Got an iPhone or iPad? We have a brand new Pastebin App for both devices, and it's totally free! Click here to download the new Pastebin App for iOS.
Public Pastes
Guest

clearscreen

By: a guest on Nov 25th, 2009  |  syntax: None  |  size: 3.64 KB  |  hits: 99  |  expires: Never
download  |  raw  |  embed  |  report abuse
Copied
  1. == Research ==
  2. Every address from here on applies to 3.0.3 client on windows.
  3.  
  4. 0x57 parsing function can be found at 00442B60.
  5.  
  6. Following data gets pushed onto stack:
  7.  
  8. * (dword) packet+24 (IP address)
  9. * (word) packet+10 (max clients)
  10. * (word) packet+6 (flag that seems to indicate if this is a payed server)
  11. * (word) packet+8 (port)
  12. * (dword) packet+24 (ip address) after it has gone through ntohl
  13. Then function 0046DE70 is called.
  14.  
  15. If segment of IP address starts with:
  16. * 127
  17. * 10
  18. * 12
  19. the function will return prematurely (no further checking needs to be done).
  20.  
  21. Then, the data is copied into a structure, below is the simplified disasembly:
  22. {{{
  23. 0046DEB5  |.  8951 1C       MOV DWORD PTR DS:[ECX+1C],EDX            ;  ECX+1C = server ip
  24. 0046DEBD  |.  66:8941 20    MOV WORD PTR DS:[ECX+20],AX              ;  ECX+20 = port
  25. 0046DEC6  |.  66:8951 22    MOV WORD PTR DS:[ECX+22],DX              ;  ECX+22 = flag
  26. 0046DECE  |.  66:8941 24    MOV WORD PTR DS:[ECX+24],AX              ;  ECX+24 = max clients
  27. 0046DED2  |.  8951 28       MOV DWORD PTR DS:[ECX+28],EDX            ;  ECX+28 = server ip
  28. }}}
  29.  
  30. It then seems to spawn a thread with ECX as argument to function 0046DE20.
  31. The pointer to the structure is retrieved from the stack and stored in ECX again:
  32.  
  33. {{{
  34. 0046DE21   .  8B7424 08     MOV ESI,DWORD PTR SS:[ESP+8]
  35. 0046DE25   .  8BCE          MOV ECX,ESI
  36. }}}
  37.  
  38. Function 0046DAF0 is called, which does a poor attempt at trying to obfuscate the verifcation's server address:
  39.  
  40. {{{
  41. 0046DB21  |.  8D4424 04     LEA EAX,DWORD PTR SS:[ESP+4]
  42. 0046DB25  |.  50            PUSH EAX                                 ; /Name
  43. 0046DB26  |.  C64424 08 70  MOV BYTE PTR SS:[ESP+8],70               ; |
  44. 0046DB2B  |.  C64424 09 72  MOV BYTE PTR SS:[ESP+9],72               ; |
  45. ... ETC ...
  46. 0046DB77  |.  FF15 74A75100 CALL DWORD PTR DS:[<&WS2_32.#52>]        ; \get proinfo.ventrilo.com host by name
  47. }}}
  48.  
  49. Then the thread sleeps for 10 seconds.
  50.  
  51. Function 0046DFC0 is called:
  52. * A new socket gets created. (after closing previous socket)
  53. * setsockopt on the socket is called with option SO_BROADCAST making the socket ready for transmitting and receiving UDP packets.
  54. * the socket is bound to the address through bind()
  55.  
  56. Function 0046DBF0:
  57. * 804 bytes are allocated
  58. * These bytes are partially set to 00. (some remnant of F00DBAAD exist as 0xADBA)
  59.  
  60. Data is copied into a buffer in this format:
  61. * buffer+0  = (dword) port
  62. * buffer+4  = (word) flag
  63. * buffer+6  = (word) max clients
  64. * buffer+8  = (dword) ip
  65. * buffer+12 = (dword) ip
  66.  
  67. This is the data section for our packet.
  68. An 18-byte header will be attached in front of it, with another 2 bytes in front of that which will act as encryption seed.
  69.  
  70. Example header:
  71.  
  72. {{{
  73. 84 e1 // encryption seed
  74. 00 00 00 06
  75. 00 29
  76. 00 10
  77. 00 10
  78. 00 01
  79. 00 00
  80. 23 be 64 c6
  81. }}}
  82.  
  83. There is no need for me to reinvent the wheel, if you are curious about the encryption technique you can have a look at Luigi Auriemma's C code; http://aluigi.altervista.org/papers/vent5000dec.zip
  84.  
  85. After attaching the header and encrypting the packet, its sent to the proinfo.ventrilo.com server for verification purposes.
  86.  
  87. After that, a call is made to close the socket (at 0046DBC0), and the structure is cleaned up so that next time 0x57 is received, the verification process starts over again:
  88.  
  89. {{{
  90. 0046DE33   .  33C0          XOR EAX,EAX
  91. 0046DE35   .  33C9          XOR ECX,ECX
  92. 0046DE37   .  33D2          XOR EDX,EDX
  93. 0046DE39   .  8946 1C       MOV DWORD PTR DS:[ESI+1C],EAX
  94. 0046DE3C   .  66:894E 20    MOV WORD PTR DS:[ESI+20],CX
  95. 0046DE40   .  66:8956 24    MOV WORD PTR DS:[ESI+24],DX
  96. 0046DE44   .  8946 28       MOV DWORD PTR DS:[ESI+28],EAX
  97. }}}
create a new version of this paste RAW Paste Data