View Full Version : hacking games with starforce
i trying my eager to crack cycling manager 4... have fonud the starforce dll file and disassmbled it... what should i look for in there?? im not new at cracking, i new at starforce cracking! :)
tell me how :D i want to play cyclingmanager 04
the original vers. doesn't work :( :mad: :mad: :mad:
i havent made a thing yet... i found the offset in the hex editor i think... but what am i going to do now? plz help me!
heh disassembly is only the first step, you'll definately need to debug it, so u gotta figure out how to bypass the anti debug, then you have to figure out what the ring 0 drivers do , then what the ring 3 code does, then figure out what the vm's do, then rebuild exe, repair imports, handle hidden file system, handle vm p-code (if present), tons of work....
heh disassembly is only the first step, you'll definately need to debug it, so u gotta figure out how to bypass the anti debug, then you have to figure out what the ring 0 drivers do , then what the ring 3 code does, then figure out what the vm's do, then rebuild exe, repair imports, handle hidden file system, handle vm p-code (if present), tons of work....
i know... but im pretty new at cracking software with starforce protection... so what do i have to do, when i'm disassembling?
cadclean
05-07-2004, 18:35
have fonud the starforce dll file and disassmbled it... what should i look for in there?? im not new at cracking, i new at starforce cracking! :)
LOL!!
its like "i managed to open the hood from my car, what sould i look for?"
i'm also not new at cracking. i made about 40 NoCD cracks and 19 are also on gamecopyworld. but at those times the executables were usualy not encrypted and had a simple cdcheck. can you even imagine how complex starforce is? replacing "74" with "EB"? its not that simple ... ;)
Kid, just FORGET trying to crack SF3!!
Perhaps the mods ought to put up a sticky topic telling people to STOP asking for SF3 cracks or how to crack it!
If the top scene crackers out there are having difficulty with it, what chance you got huh?
Just stick with your original CD's for now.
seems lately games like soldiers heros of ww2 and codename panzers are using this new SF3 and both have been out for about a week and not one has been close to being ripped yet does that mean the end of rips as we knew them or is just this a big hurdle to overcome?
Sinpoet, Read the Forum Rules (http://www.fileforums.com/showthread.php?t=54193)
lol cracks dont usually come out within the week watever the protection...
just ordered soldiers but was curious about the sf3 issue, sorry wasnt trying to break any rules
I have to say, this Starforce 3 protection has been a godsend for games publishers - not having their games ripped and available for download before they are even out on the shelves
I fully endorse whatever they have to do to stem the flow of warez etc
hopefully, with warez on the decrease because of protections such as this we will see the price of games coming down - places like play.com sell the latest releases for £17.99 - thats next to nothing!!!
just my 2 cents!
mwitters
06-07-2004, 05:36
Kid, just FORGET trying to crack SF3!!
Perhaps the mods ought to put up a sticky topic telling people to STOP asking for SF3 cracks or how to crack it!
If the top scene crackers out there are having difficulty with it, what chance you got huh?
Just stick with your original CD's for now.
Yeah, if you want the game THAT freaking bad and you love the game support the game company and go buy it! Obviously you haven't because you wouldn't be pissing yuour pants every time i look on here...
hey guys just to let ya starforce 3 is not uncrackable. irecently bought desert rats vs afrika corps and thats sf3 protected, had to wait about a month but the crack came out and it worked perfectly
t.foster73
06-07-2004, 08:03
A 'NOCD' is one thing, but a stand-alone install and play disk is a different matter. If you can't make a working backup which allows you to install the game and play from, then you don't have a backup made! I fear that VERY soon ALL games will use Starforce 3. This might sound childish, but unless they crack Starforce 3 so a backup can be made, that's me finished with PC games for good! I can understand completely why developers want to use Starforce, but it's just legitimate users who suffer. Also, I suspect that if Starforce isn't sussed, we won't see many cracks. After all, most NOCD fixes are made by the Crack groups for their own RIPS, but if they can't rip the game, why will they bother to make nocd fixes? I still think the answer lies in making some sort of image of the install, together with registry changes (See my earlier post on this). I'm sure the crackers could suss this in days, but of course they aren't interested in this method because they want to make illegal RIPS to put on the Web. This is what I'm talking about, it's not rocket science:
1.Install Trackmania from original (MUST be from original)
2.Use NOCD fix
3.Create image of Hard Drive using Norton Ghost or TrueImage
4.Hyperthetically your dog eats the original disk :-)
5.Restore Drive image and game plays fine
OK, I know it's obvious. This method won't work when you upgrade your hardware of course, as the image won't match, but I'm certain this is the way around Starforce (for legitimate original owners of course). I've got a few coder frinds who are working on program as we speak (with some success I might add).
ash2dust2
06-07-2004, 11:13
I have to say, this Starforce 3 protection has been a godsend for games publishers - not having their games ripped and available for download before they are even out on the shelves
I fully endorse whatever they have to do to stem the flow of warez etc
hopefully, with warez on the decrease because of protections such as this we will see the price of games coming down - places like play.com sell the latest releases for £17.99 - thats next to nothing!!!
just my 2 cents!
