Game Cracker (Expanded Edition)

home *** CD-ROM | disk | FTP | other *** search

/ Game Cracker (Expanded Edition) / Game Cracker (Expanded Edition).iso / cracks / SV_MONSW.ZIP / Monopoly StarWars.txt < prev next >

Wrap

Text File | 1998-11-11 | 19.7 KB | 427 lines

Free Information Xchange presents: Monopoly StarWars Edition - CD crack by Static Vengeance - Nov, 4th 1998 Requirements: Hex editor and full game install W32Dasm if you wish to follow along The StarWars Edition of Monopoly is a glitzy little hopped up multi-media version of the original board game. It contains tons of video clips from the three StarWars (special enhanced edition) movies. There is one slight problem when playing this game. You need to have the CD on line. There is an option during the install to copy all the movie files to your hard drive, but that will take up over 530 megs! Even with this option, you'll STILL need the CD in your CD-Rom drive. What's the point!?!?, who is going to download a 350+ meg (even if compressed) pirated version off some ftp site? Either way, this is a program bug that must be FiX'ed. First we'll need to start up W32Dasm and disassemble monopoly.exe. Then once you have gotten that far do the usual and go up to the menu bar and select REFS and then Data String References from the drop down menu. Once the Data string refs pop-up box apears, grab the slider bar and scroll down until you see "This game requires you to have " which is part of the pop-up dialog box that let's you know you need the CD to play the game. After you find it, double click it and W32Dasm will drop you in the middle of this routine: * Referenced by a CALL at Address: |:0044C895 <-- Called once | :0043B6B0 83EC04 sub esp, 00000004 :0043B6B3 C744240001000000 mov [esp], 00000001 :0043B6BB 53 push ebx :0043B6BC 56 push esi :0043B6BD 57 push edi :0043B6BE 55 push ebp :0043B6BF 6870106900 push 00691070 :0043B6C4 6805010000 push 00000105 * Reference To: KERNEL32.GetCurrentDirectoryA, Ord:00D0h | :0043B6C9 FF158C756900 Call dword ptr [0069758C] :0043B6CF 85C0 test eax, eax :0043B6D1 750D jne 0043B6E0 :0043B6D3 C744241000000000 mov [esp+10], 00000000 :0043B6DB E96F010000 jmp 0043B84F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0043B6D1(C) | :0043B6E0 BF70106900 mov edi, 00691070 :0043B6E5 B9FFFFFFFF mov ecx, FFFFFFFF :0043B6EA 2BC0 sub eax, eax :0043B6EC 6870106900 push 00691070 :0043B6F1 F2 repnz :0043B6F2 AE scasb :0043B6F3 66A178A14800 mov ax, word ptr [0048A178] * Possible StringData Ref from Data Obj ->"%sVIDEOS\" | :0043B6F9 687CA14800 push 0048A17C :0043B6FE 668947FF mov word ptr [edi-01], ax :0043B702 6830ED6300 push 0063ED30 :0043B707 E884670300 call 00471E90 :0043B70C 83C40C add esp, 0000000C :0043B70F 6840EE6300 push 0063EE40 * Possible StringData Ref from Data Obj ->"%sDATA\" | :0043B714 6888A14800 push 0048A188 :0043B719 6840EE6300 push 0063EE40 :0043B71E E86D670300 call 00471E90 :0043B723 83C40C add esp, 0000000C :0043B726 E875040000 call 0043BBA0 <-- Check for the CD :0043B72B 84C0 test al, al <-- Test the result stored in al :0043B72D 7450 je 0043B77F <-- al=0 means no CD :0043B72F 0FBEF0 movsx esi, al * Possible StringData Ref from Data Obj ->"\MONOPOLY" | :0043B732 6890A14800 push 0048A190 :0043B737 56 push esi * Possible StringData Ref from Data Obj ->"%c:%s\" | :0043B738 689CA14800 push 0048A19C :0043B73D 6818EA6300 push 0063EA18 :0043B742 E849670300 call 00471E90 :0043B747 83C410 add esp, 00000010 * Possible StringData Ref from Data Obj ->"\MONOPOLY" | :0043B74A 68A4A14800 push 0048A1A4 :0043B74F 56 push esi * Possible StringData Ref from Data Obj ->"%c:%s\" | :0043B750 68B0A14800 push 0048A1B0 :0043B755 6828EC6300 push 