Luigi Auriemma

Since some people on this forum seem to know a lot about reverse engineering, I will ask this here:
How do you usually go about finding the dll that controls the cd checking stuff for a game? I have cracked a few games when the routine to check for a cd is in the main exe, but if it's in a dll I often cannot find it. Just wondering if there is a quick/easy/not quick or easy way to find it besides looking through a disassembly of each dll the program uses. If this is a ridiculous/silly question, let me know and I will make a public and heartfelt apology.
(jk'd)

uhmmm there is not much difference between a function located in a dll or an exe, in reality when you debug this stuff it's just transparent.
are you sure that the dll is not compressed/encrypted and so you have problems to disassemble it?
or, worst, are you sure it's not a safedisc/securom/other system?

Well, I suppose it is just a problem with the debugger I use, or how I use it.
(I use OllyDbg usually, and with that you can only search for referenced text strings in the module you are currently viewing, which makes things take longer. At least I assume there is no way, but maybe I missed it).
So, what debugger do you use for windows? (And, hehheh, is it free?)

here I use Immunity Debugger which is just an updated ollydbg.
are you sure the dll is not loaded at runtime (LoadLibraryA) instead of being been directly imported in the executable?
you can also disassemble the dll with an external disassembler and then setting the breakpoints on the needed offsets you want to monitor (or hardware read access breakpoints on the strings) with olly.

Where can I download the Immunity Debugger? Could you post it here?

http://debugger.immunityinc.com/register.html
(doesn't matter how you fill those fields)

Ah, thanks.
I looked at it, and it really seems like OllyDbg .. I didn't notice any differences right away, except that annoying ad in the corner. After I removed the popup in the corner, I didn't find using it too annoying .. how does it differ from OllyDbg though?

for that boring ad thing the first suggestion is to add the following line in c:\windows\system32\drivers\etc\hosts:

127.0.0.1 auth.immunityinc.com

it will avoid the debugger to contact the website all the times.
while about the differences the main one is the support for the python language which can be used to do various script jobs and then I think some small or less small bugfixes (if I'm not in error only one time happened that ollydbg wasn't able to handle a program were instead immdbg had no problems)