The Secret of the Lost Cavern - Completely new copy-protection

[Hexana]

The new adventure game
ECHO - The Secret of the Lost cavern
seems to have a completely new copy protection, no backup is possible.
The protection seems to have a lot of similarities to starforce 3, but it isn't starforce.
The newest versions of Aray and Protection ID don't detect anything.

Does anybody know more about this?

[Tony22]

probably new Tages version.

[eye2eye]

yes new version of TAGES.
The deviance files are a big load of **** (as often!!), just demo files. You
can play 'till 2. cavern then it jumps to intro back...

Searched all the web:
french tit: Au coeur de lascaux
germ tit: Geheimniss der vergessenen Höhle

no working fixe so far, always demo stuff
if you want to go over 2. cavern, patch this:
...
0041F2E9 1BC0 sbb eax, eax
0041F2EB 83D8FF sbb eax, FFFFFFFF
0041F2EE 85C0 test eax, eax
0041F2F0 7519 jne 0041F30B <<<<<<<<<<< 90 90
0041F2F2 8B54241C mov edx, dword ptr [esp+1C]
...
But interface does not work correctly, whenever you have to use
object A with object B it does not work (light torche with torche,
play musical stones with hammer etc.).
Patch LUA-script and you can come across this ****.

[DABhand]

Change the 75 to EB

[GLH]

Originally Posted by DABhand

Change the 75 to EB

cyrillic?

[ByteMare]

Don't nope , just jump....

[floydz]

Originally Posted by eye2eye

...
0041F2E9 1BC0 sbb eax, eax
0041F2EB 83D8FF sbb eax, FFFFFFFF
0041F2EE 85C0 test eax, eax
0041F2F0 7519 jne 0041F30B <<<<<<<<<<< 90 90
0041F2F2 8B54241C mov edx, dword ptr [esp+1C]
...

but this works?
if works, how i can use this?

ty

[leezer3]

What he's saying, is to open up the game exe in a hex editor, and go to address 0041F2F0 . There change the 75 to a EB, which I think means to skip that instruction, and disable copy protection. (It's a long time scince I played in hex editors :P)

-Leezer-

[Joe Forster/STA]

By the way, the first patch (change 75-19 to 90-90) always SKIPS the jump, while the second patch (change 75-19 to EB-19) always TAKES the jump. One of them may work, but not both.

[eye2eye]

sorry guys, thought this was an expert forum, forgot that there are newbies.

Just to remember the problem: SOLC.EXE from deviance does not work, my hint was to pass the 2. cave where it normally jumps back to intro. The fixe
certainly removes the jump i.e. JUMP NEVER.
90 90 means NOP NOP so the jump is never performed.
...
0041F2F0 7519 jne 0041F30B
0041F2F2 8B54241C mov edx, dword ptr [esp+1C]
0041F2F6 8B442418 mov eax, dword ptr [esp+18]
0041F2FA 52 push edx
0041F2FB 50 push eax
0041F2FC 55 push ebp
0041F2FD 8BCF mov ecx, edi
0041F2FF E81CB80F00 call 0051AB20
0041F304 5F pop edi
0041F305 5E pop esi
0041F306 5D pop ebp
0041F307 5B pop ebx
0041F308 C20C00 ret 000C
; code to play Intro again, what we don't want!!!!
0041F30B E890E30900 call 004BD6A0
0041F310 68A8869400 push 009486A8
0041F315 E846950900 call 004B8860
0041F31A 68B4259B00 push 009B25B4
0041F31F 68A0869400 push 009486A0
0041F324 68B8869400 push 009486B8
0041F329 689C869400 push 0094869C
0041F32E E8FD950900 call 004B8930
0041F333 83C414 add esp, 00000014
0041F336 5F pop edi
0041F337 5E pop esi
0041F338 5D pop ebp
0041F339 5B pop ebx
0041F33A C20C00 ret 000C
...
as you see at 0041f30b there is the code to play intro,
which we don't want, so the cond. jump must be removed,
which is done bei 90 90
Forget the nonsens with EB 19
Next, 0041f2f0 is not a file offset but RVA, which means a memory
address, the file offset to modify in a hex-editor is 00124656 .

Ok, this is NO crack - it is just a mod to get out of cavern 2 (after
making fire) and you can play a little bit more. Crack TAGES is far
more complex, nothin' for common people out there or this forum...

It is no patch to play the game to the end, for this you must patch
the script-file, but this is a little bit more complex to tell here.
I posted the savegames to gcw, maybe this helps some of you.

[DABhand]

WTF

JNE = Jump Never????


JNE actually is Jump Not Equal

Bloody hell

[eye2eye]

when a command (here a conditional jump) is removed by the two
assembly commands NOP and NOP (coded bei 90 90) the jump (or
whatever f.u.c.k.i.n.g. command) is eliminated and therefore can
never be performed. It is gone, killed, blown to eternity - got it??

If you ever looked to the code you come to know that we are
here at a script-interpreter, when the command
"CS" is found then the next step within the game is done,
i.e. change position of game character. In cavern2 we have
not the command CS (guess it means "continue script") but
there is the control-word "montagne" (which stands for next/
2. Level) and therefore it jumps to the intro.
This is normally in the demo-version the sign to end up (because
there is no 2. level!!) and go to the beginning, because demo has
ended here. But we have the full version from deviance with
f.u.c.k.i.n.g. demo-EXE, so we must pass this sign
- that's done here.
No more comment on this, I'm not your nanny...
Just do it and you will see that it works!

[DABhand]

1. Nice to see you admitted your a warez user. Full version of deviance release.

2. Your talking to me as if I dont know ASM, check the coders section before you get banned, look for all posts from begining notice something? Thats right I was teaching people some ASM and how to code inject.

3. I do trainers, maybe you havent seen my work.

4. Learn to know what your talking about. Dont make me write out an explaination on how Flags work for jumps. As ive already did so in the coding section for day 3 of the tut.

[Joe Forster/STA]

eye2eye, please, don't mind newbies and DABhand's bitching, keep posting interesting articles like this for the technically minded forum members!

[DABhand]

Joe shhhhhhh, dont put me in the same category of newbies. As ive said before, you have knowledge, but I dont mean to come out and say this, your not on the same level as me. Again your post could be intepreted as a flame towards me and as you know against forum rules.

Anyways he wont be here much longer after admiting to using a deviance rls of the game.