Recent copy protections

i´ve found a tutorial covering maxpayne 2 (sd 2.30) and nfsu2 (sd 3.20), both written in german.

Can I have `em ?

[caki]

Originally Posted by ThePrince

Can I have `em ?

google

Can u please send me the link. Can´t find it by myself.

[caki]

Tis on google matey. Almost everything is on google

try this combo:

"max payne safedisc 2 manual unpacking tutorial"

I just found it with the above combo, so don't try saying it doesn't work, cuz it does :P

[Muji-FightR]

Hey, thanks for that great reply...
Well, first of all, I know what a debugger is (do I ?), I know cracking games isn't changing jumps LOL, and I'm familiar with basic unpacking/dumping/fixing IAT...

My problem is just, cracking games is rather difficult, and w/o any direction it is hard to walk, isnt it...
Thats why I was asking, how should I be able to reverse a SD3/4 game without knowing how to solve special problems (didnt even know that Olly cant handle SD3 lol)...
Only with looking at an engine, it's possible to guess its function and disassemble it, but with the knowledge of a teacher who already knows almost anything, it's WAY easier than without...
Sure, curiosity is important, no doubt, but you can also go too far with it :P

Thanks again, great help and gorgeous SR7 tutorial

@ Mujifighter read more tutorials maybe it helps.


@caki Thank you very, very much for the hint.


@ everybody else keep on writing in this forum.

[cdkiller]

@ muJi.fiGHt3r
start with an old safedisc v1/v2 game. since v2 the OEP is hardcoded wich means you can set a hwbp at it. insert your original cd, bypass antidebug, reach breakpoint, dump. if you use ollydbg ignore all exeptions.

anti debug of sd v2:
- the usual softice checks (no need to bypass when u use olly)
- IsDebuggerPresent
- CheckRemoteDebuggerPresent
- ZwQueryInformationProcess

ImpRec isn´t able to repair the IAT, you have to do this on your own or code a plugin. just step into the ff15 calls and you´ll see the api.

safedisc 2 oep snipped:
----------------------
...
je
mov eax, 00h
jmp
mov eax, dword...
push eax
call <Safedisc Anti-Debug, cd-check, Unpacking>
add esp, 14h
cmp eax, 00h // eax = 0 means no debugger and no unpacking probs
je... // no nasty stuff found, jump over call eax (jmp -> jmp leads to OEP)
mov eax, dword ptr Kernel32.ExitProcessA
call eax
...