I may be off my rocker here, but I think your 20-byte string might be overshooting the mark a bit. Let me explain...
A long, long time ago in a galaxy far, far away there was this kid who taught himself assembler language partly because he thought it was neat to remove copy protection from IBM and Apple games. It's been a long time and a lot has changed in that arena, but some things still look a lot alike, particularly when you realize that the Xbox is still just an Intel processor.
Anyway, to my point...
If you disassemble the hex bytes you're using (skipping the first one), it looks like this in machine code/assembler:
0C8E:0101 750F JNZ 0112 0C8E:0103 E8A1FE CALL FFA7 0C8E:0106 FFFF DI 0C8E:0108 85C0 TEST AX,AX 0C8E:010A 7D06 JGE 0112 0C8E:010C 33C0 XOR AX,AX 0C8E:010E 50 PUSH AX 0C8E:010F 50 PUSH AX 0C8E:0110 EB44 JMP 0156 0C8E:0112 F605FF TEST BYTE PTR [DI],FF
I skipped the first byte so you can see how the logic fits together. That's a Jump if Not Zero over the whole routine. Best not to screw with it, but it fits in place. In any case, immediately before your target byte, you have some machination which is meant to trigger the conditional jump at byte 10a (the famous '7D' byte). Normally, this is Jump if Greater Than or Equal to. If you change that 7D to an EB, it becomes an unconditional jump to 112, like so: 0C8E:010A EB06 JMP 0112
The key here, and this is cracking strategy since before a few of you were born, is what you have is a test, conditional branch, and failure. The barebones basics is always let it run the test and "force" success. In other words, the bytes immediately AFTER the conditional jump are your failure routine: 0C8E:010C 33C0 XOR AX,AX 0C8E:010E 50 PUSH AX 0C8E:010F 50 PUSH AX 0C8E:0110 EB44 JMP 0156 0C8E:0112 ...
By changing the branch to unconditional, you skip this routine altogether and proceed, making the program think the test was passed. So, what I'm suggesting, particularly since there seems to already be some variation, is you focus on the bytes from the conditional branch through the failure routine: 0C8E:010A 7D06 JGE 0112 0C8E:010C 33C0 XOR AX,AX 0C8E:010E 50 PUSH AX 0C8E:010F 50 PUSH AX 0C8E:0110 EB44 JMP 0156
The test before the conditional jump might change (although I doubt it), but I'm fairly confident that you could just use everything up to the unconditional jump (the offest might change as well). In other words, use: 7D 06 33 C0 50 50 EB
Now, if you guys have all figured this out already, or I'm wrong, well, sorry to have wasted everyone's time and thanks for letting an old man re-live some glory days. If not, would anyone care to test this? It might be a more versatile way to stay in front of the variations as they come.
Don |