you need to look deeper
Code:
.0060F870: 73 63 72 69-70 74 5F 6D-6F 64 75 6C-65 5F 70 61 script_module_pa
.0060F880: 74 68 00 00-6D 6F 76 69-65 5F 70 61-74 68 00 00 th movie_path
.0060F890: 6C 61 6E 67-75 61 67 65-00 00 00 00-65 6E 67 6C language engl
.0060F8A0: 69 73 68 00-6E 6F 5F 63-64 5F 25 73-5F 25 73 00 ish no_cd_%s_%s
.0060F8B0: 4E 4F 20 43-44 00 00 00-74 69 74 6C-65 00 00 00 NO CD title
.0060F8C0: 6D 73 67 00-20 2E 00 00-63 64 5F 70-61 74 68 00 msg . cd_path
.0060F8D0: 74 68 69 65-66 5C 73 6E-64 2E 63 72-66 00 00 00 thief\snd.crf
.0060F8E0: 72 62 00 00-72 62 00 00-63 64 5F 70-61 74 68 00 rb rb cd_path
.0060F8F0: 44 3A 5C 00-00 00 00 00-63 64 5F 70-61 74 68 00 D:\ cd_path
.0060F900: 44 3A 5C 00-00 00 00 00-74 65 73 74-5F 63 6F 70 D:\ test_cop
.0060F910: 79 5F 70 72-6F 74 65 63-74 00 00 00-6F 6E 6C 79 y_protect only
.0060F920: 5F 63 68 65-63 6B 5F 70-61 74 68 00-00 00 00 00 _check_path
now x-reference the test_copy_protect_line
to do this, there's probably a thief.cfg file, or maybe thief.ini, i think its cfg though, inside that there should be a line as
'cd_path'
which probably needs to be changed to .\
and some files copied from the cd/dvd to the installation folder (most likely the movies folder)
the AL register in ollydbg is in the EAX register
EAX = 32 bit
AX = 16 bit
AH = 8 bit high
AL = 8 bit low
think you need to read up on your asm a little more..
and changing jumps is usually a bad idea, target the procedure, NOT the conditionals, because the procedures influence the conditional
Code:
.0050E8F0: 8B442404 mov eax,[esp][4]
.0050E8F4: 50 push eax
.0050E8F5: FF1528615B00 call GetDriveTypeA
.0050E8FB: 33C9 xor ecx,ecx
.0050E8FD: 83F805 cmp eax,5
.0050E900: 0F94C1 setz cl
.0050E903: 8BC1 mov eax,ecx
.0050E905: C3 retn ; -^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-
is the function to determine if the drive is a cd drive, if it is it returns TRUE (1), otherwise it returns FALSE (0)
if you look above that you'll see it looking for snd.crf, and accessing the 'cd_path' variable..
x-ref that function and you'll find..
Code:
.0050E910: 8B442404 mov eax,[esp][4]
.0050E914: 53 push ebx
.0050E915: 85C0 test eax,eax
.0050E917: B341 mov bl,041 ;'A'
.0050E919: 7444 jz .00050E95F --↓1
.0050E91B: 8B4C240C mov ecx,[esp][00C]
.0050E91F: 85C9 test ecx,ecx
.0050E921: 7410 jz .00050E933 --↓2
.0050E923: 0FBE00 movsx eax,b,[eax]
.0050E926: 50 push eax
.0050E927: E894070900 call .00059F0C0 --↓3
.0050E92C: 8BD8 mov ebx,eax
.0050E92E: 83C404 add esp,4
.0050E931: FEC3 inc bl
.0050E933: 80FB5A cmp bl,05A ;'Z'
.0050E936: 7F27 jg .00050E95F --↓1
.0050E938: 6830F86000 push 00060F830 ;'D:\' --↓4
.0050E93D: 881D30F86000 mov [00060F830],bl ;'D:\' --↓4
.0050E943: E8A8FFFFFF call .00050E8F0 --↑5
.0050E948: 83C404 add esp,4
.0050E94B: 85C0 test eax,eax
.0050E94D: 7509 jnz .00050E958 --↓6
.0050E94F: FEC3 inc bl
.0050E951: 80FB5A cmp bl,05A ;'Z'
.0050E954: 7EE2 jle .00050E938 --↑7
.0050E956: 5B pop ebx
.0050E957: C3 retn ; -^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-
.0050E958: B830F86000 mov eax,00060F830 ;'D:\' --↓4
.0050E95D: 5B pop ebx
.0050E95E: C3 retn ; -^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-
.0050E95F: 33C0 xor eax,eax
.0050E961: 5B pop ebx
.0050E962: C3 retn ; -^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-
which is the routine that validates if the drive letter is a cd/dvd drive..
x-ref that and it'll take you to..
