Cracking Unreal 2.02 CD-Check

	by Xcellent for TrickSoft - "Software made free by us"

Welcome to my tutor!! I hope you enjoyed the last tutor, and this
time our victim is the Unreal 2.02. Nice game, bad protection, I mean
GOOD TO CRACK!!

Tools needed:
W32Dasm 8.93 (www.crackstore.com)
Any hexadecimal editor (www.crackstore.com have many!)

Before we start to crack, we need to know what does happen when the
game is played without the CD, so run Unreal 2.02 and...shit!.."Please insert
the Unreal CD-Rom and press OK to continue, or Cancel to exit." Now run
W32Dasm and open unreal.exe, click in String Data References and search
for the message...You didn't find? Ok, this time I will tell you the truth,
the cd-check routine ISN'T in unreal.exe, it is in window.dll!! So, open
window.dll and search for the message and double click on it. Now you will
see:
* Reference To: Core.?appFSize@@YAHPBD@Z, Ord:0311h
                                  |
:10B1C4AA FF15E4B6B310            Call dword ptr [10B3B6E4]
:10B1C4B0 83C404                  add esp, 00000004
:10B1C4B3 85C0                    test eax, eax <-- compare result from cd-check routine
:10B1C4B5 7F31                    jg 10B1C4E8   <-- if good then run
:10B1C4B7 6801200000              push 00002001 <-- else...

* Possible StringData Ref from Data Obj ->"Cd Required At Startup"
                                  |
:10B1C4BC 68089DB310              push 10B39D08

* Possible StringData Ref from Data Obj ->"Please insert the Unreal CD-Rom "
                                        ->"into your drive and press OK to "
                                        ->"continue, or Cancel to exit."
                                  |
:10B1C4C1 68989CB310              push 10B39C98
...
The only thing needed to do is change the jg to jmp. We need to know
the offset to change the bytes in the file, so, move the bar till the address :10B1C4B5,
the bar will turn green, look at the bottom of the screen and you will see @Offset:0001B8B5h.
Now we know that the offset is 1B8B5. Start your hexadecimal editor and search for the
offset 1B8B5 and then change 7F to EB and save. Run without cd and....Cool!! it's cracked!!
This game it's very easy to crack, but the only thing that took me some time is
that the cd-check routine wasn't in the unreal.exe, but it was in window.dll.

I hope you enjoyed...

Xcellent - The Brazillian crack3r
xcellent@bol.com.br
www.tricksoft.net