Thief ver 1.33 NO CD

[TippeX]

you need to look deeper

.0060F870:  73 63 72 69-70 74 5F 6D-6F 64 75 6C-65 5F 70 61  script_module_pa
.0060F880:  74 68 00 00-6D 6F 76 69-65 5F 70 61-74 68 00 00  th  movie_path
.0060F890:  6C 61 6E 67-75 61 67 65-00 00 00 00-65 6E 67 6C  language    engl
.0060F8A0:  69 73 68 00-6E 6F 5F 63-64 5F 25 73-5F 25 73 00  ish no_cd_%s_%s
.0060F8B0:  4E 4F 20 43-44 00 00 00-74 69 74 6C-65 00 00 00  NO CD   title
.0060F8C0:  6D 73 67 00-20 2E 00 00-63 64 5F 70-61 74 68 00  msg  .  cd_path
.0060F8D0:  74 68 69 65-66 5C 73 6E-64 2E 63 72-66 00 00 00  thief\snd.crf
.0060F8E0:  72 62 00 00-72 62 00 00-63 64 5F 70-61 74 68 00  rb  rb  cd_path
.0060F8F0:  44 3A 5C 00-00 00 00 00-63 64 5F 70-61 74 68 00  D:\     cd_path
.0060F900:  44 3A 5C 00-00 00 00 00-74 65 73 74-5F 63 6F 70  D:\     test_cop
.0060F910:  79 5F 70 72-6F 74 65 63-74 00 00 00-6F 6E 6C 79  y_protect   only
.0060F920:  5F 63 68 65-63 6B 5F 70-61 74 68 00-00 00 00 00  _check_path

now x-reference the test_copy_protect_line

to do this, there's probably a thief.cfg file, or maybe thief.ini, i think its cfg though, inside that there should be a line as
'cd_path'
which probably needs to be changed to .\
and some files copied from the cd/dvd to the installation folder (most likely the movies folder)

the AL register in ollydbg is in the EAX register
EAX = 32 bit
AX = 16 bit
AH = 8 bit high
AL = 8 bit low

think you need to read up on your asm a little more..

and changing jumps is usually a bad idea, target the procedure, NOT the conditionals, because the procedures influence the conditional

.0050E8F0: 8B442404                       mov         eax,[esp][4]
.0050E8F4: 50                             push        eax
.0050E8F5: FF1528615B00                   call        GetDriveTypeA
.0050E8FB: 33C9                           xor         ecx,ecx
.0050E8FD: 83F805                         cmp         eax,5
.0050E900: 0F94C1                         setz        cl
.0050E903: 8BC1                           mov         eax,ecx
.0050E905: C3                             retn ; -^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-

is the function to determine if the drive is a cd drive, if it is it returns TRUE (1), otherwise it returns FALSE (0)

if you look above that you'll see it looking for snd.crf, and accessing the 'cd_path' variable..

x-ref that function and you'll find..

.0050E910: 8B442404                       mov         eax,[esp][4]
.0050E914: 53                             push        ebx
.0050E915: 85C0                           test        eax,eax
.0050E917: B341                           mov         bl,041 ;'A'
.0050E919: 7444                           jz         .00050E95F --↓1
.0050E91B: 8B4C240C                       mov         ecx,[esp][00C]
.0050E91F: 85C9                           test        ecx,ecx
.0050E921: 7410                           jz         .00050E933 --↓2
.0050E923: 0FBE00                         movsx       eax,b,[eax]
.0050E926: 50                             push        eax
.0050E927: E894070900                     call       .00059F0C0 --↓3
.0050E92C: 8BD8                           mov         ebx,eax
.0050E92E: 83C404                         add         esp,4
.0050E931: FEC3                           inc         bl
.0050E933: 80FB5A                         cmp         bl,05A ;'Z'
.0050E936: 7F27                           jg         .00050E95F --↓1
.0050E938: 6830F86000                     push        00060F830 ;'D:\' --↓4
.0050E93D: 881D30F86000                   mov         [00060F830],bl ;'D:\' --↓4
.0050E943: E8A8FFFFFF                     call       .00050E8F0 --↑5
.0050E948: 83C404                         add         esp,4
.0050E94B: 85C0                           test        eax,eax
.0050E94D: 7509                           jnz        .00050E958 --↓6
.0050E94F: FEC3                           inc         bl
.0050E951: 80FB5A                         cmp         bl,05A ;'Z'
.0050E954: 7EE2                           jle        .00050E938 --↑7
.0050E956: 5B                             pop         ebx
.0050E957: C3                             retn ; -^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-
.0050E958: B830F86000                     mov         eax,00060F830 ;'D:\' --↓4
.0050E95D: 5B                             pop         ebx
.0050E95E: C3                             retn ; -^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-
.0050E95F: 33C0                           xor         eax,eax
.0050E961: 5B                             pop         ebx
.0050E962: C3                             retn ; -^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-

which is the routine that validates if the drive letter is a cd/dvd drive..

x-ref that and it'll take you to..

