I am not sure why my thread got closed. Please if you have nothing worth contributing or helping or even constructive criticism please stay off of my thread.
Invalid Header Check - This may want to stay intact just in case you don't want to crash Halo 2 because some data does not match up.
Code:
015161AD |. /74 13 |JE SHORT halo2.015161C2
015161AF |. |C745 00 0D000>|MOV DWORD PTR SS:[EBP],0D
015161B6 |. |C746 18 58517>|MOV DWORD PTR DS:[ESI+18],halo2.0173515>; ASCII "incorrect header check"
015161BD |. |E9 59010000 |JMP halo2.0151631B
015161C2 |> \F64424 14 20 |TEST BYTE PTR SS:[ESP+14],20
015161C7 |. 0F85 70010000 |JNZ halo2.0151633D
015161CD |. C745 00 07000>|MOV DWORD PTR SS:[EBP],7
015161D4 |. E9 4C010000 |JMP halo2.01516325
015161D9 |> 8B46 1C |MOV EAX,DWORD PTR DS:[ESI+1C]
015161DC |. 8B48 14 |MOV ECX,DWORD PTR DS:[EAX+14]
015161DF |. 57 |PUSH EDI
015161E0 |. 56 |PUSH ESI
015161E1 |. 51 |PUSH ECX
015161E2 |. E8 AB1E0000 |CALL halo2.01518092
Its a easy reversal to skip the check.
It is similar also with the Data check. But instead it checks against multiple sections in the file. Here is the start of the check where you can force it to load the map without any problems.
Code:
015160F7 |. 83F8 0D CMP EAX,0D
015160FA |. 0F87 2B030000 JA halo2.0151642B
01516100 |> FF2485 606451>/JMP DWORD PTR DS:[EAX*4+1516460]
01516107 |> 8B46 04 |MOV EAX,DWORD PTR DS:[ESI+4]
0151610A |. 85C0 |TEST EAX,EAX
0151610C |. 0F84 23030000 |JE halo2.01516435
01516112 |. 8346 08 01 |ADD DWORD PTR DS:[ESI+8],1
01516116 |. 8B56 1C |MOV EDX,DWORD PTR DS:[ESI+1C]
01516119 |. 83C0 FF |ADD EAX,-1
0151611C |. 8946 04 |MOV DWORD PTR DS:[ESI+4],EAX
0151611F |. 8B06 |MOV EAX,DWORD PTR DS:[ESI]
01516121 |. 0FB608 |MOVZX ECX,BYTE PTR DS:[EAX]
01516124 |. 894A 04 |MOV DWORD PTR DS:[EDX+4],ECX
01516127 |. 8B46 1C |MOV EAX,DWORD PTR DS:[ESI+1C]
0151612A |. 8B48 04 |MOV ECX,DWORD PTR DS:[EAX+4]
0151612D |. 8306 01 |ADD DWORD PTR DS:[ESI],1
01516130 |. 80E1 0F |AND CL,0F
01516133 |. 80F9 08 |CMP CL,8
01516136 |. 8BFB |MOV EDI,EBX
01516138 |. 74 12 |JE SHORT halo2.0151614C ; Check to see if <BITR> Exist
0151613A |. C700 0D000000 |MOV DWORD PTR DS:[EAX],0D
01516140 |. C746 18 84517>|MOV DWORD PTR DS:[ESI+18],halo2.0173518>; ASCII "unknown compression method"
01516147 |. E9 CF010000 |JMP halo2.0151631B ;Jump to Invalid Data.
0151614C |> 8B48 04 |MOV ECX,DWORD PTR DS:[EAX+4]
Also I found some stuff for a similar Halo 2 CE project lead by KIWIDOGGIE over at his website and halomods.
All credit to his team for this.
Multiple Instances.
Code:
01397EA0 . CALL DWORD PTR DS:[17FD764] ; halo2.013A2F07
01397EA6 . TEST EAX,EAX
01397EA8 . JE SHORT halo2.01397EB7
01397EAA . CALL DWORD PTR DS:[<&KERNEL32.GetLastErr>; [GetLastError
01397EB0 . CMP EAX,0B7 ; Checks to see if Halo 2 is already running
01397EB5 . JNZ SHORT halo2.01397ECB ; If Halo 2 is not already running continue the launching, if not show badboy message
01397EB7 > PUSH 66
Pingo posted that for the latest update of Halo 2 halo2.exe+7eb5; is the address for the reversal.
I will continue to post more research. The Halo 2 exe is protected by isDebuggerPresent and some other function.
Bookmarks