- Joined
- Oct 24, 2007
- Messages
- 245
- Reaction score
- 365
Here is a brief 'howto' I wrote:
This 'howto' assumes you are capible of unpacking Asprotect on your own. Or are making some dll to patch memory.
If having trouble, here is some detail for you:
0x43CC84 <<-- OEP
PUSH 74
PUSH DriftCit.0089D488
CALL DriftCit.0083CFDC
XOR EBX, EBX
MOV DWORD PTR SS:[EBP-20], EBX
PUSH EBX
MOV EDI, DWORD PTR DS:[86C0EC] ; kernel32.GetModuleHandleA
CALL EDI
CMP WORD PTR DS:[EAX], 5A4D
JNZ SHORT DriftCit.0083CCC4
MOV ECX, DWORD PTR DS:[EAX+3C]
searching for 66 81 38 4D 5A 75 1F 8B 48 3C 03 C8 81 39 50 45 00 00 75 12 0F B7 41 18 3D 0B 01 00 00 74 1F 3D 0B 02 00 00 74 05 from within
context of DriftCity.exe will bring you to the OEP.
Now, let us remove the launcher nag we get when attempt to start DriftCity.exe directly.
Start from WinMain. If you are unable to locate... search for binary pattern: 83 C4 04 B0 01 C3 B8 38 11 00 00
function begins with:
mov eax, 0x1138
once here, scroll down the disasm a bit...
notice the error messages "HanAuthForClient.dll not found.", "This program needs to be started from game homepage.", etc...
Skipping to the point (if know what you are doing already, you should single step, and patch the obvious jxx instructions).
CMP EAX, 1
JNZ SHORT DriftCit.004D4937 <<-- (change to JMP ) 0xeb 0x34
next...
cmp eax, 5
je 4d4a56 <<-- (change to JMP ) change to 0xeb 0x56
next, patch where above jmp lands...
test al, al
jmp 004D4A86 <<-- (change to JMP ) 0xEB 0x22
Okay... that takes care of the nag.
Next, we disable GameGuard. Look down some at the disassembly, until you see:
CMP EAX, 0B7
JNZ SHORT $+14
MOV EAX, 309
ADD ESP, 1138
RETN 10
CALL address
MOV ECX, DWORD PTR DS:[8E8EA0]
MOV EAX, DWORD PTR DS:[ECX]
CALL DWORD PTR DS:[EAX+4] ; <<-- This calls InitGameGuard
TEST AL, AL ; <<-- test for success ( bool )
JNZ SHORT 12_.004D4B44 ; <<-- if we fail, JNZ is not taken
How to disable? Simple.
NOP both the call addr and test al, al instruction (since test is no longer needed..), and change
the JE to JMP:
90 NOP
90 NOP
90 NOP
90 NOP
90 NOP
EB 0E JMP SHORT 12_.004D4B42
Save modifications to the .exe file -- that is all.
-Fyyre
Last edited by a moderator: