD to be in the CD-Rom drive. To crack HOD, I used my favorite tools and my favorite method to track down CD rom checks. I loaded up W32Dasm from RUSoft and disassembled THOTD.exe. Once W32Dasm had finished it's work, I went up to the menu bar and selected "refs" then "Data String References" from the drop down menu. Once the string refs box popped up, I grabbed the slider bar and scrolled down looking for things of interest. I found a string "A:\" which is commonly used in CD checks. Starting with A:\ (or more often C:\), CD-Rom check routines will go down through the drives connected to your system looking for a CD-Rom drive. Once these routines find a CD-Rom drive, they then start checking for specific files to make sure that the original game CD is in the drive. Being a good place to start, I double clicked on it and W32Dasm put me in the middle of the following CD check routine: * Referenced by a CALL at Address: |:004186AE <-- Called once | :00411940 52 push edx :00411941 89C2 mov edx, eax :00411943 B88CBB5C00 mov eax, 005CBB8C :00411948 E81F000000 call 0041196C <-- Call to actual CD check :0041194D 85C0 test eax, eax :0041194F 7418 je 00411969 <-- Taking this jump means failed :00411951 BA00020000 mov edx, 00000200 :00411956 B89CBB5C00 mov eax, 005CBB9C :0041195B E800010000 call 00411A60 :00411960 85C0 test eax, eax :00411962 7405 je 00411969 :00411964 B801000000 mov eax, 00000001 <-- Set up for passed CD check * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:0041194F(C), :00411962(C) | :00411969 5A pop edx :0041196A C3 ret <-- Return to the caller * Referenced by a CALL at Address: |:00411948 <-- Called from above | :0041196C 53 push ebx :0041196D 51 push ecx :0041196E 56 push esi :0041196F 57 push edi :00411970 55 push ebp :00411971 81EC14010000 sub esp, 00000114 :00411977 89842410010000 mov dword ptr [esp+00000110], eax :0041197E 89D5 mov ebp, edx :00411980 8DBC2400010000 lea edi, dword ptr [esp+00000100] * Possible StringData Ref from Code Obj ->"A:\" <-- Start with drive A: and work down to CD drive | :00411987 BE30194100 mov esi, 00411930 :0041198C BB41000000 mov ebx, 00000041 :00411991 A5 movsd :00411992 A5 movsd :00411993 A5 movsd :00411994 A5 movsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00411A4A(C) | :00411995 8D842400010000 lea eax, dword ptr [esp+00000100] :0041199C 50 push eax :0041199D 889C2404010000 mov byte ptr [esp+00000104], bl * Reference To: KERNEL32.GetDriveTypeA, Ord:0005h <-- Commonly used in CD checks | :004119A4 2EFF1564023901 Call dword ptr cs:[01390264] :004119AB 83F805 cmp eax, 00000005 <-- 05 is the value for a CD Rom drive :004119AE 0F8592000000 jne 00411A46 <-- Take this jump for non CD drives :004119B4 85ED test ebp, ebp :004119B6 745F je 00411A17 :004119B8 55 push ebp :004119B9 8D842404010000 lea eax, dword ptr [esp+00000104] :004119C0 50 push eax * Possible StringData Ref from Data Obj ->"%s%s" | :004119C1 68D4005A00 push 005A00D4 :004119C6 8D44240C lea eax, dword ptr [esp+0C] :004119CA 50 push eax :004119CB E80E2A1800 call 005943DE :004119D0 83C410 add esp, 00000010 * Possible StringData Ref from Data Obj ->"rb" <-- Read Binary call | :004119D3 BADC005A00 mov edx, 005A00DC :004119D8 89E0 mov eax, esp :004119DA E8472E1800 call 00594826 :004119DF 85C0 test eax, eax :004119E1 7463 je 00411A46 :004119E3 8DB42400010000 lea esi, dword ptr [esp+00000100] :004119EA 8BBC2410010000 mov edi, dword ptr [esp+00000110] :004119F1 E888221800 call 00593C7E :004119F6 57 push edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00411A0D(C) | :004119F7 8A06 mov al, byte ptr [esi] :004119F9 8807 mov byte ptr [edi], al :004119FB 3C00 cmp al, 00 :004119FD 7410 je 00411A0F :004119FF 8A4601 mov al, byte ptr [esi+01] :00411A02 83C602 add esi, 00000002 :00411A05 884701 mov byte ptr [edi+01], al :00411A08 83C702 add edi, 00000002 :00411A0B 3C00 cmp al, 00 :00411A0D 75E8 jne 004119F7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:004119FD(C) | :00411A0F 5F pop edi :00411A10 B801000000 mov eax, 00000001 <-- Set up for a passed CD check :00411A15 EB3B jmp 00411A52 <-- Jump down to the exit section * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:004119B6(C) | :00411A17 8DB42400010000 lea esi, dword ptr [esp+00000100] :00411A1E 8BBC2410010000 mov edi, dword ptr [esp+00000110] :00411A25 57 push edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00411A3C(C) | :00411A26 8A06 mov al, byte ptr [esi] :00411A28 8807 mov byte ptr [edi], al :00411A2A 3C00 cmp al, 00 :00411A2C 7410 je 00411A3E :00411A2E 8A4601 mov al, byte ptr [esi+01] :00411A31 83C602 add esi, 00000002 :00411A34 884701 mov byte ptr [edi+01], al :00411A37 83C702 add edi, 00000002 :00411A3A 3C00 cmp al, 00 :00411A3C 75E8 jne 00411A26 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00411A2C(C) | :00411A3E 5F pop edi :00411A3F B801000000 mov eax, 00000001 <-- Set up for a passed CD check :00411A44 EB0C jmp 00411A52 <-- Jump down to the exit section * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:004119AE(C), :004119E1(C) | :00411A46 43 inc ebx <-- Increase the number of tries :00411A47 83FB5A cmp ebx, 0000005A <-- Try up to 5A times :00411A4A 0F8E45FFFFFF jle 00411995 <-- Take this jump to keep trying :00411A50 31C0 xor eax, eax <-- Else, set up for a failed CD check * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:00411A15(U), :00411A44(U) | :00411A52 81C414010000 add esp, 00000114 <-- Exit section of this routine :00411A58 5D pop ebp :00411A59 5F pop edi :00411A5A 5E pop esi :00411A5B 59 pop ecx :00411A5C 5B pop ebx :00411A5D C3 ret Well that's the code that actually tries to read the file (ART\STAGE1\CREATURE\bigger.vmc) off the CD, which is of course the CD check. Well lets look at the code that surounds the caller to the above routine. The code around 4186AE is as follows: -- Program code -- :0041869D B800040000 mov eax, 00000400 :004186A2 E8A9A81400 call 00562F50 :004186A7 31DB xor ebx, ebx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:004186CD(C), :004186EF(U) | * Possible StringData Ref from Data Obj ->"ART\STAGE1\CREATURE\bigger.vmc" <-- File to search CD for | :004186A9 A15CE65C00 mov eax, dword ptr [005CE65C] :004186AE E88D92FFFF call 00411940 <-- Try to read file off the CD - CD check :004186B3 85C0 test eax, eax <-- eax is flag 00=failed / 01=passed :004186B5 753A jne 004186F1 <-- Take this jump to continue with game * Possible StringData Ref from Data Obj ->"The House Of The Dead CD was not " <-- Why we are doing this ->"found." | :004186B7 683C0D5A00 push 005A0D3C :004186BC 8B15244BC600 mov edx, dword ptr [00C64B24] :004186C2 52 push edx :004186C3 E828B01400 call 005636F0 :004186C8 83C408 add esp, 00000008 :004186CB 85C0 test eax, eax :004186CD 75DA jne 004186A9 :004186CF 66A1D4A5D500 mov ax, word ptr [00D5A5D4] :004186D5 50 push eax * Reference To: KERNEL32.GlobalDeleteAtom, Ord:000Bh | :004186D6 2EFF157C023901 Call dword ptr cs:[0139027C] :004186DD 53 push ebx * Reference To: USER32.ClipCursor, Ord:0006h | :004186DE 2EFF1520043901 Call dword ptr cs:[01390420] :004186E5 B801000000 mov eax, 00000001 :004186EA E8A4B21400 call 00563993 :004186EF EBB8 jmp 004186A9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:004186B5(C) | :004186F1 E8FE960000 call 00421DF4 <-- Getting here continues with the game :004186F6 E8B19AFFFF call 004121AC * Possible StringData Ref from Data Obj ->"rb" | :004186FB BA800D5A00 mov edx, 005A0D80 * Possible StringData Ref from Data Obj ->"ART\STAGE1\CREATURE\texture.VMC" <-- Need to load this file | :00418700 A160E65C00 mov eax, dword ptr [005CE660] :00418705 E81CC11700 call 00594826 -- Continuing program code -- Changing the call 00411940 to mov eax, 00000001 will kill the call to the CD check and also force the jne 004186F1 (at 4186B5) to always be taken. This is what you want if you always want to play the game without the CD. Now, there are a few things I wanted to correct. First, the cd_nocheck command line string should always be forced as well. So scroll down the refs string box and double click on the cd_nocheck and W32Dasm will put you here: * Possible StringData Ref from Data Obj ->"cd_nocheck" <-- Ref string that got us here | :0057A5F4 BA54B25C00 mov edx, 005CB254 :0057A5F9 A13C4BC600 mov eax, dword ptr [00C64B3C] :0057A5FE E81D94FFFF call 00573A20 :0057A603 85C0 test eax, eax :0057A605 7522 jne 0057A629 <-- We'll force this jump to continue :0057A607 85DB test ebx, ebx :0057A609 7523 jne 0057A62E * Possible StringData Ref from Data Obj ->"The House Of The Dead CD Must " <-- Never want to see this! ->"be in to run." | :0057A60B 6860B25C00 push 005CB260 :0057A610 A1244BC600 mov eax, dword ptr [00C64B24] :0057A615 50 push eax :0057A616 E84591FEFF call 00563760 :0057A61B 83C408 add esp, 00000008 :0057A61E 85C0 test eax, eax :0057A620 750C jne 0057A62E :0057A622 E87989FEFF call 00562FA0 :0057A627 EB05 jmp 0057A62E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0057A605(C) | :0057A629 BB01000000 mov ebx, 00000001 <-- Get here to activate "cd_nocheck" * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:0057A609(C), :0057A620(C), :0057A627(U) | :0057A62E 85DB test ebx, ebx :0057A630 0F840AFFFFFF je 0057A540 :0057A636 8D65EC lea esp, dword ptr [ebp-14] :0057A639 5F pop edi :0057A63A 5E pop esi :0057A63B 5A pop edx :0057A63C 59 pop ecx :0057A63D 5B pop ebx :0057A63E 5D pop ebp :0057A63F C3 ret Alright, just change the conditional jump (75 xx) at 57A605 to a non-conditional jump (EB xx). This will force the cd_nocheck switch to always be active, eliminating the last portion of the copy protection. What was the purpose of this switch anyways? Without the switch active and even WITH the CD in the drive the game comes up and says "The House Of The Dead CD Must be in to run." It's a waste of code when you cannot load the entire game on the hard drive. Next up, I wanted to force the game to always use Direct3D so I checked for a reference to d3d and didn't find one. However I did find a ref to ddraw. I figured that if I couldn't find d3d it would be in the section that forced plain DirectDraw. Double clicking on ddraw from the ref's box I played around a bit. * Possible StringData Ref from Data Obj ->"ddraw" <-- The ref string that got us here | :005634AF BA806E5C00 mov edx, 005C6E80 <-- Actual pointer to ddraw :005634B4 A13C4BC600 mov eax, dword ptr [00C64B3C] :005634B9 E862050100 call 00573A20 <-- Check if switch was active :005634BE 85C0 test eax, eax :005634C0 751A jne 005634DC <-- Take this jump if it was active :005634C2 BA886E5C00 mov edx, 005C6E88 <-- Pointer to string D3D, I think :005634C7 A13C4BC600 mov eax, dword ptr [00C64B3C] :005634CC E84F050100 call 00573A20 :005634D1 85C0 test eax, eax :005634D3 7407 je 005634DC <-- Take this jump if D3D NOT active :005634D5 E8C6070100 call 00573CA0 <-- Set game for Direct3D device :005634DA EB05 jmp 005634E1 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:005634C0(C), :005634D3(C) | :005634DC E88F290000 call 00565E70 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:005634DA(U) <-- Continue with the game | * Possible StringData Ref from Data Obj ->"AppIcon" | :005634E1 688C6E5C00 push 005C6E8C :005634E6 BB60315600 mov ebx, 00563160 :005634EB 8B35204BC600 mov esi, dword ptr [00C64B20] :005634F1 31C9 xor ecx, ecx :005634F3 56 push esi :005634F4 31FF xor edi, edi :005634F6 894DE4 mov dword ptr [ebp-1C], ecx Eventually I found if the game takes the call to 573CA0 (at 5634D5) it will use your Direct3D device. So I changed the mov edx, 005C6E80 to 3 NOP's and a jump down to 5634D5 so the game always uses D3D for the graphics. If you wanted to force DirectDraw, then you don't need to do anything. That wraps up everything I wanted to do with the game as far as cracking it and "customizing" it. Now you can simply run the THOTD.exe without any command line switches active and still not need the CD online and always get the D3D version to run. The steps needed to crack The House of the Dead are as follows: 1. Install the game to your hard drive 2. Copy all files from x:\art\stage1\creature\ to the same directory in HOD game directory (where "x" is your actual CD-Rom drive letter) 3. Copy Wgamecfg.exe from root of the game CD to the HOD game directory 4. Make the following edits: Edit THOTD.EXE ================================================ Search for: E8 8D 92 FF FF at offset 35,502 Change to : B8 01 00 00 00 Search for: 85 C0 75 22 at offset 1,485,315 Change to : -- -- EB -- -- Optional to force D3D all the time -- Search for: BA 80 6E 5C 00 at offset 1,390,767 Change to : 90 90 90 EB 21 There you have it, The House of the Dead is now FiX'ed and can be run from the hard drive. As a benefit of the above process, you can now change the color of blood as well all right from your HD. Static Vengeance Cheat Codes: At Main Menu hold CTRL and type: SKIDMARX To enable Cheat and Edit Stats CREATURE To enable Creature Test