Jump to content

A Simple NO-CD Cracking Tutorial [Learning Purposes]


Recommended Posts

Use this tute only for cracking the EXEs of the CDs that you own...

This tutorial is for Educational purpose only.


Author: Creativity

Target Program: Ballance (But the splash page displays v1.13)

Application type: Microsoft Visual C++ application (Use PEiD to find it out)


Tools required:

W32Dasm 8.93 or above.

Olly Debugger 1.10 (Debugging + Patching the game)

PEiD / ClonyXXL / ProtectionID


How to crack:

This is my first cracking tutorial... so please report me or forgive me for my mistakes that I made, I'm a newbie in cracking...



Step 01: Insert the disc into the drive then click Scan in clony XXL.

Oh great the game doesnot contain any CD protection.



Step 01: Click on "..." and open the target "Player.exe" in the bin folder in the game's installation directory.

Step 02: Oh cool the game doesn't contain any protection like Securom, safeDisc etc and it is not protected with any Exe protectors. We are lucky... and our cracking burden is reduced.



Step 01: Start the game without the CD... oh no... a window with title "Attention" and It says "Place the CD-ROM into the Drive and Start the Game again"

Step 02: Load up W32Dasm and disassemble the file "Player.exe" in the Bin folder...

Step 03: Since the error message "Place the CD-ROM into the drive and start the game again" loads up in the runtime, so it is not possible to search with the string.

Step 04: In W32Dasm click on "String Data references" button in the toolbar. Search for "Attention" thats the title of error message window.An alternate method is by using the menu "Search->Find Text" then type your text,"Attention" in the text box. Click on "Find next".

Step 05: It will take us to the line that displays the following


* Possible StringData Ref from Data Obj ->"Attention"


Step 06: Scroll a little below and you can find these lines.


* Referenced by a (U)nconditional or ©onditional Jump at Address:



It says that the jump to this error message is from the address 0040121B and it also indicates what type of jump it is.

©-Conditional Jump (JNE's and JE's) and

(U)-Unconditional Jump (JMP)


So our jump is a conditional jump... (ie) it is checked for specific condition and then jumped.okay now that we've got the address where the game checks,Note it down in a piece of paper... Next is to Patch it out... close W32Dasm.


Note: There are two dialog with title "Attention", If you are not sure of which one is the dialog that points to CD-Check then run the target in a debugger to find out the correct Error string.



i've added a screen shot of Olly and with the three important windows marked...




My interface and yours might differ because I've added new plugins and changed the color of the interface.


Step 01: Open the target file "Player.exe" in OllyDebugger

Step 02: Ollydebugger has many windows, we have to open the CPU window to debug the process. Click on the "C" icon in the toolbar... It will display the decompiled code. Maximize the window.

Step 03: Now Right click in the window and Select "Goto->Expression" and enter the address that you noted in W32Dasm... In this case it is 0040121B and then Click "OK"

Step 04: Ok now we have successfully landed in our checking area 0040121B. We need to bypass the check so that we can run the game without the CD and with the CD. This is really important, because the game must be able to run with a CD and without a CD, in that way we must crack it.


Original code:

00401219 . 84C0 TEST AL,AL

0040121B 75 46 JNZ SHORT Player.00401263


What does this code do ?

To know what it does follow the steps, Select the line 00401219 and then right click Select "Breakpoint->Run to selection" Now look at the information window, the sliced one that is just below the code window slice. We'll find that registerAL=00 if the CD is not inserted and AL=01 when the CD is inserted. so the next line is JNZ(Jump if Not Zero) if the AL value is 0 it will not jump, So it'll jump only when the CD is inserted (ie.)when AL becomes 01, so this is a conditional Jump. We have to change it to unconditional jump, It must jump always. So we have to modify it. So follow the steps below.


Step 05: Double Click on the line 0040121B or Click on the line and press Spacebar a window with title "Assemble at 0040121B" will pop up, now change "JNZ SHORT 00401263-->JMP SHORT 00401263", I've only changed the first three characters in the line.

Step 06: So we have patched the game in the memory, to patch the executable, Right click in the code window and select "Copy to executable-> All modifications" and click "Copy All", Now a dump window(D in the title) will popup displaying all the modifications that we made. Now Right click in the Dump window and select "Save file" then save the file with some other name, example Player_cracked.exe...


Patched code:

00401219 . 84C0 TEST AL,AL

0040121B EB 46 JMP SHORT Player.00401263


Final Notes:

So we've successfully cracked the game Ballance (V1.13 according to the splash page), Now the game will run when the CD is inserted and also when the CD is not in the drive. There are manys ways to crack this... one method is this one. Every program has its own weakness. Finding the weakness is the solution.



To all NO-CD crackers in the world.



Link to comment
Share on other sites

This topic is now closed to further replies.

  • Posts

    • Promotional banners:  
    • We have added few new features for Second Edition of L2Etina. Check them out:   While streaming L2Etina, you will now receive L2Coins automatically.   Dwarves who have set private workshop, now automatically sell Crystallization to nearby players. For this service, they receive 10% of created crystals.   Before closing game, you will now see amount of earned experience, adena, total play time and acquired items.   You can now check Ranking of current and previous edition. This window can be found in Main Menu.   Party Window now have a special spot, showing if member has Noble Blessing.   Players from South America will be able to connect to the server by proxy.   Players who have supported first edition by donation, will now 2 weeks of free premium.   We have rewritten description of every buff, so they are now clear and handy. Vote rewards will be different for new edition, but exact items are not decided yet.   When spoil is successfull, you will now see special popup window. When you target monster who has been spoiled, you will see Spoil as a debuff.   Buff Store now have possibility to refuse to buff someone. Retail version of party matching was added back. Offline private stores now automatically disappear after 5 days. There are plenty more improvements and fixes, like ability to disable skill bar, multiple fixes to epic bosses, adjustments to aggro.
    • First of all thank you for fast answer. I have changed internal as you said but didn't work sir.
    • The difference isn't paying upfront or at the end of each week. The major difference is that paying clans to join, leads to leaders making random weak sides who play just for money and creates an extremely toxic fake competition in-game (i.e. l2 dex, e-global, valhalla and this kind of servers). Paying clans just to join absolutely kills the rivalry between them as there are no real losers and winners. Everyone gets paid at the end of every week so who cares right ?   Rewarding the winners with cash gives a massive motive to the leaders to create strong sides and try their best to win without giving any advantage to any clan (unlike paying people to join and basically giving them free premiums and whatnot). In this case, there will always be losers and winners and the rivalry will be kept alive.   I hope that clears up the massive difference between the 2 scenarios. Look at all those big russian servers. No1 makes fraps flaming about which side is better. Everyone cares about daily 9v9s or organized ones. There is no clan identity anymore because leaders simply don't care. They have been so detached from the clan's identity that most of the times the leader's CP holds a different name to the side's. This is a very important point to think about. 
  • Topics

  • Create New...

AdBlock Extension Detected!

Our website is made possible by displaying online advertisements to our members.

Please disable AdBlock browser extension first, to be able to use our community.

I've Disbaled AdBlock