Game Cracker (Expanded Edition)

home *** CD-ROM | disk | FTP | other *** search

/ Game Cracker (Expanded Edition) / Game Cracker (Expanded Edition).iso / cracks / SV_WWS.ZIP / World Wide Soccer.txt < prev next >

Wrap

Text File | 1998-09-12 | 16.2 KB | 333 lines

Free Information Xchange '98 presents: World Wide Soccer - CD check crack by Static Vengeance Requirements: Hex editor and full game install W32Dasm if you wish to follow along World Wide Soccer from Sega Entertainment will provide us with our next tutorial. I had a chance to look at the original CD so I thought I would crack this game. I installed the game and went about making a simular patch to the D3D upgrade that I had already cracked for someone. After I disassembled it and went through it I had a working crack in a couple of minutes. There is, however a trick you need to use for this game. First do the maxium install allowed (130megs), then you MUST copy the subdirectory "WAVE" (and all files & directories in it) from the \game\ directory off the CD to the WWS (where you installed the game) directory on your hard drive. This will push the install up to about 200megs or so, however when you make the patch the exe file you'll end up with 100% cracked and playable version of World Wide Soccer on your hard drive. Anyway the tutorial continues: It all starts by disassembling wws.exe with W32Dasm (by RUSoft) and going through the usual tricks outlined time after time in my other articles. Simply go up to the title bar and select "Refs" and then select "Data String References" from the drop down menu. Once the data string refs box pops up, grab the slider bar and scroll down looking for something that might have to do with the copy protection. examples would be "Please insert the SEGA WORLDWIDE SOCCER PC CD." and/or a reference to file on the CD (which would include a path name) like "Game\wwc_end.dll". Anyways, once you find a likly string double click on it and check the surounding code to see what you have found. Double clicking on "Please insert..." revealed this: * Referenced by a CALL at Address: |:00441156 | :0043E2A0 81EC88020000 sub esp, 00000288 :0043E2A6 8D842488000000 lea eax, dword ptr [esp+00000088] :0043E2AD 53 push ebx :0043E2AE 55 push ebp :0043E2AF 56 push esi :0043E2B0 57 push edi :0043E2B1 50 push eax :0043E2B2 6800010000 push 00000100 * Reference To: KERNEL32.GetLogicalDriveStringsA, Ord:00F8h <-- Another possible text string to | <-- search for "GetLogicalDriveStringsA" :0043E2B7 FF1598640D01 Call dword ptr [010D6498] :0043E2BD 85C0 test eax, eax :0043E2BF 7510 jne 0043E2D1 <-- Do the CD check :0043E2C1 B801000000 mov eax, 00000001 <-- Otherwise set for a failed check :0043E2C6 5F pop edi :0043E2C7 5E pop esi :0043E2C8 5D pop ebp :0043E2C9 5B pop ebx :0043E2CA 81C488020000 add esp, 00000288 :0043E2D0 C3 ret <-- And return to the caller * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0043E2BF(C) | * Reference To: KERNEL32.OpenFile, Ord:01AFh | :0043E2D1 8B1D28650D01 mov ebx, dword ptr [010D6528] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0043E3B1(C) | :0043E2D7 8A842498000000 mov al, byte ptr [esp+00000098] :0043E2DE 8DAC2498000000 lea ebp, dword ptr [esp+00000098] :0043E2E5 84C0 test al, al :0043E2E7 0F84AB000000 je 0043E398 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0043E392(C) | :0043E2ED 55 push ebp * Reference To: KERNEL32.GetDriveTypeA, Ord:00DFh <-- Another give away text string to | <-- search for is "GetDriveTypeA" :0043E2EE FF1594640D01 Call dword ptr [010D6494] :0043E2F4 83F805 cmp eax, 00000005 <-- 05 is the value for CD-ROM drives :0043E2F7 0F8581000000 jne 0043E37E :0043E2FD 8BFD mov edi, ebp :0043E2FF 83C9FF or ecx, FFFFFFFF :0043E302 33C0 xor eax, eax :0043E304 8D942498010000 lea edx, dword ptr [esp+00000198] :0043E30B F2 repnz :0043E30C AE scasb :0043E30D F7D1 not ecx :0043E30F 2BF9 sub edi, ecx :0043E311 6800400000 push 00004000 :0043E316 8BC1 mov eax, ecx :0043E318 8BF7 mov esi, edi :0043E31A 8BFA mov edi, edx :0043E31C 8D94249C010000 lea edx, dword ptr [esp+0000019C] :0043E323 C1E902 shr ecx, 02 :0043E326 F3 repz :0043E327 A5 movsd :0043E328 8BC8 mov ecx, eax :0043E32A 33C0 xor eax, eax :0043E32C 83E103 and ecx, 00000003 :0043E32F F3 repz :0043E330 A4 movsb * Possible StringData Ref from Data Obj ->"Game\wwc_end.dll" <-- File to check for with CD path | :0043E331 8B3D5CE14D00 mov edi, dword ptr [004DE15C] :0043E337 83C9FF or ecx, FFFFFFFF :0043E33A F2 repnz :0043E33B AE scasb :0043E33C F7D1 not ecx :0043E33E 2BF9 sub edi, ecx :0043E340 8BF7 mov esi, edi :0043E342 8BFA mov edi, edx :0043E344 8BD1 mov edx, ecx :0043E346 83C9FF or ecx, FFFFFFFF :0043E349 F2 repnz :0043E34A AE scasb :0043E34B 8BCA mov ecx, edx :0043E34D 4F dec edi :0043E34E C1E902 shr ecx, 02 :0043E351 F3 repz :0043E352 A5 movsd :0043E353 8BCA mov ecx, edx :0043E355 83E103 and ecx, 00000003 :0043E358 F3 repz :0043E359 A4 movsb :0043E35A B922000000 mov ecx, 00000022 :0043E35F 8D7C2414 lea edi, dword ptr [esp+14] :0043E363 F3 repz :0043E364 AB stosd :0043E365 8D442414 lea eax, dword ptr [esp+14] :0043E369 8D8C249C010000 lea ecx, dword ptr [esp+0000019C] :0043E370 50 push eax :0043E371 51 push ecx :0043E372 C644241C88 mov [esp+1C], 88 :0043E377 FFD3 call ebx :0043E379 83F8FF cmp eax, FFFFFFFF :0043E37C 7549 jne 0043E3C7 <-- Take this jump to pass CD check * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0043E2F7(C) | :0043E37E 807D0000 cmp byte ptr [ebp+00], 00 :0043E382 7408 je 0043E38C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0043E38A(C) | :0043E384 8A4501 mov al, byte ptr [ebp+01] :0043E387 45 inc ebp :0043E388 84C0 test al, al :0043E38A 75F8 jne 0043E384 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0043E382(C) | :0043E38C 8A4501 mov al, byte ptr [ebp+01] :0043E38F 45 inc ebp :0043E390 84C0 test al, al :0043E392 0F8555FFFFFF jne 0043E2ED * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0043E2E7(C) | * Possible StringData Ref from Data Obj ->"SEGA Worldwide Soccer PC" | :0043E398 8B1550E84D00 mov edx, dword ptr [004DE850] :0043E39E 6A35 push 00000035 :0043E3A0 52 push edx * Possible StringData Ref from Data Obj ->"Please insert the SEGA WORLDWIDE " <-- Give me the CD!! ->"SOCCER PC CD." <-- Dead give away | :0043E3A1 68ACE74D00 push 004DE7AC :0043E3A6 6A00 push 00000000 * Reference To: USER32.MessageBoxA, Ord:019Bh | :0043E3A8 FF1554660D01 Call dword ptr [010D6654] :0043E3AE 83F802 cmp eax, 00000002 <-- 02 means you hit cancel :0043E3B1 0F8520FFFFFF jne 0043E2D7 <-- Otherwise loop up and check again :0043E3B7 B801000000 mov eax, 00000001 <-- CD check failed!!! :0043E3BC 5F pop edi :0043E3BD 5E pop esi :0043E3BE 5D pop ebp :0043E3BF 5B pop ebx :0043E3C0 81C488020000 add esp, 00000288 :0043E3C6 C3 ret <-- But return to the caller anyways * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0043E37C(C) | :0043E3C7 8BFD mov edi, ebp <-- If you get here the CD check :0043E3C9 83C9FF or ecx, FFFFFFFF <-- has passed!! Yippie :0043E3CC 33C0 xor eax, eax :0043E3CE 8A15A8E74D00 mov dl, byte ptr [004DE7A8] :0043E3D4 F2 repnz :0043E3D5 AE scasb :0043E3D6 F7D1 not ecx :0043E3D8 2BF9 sub edi, ecx :0043E3DA 8BC1 mov eax, ecx :0043E3DC 8BF7 mov esi, edi :0043E3DE BFC0786900 mov edi, 006978C0 :0043E3E3 C1E902 shr ecx, 02 :0043E3E6 F3 repz :0043E3E7 A5 movsd :0043E3E8 8BC8 mov ecx, eax :0043E3EA 33C0 xor eax, eax <-- Set for result of the CD check :0043E3EC 83E103 and ecx, 00000003 <-- xor eax,eax is the same as loading :0043E3EF F3 repz <-- eax with zero ( mov eax,00000000 ) :0043E3F0 A4 movsb <-- and a zero on return means it passed :0043E3F1 BFC0786900 mov edi, 006978C0 :0043E3F6 83C9FF or ecx, FFFFFFFF :0043E3F9 F2 repnz :0043E3FA AE scasb :0043E3FB 8B0DA4E74D00 mov ecx, dword ptr [004DE7A4] :0043E401 4F dec edi :0043E402 890F mov dword ptr [edi], ecx :0043E404 885704 mov byte ptr [edi+04], dl :0043E407 5F pop edi :0043E408 5E pop esi :0043E409 5D pop ebp :0043E40A 5B pop ebx :0043E40B 81C488020000 add esp, 00000288 :0043E411 C3 ret That was the routine responsible for checking for the original CD. And if not found it prints "Please insert the SEGA WORLDWIDE SOCCER PC CD." From there, if you hit okay it loops back up and tries again. Otherwise