[ASM]Serial key

[gurps123456789]

Basically i know to enable serial key you go to 004972A7
and change MOV EAX,0FFFF to CMP EAX,0FFF
but here's the problem i open my runnable and it's already CMP EAX,0FFF , but i cant still start it by clicking on it, i changed the value to MOV then CMP again but still didnt work , any ideas whats wrong?

[MentaL]

[Mark]

If you want to be able to run it without a launcher, change it to MOV. If you want to have to use a launcher, use CMP.

[gurps123456789]

i want to use the launcher, but when i open it it's cmp, and it can run without a launcher...
you get what i mean now?

[Mark]

Yeah, that probably means theres another edit in there stopping it from doing so. Search around that area for some changes.

[gurps123456789]

hmmz this is where i sux, im not very good at asm, just been following some tuts and understanding
i tried changing some jnz value's to jmp's but still didnt work

[ThievingSix]

Whats the next 3 lines after the CMP/MOV?

[own_prox]

compare it to xions runable its a push that isnt pointing to the right address

[[INDG]FeN$x]

not from this game, but asm expert...

if you want answer copy all lines from blow the CMP till RETN or copy like 10-20 lines down and send by PM or put them here.

if you use ollydbg select the 20 lines from cmp below and put secondary buttom and put copy>to file.

thx

[Linear88]

Lol, mine's fixed - I did it myself. :o

You should compare the runnables.

[ThievingSix]

not from this game, but asm expert...

if you want answer copy all lines from blow the CMP till RETN or copy like 10-20 lines down and send by PM or put them here.

if you use ollydbg select the 20 lines from cmp below and put secondary buttom and put copy>to file.

thx

I could have sword I said that...could be wrong though.

[Trilest]

Whats the next 3 lines after the CMP/MOV?

004972AE             > \6A 00             PUSH 0

lines below the cmp / mov till the return:

