三角洲部隊之大地勇士光碟版的破解
前幾天到電腦市場買了這個遊戲，沒光碟也能玩，不過只能玩Multiplayer的join模式，不插光碟毫無提示，破解頗費了一番周折，首先檢視了安裝目錄下的檔案，發現DFLW.CD裡面有光碟機的磁碟機代號G：，先下斷BPX
GETDRIVETYPE，執行遊戲......，怎麼？沒攔住？用W32DASM反彙編DFLW.EXE,發現並沒加殼，檢視輸入的函式，KERNEL32裡沒有此函式，難怪沒攔住。但看到GETVOLUMEINFORMATIONA,雙擊它，來到：
* Reference To: KERNEL32.GetVolumeInformationA, Ord:01DEh ----------------讀取卷資訊
|
:0042E7E9 FF1544524E00 Call dword ptr
[004E5244]
:0042E7EF 6A0B
push 0000000B
:0042E7F1 8D8424B4000000 lea eax, dword ptr
[esp+000000B4]
* Possible StringData Ref from Data Obj ->"DELTAFORCELW" -----------------這不是光碟的卷名嗎？有戲！
|
:0042E7F8 682C834E00 push 004E832C
:0042E7FD 50
push eax
:0042E7FE E89DA60800 call 004B8EA0
:0042E803 83C40C
add esp, 0000000C
:0042E806 85C0
test eax, eax
:0042E808 7549
jne 0042E853
:0042E80A 53
push ebx
* Possible StringData Ref from Data Obj ->"CDFS"
------------------- 光碟的標誌
|
:0042E80B BE24834E00 mov esi,
004E8324
:0042E810 8D8424B4010000 lea eax, dword ptr
[esp+000001B4]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E839(C)
|
:0042E817 8A10
mov dl, byte ptr [eax]
:0042E819 8A1E
mov bl, byte ptr [esi]
:0042E81B 8ACA
mov cl, dl
:0042E81D 3AD3
cmp dl, bl
:0042E81F 751E
jne 0042E83F
:0042E821 84C9
test cl, cl
:0042E823 7416
je 0042E83B
:0042E825 8A5001
mov dl, byte ptr [eax+01]
:0042E828 8A5E01
mov bl, byte ptr [esi+01]
:0042E82B 8ACA
mov cl, dl
:0042E82D 3AD3
cmp dl, bl
:0042E82F 750E
jne 0042E83F
:0042E831 83C002
add eax, 00000002
:0042E834 83C602
add esi, 00000002
:0042E837 84C9
test cl, cl
:0042E839 75DC
jne 0042E817
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E823(C)
|
:0042E83B 33C0
xor eax, eax
:0042E83D EB05
jmp 0042E844
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042E81F(C), :0042E82F(C)
|
:0042E83F 1BC0
sbb eax, eax
:0042E841 83D8FF
sbb eax, FFFFFFFF
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042E83D(U)
|
:0042E844 85C0
test eax, eax
:0042E846 5B
pop ebx
:0042E847 750A
jne 0042E853
:0042E849 C705CCD9CD0000000000 mov dword ptr [00CDD9CC], 00000000
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0042E775(C), :0042E808(C), :0042E847(C)
|
:0042E853 5E
pop esi
:0042E854 81C4AC020000 add esp, 000002AC
:0042E85A C3
ret
試著將上述的幾個跳轉改一下，均未成功，苦思冥想時，覺得:0042E849 mov dword ptr [00CDD9CC], 00000000有點問題，試著改為mov
dword ptr [00CDD9CC], 00000001，再執行遊戲，哇！成功了。原來光碟檢測函式的返回值是個全域性變數，在DS:00CDD9CC處，當它為0時表示無光碟，為1時表示有光碟。
用HIEW32t開啟DFLW.EXE找到：
C705CCD9CD0000000000
改為：
C705CCD9CD0001000000
搞定！
大波羅
2001.8.24
轉載請保持完整，謝謝