0063EC28 :0043B75A E831670300 call 00471E90 :0043B75F 83C410 add esp, 00000010 * Possible StringData Ref from Data Obj ->"\MONOPOLY\VIDEOS" | :0043B762 68B8A14800 push 0048A1B8 :0043B767 56 push esi * Possible StringData Ref from Data Obj ->"%c:%s\" | :0043B768 68CCA14800 push 0048A1CC :0043B76D 6820EB6300 push 0063EB20 :0043B772 E819670300 call 00471E90 :0043B777 83C410 add esp, 00000010 :0043B77A E9D0000000 jmp 0043B84F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0043B72D(C) <-- Conditional jump to pop-up dialog | :0043B77F 33FF xor edi, edi * Possible StringData Ref from Data Obj ->"LE_CMAIN_CURSOR" | :0043B781 68D4A14800 push 0048A1D4 :0043B786 E80588FDFF call 00413F90 :0043B78B 83C404 add esp, 00000004 :0043B78E E83D88FDFF call 00413FD0 * Reference To: USER32.PostQuitMessage, Ord:01B3h | :0043B793 8B3578776900 mov esi, dword ptr [00697778] * Reference To: USER32.DestroyWindow, Ord:008Ah | :0043B799 8B1D74776900 mov ebx, dword ptr [00697774] * Reference To: USER32.MessageBoxA, Ord:0195h | :0043B79F 8B2D7C776900 mov ebp, dword ptr [0069777C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0043B844(C) | :0043B7A5 6815100000 push 00001015 * Possible StringData Ref from Data Obj ->"MONOPOLY Star Wars" | :0043B7AA 68E4A14800 push 0048A1E4 * Possible StringData Ref from Data Obj ->"This game requires you to have " <-- String that lead us here ->"your Monopoly Star Wars CD-ROM " ->"in a drive." | :0043B7AF 68F8A14800 push 0048A1F8 :0043B7B4 6A00 push 00000000 :0043B7B6 FFD5 call ebp :0043B7B8 83F804 cmp eax, 00000004 :0043B7BB 755B jne 0043B818 :0043B7BD E8DE030000 call 0043BBA0 <-- Check for the CD again :0043B7C2 84C0 test al, al <-- Test for the result in al :0043B7C4 747C je 0043B842 <-- Zero in al means ask for the CD again :0043B7C6 0FBEF8 movsx edi, al * Possible StringData Ref from Data Obj ->"\MONOPOLY" | :0043B7C9 68D8A24800 push 0048A2D8 :0043B7CE 57 push edi * Possible StringData Ref from Data Obj ->"%c:%s\" | :0043B7CF 68E4A24800 push 0048A2E4 :0043B7D4 6818EA6300 push 0063EA18 :0043B7D9 E8B2660300 call 00471E90 :0043B7DE 83C410 add esp, 00000010 * Possible StringData Ref from Data Obj ->"\MONOPOLY" | :0043B7E1 68ECA24800 push 0048A2EC :0043B7E6 57 push edi * Possible StringData Ref from Data Obj ->"%c:%s\" | :0043B7E7 68F8A24800 push 0048A2F8 :0043B7EC 6828EC6300 push 0063EC28 :0043B7F1 E89A660300 call 00471E90 :0043B7F6 83C410 add esp, 00000010 * Possible StringData Ref from Data Obj ->"\MONOPOLY\VIDEOS" | :0043B7F9 6800A34800 push 0048A300 :0043B7FE 57 push edi * Possible StringData Ref from Data Obj ->"%c:%s\" | :0043B7FF 6814A34800 push 0048A314 :0043B804 BF01000000 mov edi, 00000001 :0043B809 6820EB6300 push 0063EB20 :0043B80E E87D660300 call 00471E90 :0043B813 83C410 add esp, 00000010 :0043B816 EB2A jmp 0043B842 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0043B7BB(C) | :0043B818 E8D387FDFF call 00413FF0 :0043B81D 6A00 push 00000000 :0043B81F FFD6 call esi :0043B821 A1A0506900 mov eax, dword ptr [006950A0] :0043B826 50 push eax :0043B827 FFD3 call ebx :0043B829 E86209FEFF call 0041C190 :0043B82E E85D09FEFF call 0041C190 :0043B833 E85809FEFF call 0041C190 :0043B838 6AFF push FFFFFFFF :0043B83A E8315B0300 call 00471370 :0043B83F 83C404 add esp, 00000004 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:0043B7C4(C), :0043B816(U) | :0043B842 85FF test edi, edi :0043B844 0F845BFFFFFF je 0043B7A5 :0043B84A E8A187FDFF call 00413FF0 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:0043B6DB(U), :0043B77A(U) | :0043B84F 8B442410 mov eax, dword ptr [esp+10] :0043B853 5D pop ebp :0043B854 5F pop edi :0043B855 5E pop esi :0043B856 5B pop ebx :0043B857 83C404 add esp, 00000004 :0043B85A C3 