004972A7             .  3D FFFF0000       CMP EAX,0FFFF
004972AC             .  75 00             JNZ SHORT Theduel_.004972AE
004972AE             >  6A 00             PUSH 0
004972B0             .  C746 10 02000000  MOV DWORD PTR DS:[ESI+10],2
004972B7             .  E8 34830300       CALL Theduel_.004CF5F0
004972BC             .  8BC8              MOV ECX,EAX                                ;  kernel32.BaseThreadInitThunk
004972BE             .  E8 5D820300       CALL Theduel_.004CF520
004972C3             .  5E                POP ESI                                    ;  kernel32.778E4911
004972C4             .  B0 01             MOV AL,1
004972C6             .  5B                POP EBX                                    ;  kernel32.778E4911
004972C7             .  C2 0400           RETN 4
004972CA             .  53                PUSH EBX
004972CB             .  E8 20830300       CALL Theduel_.004CF5F0
004972D0             .  8BC8              MOV ECX,EAX                                ;  kernel32.BaseThreadInitThunk
004972D2             .  E8 69820300       CALL Theduel_.004CF540
004972D7             .  5E                POP ESI                                    ;  kernel32.778E4911
004972D8             .  5B                POP EBX                                    ;  kernel32.778E4911
004972D9             .  C2 0400           RETN 4
004972DC             .  83F8 5B           CMP EAX,5B
004972DF             .^ 74 BD             JE SHORT Theduel_.0049729E
004972E1             .  3D 11270000       CMP EAX,2711
004972E6             .  74 0D             JE SHORT Theduel_.004972F5
004972E8             .  68 3C265F00       PUSH Theduel_.005F263C                     ;  ASCII "Invalid Locale \n"
004972ED             .  E8 6EA20900       CALL Theduel_.00531560
004972F2             .  83C4 04           ADD ESP,4
004972F5             >  5E                POP ESI                                    ;  kernel32.778E4911
004972F6             .  32C0              XOR AL,AL
004972F8             .  5B                POP EBX                                    ;  kernel32.778E4911
004972F9             .  C2 0400           RETN 4
004972FC             .  3D FEFF0000       CMP EAX,0FFFE
00497301             .  75 27             JNZ SHORT Theduel_.0049732A
00497303             .  BB 01000000       MOV EBX,1
00497308             .  C746 10 03000000  MOV DWORD PTR DS:[ESI+10],3
0049730F             .  889E 34110000     MOV BYTE PTR DS:[ESI+1134],BL
00497315             >  6A 00             PUSH 0
00497317             .  E8 D4820300       CALL Theduel_.004CF5F0
0049731C             .  8BC8              MOV ECX,EAX                                ;  kernel32.BaseThreadInitThunk
0049731E             .  E8 FD810300       CALL Theduel_.004CF520
00497323             .  5E                POP ESI                                    ;  kernel32.778E4911
00497324             .  8AC3              MOV AL,BL
00497326             .  5B                POP EBX                                    ;  kernel32.778E4911
00497327             .  C2 0400           RETN 4
0049732A             >  3D FDFF0000       CMP EAX,0FFFD
0049732F             .^ 75 C4             JNZ SHORT Theduel_.004972F5
00497331             .  BB 01000000       MOV EBX,1
00497336             .  6A 00             PUSH 0
00497338             .  C746 10 03000000  MOV DWORD PTR DS:[ESI+10],3
0049733F             .  889E 34110000     MOV BYTE PTR DS:[ESI+1134],BL
00497345             .  E8 A6820300       CALL Theduel_.004CF5F0
0049734A             .  8BC8              MOV ECX,EAX                                ;  kernel32.BaseThreadInitThunk
0049734C             .  E8 CF810300       CALL Theduel_.004CF520
00497351             .  889E 35110000     MOV BYTE PTR DS:[ESI+1135],BL
00497357             .  5E                POP ESI                                    ;  kernel32.778E4911
00497358             .  8AC3              MOV AL,BL
0049735A             .  5B                POP EBX                                    ;  kernel32.778E4911
0049735B             .  C2 0400           RETN 4
0049735E                CC                INT3
0049735F                CC                INT3
00497360            /$  56                PUSH ESI
00497361            |.  8BF1              MOV ESI,ECX
00497363            |.  57                PUSH EDI
00497364            |.  8D8E 38110000     LEA ECX,DWORD PTR DS:[ESI+1138]
0049736A            |.  E8 01AD0100       CALL Theduel_.004B2070
0049736F            |.  B9 AC006700       MOV ECX,Theduel_.006700AC
00497374            |.  E8 379FF9FF       CALL Theduel_.004312B0
00497379            |.  E8 C2270800       CALL Theduel_.00519B40