A godsend? Doubt it. They may have to stop believing their own hype about how many billions of dollars they lost due to piracy. They probably had $1k increase in sales.
Monty Burns
06-07-2004, 12:22
Not to forget that even originals sometimes refuse their work. That isn't godsent, that is taking the piss out of legit customers.
ByteMare
06-07-2004, 13:17
Not to forget that even originals sometimes refuse their work. That isn't godsent, that is taking the piss out of legit customers.
Hmmm...I wonder what *company* you were refering to? :D *w00t*
They say they loose on avg 1 billion a year in sales but they don't take in consideration how many people actually buy software after trying the full versions of their product found all around the net. There was a post on here saying if they can get piracy under control that will lower the cost of games, well I don't see that ever happening as greed is good just look at the record companies they were even sued and had to pay a huge settlement because they were over charging consumers but did it effect the sales price of a cd? heck no theyre still going for $17-22.00 a piece so gaming companies aren't gonna budge either just because they nipped piracy in the butt....temporarily :)
SiN
Kid, just FORGET trying to crack SF3!!
Perhaps the mods ought to put up a sticky topic telling people to STOP asking for SF3 cracks or how to crack it!
If the top scene crackers out there are having difficulty with it, what chance you got huh?
Just stick with your original CD's for now.
Good idea!
Put up a sticky about the SF3!
As far i i can see, not sure, but StarForce v3 has been cracked is "GangLand" not using that protection too ?
As I understand it there are different levels of how to implement SF3 protection.
One is to just protect the EXE, not too difficult to deal with. I believe Gangland and Singles are examples of this
Another method involves not only protecting the EXE but encrypting data files too, look at Dead To Rights for an example of that! The 'crack' was nearly a whole CD!
Then there are the 'emulated functions'. As I understand it from a reliable source, it's these 'active protected functions' in the EXE that are the bitch that has stopped the release of titles like Beyond Divinity, TOCA2 and Killswitch as they are time consuming to find/trace!!
Please correct me if I'm wrong on any of those points :)
Morglum007
08-07-2004, 06:21
U re right barry, but lets say the problem is not to trace such functions, but "create" the VM SF code that is removed when a dump is made.
Thats the problem with SF, finding and linking the so called p-code table to make an "universal" crack that just works for every game release, and not only in the native cracked release.
Good luck!
As far as I know, StarForce3 sneakily install hidden hardware devices (software dongles).
This degrades system speed/stability, and soon tools like Spybot S&D or AdAware will have no other option than to scan for, and remove these illegal "installs".
I'm not sure a 'universal' crack could be made Morglum, maybe coded tools to help in the tracing/creating these functions that don't get dumped, or maybe you mean once dumped, then fix it with a universal tool? Still not sure it's that easy, the developers of this protection meant it to be tough to crack, and it's proving just that!
Morglum007
08-07-2004, 15:59
I'm not sure a 'universal' crack could be made Morglum, maybe coded tools to help in the tracing/creating these functions that don't get dumped, or maybe you mean once dumped, then fix it with a universal tool? Still not sure it's that easy, the developers of this protection meant it to be tough to crack, and it's proving just that!
Well, i think it is possible. The problem is to hook EVERY p-code, used or not, and not just the minimum required to launch with a specific release of the game. Thats like the API calls in SecuROM. In SF there is a p-code table and a "translation table" found in near .dll ( not protect.dll) The problem is to get all translated. With US/UK/german releases, it is fixed just the p-code to make working such releases, but not every one, so other releases in other countries do not have "support". the way of obtain such table will make a "universal" way of procceding.
Good luck!
ByteMare
09-07-2004, 03:54
Ok, what about those "Active protection functions",something similar to sexxurom triggers? Just checked out a "known title" and *wow* hooking every p-code sure as hell gonna take some time....nice antidebug, it took me 3 beers to get around (and some reboots) :D I should join your forums, Morglum..this starts to look like a real challenge heh
Morglum007
09-07-2004, 06:37
Well, that "Active protection functions" are too easy to find in SecuROM. It is just API call. SF works in another way.
Good luck!
Well, that "Active protection functions" are too easy to find in SecuROM. It is just API call. SF works in another way.
Good luck!
thats called 'triggers'
sf3 works in many ways, api rerouting, api hooking, virtual file system and p-code procs, oh and the sf3 api system doesnt work in another way, look deeper and think a little
Morglum007
10-07-2004, 04:02
Well, what i mean to say is that SF is not based on that "active functions" that are know as triggers. The difficulty of SF resides in its p-code fixing. In SecuROM it's quity easy to find such triggers, cause once dumped, iAT fixed and OEP found (with crc fixing of course), there is just to nop or jnz to jz some call to cercain API and done. Anyway, not every SecuROM released game have triggers on it, and just only a few titles have it ( commandos 3, vietcong...)
Thats like the "silent alarm" "technology" of newest safedisc, and both of them copied the Codemasters/Sta clara Fade scripting system to do that.
Anyway, SF is strong for its p-code table, not for its API system. (besides relationated, i think not mixable)
Good luck!
Heaven871
01-08-2004, 08:30
StarForce3 can not be cracked? Uhhh, I am scared, I don't want to put a list up here, but there are a lot of SF3 title already hacked.
I am just wondering why only the 1.0 game versions get hacked, what's the point in that??? There must be a stupid masterplan behind it.
Welll SF3 isnt the real problem, the main problem is always the VM Pcode.
which means even if u dumped en encrypted exe there are still crypted functions that point somewhere but not into the place the data code is located.
If pcode is present can be easely detected by everyone
always there is a "protect.dll" - it has .sforce section but musten be named protect.dll - Version of this .dll is the starforce version and if the dll file is biggern then 4MB pcode is present.
Normaly per 1MB bigger then 4MB its 7 pcoded functions that got to be fixed after dumping and rebuilding the exe and their apis.
there are mainly 4 different versions of starforce
light (dll smaller 2mb)
normal (dll between 2 and 4mb)
hard (dll bigger then 4mb)
hardest (dll bigger then 4mb and a .dat file addionaly on CD - like seen in Dday demo and german retail)
hard and hardest i dont think you wont see a crack as no cracker takes a month or longer to fix the pcode which is a allbyhand job. no game is worth the time you need to crack that.
there are mainly 4 different versions of starforce
light (dll smaller 2mb)
normal (dll between 2 and 4mb)
hard (dll bigger then 4mb)
hardest (dll bigger then 4mb and a .dat file addionaly on CD - like seen in Dday demo and german retail)
hard and hardest i dont think you wont see a crack as no cracker takes a month or longer to fix the pcode which is a allbyhand job. no game is worth the time you need to crack that.
The game "Black Mirror" has
Bmirror.dll with over 5 MB with starforce,
exe over 2 MB,
data.adb over 2 MB with starforce
and two small files with 59 KB also with starforce.
It was published in October or November last year and only a few days later the group immersion released a fully working crack.
So it seeems to be possible, doesn't it???
Unfortunately immersion seems to no longer exist :-(
Black Mirror isnt that hard as not much pcoded functions.
And yes IMS did a nice job on it but it was also handmade.
I dont say it is impossible but twhen u get f.e. Obscure or D-Day which have 27 or 34 pcoded functions you dont want to invest the time. Black mirror had 5 pcodes, the german one 7 or so dunno. but thats alot less.
there are some freaks that can surely crack sf3 fastern then that but todays crackers have a rl :)
@michse
You seem to be an expert in that kind of things. ;-)
So let me ask you:
If it's too time intensive for those harder protected games,
would it be possible or realistic to make a "global" starforce crack, I mean an application that modifies installed starforce drivers in the system or
an application that installs own drivers that go deeper in the system as the starforce drivers and knocks them out?
Yes from my point of view it is possible to either emulate the starforce drivers or at least patch em that every copy with dpms included will run.
If your able to code a tool that hook every single pcode function ... no matter what they do or if they are protection relevant or not then your able todo a generic tool. In my eyes it is possible and there are some guys trying this already as i saw already outputs from such tools in develop but it is a real hard stuff. You need alot more skills then just debugging, dumping hooking i think and btw im not a real expert in it but i try to understand more and more until the russians find a new **** that gets you back to the basics again :)
Only one game isn't cracked with Starforce3 protection the name is Move2play, it's a good eyetoy Playstation2 clone, check to www.move2play.com
not find any crack, in P2P only fake virus !!! :mad:
Can u help me ?
only one game? ¬¬ theres a few starforce games that havent been cracked...
only one game? ¬¬ theres a few starforce games that havent been cracked...
