Post
Topic
Board Mining (Altcoins)
Re: Claymore's Ethereum Mining NoDevFee v8.0 🔥
by
xiphon
on 14/10/2017, 05:31:36 UTC
New version
Download: http://www.mediafire.com/file/rz7j2g97d5xa1jw/NoDevFee8.0.zip
v8.0
 TCP packets checking speed is improved (checking function is replaced with assembly code to speed up checking)
 Fixed bug with automatic adding to startup (this feature is deleted).
 New Logo

how do I take out ur address?

hexedit?

No - my initial analysis indicates the user address is used most of the time, with a switch to something else which has yet to be determined. It's a string (seemingly) that is sourced from the stack - not embedded in the binary, but probably made at runtime in some way. Currently doing just static analysis.

Nope, stack usage doesn't mean that something "embedded in the binary" wasn't just loaded there, even the static const.
Actually the address is a string, it is even not encrypted in that sample.
Also the OP implemented some one-hand patchable script kiddie protection there.

Won't place the address here, it is only the OP's business to share his address.

Commitment

sha256(string_with_address) is 1d7d2c0110e1a1a397963dd663ae0abe1af186eed55ab33b7e84c457588574f5

Code:
.text:0000000140001DCA                 movups  xmm0, cs:xmmword_140007720
.text:0000000140001DD1                 movups  [rbp+2460h+var_2430], xmm0
.text:0000000140001DD5                 movups  xmm1, cs:xmmword_140007730
.text:0000000140001DDC                 movups  [rbp+2460h+var_2420], xmm1
.text:0000000140001DE0                 movsd   xmm0, cs:qword_140007740
.text:0000000140001DE8                 movsd   [rbp+2460h+var_2410], xmm0
.text:0000000140001DED                 movzx   eax, cs:word_140007748
.text:0000000140001DF4                 mov     [rbp+2460h+var_2408], ax
.text:0000000140001DF8                 movzx   eax, cs:byte_14000774A
.text:0000000140001DFF                 mov     [rbp+2460h+var_2406], al

And the "protection" follows right after.