I am not sure why my thread got closed. Please if you have nothing worth contributing or helping or even constructive criticism please stay off of my thread.
Invalid Header Check - This may want to stay intact just in case you don't want to crash Halo 2 because some data does not match up.
Its a easy reversal to skip the check.Code:015161AD |. /74 13 |JE SHORT halo2.015161C2 015161AF |. |C745 00 0D000>|MOV DWORD PTR SS:[EBP],0D 015161B6 |. |C746 18 58517>|MOV DWORD PTR DS:[ESI+18],halo2.0173515>; ASCII "incorrect header check" 015161BD |. |E9 59010000 |JMP halo2.0151631B 015161C2 |> \F64424 14 20 |TEST BYTE PTR SS:[ESP+14],20 015161C7 |. 0F85 70010000 |JNZ halo2.0151633D 015161CD |. C745 00 07000>|MOV DWORD PTR SS:[EBP],7 015161D4 |. E9 4C010000 |JMP halo2.01516325 015161D9 |> 8B46 1C |MOV EAX,DWORD PTR DS:[ESI+1C] 015161DC |. 8B48 14 |MOV ECX,DWORD PTR DS:[EAX+14] 015161DF |. 57 |PUSH EDI 015161E0 |. 56 |PUSH ESI 015161E1 |. 51 |PUSH ECX 015161E2 |. E8 AB1E0000 |CALL halo2.01518092
It is similar also with the Data check. But instead it checks against multiple sections in the file. Here is the start of the check where you can force it to load the map without any problems.
Also I found some stuff for a similar Halo 2 CE project lead by KIWIDOGGIE over at his website and halomods.Code:015160F7 |. 83F8 0D CMP EAX,0D 015160FA |. 0F87 2B030000 JA halo2.0151642B 01516100 |> FF2485 606451>/JMP DWORD PTR DS:[EAX*4+1516460] 01516107 |> 8B46 04 |MOV EAX,DWORD PTR DS:[ESI+4] 0151610A |. 85C0 |TEST EAX,EAX 0151610C |. 0F84 23030000 |JE halo2.01516435 01516112 |. 8346 08 01 |ADD DWORD PTR DS:[ESI+8],1 01516116 |. 8B56 1C |MOV EDX,DWORD PTR DS:[ESI+1C] 01516119 |. 83C0 FF |ADD EAX,-1 0151611C |. 8946 04 |MOV DWORD PTR DS:[ESI+4],EAX 0151611F |. 8B06 |MOV EAX,DWORD PTR DS:[ESI] 01516121 |. 0FB608 |MOVZX ECX,BYTE PTR DS:[EAX] 01516124 |. 894A 04 |MOV DWORD PTR DS:[EDX+4],ECX 01516127 |. 8B46 1C |MOV EAX,DWORD PTR DS:[ESI+1C] 0151612A |. 8B48 04 |MOV ECX,DWORD PTR DS:[EAX+4] 0151612D |. 8306 01 |ADD DWORD PTR DS:[ESI],1 01516130 |. 80E1 0F |AND CL,0F 01516133 |. 80F9 08 |CMP CL,8 01516136 |. 8BFB |MOV EDI,EBX 01516138 |. 74 12 |JE SHORT halo2.0151614C ; Check to see if <BITR> Exist 0151613A |. C700 0D000000 |MOV DWORD PTR DS:[EAX],0D 01516140 |. C746 18 84517>|MOV DWORD PTR DS:[ESI+18],halo2.0173518>; ASCII "unknown compression method" 01516147 |. E9 CF010000 |JMP halo2.0151631B ;Jump to Invalid Data. 0151614C |> 8B48 04 |MOV ECX,DWORD PTR DS:[EAX+4]
All credit to his team for this.
Multiple Instances.
Pingo posted that for the latest update of Halo 2 halo2.exe+7eb5; is the address for the reversal.Code:01397EA0 . CALL DWORD PTR DS:[17FD764] ; halo2.013A2F07 01397EA6 . TEST EAX,EAX 01397EA8 . JE SHORT halo2.01397EB7 01397EAA . CALL DWORD PTR DS:[<&KERNEL32.GetLastErr>; [GetLastError 01397EB0 . CMP EAX,0B7 ; Checks to see if Halo 2 is already running 01397EB5 . JNZ SHORT halo2.01397ECB ; If Halo 2 is not already running continue the launching, if not show badboy message 01397EB7 > PUSH 66
I will continue to post more research. The Halo 2 exe is protected by isDebuggerPresent and some other function.





Bookmarks