How To Disable Gameprotection “On The Fly”
(Asprotect & Nprotect Possible Other Packages or GameProtect)
Target File : AIKAIN.exe (Aika Indonesia)
File Protection : ASProtect 1.23 RC4
Tools : OllyDbg With aadp4olly plugins
Olly Settings :
Debugging Options :
Aadp4olly Plugins Setting :
Main Proses :
1. Get OEP The AIKAIN.EXE
2. Disable Nprotect On The Fly
PART I
Detail Prosses :
1. Load Target, AIKAIN.exe With Olly.
2. Press SHIFT + F9 Until You Find This Code (in Mycase I Press SHIFT + F9 x16 Times)
030239FF 6A 0C PUSH 0C
=>030239FF 6A 0C PUSH 0C
03023A01 B9 B07E0203 MOV ECX,3027EB0
03023A06 8D45 F8 LEA EAX,[EBP-8]
03023A09 BA 04000000 MOV EDX,4
03023A0E E8 2DD1FFFF CALL 03020B40
03023A13 FF75 FC PUSH DWORD PTR [EBP-4]
03023A16 FF75 F8 PUSH DWORD PTR [EBP-8]
03023A19 8B45 F4 MOV EAX,[EBP-C]
03023A1C 8338 00 CMP DWORD PTR [EAX],0
03023A1F 74 02 JE SHORT 03023A23
03023A21 FF30 PUSH DWORD PTR [EAX]
03023A23 FF75 F0 PUSH DWORD PTR [EBP-10]
03023A26 FF75 EC PUSH DWORD PTR [EBP-14]
=> C3 RET <<< PUT BREAKPOINT HERE
03023A2A 5F POP EDI
03023A2B 5E POP ESI
03023A2C 5B POP EBX
03023A2D 8BE5 MOV ESP,EBP
03023A2F 5D POP EBP
03023A30 C3 RET
3. Press SHIFT + F9 x 1 Time
Olly Will Break.
4. Press ALT + M and Set Memory Breakpoint On Access ( View The Image Below )
5. Press SHIFT + F9, Olly Will Stop Near OEP AIKAIN.EXE.
6. Press CTRL + A, Olly Will Do Analysing.
Part I Get Near OEP AIKAIN.EXE Complete.
Part II
Next Part Is to Disable Nprotect On The Fly (Without Unpack The EXE)
1. Right Click On Olly . >> Search For >> All Referenced Text Strings
2. On Pop Up Windows Scroll Up To The Top.
3. Double Click String “ GameGuard Error”
4. Right Click on This Call, And Select Binary >> Fill With Nops
5. Right Click JE SHORT 004xxxxxx Assmble And Change To JMP SHORT 004xxxxxx
6. Result Must Be Same With This Picture
7. After That Scroll Up a Bit Until You Find
ASCII “98”
ASCII “NT”
Look At Picture .
8. Right Click on This Call, And Select Binary >> Fill With Nops
9. Right Click JNZ SHORT 004xxxxxx Assmble And Change To JMP SHORT 004xxxxxx
10. Result Must Be Same With This Picture
11. Press CTRL + A, Olly Will Analys
Part II Disable Nprotect on The Fly Complete.
Final Part :
1. Remove All Used Breakpoint
Right Click On Main Olly, Select Breakpoint and Remove Breakpoint On Memory
GameGuard has Been Disable, Now Just Press F9 To Run The Program.
Just Ignore and Press OK When An Error MessageBox Appear.
Credit :
- All The Author Asprotect Unpack Guide.
- S4R4H For Recreate Unpack Guide.
- Ulquiorra For Disable GameGuard Guide.
- ME
Note :
Before Asking an Question, Please Make Sure You Already Follow The Guide Without Missing Step..
And Using This Guide Wisely
Tx