IRONIC MODE ON
Only one game
IRONIC MODE OFF
Ironic.... because my request of crack haven't been answered
:D
well taugh **** dude we dont make cracks here, so i dont see the point on u "requesting" u can just wait and hope it will come out, just like the DTM2 people still waiting. GCW only hosts cracks, they dont make em.
DTM2 has over 50 pcoded functions ... i would say forget it
move2play isnt so cool that it get on higher preority :)
move2play isnt so cool that it get on higher preority :)
Arghhh!!!! :eek:
Ok i waiting the end of the other priority....
;)
Morglum007
02-08-2004, 17:12
Yeap, thats the point with SF.
Today most SF cracks are hand made cracks with some primitive tools for semi-dumping.
Anyway, to code a complete p-code catching tool, we must know entirely how SF works. Thats the way some people is researching (...)
Because there are two VM and both uses pcode functions, the only way to make it easy is by coding a VM logger into a patcher ;)
By the way, there is a lot of people behind that.
Be patient.
Good luck!
Additional question:
Besides starforce, here in Germany a lot of new games also use
VOB ProtectCD 5.x
Is this thing similar to starforce3 or what are the differences?
It seems that this one doesn't install permanent drivers in the windows system like starforce or am I wrong?
In most cases there are also no cracks available for those games (e.g. Port Royale)
VOB is kinda simmilar to SF3 but SF3 is a way much better coded as it doesnt take so much resources as VOB does. But VOB isnt a so much found Protection at all. The last Games i know are Port Royal 2 + Arena Wars from Ascaron and Holiday World from Brigades.
The similar thing is they both used special drivers but VOB can always be copied with the same trick what for SF3 isnt possible. SF3 you either have a good burner or are skilled enough to patch the installed .sys file from SF3.
The difference is: VOB from Ascaron is filled with hidden checks (crc, size, date, etc.) or like in Arena Wars a non original exe cant play online in any way. Maybe u ask the main creator of SF3 as he did the most VOB cracks before :D
Its a lot of work too and their are to less people that try themself and improve on trying. Most people simple leech via p2p and dont care how much work crackers invested and that they might need help and new talents.
Its like in sports ... only if no new talent arrives the ppl start crying ... but i dont see alot of people here that exchange infos about their trys .... its always i nedd, how do i, and so on ...
to Morglum007:
---------------
i hope it gets done before the russian freak finds something new :( as
i hate games like D-Day German where you dont see an end during debugging :)
Good luck on it.
-----------------
btw. Tages is a lot harder as you hae to play the game to finish as it gets only decrypted level by level :)
morglum i have a question...
Is it possible to get 2 tools done that do the follwoing
1st one is a dumper/logger that returns some offsets or so that explain the point where it goes into protection checking and the offset where its passed with result CD is Ok?
2nd one is a loader that bypass the protection check and jumps to the point in mainexe memory where the protection check has returned result ok
it was already used for some VOB 5 games like Port Royal 1 as u might know
But then, the next question will be, who's going to have the guts to read through 500+ MB of logs to figure it out? :(
The cd-check appears to be quick because star-force is running at an absolutely high priority level... ever tried moving the mouse while the cd-check is running.. slow eh ;p It would probably take a few days (non-stop, and at a good speed) just to trace through the cd-check once.
well if it would be easy we would see such tools already spreaded :) and have for sure new updated SF already from the russian freaks.
But coding a dumper that hooks every pcoded function no matter if recent for protection or not is also a hard job.
Such a tool might be coded for already cracked sf3 games and then we could learn from the logfile what we have to seach. There are some of them already and it doesnt matter if it has pcode or not with such a loader and as you dont patch the main files it gives you the chance that hidden checks or something like this can be stoped. A NoCD might be difficult then when addional simple cdchecks are in the game but who cares if you can run from a mounted image from original CD. HDDs are big and so a image can be stored and the orig cd can be placed save into the box again. I hate it when CDs go bad like my Soldiers and Toca 2 :( and companys doesnt do a **** to give you a new one when you ask, they simply say you buy again. grrr
ash2dust2
05-08-2004, 17:38
Thanx for the info. One of the more intelligent threads. Maybe worth a stickey so we can point all the monkeys requesting SF3 cracks to this.
