Saturday, July 02 2005 @ 04:17 PM CEST Contributed by: BoR0 Views: 12565
Level : beginner
How to halt the timer in the solitaire cardgame.
Dedication: My best friend Error_Vir
Food: Ruffles and nectarine juice
Music: Falcon - Cosmic outflow.xm
This tutorial I dedicate especially to my old friend Error_Vir.
And as one of the famous quote follows:
"one time of time on the time at of the time i dont remember it"
For more information on my friend you can find on the following webpage here; that is dedicated to him.
Enough blabla's. Proceed to tutorial.
Ok. The tool that we will to use is OllyDbg. (Ollydbg)
Alright, sol.exe can be found (obviously, if you didn't need to free
some space up on your HDD by deleting it) in %windir%system32sol.exe.
(on my computer it's C:WINNTsystem32sol.exe)
So let's debug this tiny little app.
Oh, if you're asking why I chose sol.exe I simply find it the best
game for the boring days. Try to combine it with some demoscene music
Fits perfectly for boring and raining days :-)
BY THE WAY, I won a game in 51 seconds (without any time hacks).
That's my highest score, I also had scores like 71 seconds, 78, 82, ...
Open ollydbg, File->Open and type "%windir%system32sol.exe" there.
Press F9 to run Solitaire.
As you might have(n't) noticed, the timer starts when you click anywhere
on the game. Example click on a card. Cool, the timer started!
To restart the timer, goto ollydbg Debug->Restart->Yes->Press F9.
We restarted the game.
Sometimes in cracking,
(as my old friend says,
"in the cracking = idont have time to write all thinges")
I dont have the time to explain all things.
So don't ask me why I picked this way. There are (probably) other ways for
cracking this application, but I prefer the ninja-style.
HOWEVER, back to work. The ninja-style is the following.
We must defeat Solitaire in the easiest way. How do we do that?
Simply. Notice the string "Time: %d" ? :-)
In Ollydbg, View->Memory. Right click anywhere, click Search.
Search for HEX val: 54 00 69 00 6D 00 65 00 3A
(meaning "Time:" with a zero in between every char)
This is very important. Before setting a breakpoint make sure you activate the
timer first, because if you don't activate it Olly will break all the time
and the Timer will be =0 so NO use.
Anyway, we found it. While the text we searched for is highlighted,
right click on it and set a breakpoint on memory access.
Ollydbg IMMEDIATELY breaks, this is a good sign.
Once ollydbg lands us on the physical memory, press ALT+F9 to get back
to the user's memory.
We are here:
0100243B . C2 0800 RETN 8
Now as we step out from this procedure this is what we see: