Yet another post on making cracks

[sarah071]

OK, let me get right to the point. My method of cracking programs and making fixed-exes is outdated. I want to learn how to make new ones. Now before anyone throws a temper tamtrum, let me tell you that I have search the message several times and the only articles of links I can find are old articles that deal with material from 1999. I want to know how to make program and games cracks now....2003. I am a great learner, have knowledge in C++, c#, and visual studio .net. I wam willing to learn anything so any links will be helpful.

P.S. I know how hard it is to make cracks for todays games so there is no need to point that out.

[krondike]

Try to buy fresh new books from ASM language, and API structor. If you understand how API works and can ASM language... you can crack man! :)

[Dr Apocalypse]

You could try here:

h**p://woodmann.cjb.net/

It's undergoing a revamp atm, so all the sections are not there yet so just post your questions in the main section.

But DON'T go there thinking they will teach you how to crack all the latest games/protections, they WON'T. They do have people there that have the knowledge to crack games, but what they WILL do is try to help you with furthering your education regarding programming/reversing, and as you already have some prior coding knowledge you may fit in well there.

If you're stuck on reversing something, give them examples of code you're stuck on or ask questions on how to use a particular program like IDA, Soft Ice etc, they may point you in the right direction.

Also checkout the LINKS section, there are some sites there you may find useful.

DrA.

[TippeX]

1. learn assembly
2. learn windows internals, the win32 api set etc
3. learn how to use softice
4. have lots of pens, paper and time
5. expect a lot of reboots

[krondike]

"Pens and paper"
he can also use.....Notepad....:p

[TippeX]

krondike pen and paper stays when ur pc reboots and blue screens.. remember that ;)

[krondike]

Hehe use CTL+S often...very often....and document would be saved..... how ever... I agree now...when I think it over....
Becuase...what happen if the computer crash...and all the document and files are deleted....or destroyed...... he haven't record how he did that...if he don't write it down with pencil and paper...:p

"How to destroy a computer"... :p

No seruisly use paper and pencil...but beware....it's much to write....or use a second computer....and notepad...OR some word program... ;)
The main thing remains....always record what you have done and how you done it. That's is the best way to learn...new things in the crack world!

[ByteMare]

Originally posted by TippeX
1. learn assembly
2. learn windows internals, the win32 api set etc
3. learn how to use softice
4. have lots of pens, paper and time
5. expect a lot of reboots


6. Prepare for some frustration when the whole program crash.
7.Have some cold beer in the fridge

Yeah, Krondike mentioned to write down all the steps which is really helpful when the program crashes. That way you might have a good chance to find out where it all went to hell:rolleyes:

[cdkiller]

8. u need knowledge of the PE File Format
9. and a hell lot of time for the ISO Protections ;)

start with unpacking upx, if u never unpacked a protected file.
cuz it´s very easy (Softice or OllyDebug).
trace the code and learn...

then read tutorials about rebuilding (or fixing) the IAT.
(learn how to handle procdump, lord pe or imprec).

[ByteMare]

10. The original game (if you're about to attack games)....it helps a LOT, especially with the new iso protections

[TippeX]

Originally posted by ByteMare
10. The original game (if you're about to attack games)....it helps a LOT, especially with the new iso protections


not always necessary ;)

[ByteMare]

True, at least for safedisc where you can obtain the decryption key without the original, but what about securom? Dunno nowadays but earlier you needed the original due to that damn Read/WriteProcessMemory code + code importcall fixer

Hm...must check...

[krondike]

One funny thing that can happen when you cracking did I bump in to... Need For Speed I think it was the first one... It's protected with SafeDisc 1.006 or something.. and R!SC unSafeDisc 1.5.5 working perfect for this... and I've running the fixed .exe file... the second..it's creaties two... And it ask for Play Disc... normal.. becuase it's also CD-checks left over...
Then I was trying to crack the cd-checks that was over.. And I'm a new bie...but I've done cd-checks before and stuff like that.. and I never bump in to this!

I'm using Windows XP sp1 American Language....
Hope you get the same problem.. :p

Download the .exe file and run and see if any funny happens.

OBS! I don't take any responsible for your computer!

Dowload link (members.lycos.co.uk/krondike/funny.rar).

My question is WHAT that hell have I done..can I do this just to change one 75 to an 74... :p oh DEAR... :p
If you don't see what happen is that CD-rom driver is OPEN it self...when you running this .exe file... and you can close it... you must shotdown the .exe file... with ALT+CTRL+DELETE .... so.... what that hell...:p

[TippeX]

downloaded the funny.rar, unrar'd, ran it, messagebox appeared, looked game exited, i set eax = 1 at the end of the check to bypass the exit and the cdrom did indeed pop out, however i also set a breakpoint on typical cdrom checks none broke so i guess more files are needed for the exe to get to the actual check and i really couldnt be bothered debugging it any more

giving locations of where you were patching / working from might have helped as well krondike.. i gues you're new to this
a simple xreference on the 'Please insert game disk' string takes you to 4f476dh, scroll up a bit i see a test eax,eax at 4f4762 which seems to jump over the message box nag, so investigate the call above it, it should return eax being non zero if the check or whatever passed, now scroll down a bit to 4f47ca, theres a string reference to 'set cdaudio door open'.. could that be whats popping out your cdrom?.. start debugging, and like i said not all cracks are simple 7x->90 or 7x->eb type patches

[ByteMare]

Thanks TippeX, I was about to give some kind of answer to this one, but your explanation was much better. Kinda hard to debug it when I don't have the original anymore. Are there any audio files on cd?

Krondike, Unsafedisc creates two exes when it deals with SD v1 R1/R2, if you read the "history" file, you find out why;)

[cdkiller]

there are music files on the cd-rom
and registry entries wich are pointing to the dir of the files.
patch the registry value like 'Music -cdrom dir' to
'Music .\\' and copy all music tracks in your NFS dir on your harddisk.

and krondike remember, there aren´t only the '74' and '75'
to play with when cracking cd-checks ;)
but i think nfs is very easy.
like tippex said, search the error message in the references,
scroll some lines above and check for a call / jump wich executes
the check and pops up the msgbox.

i will search my old nfs copy to check this funny thing out.

[{Sygen}]

Would you need to know the cd protection when dealing just with no-cd checks?

Win32 ASM tuts

http://spiff.tripnet.se/~iczelion/tutorials.html

[TippeX]

Originally posted by {Sygen}
Would you need to know the cd protection when dealing just with no-cd checks?

Win32 ASM tuts

http://spiff.tripnet.se/~iczelion/tutorials.html

usually the no-cd checks are after the protection, so you will have to know about the protection in order to remove it, of course you could wait for someone else to release the cracked exe and then you could rip it off and upload it claiming you did it, but thats not really nice now is it (even tho i have seen it done lots)

[krondike]

Originally posted by ByteMare
Thanks TippeX, I was about to give some kind of answer to this one, but your explanation was much better. Kinda hard to debug it when I don't have the original anymore. Are there any audio files on cd?

Krondike, Unsafedisc creates two exes when it deals with SD v1 R1/R2, if you read the "history" file, you find out why;)
Yeah I know... And I did care.. the second was working the first one crash. How ever..the main thing is that I was "lol:ing" my self to death when my CD-rom driver pop outs... with...ehm just then no reasen...well it got's there own reasens...but any way.. I never bump it to this things before....

Fifa 2003 are also asking for it's play disc... and yepp it have taking me severals of times... to crack that... But under that time NEVER in my life...the CD-rom driver pop outs and stuck....:p Any way...thanks for all your answer... when I have found the sulution....I will try to crack the SafeDisc...also.. And it's one of the first SafeDisc versions...so I hope it will not be so hard..... ;).
But I just trying to say to the guy who ask for the cracking thing..that problems can happen. Next time maybe I start my TV by my computer... becuase I tried to crack some game... Bevare everything can happen! :p

[{Sygen}]

Originally posted by TippeX
usually the no-cd checks are after the protection, so you will have to know about the protection in order to remove it, of course you could wait for someone else to release the cracked exe and then you could rip it off and upload it claiming you did it, but thats not really nice now is it (even tho i have seen it done lots)

Ahh, ok. I have finished c++ and am now on ASM, and was hoping that I wouldnt have to know that also.