I like this game library site, there are dozen HQ free racing (my favorite genre) games for download. As we know the games upon exiting will launch your browser pointing to their site. There seems to be no catch here, no suspicious parameter etc. it's simply "open this url" call, although a googling for privacy concern of these games return a few security paranoid's comments.
Having a look from dependency walker I believe ShellExecute is responsible for the call. I try hex it with another same-length function name of shell32.dll (e.g. CheckEscapes) and yeah that's it.
EDIT:
Steps:
Having a look from dependency walker I believe ShellExecute is responsible for the call. I try hex it with another same-length function name of shell32.dll (e.g. CheckEscapes) and yeah that's it.
EDIT:
Steps:
- Download and install free hex editor: WXHexeditor / HexEditor or HxD
in this case I use HexEditor. - Download the game, in this case Battle Rush.
- Browse battle rush executable, open it in HexEditor
- In HexEditor pres Ctrl-H to bring Find and Replace dialog, find "ShellExecuteA" and for the replacement use "CheckEscapesA" click Replace All. You'll be asked to turn off read only mode, Click ok :
- A confirmation of the function being replaced will shown like below. If not, it may be in another name e.g. "ShellExecuteW" -> "CheckEscapesW" just give it a try. You can now save the file. Try run it.
| battle rush.exe |
![]() |
| Replace the function |
![]() |
| Confirmation |