Code:
.0050E970: 81EC04010000 sub esp,000000104
x-ref that and it takes you to..
Code:
.0050EB90: C705AC8E670000000000 mov d,[000678EAC],0
.0050EB9A: E8D1FDFFFF call .00050E970 --↑7
.0050EB9F: 85C0 test eax,eax
.0050EBA1: 7517 jnz .00050EBBA --↓8
.0050EBA3: 6A01 push 1
.0050EBA5: E806FCFFFF call .00050E7B0 --↑9
.0050EBAA: 83C404 add esp,4
.0050EBAD: 85C0 test eax,eax
.0050EBAF: 742A jz .00050EBDB --↓A
.0050EBB1: E8BAFDFFFF call .00050E970 --↑7
.0050EBB6: 85C0 test eax,eax
.0050EBB8: 74E9 jz .00050EBA3 --↑B
.0050EBBA: A1AC8E6700 mov eax,[000678EAC]
.0050EBBF: 85C0 test eax,eax
.0050EBC1: 740E jz .00050EBD1 --↓C
.0050EBC3: 50 push eax
.0050EBC4: E897FEFFFF call .00050EA60 --↑D
.0050EBC9: A1AC8E6700 mov eax,[000678EAC]
.0050EBCE: 83C404 add esp,4
.0050EBD1: 33C9 xor ecx,ecx
.0050EBD3: 85C0 test eax,eax
.0050EBD5: 0F95C1 setnz cl
.0050EBD8: 8BC1 mov eax,ecx
.0050EBDA: C3 retn ; -^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-
.0050EBDB: 33C0 xor eax,eax
.0050EBDD: C3 retn ; -^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-
x-ref that and it takes you to..
Code:
.0050EC90: 6A00 push 0
.0050EC92: 6A00 push 0
.0050EC94: 6808F96000 push 00060F908 ;'test_copy_protect' --↓2
.0050EC99: E842B70300 call .00054A3E0 --↓3
.0050EC9E: 83C40C add esp,00C
.0050ECA1: 84C0 test al,al
.0050ECA3: 7507 jnz .00050ECAC --↓4
.0050ECA5: B801000000 mov eax,1
.0050ECAA: EB21 jmps .00050ECCD --↓5
.0050ECAC: 6A00 push 0
.0050ECAE: 6A00 push 0
.0050ECB0: 681CF96000 push 00060F91C ;'only_check_path' --↓6
.0050ECB5: E826B70300 call .00054A3E0 --↓3
.0050ECBA: 83C40C add esp,00C
.0050ECBD: 84C0 test al,al
.0050ECBF: 7507 jnz .00050ECC8 --↓7
.0050ECC1: E8CAFEFFFF call .00050EB90 --↑8
.0050ECC6: EB05 jmps .00050ECCD --↓5
.0050ECC8: E813FFFFFF call .00050EBE0 --↑9
.0050ECCD: 85C0 test eax,eax
.0050ECCF: 7405 jz .00050ECD6 --↓A
.0050ECD1: E96AFBFFFF jmp .00050E840 --↑B
.0050ECD6: 33C0 xor eax,eax
.0050ECD8: C3 retn ; -^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-
now perhaps you see how i saw the configuration names.. which are most likely in the cfg file (or ini)...
and how if the value is 0 (i think), it'll set eax to TRUE (1) and return...
skipping the checks..
so there may be no patching required, just a simple editing of a cfg file, copying files from the cd/dvd drive to the install folder.. job done...
or do you have better ideas cowsheep?, also, without all the files the exe crashes, so debugging it without the complete files, its a bit tricky