you need to select cancel (the cmp eax, 00000002) and the program will exit to Win95 and the game is over. So we need to look at the section of code that calls the above routine and see what it does. The call came from 441156, the call and surounding code looks like this: -- Program Code -- :0044114C C70548E84D0001000000 mov dword ptr [004DE848], 00000001 :00441156 E845D1FFFF call 0043E2A0 <-- Check for CD :0044115B 85C0 test eax, eax <-- what was the result :0044115D 0F8520060000 jne 00441783 <-- Not zero means failed! :00441163 8D542410 lea edx, dword ptr [esp+10] <-- Continue with the game :00441167 897C2410 mov dword ptr [esp+10], edi :0044116B 52 push edx :0044116C 6820E44300 push 0043E420 * Reference To: USER32.EnumWindows, Ord:00C8h | :00441171 FF15DC650D01 Call dword ptr [010D65DC] :00441177 397C2410 cmp dword ptr [esp+10], edi :0044117B 0F8502060000 jne 00441783 * Reference To: USER32.GetSystemMetrics, Ord:012Ch | :00441181 8B35E0650D01 mov esi, dword ptr [010D65E0] :00441187 57 push edi :00441188 FFD6 call esi :0044118A 6A01 push 00000001 -- Continuing Program Code -- Okay, you have the call to the CD check, a test and then a conditional jump. What I chose to do here was to change the call to the CD checking routine to XOR eax,eax and three NOP's. That way eax is set to zero, you hit the three NOP's and then you test eax to see if it's zero (which we just set). This way the JNE is never taken and the game will always fall through to the continue code. And that's "all" there is to this crack. Now let's take a quick look at the code from the WWS.exe off the CD: -- Program Code -- :00411161 8B442418 mov eax, dword ptr [esp+18] :00411165 85C0 test eax, eax :00411167 740E je 00411177 :00411169 6A00 push 00000000 :0041116B 6A00 push 00000000 :0041116D 6A00 push 00000000 :0041116F 6A55 push 00000055 * Reference To: USER32.SystemParametersInfoA, Ord:023Bh | :00411171 FF15E855E700 Call dword ptr [00E755E8] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00411167(C) | :00411177 E81B850000 call 00419697 <-- Do the CD check :0041117C 85C0 test eax, eax :0041117E 740C je 0041118C <-- Take this jump for good CD check :00411180 33C0 xor eax, eax <-- Setup for Quit to Win95 :00411182 5D pop ebp :00411183 5F pop edi :00411184 5E pop esi :00411185 5B pop ebx :00411186 83C450 add esp, 00000050 :00411189 C21000 ret 0010 <-- Return to calller * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0041117E(C) | :0041118C C744241000000000 mov [esp+10], 00000000 :00411194 8D742410 lea esi, dword ptr [esp+10] :00411198 56 push esi :00411199 68EA974100 push 004197EA * Reference To: USER32.EnumWindows, Ord:00C8h | :0041119E FF15D056E700 Call dword ptr [00E756D0] :004111A4 8B442410 mov eax, dword ptr [esp+10] -- Continuing Program Code -- With this version of WWS (off the CD) there is a call to the CD check routine followed by a je (Jump Eqaul) to continue the game. Basicaly the same thing, and the same patch will also work for this version. Although implemented in a slightly diferent way, the CD check works the same and can also be cracked in the same way. However, the edit has this effect: Changing the call to the CD checking routine to XOR eax,eax and three NOP's kills the actual call to the check. Again, eax is set to zero, followed by three NOP's; the diference being when you test eax to see if it's zero we want the JE to always be taken. Then the game will always jump to the continue code and let us play. To actual steps to crack World Wide Soccer are: 1. Do a Maximum install 2. Copy the WAVE subdirectory to your hard drive 3. Make the following edits CD version: Edit wws.exe at offset 66,935 ========================================= Search for: E8 1B 85 00 00 Change to : 33 C0 90 90 90 D3D patch: Edit wws.exe at offset 263,510 ========================================= Search for: E8 45 D1 FF FF Change to : 33 C0 90 90 90 Now you have a 100% functional copy of World Wide Soccer (with or without the D3D patch) you can play directly from the hard drive without the need for the CD to be present, because it's been FiX'ed Static Vengeance