0049737E            |.  8BC8              MOV ECX,EAX                                ;  kernel32.BaseThreadInitThunk
00497380            |.  E8 AB210800       CALL Theduel_.00519530
00497385            |.  B9 78FD6600       MOV ECX,Theduel_.0066FD78
0049738A            |.  E8 F1AEFFFF       CALL Theduel_.00492280
0049738F            |.  E8 0C94F9FF       CALL Theduel_.004307A0
00497394            |.  68 AC265F00       PUSH Theduel_.005F26AC                     ;  ASCII "Destroy console.\n"
00497399            |.  E8 C2A10900       CALL Theduel_.00531560
0049739E            |.  8B0D 4CFB6600     MOV ECX,DWORD PTR DS:[66FB4C]
004973A4            |.  33FF              XOR EDI,EDI
004973A6            |.  83C4 04           ADD ESP,4
004973A9            |.  3BCF              CMP ECX,EDI
004973AB            |.  74 0D             JE SHORT Theduel_.004973BA
004973AD            |.  8B01              MOV EAX,DWORD PTR DS:[ECX]
004973AF            |.  6A 01             PUSH 1
004973B1            |.  FF50 30           CALL DWORD PTR DS:[EAX+30]                 ;  Theduel_.005CFC45
004973B4            |.  893D 4CFB6600     MOV DWORD PTR DS:[66FB4C],EDI
004973BA            |>  8B0E              MOV ECX,DWORD PTR DS:[ESI]
004973BC            |.  3BCF              CMP ECX,EDI
004973BE            |.  74 09             JE SHORT Theduel_.004973C9
004973C0            |.  8B11              MOV EDX,DWORD PTR DS:[ECX]
004973C2            |.  6A 01             PUSH 1
004973C4            |.  FF52 30           CALL DWORD PTR DS:[EDX+30]
004973C7            |.  893E              MOV DWORD PTR DS:[ESI],EDI
004973C9            |>  8B4E 08           MOV ECX,DWORD PTR DS:[ESI+8]
004973CC            |.  3BCF              CMP ECX,EDI
004973CE            |.  74 09             JE SHORT Theduel_.004973D9
004973D0            |.  8B01              MOV EAX,DWORD PTR DS:[ECX]
004973D2            |.  6A 01             PUSH 1
004973D4            |.  FF10              CALL DWORD PTR DS:[EAX]
004973D6            |.  897E 08           MOV DWORD PTR DS:[ESI+8],EDI
004973D9            |>  8B4E 0C           MOV ECX,DWORD PTR DS:[ESI+C]
004973DC            |.  3BCF              CMP ECX,EDI
004973DE            |.  74 09             JE SHORT Theduel_.004973E9
004973E0            |.  8B11              MOV EDX,DWORD PTR DS:[ECX]
004973E2            |.  6A 01             PUSH 1
004973E4            |.  FF12              CALL DWORD PTR DS:[EDX]
004973E6            |.  897E 0C           MOV DWORD PTR DS:[ESI+C],EDI
004973E9            |>  B9 08006700       MOV ECX,Theduel_.00670008
004973EE            |.  E8 3DF10300       CALL Theduel_.004D6530
004973F3            |.  B9 30006700       MOV ECX,Theduel_.00670030
004973F8            |.  E8 33F10300       CALL Theduel_.004D6530
004973FD            |.  68 94265F00       PUSH Theduel_.005F2694                     ;  ASCII "Destroy mesh manager.\n"
00497402            |.  E8 59A10900       CALL Theduel_.00531560
00497407            |.  83C4 04           ADD ESP,4
0049740A            |.  B9 58006700       MOV ECX,Theduel_.00670058
0049740F            |.  E8 1CF10300       CALL Theduel_.004D6530
00497414            |.  68 74265F00       PUSH Theduel_.005F2674                     ;  ASCII "Destroy weapon mesh manager.\n"
00497419            |.  E8 42A10900       CALL Theduel_.00531560
0049741E            |.  8B86 18110000     MOV EAX,DWORD PTR DS:[ESI+1118]
00497424            |.  83C4 04           ADD ESP,4
00497427            |.  3BC7              CMP EAX,EDI
00497429            |.  74 0D             JE SHORT Theduel_.00497438
0049742B            |.  50                PUSH EAX                                   ;  kernel32.BaseThreadInitThunk
0049742C            |.  FF15 60655E00     CALL DWORD PTR DS:[<&WINMM.timeEndPeriod>] ;  WINMM.timeEndPeriod
00497432            |.  89BE 18110000     MOV DWORD PTR DS:[ESI+1118],EDI
00497438            |>  E8 D34B0400       CALL Theduel_.004DC010
0049743D            |.  8BC8              MOV ECX,EAX                                ;  kernel32.BaseThreadInitThunk
0049743F            |.  E8 2CBB0500       CALL Theduel_.004F2F70
00497444            |.  68 54265F00       PUSH Theduel_.005F2654                     ;  ASCII "destroy game application done.\n"
00497449            |.  E8 12A10900       CALL Theduel_.00531560
0049744E            |.  83C4 04           ADD ESP,4
00497451            |.  5F                POP EDI                                    ;  kernel32.778E4911
00497452            |.  5E                POP ESI                                    ;  kernel32.778E4911
00497453            \.  C3                RETN

