Free Information Xchange '98 presents:
Battle Arena Toshinden 2 - CD crack by Static Vengeance
Requirements:
Hex Editor and Full Install
Battle Arena Toshinden 2 is set up to run completely off the CD via Win95's CD autorun feature.
However this just wont do, I want the game on my hard drive to play it whenever without the CD. So I
set out to make a playable version that could be run entirely off the hard drive. To do this I looked
at the files in the root directory of the CD. I figured I could get by with copying the two EXE files,
one "font" file and one subdirectory. You'll need to copy T2.exe which is the actual program, killgame.exe
is called from T2.exe so you'll need that one. Then the Font.tga file and of course the Data subdirctory
which would be all the game's data files. After I copied all these files (about 203 megs) to my hard
drive I tried to run Toshinden 2. However the game came up and said "Program cannot detect the CD-ROM
audio tracks." I thought to myself, this'll be easy I'll just get W32Dasm up and running and search for
that "Data String Ref" and walk through the CD check routine. No problem... Well there is a slight bit
of a problem using that method. It's the way the string is referenced; it comes up as "a possible" ref
almost everywhere... So I decided to take another aproch. When going through as many CD check routines
as I have seen I have noticed that the KERNEL32 call "GetDriveTypeA" is used a lot of the times. So I
did a text string search for GetDriveTypeA and found this:
-- Program Code --
* Reference To: KERNEL32.GetCurrentDirectoryA, Ord:00D1h
|
:0040A247 FF1510057A00 Call dword ptr [007A0510]
:0040A24D 8A8424C2010000 mov al, byte ptr [esp+000001C2]
:0040A254 889C24C3010000 mov byte ptr [esp+000001C3], bl
:0040A25B 3C5C cmp al, 5C
:0040A25D 751D jne 0040A27C
:0040A25F 80BC24C10100003A cmp byte ptr [esp+000001C1], 3A
:0040A267 7513 jne 0040A27C
:0040A269 8D9424C0010000 lea edx, dword ptr [esp+000001C0]
:0040A270 52 push edx
* Reference To: KERNEL32.GetDriveTypeA, Ord:00DFh <-- As mentioned before, common in CD checks
|
:0040A271 FF1528057A00 Call dword ptr [007A0528]
:0040A277 83F805 cmp eax, 00000005 <-- 05 is the value for a CD-ROM drive
:0040A27A 7413 je 0040A28F <-- Force this jump to continue
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A25D(C), :0040A267(C)
|
:0040A27C 53 push ebx
:0040A27D 6860BE4900 push 0049BE60
:0040A282 6820B94900 push 0049B920
:0040A287 53 push ebx
:0040A288 FFD7 call edi
:0040A28A E8B1040000 call 0040A740 <-- Tell user of bad news: Need the CD!
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A238(C), :0040A27A(C)
|
:0040A28F 68C0BB4900 push 0049BBC0 <-- Get here to continue the game
* Possible Reference to String Resource ID=00001: "Toshinden 2"
|
:0040A294 C705B4F5470001000000 mov dword ptr [0047F5B4], 00000001
* Reference To: KERNEL32.InitializeCriticalSection, Ord:0179h
|
:0040A29E FF152C057A00 Call dword ptr [007A052C]
:0040A2A4 68007F0000 push 00007F00
:0040A2A9 53 push ebx
* Reference To: USER32.LoadCursorA, Ord:0172h
|
:0040A2AA FF1528077A00 Call dword ptr [007A0728]
:0040A2B0 89442428 mov dword ptr [esp+28], eax
:0040A2B4 A18CC14900 mov eax, dword ptr [0049C18C]
-- Continuing Program Code --
I knew that I had to force the above listed jump so the program would "think" it was still on
the CD in the CD-ROM drive. I figured I had to atleast start with that much. I tried to run Toshinden 2
again... and to my surprise it started right up and ran. I played a couple of games and it all works
fine right from the hard drive! Create a shortcut somewhere on your start menu for this game and you'll
have a nice clean install for Toshinden 2. To crack Battle Arena Toshinden you need to:
1. Create a new subdirectory called "Toshinden" (or whatever you like)
2. Copy the files T2.exe, Killgame.exe and Font.tga off the CD in to Toshinden
3. Copy the subdirectory Data off the CD in to the Toshinden directory
4. Edit T2.exe at offset 38,522
=================================
Search for: 74 13 53 68
Change to : EB -- -- --
Battle Arena Toshinden 2 can now be run completely from your hard drive without the need for the
original CD in your CD-ROM drive. Toshinden 2 has now been added to the list of FiX'ed games.
Static Vengeance