I always purchase my games! My friends too, but we had to get THOCA and Soldiers-Heroes of WW2 two times before they worked.The way i see it (and my friends agree) SF3 is created only to suck more MONEY from us! This, and i hope U feel me is NOT good at all! :mad:
Tootzie.
13-08-2004, 13:07
Heres the crack, in the thread theres a post that this crack should work on each starforce protected game which is on CD for the PC. I tried to use it for Kill.Switch (Which has been brought to the pc from a console), but that didnt work.. So I guess its only for games which arent brought to the pc from a console or are on DVD.
http://fileforums.com/archive/index.php/t-63374.html
@Tootzie.:
first of all, it's not a crack.
Second, the file you are refering to will only work for Soldiers heroes of wwii. A new one has to be created for each game and it doesn't seem to be possible on DVD games.
Morglum007
14-08-2004, 12:13
Well, ummm, sorry for the late, but i'm at holydays, so cannot reply as soon as other.
Well, respecting that russian SF tool, it is just a dumper and do not include pcodes catching. It does the "easy" thing, reconstruct OEP and IT, with some CRC fixing.
Respecting VOB, well we haven't studied such prot, so cannot say anything about.
About p-code catching, we have pointed the routine that calls such pcodes, and there is just about 500 p-codes, so no 500 mB logger needed. It is pretty similar to SecuROM API routione with minimal variants, just changing some instructions to fool novice crackers. As said for other user, here or in another forum, p-codes are different from game to game and are increasing in number to make it "impossible" to trace all. Thats why there isn't a standart tool for SF dumping.
I know both that russian tool and others, but nothing to do with p-codes right now. As told in my web page, we are a very interesting researching group and have a lot of progress in every SF way.
We are so close to make a valid SF key from an original one, but we are reversing the whole thing too.
Respecting p-codes, most are just jmp to main x86 code into main .exe, but some are into VM, and that x86 code generation is the problem.
The way SF is muting is the way crackers are doing too, and crackers are muting fast, so SF will be "solved" soon, in every aspect.
As said Kosmonaut too ( from cdfreaks and "member" of our little group), SF is something made from expert crackers, and do not know a lot about copy-protection. It is just a CD cops check with a very impressive guarding code.
Our latest research thinks SF have not a very smart cd checking, and maybe could be duplicated with a "twinpeak" method soon. It seems SF checks for the "asymetric" and EXTERNAL data spiral. Because burned CD are asymetric in the inner zone ( p-cav, cav) and "symetric" in the outer one (clv), that can make SF to distinguish between copy and original.
There is a lot of more interesting things about SF, but thats all for now.
Good luck eveybody.
TIP: I do not like another type of emulation ( like RAM one) cause thats can be always blacklisted by making spin command test on every drive.Well, time will say.
Morglum007 you are saying that sooner or later your group will slash this EVIL SF thing?! Very very good! Those evil, money sucking corp criminals must be put down for good. NOBODY can mess with the gamers. We hope that SF will be the last PATHETHIC attempt to disrupt reality. :D
zir_zolan
16-08-2004, 08:40
This may sound stupid, but could you (Morglum007) please translate your homepage into english. I'm very interested in the progress of the sf cracking, and would like to understand your page. :D
BTW.. Cool design! :cool:
crnelyone
19-08-2004, 08:14
pero los parches solo para las versionas espanoles - or something like that
there's nothing about the progress on their website i think they will tell us
WHEN IT'S DONE
Morglum007
19-08-2004, 14:09
pero los parches solo para las versionas espanoles - or something like that
there's nothing about the progress on their website i think they will tell us
WHEN IT'S DONE
Well, besides we are a spanish web site, we have russian, and british members in our team. Everybody share what they have. Some have the first VM defeated, others have p-code loggers, another have key generation system, and others knows a lot about physical check. Since now we are in summer, i ( who normally actualize that web site) am little far from my original location. On September we will post more results, but now we make it through PM (for evident reasons).
Another teams are in a permanent hurry with SF, we prefer to be slowly and in a deeper knowledge. You can also try another locations, but i doubt u could get a better place to get info about.
Respecting web translation, well, we are not enough (about 500 visits per day) so that will be delayed some time.
Good luck!
crnelyone
20-08-2004, 12:32
well if a n00b can help u somehow just call me and i'll be there ;-)
Hi, I know this is an old thread and all, but one of the replies stated that "It will probably take a week to crack SOWW2 - Its been over a year, and only just came out (Courtesy of Reloaded)...
vBulletin® v3.8.11, Copyright ©2000-2026, vBulletin Solutions Inc.