.0050E970: 81EC04010000                   sub         esp,000000104

x-ref that and it takes you to..

.0050EB90: C705AC8E670000000000           mov         d,[000678EAC],0
.0050EB9A: E8D1FDFFFF                     call       .00050E970 --↑7
.0050EB9F: 85C0                           test        eax,eax
.0050EBA1: 7517                           jnz        .00050EBBA --↓8
.0050EBA3: 6A01                           push        1
.0050EBA5: E806FCFFFF                     call       .00050E7B0 --↑9
.0050EBAA: 83C404                         add         esp,4
.0050EBAD: 85C0                           test        eax,eax
.0050EBAF: 742A                           jz         .00050EBDB --↓A
.0050EBB1: E8BAFDFFFF                     call       .00050E970 --↑7
.0050EBB6: 85C0                           test        eax,eax
.0050EBB8: 74E9                           jz         .00050EBA3 --↑B
.0050EBBA: A1AC8E6700                     mov         eax,[000678EAC]
.0050EBBF: 85C0                           test        eax,eax
.0050EBC1: 740E                           jz         .00050EBD1 --↓C
.0050EBC3: 50                             push        eax
.0050EBC4: E897FEFFFF                     call       .00050EA60 --↑D
.0050EBC9: A1AC8E6700                     mov         eax,[000678EAC]
.0050EBCE: 83C404                         add         esp,4
.0050EBD1: 33C9                           xor         ecx,ecx
.0050EBD3: 85C0                           test        eax,eax
.0050EBD5: 0F95C1                         setnz       cl
.0050EBD8: 8BC1                           mov         eax,ecx
.0050EBDA: C3                             retn ; -^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-
.0050EBDB: 33C0                           xor         eax,eax
.0050EBDD: C3                             retn ; -^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-

x-ref that and it takes you to..

.0050EC90: 6A00                           push        0
.0050EC92: 6A00                           push        0
.0050EC94: 6808F96000                     push        00060F908 ;'test_copy_protect' --↓2
.0050EC99: E842B70300                     call       .00054A3E0 --↓3
.0050EC9E: 83C40C                         add         esp,00C
.0050ECA1: 84C0                           test        al,al
.0050ECA3: 7507                           jnz        .00050ECAC --↓4
.0050ECA5: B801000000                     mov         eax,1
.0050ECAA: EB21                           jmps       .00050ECCD --↓5
.0050ECAC: 6A00                           push        0
.0050ECAE: 6A00                           push        0
.0050ECB0: 681CF96000                     push        00060F91C ;'only_check_path' --↓6
.0050ECB5: E826B70300                     call       .00054A3E0 --↓3
.0050ECBA: 83C40C                         add         esp,00C
.0050ECBD: 84C0                           test        al,al
.0050ECBF: 7507                           jnz        .00050ECC8 --↓7
.0050ECC1: E8CAFEFFFF                     call       .00050EB90 --↑8
.0050ECC6: EB05                           jmps       .00050ECCD --↓5
.0050ECC8: E813FFFFFF                     call       .00050EBE0 --↑9
.0050ECCD: 85C0                           test        eax,eax
.0050ECCF: 7405                           jz         .00050ECD6 --↓A
.0050ECD1: E96AFBFFFF                     jmp        .00050E840 --↑B
.0050ECD6: 33C0                           xor         eax,eax
.0050ECD8: C3                             retn ; -^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-

now perhaps you see how i saw the configuration names.. which are most likely in the cfg file (or ini)...

and how if the value is 0 (i think), it'll set eax to TRUE (1) and return...
skipping the checks..

so there may be no patching required, just a simple editing of a cfg file, copying files from the cd/dvd drive to the install folder.. job done...

or do you have better ideas cowsheep?, also, without all the files the exe crashes, so debugging it without the complete files, its a bit tricky