[PaulBub]

Weird that it jumps to the next line if not zero, but if zero, it will still execute it..

[Linear88]

Weird that it jumps to the next line if not zero, but if zero, it will still execute it..

And that is what is removing the serial key. :)

It's fairly easy.

[Trilest]

Then how to enable ?

[ThievingSix]

My guess, without looking at anything is it should be JNZ 004972CA.

And after looking, I was right.

[Donald Duck]

Weird that it jumps to the next line if not zero, but if zero, it will still execute it..

He's probably using OllyDBG V1.

004972AE             > \6A 00             PUSH 0

lines below the cmp / mov till the return:

004972A7             .  3D FFFF0000       CMP EAX,0FFFF
004972AC             .  75 00             JNZ SHORT Theduel_.004972AE
004972AE             >  6A 00             PUSH 0
004972B0             .  C746 10 02000000  MOV DWORD PTR DS:[ESI+10],2
004972B7             .  E8 34830300       CALL Theduel_.004CF5F0
004972BC             .  8BC8              MOV ECX,EAX                                ;  kernel32.BaseThreadInitThunk
004972BE             .  E8 5D820300       CALL Theduel_.004CF520
004972C3             .  5E                POP ESI                                    ;  kernel32.778E4911
004972C4             .  B0 01             MOV AL,1
004972C6             .  5B                POP EBX                                    ;  kernel32.778E4911
004972C7             .  C2 0400           RETN 4
004972CA             .  53                PUSH EBX
004972CB             .  E8 20830300       CALL Theduel_.004CF5F0
004972D0             .  8BC8              MOV ECX,EAX                                ;  kernel32.BaseThreadInitThunk
004972D2             .  E8 69820300       CALL Theduel_.004CF540
004972D7             .  5E                POP ESI                                    ;  kernel32.778E4911
004972D8             .  5B                POP EBX                                    ;  kernel32.778E4911
004972D9             .  C2 0400           RETN 4
004972DC             .  83F8 5B           CMP EAX,5B
004972DF             .^ 74 BD             JE SHORT Theduel_.0049729E
004972E1             .  3D 11270000       CMP EAX,2711
004972E6             .  74 0D             JE SHORT Theduel_.004972F5
004972E8             .  68 3C265F00       PUSH Theduel_.005F263C                     ;  ASCII "Invalid Locale \n"
004972ED             .  E8 6EA20900       CALL Theduel_.00531560
004972F2             .  83C4 04           ADD ESP,4
004972F5             >  5E                POP ESI                                    ;  kernel32.778E4911
004972F6             .  32C0              XOR AL,AL
004972F8             .  5B                POP EBX                                    ;  kernel32.778E4911
004972F9             .  C2 0400           RETN 4
004972FC             .  3D FEFF0000       CMP EAX,0FFFE
00497301             .  75 27             JNZ SHORT Theduel_.0049732A
00497303             .  BB 01000000       MOV EBX,1
00497308             .  C746 10 03000000  MOV DWORD PTR DS:[ESI+10],3
0049730F             .  889E 34110000     MOV BYTE PTR DS:[ESI+1134],BL
00497315             >  6A 00             PUSH 0
00497317             .  E8 D4820300       CALL Theduel_.004CF5F0
0049731C             .  8BC8              MOV ECX,EAX                                ;  kernel32.BaseThreadInitThunk
0049731E             .  E8 FD810300       CALL Theduel_.004CF520
00497323             .  5E                POP ESI                                    ;  kernel32.778E4911
00497324             .  8AC3              MOV AL,BL
00497326             .  5B                POP EBX                                    ;  kernel32.778E4911
00497327             .  C2 0400           RETN 4
0049732A             >  3D FDFF0000       CMP EAX,0FFFD
0049732F             .^ 75 C4             JNZ SHORT Theduel_.004972F5
00497331             .  BB 01000000       MOV EBX,1
00497336             .  6A 00             PUSH 0
00497338             .  C746 10 03000000  MOV DWORD PTR DS:[ESI+10],3
0049733F             .  889E 34110000     MOV BYTE PTR DS:[ESI+1134],BL
00497345             .  E8 A6820300       CALL Theduel_.004CF5F0
0049734A             .  8BC8              MOV ECX,EAX                                ;  kernel32.BaseThreadInitThunk
0049734C             .  E8 CF810300       CALL Theduel_.004CF520
00497351             .  889E 35110000     MOV BYTE PTR DS:[ESI+1135],BL
00497357             .  5E                POP ESI                                    ;  kernel32.778E4911
00497358             .  8AC3              MOV AL,BL
0049735A             .  5B                POP EBX                                    ;  kernel32.778E4911
0049735B             .  C2 0400           RETN 4
0049735E                CC                INT3
0049735F                CC                INT3
00497360            /$  56                PUSH ESI
00497361            |.  8BF1              MOV ESI,ECX
00497363            |.  57                PUSH EDI
