FEAR 1.06 No CD

[caki]

Hey Barry, i dont have FEAR, but a friend of mine tried your NOCD and said no go

[Muyfa666]

Actually, I do not have that update installed. KB917422 I mean. I heard before that I should not install it.

[TippeX]

image base of the new iat? huh?

only the executable has an image base.. the iat is baseless, what you mean is its va.. and the va of the iat can change, provided the import table itself (the part which gets filled with the va's of all the lovely api's) remains the same.. no fixups required then... if it changes then you have lots of fixups to do for practically every ff 25 / ff 15 in the exe.. fun fun fun

[Muji-FightR]

If I understood you right, you can just check 'Create new IAT' in ImpRec, it should patch the Call / Jmp Dwords (ff15/25) to the newly created IAT which resides inside the .mackt section...
Guess with base of IAt he means the beginning...

[TippeX]

hmm but theres multiple iat's in the dump...

one from the initial wrapper, and one from the 'virgin' executable,
so changing the ff 15 / ff 25 stuff can be very error prone, unless a 'merged' iat is used, and then you have the dilema of it actually accurately patching a real call/jmp and not fpu code or something similar (easiest way i do for that is check alignment, opcode length, bytes preceeding the ff 15 / ff 25 etc..)

gets very tricky, for some prots

[BarryB]

@TippeX: I think I meant it's image as in memory, meaning it's address in memory as you've pointed out. There's probably some sections that can be removed, but then it means cleaning up the dump so it still works, which is beyond me.

Sorry it doesn't work for anyone else but me, a consequence of dumping/fixing on my own system I guess

[Muyfa666]

No big deal, I don't even play FEAR. If I would, I'd play 1.06 with no-cd crack. Doesn't matter to me.