Quote from: Wolf0 on October 11, 2017, 05:15:15 AM

Quote from: crypto.lawyer.187 on October 11, 2017, 04:07:31 AM

Quote from: Millenium Falcon on October 10, 2017, 05:29:28 PM

New version
Download: http://www.mediafire.com/file/rz7j2g97d5xa1jw/NoDevFee8.0.zip
v8.0
TCP packets checking speed is improved (checking function is replaced with assembly code to speed up checking)
Fixed bug with automatic adding to startup (this feature is deleted).
New Logo

how do I take out ur address?

hexedit?

No - my initial analysis indicates the user address is used most of the time, with a switch to something else which has yet to be determined. It's a string (seemingly) that is sourced from the stack - not embedded in the binary, but probably made at runtime in some way. Currently doing just static analysis.

Nope, stack usage doesn't mean that something "embedded in the binary" wasn't just loaded there, even the static const.
Actually the address is a string, it is even not encrypted in that sample.
Also the OP implemented some one-hand patchable script kiddie protection there.

Won't place the address here, it is only the OP's business to share his address.

Commitment

sha256(string_with_address) is 1d7d2c0110e1a1a397963dd663ae0abe1af186eed55ab33b7e84c457588574f5

Code:

.text:0000000140001DCA movups xmm0, cs:xmmword_140007720
.text:0000000140001DD1 movups [rbp+2460h+var_2430], xmm0
.text:0000000140001DD5 movups xmm1, cs:xmmword_140007730
.text:0000000140001DDC movups [rbp+2460h+var_2420], xmm1
.text:0000000140001DE0 movsd xmm0, cs:qword_140007740
.text:0000000140001DE8 movsd [rbp+2460h+var_2410], xmm0
.text:0000000140001DED movzx eax, cs:word_140007748
.text:0000000140001DF4 mov [rbp+2460h+var_2408], ax
.text:0000000140001DF8 movzx eax, cs:byte_14000774A
.text:0000000140001DFF mov [rbp+2460h+var_2406], al

And the "protection" follows right after.