xREL.v3

nERv

The Sims 2 Castaway (c) EA Games

01/2008 :..... RELEASE.DATE .. PROTECTION .......: Securom+Serial
1 :.......... DISC(S) .. GAME.TYPE ........: Sims

Help your Sims survive and thrive on an uncharted island and build a life
from scratch after washing ashore on a deserted tropical island. Overcome
the forces of nature to help them become the ultimate survivors and thrive
in this undiscovered paradise while unearthing clues that will lead them
back to civilization. Build shelters, craft unique items, and discover many
useful treasures and ancient mysteries hidden deep within a diverse jungle
environment filled with plants, fruits, and even wildlife. Your Sims change
as they take on the challenges of island life and learn to survive in style.
Create a new life for your Sims on an uncharted island in The Sims 2
Castaway.
Features:
* Stay Alive!   Help your Sim meet basic needs to survive.
* Discover Diverse Islands   Explore a variety of new environments: beaches,
caves, lagoons, jungle, plains, and volcanic mountains.
* Craft Everything   Create a new life from scratch. Develop tools, build
shelter, craft furniture, create clothing, and make art & entertainment.
* Gather and Collect   Gather fish, trap animals, raise plants, collect
shells, scavenge and decode treasure maps.
* Flourish or Escape   Build a life comfort on the island or find a way to
escape back to civilization.
* Create a Crew   Choose from a wide range of Sims: Auto Mechanic, Chef,
Doctor, Musician, Teacher, Executive, or Park Ranger. Each one brings a
unique Sim humor and quirkiness to your crew. Reunite members of your crew
and build a thriving community.

Special Note:

Regarding vitality's proper and the nfo they included in their 'proper' of
The Sims Carnival SnapCity:

They quote us out of context from a 3 year old release, where HOODLUM used
a loader to completely bypass the safedisc cdcheck used in that game.
As said, the proper reason then was that a loader exe was used, where the
loader code was used to execute the ENTIRE protected exe. This is a
completely different situation, and emulation of for instance sdapiv2 has
always been permitted.

Unlike they claim in their nfo, their crack is not a fully rebuilt executable
and much of the securom code is still left in their 'fully rebuilt crack'.
Lets analyse their 'complete gamecode rebuilt crack':

1) their crack is upx compressed, which makes it impossible to see gamecode
directly (This may fool you to believe their exe is fully rebuilt and
may fool you into thinking that exe size says anything about performance)
2) when you check the header of the unpacked vitality crack (upx moved it
somewhere in memory ;-) you can see that vitality merged all Securom
Sections into a 1x9mb mess (which is even used by their 'fully rebuilt'
crack, as we will later show)
3) when you further examine the gamecode (which vitality wants you to believe
its completely rebuilt) you will encounter the following peace of code,
which refers to their messy 9mb section of securom code:

004B1913  PUSH 00404816
004B1918  PUSH 222D8522
004B191D  PUSHFD
004B191E  XOR DWORD PTR SS:[ESP+4],224559A2
004B1926  POPFD
004B1927  POP EAX
004B1928  JMP SHORT 004B1929
004B1929  CALL NEAR EAX

0068DC80  JMP NEAR DWORD PTR DS:[CE2988]           ;00BDE000
0068DC86  PUSH EAX
0068DC87  MOV EAX,DWORD PTR SS:[ESP+8]
0068DC8B  MOV DWORD PTR DS:[EAX+C],50
0068DC92  POP EAX
0068DC93  JMP NEAR DWORD PTR DS:[CE2988]

00BDE000  PUSHAD
00BDE001  PUSHFD
00BDE002  MOV EAX,DWORD PTR SS:[ESP+28]
00BDE006  CALL 00BDE00B
00BDE00B  POP EBX
00BDE00C  ADD EBX,35
00BDE00F  XOR ECX,ECX
00BDE011  CMP DWORD PTR DS:[ECX+EBX],EAX
00BDE014  JE SHORT 00BDE01B
00BDE016  ADD ECX,8
00BDE019  JMP SHORT 00BDE011
00BDE01B  MOV EAX,DWORD PTR DS:[ECX+EBX+4]
00BDE01F  PUSH EAX
00BDE020  LEA ESP,DWORD PTR SS:[ESP+4]
00BDE024  POPFD
00BDE025  POPAD
00BDE026  JMP NEAR DWORD PTR SS:[ESP-28]

00BE1169  POP EAX                                  ; 004B192B
00BE116A  XCHG DWORD PTR SS:[ESP],EAX
00BE116D  JMP NEAR DWORD PTR DS:[53D1C8]           ; kernel32.GetSystemTimeAsFileTime

While this same instruction, rebuilt in a proper way would be:

CALL DWORD PTR DS:[53D1C8]           ; kernel32.GetSystemTimeAsFileTime

Of course this is just a very small example, and 1 of the many instructions
that are emulated in vitality's 'fully rebuilt crack'.
As we mentioned above they have 9MB of Securom Code/Values in their messy
section. So they do not adhere to their own arguement that 'protections
should be removed entirely'.

So to sum it up, vitality uses upx to pack their exe to hide their shady
crack methods, lie about fully rebuilding securom and propering valid cracks
by other groups with possibly worse cracks.

We will not repeat this story every time, but we would just like to point
out the bullshit and the lying of vitality once again, since many people
still don't seem to understand how lame they really are and let them get
away with these useless propers with bullshit propaganda.

1. Unrar.
2. Install, when asked for a serial enter one of the following serials or
use the keygen located in the Crack dir on the DVD.

3. Copy the cracked files located in the Crack directory on the DVD to your
installation\TSBin directory.
4. Play the game.