No Cd for "Alle Neune" (old german skittles game)

[Metalex]

Hi to all / Salut a tous.

I am searching for a no cd patch of an old (2004) german skittles game named Alle neune that i just bought 2 days ago.

Because of the non popularity of the game, I can't find it on GCW.

I read the FAQ and used Protection ID. It said that there is no protection detected.

Can you help me?

The cd check message appears when the EXE and the "the.dll" only are in a folder, i had attached them with this post.

I let the tools to the experts


Thanks a lot.

[TippeX]

its just a normal cd/dvd check

procedure @ 0x401FB0

does the good old GetDriveTypeA -> GetVolumeInformation stuff..

Disk label is expected to be ALLE_NEUNE

[Metalex]

Wow wow thx a lot

But i am a total noob in programming....


Can you just tell me how to do it?

EDIT : FIXED! I just created an ISO image with the "ALLE_NEUNE" label and it works. thanks a lot again

[Cowsheep]

I can patch the disc in whatever way i want, process always crashes here:

004A2E29   /$  68 20644C00              PUSH Skittles.004C6420                     ; /pModule = "mscoree.dll"
004A2E2E   |.  FF15 C8304B00            CALL DWORD PTR DS:[<&KERNEL32.GetModuleHan>; \GetModuleHandleA
004A2E34   |.  85C0                     TEST EAX,EAX
004A2E36   |.  74 16                    JE SHORT Skittles.004A2E4E
004A2E38   |.  68 10644C00              PUSH Skittles.004C6410                     ; /ProcNameOrOrdinal = "CorExitProcess"
004A2E3D   |.  50                       PUSH EAX                                   ; |hModule = NULL
004A2E3E   |.  FF15 C4304B00            CALL DWORD PTR DS:[<&KERNEL32.GetProcAddre>; \GetProcAddress
004A2E44   |.  85C0                     TEST EAX,EAX
004A2E46   |.  74 06                    JE SHORT Skittles.004A2E4E
004A2E48   |.  FF7424 04                PUSH DWORD PTR SS:[ESP+4]
004A2E4C   |.  FFD0                     CALL EAX
004A2E4E   |>  FF7424 04                PUSH DWORD PTR SS:[ESP+4]                  ; /ExitCode = FFFFFFFD
004A2E52   \.  FF15 78314B00            CALL DWORD PTR DS:[<&KERNEL32.ExitProcess>>; \ExitProcess

GetModuleHandleA returns 0 in EAX, so ExitProcess is hit.


Here falls the decision to call the function.

004A2F5B   |> \68 34E04C00              PUSH Skittles.004CE034
004A2F60   |.  B8 28E04C00              MOV EAX,Skittles.004CE028
004A2F65   |.  E8 01FFFFFF              CALL Skittles.004A2E6B
004A2F6A   |.  59                       POP ECX
004A2F6B   |>  68 40E04C00              PUSH Skittles.004CE040
004A2F70   |.  B8 38E04C00              MOV EAX,Skittles.004CE038
004A2F75   |.  E8 F1FEFFFF              CALL Skittles.004A2E6B
004A2F7A   |.  59                       POP ECX
004A2F7B   |.  834D FC FF               OR [LOCAL.1],FFFFFFFF
004A2F7F   |.  E8 18000000              CALL Skittles.004A2F9C
004A2F84   |.  397D 10                  CMP [ARG.3],EDI
004A2F87   |.  75 21                    JNZ SHORT Skittles.004A2FAA
004A2F89   |.  8935 0CB34E00            MOV DWORD PTR DS:[4EB30C],ESI
004A2F8F   |.  FF75 08                  PUSH [ARG.1]
004A2F92   |.  E8 92FEFFFF              CALL Skittles.004A2E29
004A2F97   |.  33FF                     XOR EDI,EDI
004A2F99   |.  33F6                     XOR ESI,ESI
004A2F9B   |.  46                       INC ESI
004A2F9C   |$  397D 10                  CMP [ARG.3],EDI
004A2F9F   |.  74 08                    JE SHORT Skittles.004A2FA9
004A2FA1   |.  6A 08                    PUSH 8
004A2FA3   |.  E8 A2130000              CALL Skittles.004A434A
004A2FA8   |.  59                       POP ECX
004A2FA9   |>  C3                       RETN
004A2FAA   |>  E8 4C200000              CALL Skittles.004A4FFB
004A2FAF   \.  C3                       RETN

[TippeX]

hey cowsheep -> i pasted the va of the check itself, if you trace into it you'll see it does the label compare and then a jump to the top, then a compare against edi being -1, if this matches (it does if you knock out the compares), then it jumps to an entirely different subroutine, which does its magic and returns with eax being some struct pointer, allowing the game to continue, but like i said, its a simple cd/dvd check (against volume name), and it seems to be solved now

[Joe Forster/STA]

If I have time during the weekend or something, I'll create a small patch. I prefer clear solutions to temporary hacks.

[Cowsheep]

Tippey, whats in eax for after the call the the routine:
00401001 |. E8 AA0F0000 CALL Skittles.00401FB0
00401006 |. 85C0 TEST EAX,EAX ; Skittles.00400000

For me, eax is 00AA23B0.

Aargh, i dont have a certain file.
0041AD5A |. 68 94564B00 PUSH Skittles.004B5694 ; ASCII "thd3dx.dll"
EDIT: I misunderstand the first post, i assumed that the exe and dll are the whole game ans its some mini game comparable with Minesweeper.

[Joe Forster/STA]

Try the no-CD patch attached. I'm not sure if it works correctly, though - yeah, we need thd3dx.dll to further test the crack...