00497364            |.  8D8E 38110000     LEA ECX,DWORD PTR DS:[ESI+1138]
0049736A            |.  E8 01AD0100       CALL Theduel_.004B2070
0049736F            |.  B9 AC006700       MOV ECX,Theduel_.006700AC
00497374            |.  E8 379FF9FF       CALL Theduel_.004312B0
00497379            |.  E8 C2270800       CALL Theduel_.00519B40
0049737E            |.  8BC8              MOV ECX,EAX                                ;  kernel32.BaseThreadInitThunk
00497380            |.  E8 AB210800       CALL Theduel_.00519530
00497385            |.  B9 78FD6600       MOV ECX,Theduel_.0066FD78
0049738A            |.  E8 F1AEFFFF       CALL Theduel_.00492280
0049738F            |.  E8 0C94F9FF       CALL Theduel_.004307A0
00497394            |.  68 AC265F00       PUSH Theduel_.005F26AC                     ;  ASCII "Destroy console.\n"
00497399            |.  E8 C2A10900       CALL Theduel_.00531560
0049739E            |.  8B0D 4CFB6600     MOV ECX,DWORD PTR DS:[66FB4C]
004973A4            |.  33FF              XOR EDI,EDI
004973A6            |.  83C4 04           ADD ESP,4
004973A9            |.  3BCF              CMP ECX,EDI
004973AB            |.  74 0D             JE SHORT Theduel_.004973BA
004973AD            |.  8B01              MOV EAX,DWORD PTR DS:[ECX]
004973AF            |.  6A 01             PUSH 1
004973B1            |.  FF50 30           CALL DWORD PTR DS:[EAX+30]                 ;  Theduel_.005CFC45
004973B4            |.  893D 4CFB6600     MOV DWORD PTR DS:[66FB4C],EDI
004973BA            |>  8B0E              MOV ECX,DWORD PTR DS:[ESI]
004973BC            |.  3BCF              CMP ECX,EDI
004973BE            |.  74 09             JE SHORT Theduel_.004973C9
004973C0            |.  8B11              MOV EDX,DWORD PTR DS:[ECX]
004973C2            |.  6A 01             PUSH 1
004973C4            |.  FF52 30           CALL DWORD PTR DS:[EDX+30]
004973C7            |.  893E              MOV DWORD PTR DS:[ESI],EDI
004973C9            |>  8B4E 08           MOV ECX,DWORD PTR DS:[ESI+8]
004973CC            |.  3BCF              CMP ECX,EDI
004973CE            |.  74 09             JE SHORT Theduel_.004973D9
004973D0            |.  8B01              MOV EAX,DWORD PTR DS:[ECX]
004973D2            |.  6A 01             PUSH 1
004973D4            |.  FF10              CALL DWORD PTR DS:[EAX]
004973D6            |.  897E 08           MOV DWORD PTR DS:[ESI+8],EDI
004973D9            |>  8B4E 0C           MOV ECX,DWORD PTR DS:[ESI+C]
004973DC            |.  3BCF              CMP ECX,EDI
004973DE            |.  74 09             JE SHORT Theduel_.004973E9
004973E0            |.  8B11              MOV EDX,DWORD PTR DS:[ECX]
004973E2            |.  6A 01             PUSH 1
004973E4            |.  FF12              CALL DWORD PTR DS:[EDX]
004973E6            |.  897E 0C           MOV DWORD PTR DS:[ESI+C],EDI
004973E9            |>  B9 08006700       MOV ECX,Theduel_.00670008
004973EE            |.  E8 3DF10300       CALL Theduel_.004D6530
004973F3            |.  B9 30006700       MOV ECX,Theduel_.00670030
004973F8            |.  E8 33F10300       CALL Theduel_.004D6530
004973FD            |.  68 94265F00       PUSH Theduel_.005F2694                     ;  ASCII "Destroy mesh manager.\n"
00497402            |.  E8 59A10900       CALL Theduel_.00531560
00497407            |.  83C4 04           ADD ESP,4
0049740A            |.  B9 58006700       MOV ECX,Theduel_.00670058
0049740F            |.  E8 1CF10300       CALL Theduel_.004D6530
00497414            |.  68 74265F00       PUSH Theduel_.005F2674                     ;  ASCII "Destroy weapon mesh manager.\n"
00497419            |.  E8 42A10900       CALL Theduel_.00531560
0049741E            |.  8B86 18110000     MOV EAX,DWORD PTR DS:[ESI+1118]
00497424            |.  83C4 04           ADD ESP,4
00497427            |.  3BC7              CMP EAX,EDI
00497429            |.  74 0D             JE SHORT Theduel_.00497438
0049742B            |.  50                PUSH EAX                                   ;  kernel32.BaseThreadInitThunk
0049742C            |.  FF15 60655E00     CALL DWORD PTR DS:[<&WINMM.timeEndPeriod>] ;  WINMM.timeEndPeriod
00497432            |.  89BE 18110000     MOV DWORD PTR DS:[ESI+1118],EDI
00497438            |>  E8 D34B0400       CALL Theduel_.004DC010
0049743D            |.  8BC8              MOV ECX,EAX                                ;  kernel32.BaseThreadInitThunk
0049743F            |.  E8 2CBB0500       CALL Theduel_.004F2F70
00497444            |.  68 54265F00       PUSH Theduel_.005F2654                     ;  ASCII "destroy game application done.\n"
00497449            |.  E8 12A10900       CALL Theduel_.00531560
0049744E            |.  83C4 04           ADD ESP,4
00497451            |.  5F                POP EDI                                    ;  kernel32.778E4911
00497452            |.  5E                POP ESI                                    ;  kernel32.778E4911
00497453            \.  C3                RETN

You should try NOP-PING the JNZ or simply doing the MOV EAX.

Basically i know to enable serial key you go to 004972A7
and change MOV EAX,0FFFF to CMP EAX,0FFF
but here's the problem i open my runnable and it's already CMP EAX,0FFF , but i cant still start it by clicking on it, i changed the value to MOV then CMP again but still didnt work , any ideas whats wrong?

That might be caused because the serialkey is still on your clipboard. Reboot your computer.

[ThievingSix]

He's probably using OllyDBG V1.



You should try NOP-PING the JNZ or simply doing the MOV EAX.



That might be caused because the serialkey is still on your clipboard. Reboot your computer.

First, look at where the JNZ jumps to? The very next line. How does using Ollydbg v1.1 affect anything?

[Mark]

No, change the JNZ back to what T6 said. At the moment it just goes to the next line either way.

[PaulBub]

NOPing the jump would have no effect, and T6 gave the solution, jump to the bad boy :)

[Mark]

004972AC . 75 00 JNZ SHORT Theduel_.004972AE

That should be

JNZ 004972CA.

As T6 said.

[Trilest]

004972AC . 75 00 JNZ SHORT Theduel_.004972AE

That should be

JNZ 004972CA.

As T6 said.

I changed it but I still can run it without launcher ..

[ResStlesS]

This is not the solution. Trilest tried it..

[Linear88]

This is not the solution. Trilest tried it..

And yours is?

You just bumped an old topic..