CDROM check protection





I'm writing you this tutorial, to share my first cracking experience with you,

to reveal the cracking from the perspective of a newbye.

This tut deals with cracking a "CDROM check" type protection, in wich the

program searches for a particular data on the original CD. This type of

protection you'll encounter in many today's games which are distributed on CD.



After you complete this tutorial you'll know how to:



-deal with a DOS4GW program

-tackle a CD check type protection



You probably won't know how to crack any CD check protection, but, at least,

you'll know how to start with it.



To better follow this tut you'll need:



- the game "Silent Hunter", a wonderful WW II submarine simulator, a must

  have for the strategy freaks. I worked on a Razor distribution, and I think

  you'll find it on the web. It's a CD ripped version, and it's just what we

  need, with animation files removed.



- a patch for Silent Hunter, from version 1.0 to version 1.11. You can download

  it from SSI web site. This version is protected, so it won't work. It must be

  cracked.



- some tools. I recommend: SoftIce for Win95 (DOS version is useless with all

  new programs), KGB ( the best spy I found, and it's with source code so you

  can modify it), DOS Navigator (for editing large files, and for many more...)

  and much patience :-)



Now let's get to work. I'll describe my approach. I'm quite lazy so I always

try to find the easiest way in doing something. This is how we'll do it:



1. When you run the program it asks you to put the original CD in drive. What do

   you do now? Well, I don't know, but my first try is to run a fakeCD utility

   (a little TSR wich emulates a CDROM drive on your hard disk)

   Doesn't work.



2. What next? I'll install KGB.exe and run the game again. This TSR will log some

   DOS INT 21h file access functions to a file. Now sit down and study the log.

   Here is an extras from the log file:



        OpenFile-R  : ART\GUI_1.FNT

        OpenFile-R  : ART\FONT1.FNT

        OpenFile-R  : ART\FONT1.FNT

        OpenFile-R  : BUD\10.SMK

        OpenFile-R  : BUD\10.SMK

        OpenFile-R  : BUD\10.SMK



   As you can see the program tries to open BUD\10.smk and, since it can't find

   it, assumes it doesn't have the right CD in drive. This is an animation file

   quite big, probably, to be sure it is left apart when the program is ripped

   from CD.



3. As I told you, I want to do it the easy (but the right) way. I don't want

   to step through code. At least not until I use all other means.

   So I make a file 10.smk, and put some crap in it. Run again the program.

   Doesn't work again! How stupid I can be!



4. Well, maybe it needs a valid smk file. OK. Let's give it one. I take a smk

   file from another game (smk files are quite standard for animation in games),

   and rename  it 10.smk. Run SH again. No change. Still asks for CD.



5. Now, I think it's time to do it the hard way.It's time for little assembler

   and crackin'.

   I modify KGB to log all DOS functions (not only Open, Close,  Execute File)

   and dump registers for each function (how cool was the guy who wrote

   the program, cause he gave the source code too).

   Launch (Yamato)KGB then run SH.EXE. Then you'll have a trace of all DOS

   functions called by program.



6. Now it's time to remember abou