Credits to anantasia for the trace and Cucurucho for clarify the things.
Here we going to see how patch the file directly, so you will dont need patch every time.
Warning: use this tools at your own risk, some av software detect suspicious things on it, read the entire post before. You can find another tool that do the same [Only registered and activated users can see links. Click Here To Register...]
First the things we need.
1 The post of anantsia
[Only registered and activated users can see links. Click Here To Register...]
To give karma to him and download the SV(AgentKing.exe and countrymakeinUS.dll)
2 Post of Cucurucho
[Only registered and activated users can see links. Click Here To Register...]
Karma to him for clarify the things a little more, and the adress.
3 This tools (same files in the 2 links)
[Only registered and activated users can see links. Click Here To Register...]
[Only registered and activated users can see links. Click Here To Register...]
For unpack and edit the files.
First we need unpack the files, extract the files in tools.rar and open asprstripperxp.exe, open the AgentKing.exe and click unpacking(AgentKing.exe and countrymakeinUS.dll must be in the same folder), do the same for countrymakeinUS.dll. Now you have your files unpacked, one called _AgentKing.exe and another called _countrymakeinUS.dll, copy this to another place and change the name for the original (without the "_").
Now open hiew32.exe(tools.rar), and browse to the dir where you have your unpacked files(ALT+F1 to change drives/partitions if needed). Open AgentKing.exe.
F4 and select decode. Now wee need the adress in Cucuruchoīs post. F5 and write the first adress (00403596) beggining whit a "." so write this ".00403596" and press enter and you will see something like this:
.00403596: 0F84F0010000 je .00040378C --- (6)
This is what we need to edit and the tricky part. Look carefully at this, we need separate the 0F84F0010000 in bytes, so every pair of numbers its a byte, we need count the bytes, 0F 84 F0 01 00 00. We have 6 pairs so we have 6 bytes.
Now we need to do the 'Replace for code that does nothing' manually, The "code that does nothing" its the NOP or the Hex code 90, but this is only one byte long, and we need change the entire line, We have 6 bytes(0F 84 F0 01 00 00), we need 6 NOPīs(90). Locate your cursor in the first pair (0F) and press F3, now you are in edit mode, just write 6 times 90 to replace the 6 bytes. Press F9 to update the file and you will have something like:
.00403596: 90 nop
.00403597: 90 nop
.00403598: 90 nop
.00403599: 90 nop
.0040359A: 90 nop
.0040359B: 90 nop
Replace the next 3 adress in the same way.
What happen? Where is the 10002895?. In the dll. Open the countrymakeinUS.dll pressing F9 (the changes you made to the other file are saved when you press F9). Change mode to decode (F4), and replace the adress in Cucuruchos post.
Just be carefull here, not all the adress are 6 bytes long, the 10002895 are only 2 bytes long, so here you just need replace for 2 nopīs(90). When you repalce the 11 adress the work is done :D.
Happy cracking.
Here we going to see how patch the file directly, so you will dont need patch every time.
Warning: use this tools at your own risk, some av software detect suspicious things on it, read the entire post before. You can find another tool that do the same [Only registered and activated users can see links. Click Here To Register...]
First the things we need.
1 The post of anantsia
[Only registered and activated users can see links. Click Here To Register...]
To give karma to him and download the SV(AgentKing.exe and countrymakeinUS.dll)
2 Post of Cucurucho
[Only registered and activated users can see links. Click Here To Register...]
Karma to him for clarify the things a little more, and the adress.
3 This tools (same files in the 2 links)
[Only registered and activated users can see links. Click Here To Register...]
[Only registered and activated users can see links. Click Here To Register...]
For unpack and edit the files.
First we need unpack the files, extract the files in tools.rar and open asprstripperxp.exe, open the AgentKing.exe and click unpacking(AgentKing.exe and countrymakeinUS.dll must be in the same folder), do the same for countrymakeinUS.dll. Now you have your files unpacked, one called _AgentKing.exe and another called _countrymakeinUS.dll, copy this to another place and change the name for the original (without the "_").
Now open hiew32.exe(tools.rar), and browse to the dir where you have your unpacked files(ALT+F1 to change drives/partitions if needed). Open AgentKing.exe.
F4 and select decode. Now wee need the adress in Cucuruchoīs post. F5 and write the first adress (00403596) beggining whit a "." so write this ".00403596" and press enter and you will see something like this:
.00403596: 0F84F0010000 je .00040378C --- (6)
This is what we need to edit and the tricky part. Look carefully at this, we need separate the 0F84F0010000 in bytes, so every pair of numbers its a byte, we need count the bytes, 0F 84 F0 01 00 00. We have 6 pairs so we have 6 bytes.
Now we need to do the 'Replace for code that does nothing' manually, The "code that does nothing" its the NOP or the Hex code 90, but this is only one byte long, and we need change the entire line, We have 6 bytes(0F 84 F0 01 00 00), we need 6 NOPīs(90). Locate your cursor in the first pair (0F) and press F3, now you are in edit mode, just write 6 times 90 to replace the 6 bytes. Press F9 to update the file and you will have something like:
.00403596: 90 nop
.00403597: 90 nop
.00403598: 90 nop
.00403599: 90 nop
.0040359A: 90 nop
.0040359B: 90 nop
Replace the next 3 adress in the same way.
What happen? Where is the 10002895?. In the dll. Open the countrymakeinUS.dll pressing F9 (the changes you made to the other file are saved when you press F9). Change mode to decode (F4), and replace the adress in Cucuruchos post.
Just be carefull here, not all the adress are 6 bytes long, the 10002895 are only 2 bytes long, so here you just need replace for 2 nopīs(90). When you repalce the 11 adress the work is done :D.
Happy cracking.