ret This is a short routine that tells the user they need the CD to play the game. I found the CD check routine by looking for the first condition jump reference before the pop-up dialog text. The jump came from 43B72D and at 43B726 you see a call 0043BBA0 instruction followed by the test al, al instruction. So we should check out the code at 43BBA0 and find out what it does: * Referenced by a CALL at Addresses: |:0043B726 , :0043B7BD <-- Called twice from the above listed code | :0043BBA0 81EC14020000 sub esp, 00000214 :0043BBA6 53 push ebx :0043BBA7 56 push esi :0043BBA8 57 push edi :0043BBA9 B343 mov bl, 43 :0043BBAB 55 push ebp * Reference To: KERNEL32.GetDriveTypeA, Ord:00DEh <-- Commonly used in CD checks | :0043BBAC 8B2D84756900 mov ebp, dword ptr [00697584] <-- Put the call address in ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0043BC1D(C) | :0043BBB2 0FBEC3 movsx eax, bl :0043BBB5 8D4C2414 lea ecx, dword ptr [esp+14] :0043BBB9 50 push eax * Possible StringData Ref from Data Obj ->"%c:\" | :0043BBBA 6834A34800 push 0048A334 :0043BBBF 51 push ecx :0043BBC0 E8CB620300 call 00471E90 :0043BBC5 8D4C2420 lea ecx, dword ptr [esp+20] :0043BBC9 83C40C add esp, 0000000C :0043BBCC 51 push ecx :0043BBCD FFD5 call ebp <-- Make the "GetDriveTypeA" call :0043BBCF 83F805 cmp eax, 00000005 <-- 05 is the valued for a CD-Rom :0043BBD2 7544 jne 0043BC18 :0043BBD4 8B442410 mov eax, dword ptr [esp+10] :0043BBD8 8D4C2410 lea ecx, dword ptr [esp+10] :0043BBDC 8D542414 lea edx, dword ptr [esp+14] :0043BBE0 50 push eax :0043BBE1 8D842420010000 lea eax, dword ptr [esp+00000120] :0043BBE8 6A00 push 00000000 :0043BBEA 51 push ecx :0043BBEB 8D4C241C lea ecx, dword ptr [esp+1C] :0043BBEF 51 push ecx :0043BBF0 6A00 push 00000000 :0043BBF2 6805010000 push 00000105 :0043BBF7 50 push eax :0043BBF8 52 push edx * Reference To: KERNEL32.GetVolumeInformationA, Ord:014Eh <-- Get the volume string | :0043BBF9 FF1588756900 Call dword ptr [00697588] :0043BBFF 85C0 test eax, eax :0043BC01 7415 je 0043BC18 :0043BC03 8DB4241C010000 lea esi, dword ptr [esp+0000011C] * Possible StringData Ref from Data Obj ->"MONOPOLY" <-- The string should be this | :0043BC0A BF3CA34800 mov edi, 0048A33C :0043BC0F B909000000 mov ecx, 00000009 <-- Number of characters to compare + 1 :0043BC14 F3 repz <-- Repeat until ecx is zero :0043BC15 A6 cmpsb <-- CoMPare String Bytes (CMPSB) :0043BC16 7407 je 0043BC1F <-- They should be the same, jump equal * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:0043BBD2(C), :0043BC01(C) | :0043BC18 FEC3 inc bl <-- Increment drive letter :0043BC1A 80FB5A cmp bl, 5A <-- Compare against last drive letter :0043BC1D 7E93 jle 0043BBB2 <-- Keep trying drive letters * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0043BC16(C) | :0043BC1F 80FB5A cmp bl, 5A <-- Did we exceed the last drive letter :0043BC22 7E02 jle 0043BC26 <-- If no, then skip "set for fail" :0043BC24 32DB xor bl, bl <-- Set for fail, ZERO out bl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0043BC22(C) | :0043BC26 8AC3 mov al, bl <-- Move bl into al, zero means no CD! :0043BC28 5D pop ebp :0043BC29 5F pop edi :0043BC2A 5E pop esi :0043BC2B 5B pop ebx :0043BC2C 81C414020000 add esp, 00000214 :0043BC32 C3 ret <-- Return to caller Okay, you can see how Monopoly checked for it's CD. Now we have to make sure the game "thinks" the CD is in the CD-Rom drive. When looking at the first section of code, you can see it's called once. This is good, so let's check out the caller and surounding code: -- Program code -- :0044C891 85C0 test eax, eax :0044C893 740E je 0044C8A3 :0044C895 E816EEFEFF call 0043B6B0 <-- Check for the CD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0044C887(C) | :0044C89A 