Mini images request

[haggar]

I tought that it was obvious - I have these games , full with cracked and original exe files. But I need original CDs, which I don't have, or mini images, so I can see how protection works. I do not have original CDs, and I do not have mini images. But I see that on this site mini images are shared just like that. Ofcourse, most of folks who exchanges images just want to play games. I want to play with protections.

Protections are maybe obsolete, but earlier version of protection can be easier and give you some clues how newer versions work. For example, I was just removing SafeDisc from Need For Sped Undergound 2 (not sure is it 4.00 or 3.xx version of SafeDisc). I can see that it is very similar to earlier versions in some parts (anti-debug tricks). Except nanomites, it looks just like SafeCast. I was also removing SecuROM 4.41 from one original CD (yeah, I even got one original) , but it looks like v5.00 is not really different. I know that current version is 7, I will get it soner or later.

regards

[TippeX]

hang on.. you dont have the originals? and yep safedisc is more or less safecast with teeth..

[Muji-FightR]

Whilst talking about Securom:
I just had a deeper look into my 'old and crappy games box' and came out of it with an old copy of WarCraft 3, PiD says it's protected with SR 4.8 whatever...

I first used the original CD, then switched to the mini image not having to switch around.

Finding OEP is pretty straight forward (?), afaik similar to newer versions, SR 5 and early SR7s... (CreateEventA)

However, I experienced 2 strange things:
1. Running the game inside Olly takes about 5 minutes (!!!) to load and get to the OEP
Outside Olly it only takes about say 20 seconds
Does using SICE help here ? And why does it take Olly so long ? The protected file is only 600kb ?!?!

2. When reparing imports (just made a cheap plugin recovering imports) it crashes after a certain amount of imports...
This way, I have to copy the changes made by the script, restart (5 min -.-), reapply changes and repair the remaining imports... and Ive got to do that over and over again...

I constantly forget to set a BP on the JMP EAX (EAX = API), thus letting the script do nothing... -> 5 mins loading in vain :/
Already did that 5 times lol
btw Attaching didnt do it for me, often crashed, even took longer to load after attaching :/ phew dunno

However, not too hard if you know what youre dealing with, guess more recent versions are way harder

[haggar]

1. SecuROM generates zillion "intiger division by 0" exceptions. That is why it is slow within debugger. Olly catches every that exception, then based on your settings, it chose will it stop or continue debug event. Btw, pop-out CD from drive, run protected exe, it will ask for CD. At that time all exceptions are passed. Attch with Olly, throw in CD, put bp on GetDriveTypeA or MessageBox and continue debugging.

2. Apears that it is a timer check (maybe). timeGetTime API? It needs little tracing and examning for which I didn't want to spend much time so I was restarting.


Version of <5 SecuROM is easy to find in file. Search AddD string.
I don't know why attaching doesn't work.

Can you help me with images?

[Muji-FightR]

Well, try the obvius pages, megagames, gamecopyworld has a good collection of mini images...
PM me for direct links, mkay

btw, great trick, I'll remember that one

[TippeX]

Originally Posted by haggar

2. Apears that it is a timer check (maybe). timeGetTime API? It needs little tracing and examning for which I didn't want to spend much time so I was restarting.

Version of <5 SecuROM is easy to find in file. Search AddD string.
I don't know why attaching doesn't work.

used within the api handler, and also for triggers.. attaching should work in v5

and yep softice is better to work with, its my 'weapon of choice', or well, it was..

AddD string, why search?, for those older versions, last dword in the file= the file offset of the AddD portion...

Can you help me with images?

without the originals you're really violating the rules...

[Joe Forster/STA]

My heart bleeds for all the useful information contained in this thread, but no exceptions: no original => no help! Closed.

@haggar: Next time you'll get banned for this!