85C0 test eax, eax <-- Test result store in eax :0044C89C 740E je 0044C8AC <-- Need to "fall through" this jump :0044C89E E89D840100 call 00464D40 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0044C893(C) | :0044C8A3 85C0 test eax, eax :0044C8A5 740E je 0044C8B5 :0044C8A7 E8446B0100 call 004633F0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0044C89C(C) | :0044C8AC 85C0 test eax, eax -- Continuing program code -- Alright, just change the call to the CD check to mov eax, 00000001 and the game will always continue as though the CD is on-line. The last thing you'll need to do is make sure the game doesn't try to play the AVI files for the game. So it's back up to the data string references box and double click on the ".avi" string and you'll find this: * Referenced by a CALL at Address: |:0042E58A | :0042F1B0 8B442404 mov eax, dword ptr [esp+04] :0042F1B4 81EC04010000 sub esp, 00000104 :0042F1BA 8BC8 mov ecx, eax :0042F1BC C1E104 shl ecx, 04 :0042F1BF 53 push ebx :0042F1C0 56 push esi :0042F1C1 03C8 add ecx, eax :0042F1C3 57 push edi * Possible StringData Ref from Data Obj ->".avi" | :0042F1C4 BE609D4800 mov esi, 00489D60 :0042F1C9 8D0488 lea eax, dword ptr [eax+4*ecx] :0042F1CC B9FFFFFFFF mov ecx, FFFFFFFF :0042F1D1 8D14850CEB6100 lea edx, dword ptr [4*eax+0061EB0C] :0042F1D8 8D1C8500000000 lea ebx, dword ptr [4*eax+00000000] -- Snip the rest of this routine -- Alright, that's the string we wanted, we are not concerned with what the routine does or what other routines it calls. We just want to stop it from being run. So now we need to check out the caller at 42E58A. That bit of code looks like this: :0042E585 85C0 test eax, eax <-- Test for no video from options :0042E587 740B je 0042E594 <-- Take this jump for no videos :0042E589 53 push ebx <-- Push value on stack :0042E58A E8210C0000 call 0042F1B0 <-- Play video :0042E58F 83C404 add esp, 00000004 <-- Adjust stack for the push ebx :0042E592 892F mov dword ptr [edi], ebp * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:0042E565(C), :0042E572(C), :0042E583(U), :0042E587(C) | :0042E594 81C714010000 add edi, 00000114 :0042E59A 43 inc ebx I decided to change the call 0042F1B0 to mov eax, 00000000 so the videos are never played reguardless of the setting of the user's perferences. Killing both the play avi call and the CD check results in a cracked copy of Monopoly StarWars edition that can be run from your hard drive without the need for the original CD. I have included the edits for the original CD version of the game and the updated patch off the net. 1. Do a full game install without the movies 2. Make the following edits: For v1.00z off the CD edit Monopoly.exe ============================================= Search for: E8 16 EE FE FF at offset 313,493 Change to : B8 01 00 00 00 -- Kill the avi movie patch -- Search for: E8 21 0C 00 00 at offset 189,834 Change to : B8 00 00 00 00 For v1.03b off the net edit Monopoly.exe ============================================= Search for: E8 86 E6 FE FF at offset 317,701 Change to : B8 01 00 00 00 -- Kill the avi movie patch -- Search for: E8 11 0D 00 00 at offset 190,490 Change to : B8 00 00 00 00 There you have yet another game FiX'ed and freed of it's need for the CD to be online when you want to play it. And that concludes today's CD cracking tutorial, thanks for tuning in! Static Vengeance - FiX Optional, if you want the movies, do the full 530+ meg install and skip the "Kill the avi movie patch" This will give you a 100% complete working version of the game, but it'll eat up quite a chunk of your hard drive. Otherwise, do complete install (minus the movies) and make both edits.