[tut] How To Find The Ip Of A Client

hummmu · Post by **hummmu** » Wed Feb 16, 2005 8:02 pm

I'm getting sick of newb posting over and over about how to find the IP of client, when its slightly hidden.

If the client is packed.
•First open ur client with a Hex editor.
•Look at the header of the script, where its says “This program cannot be run in DOS mode ... bla bla bla” A bit further down, if ur client is packed then you will see something similar to this “Compressed by Petite ©1999 Ian Luck”
•Then that’s the moment where you say “fuck”, cause that dude who’s hosting the server just gave you an extra 5 min of work, by lamely packing his client.
•Now ur gonna need an unpacker. Probably the best for your ppl lvl of knowledge, would be <a href='http://www.chez.com/sahesa/dwn/ProcDump32.rar' target='_blank'>ProcDump32</a>(YOU HAVE TO RIGHT CLICK). Which is a basic PEunpacker/packer.
•Now unpack the client using ProcDump32, select the unpacking form, based on what is in the header of ur client, when you first hexed it.
As in this example “Compressed by Petite ©1999 Ian Luck”, you would select Petite<1.3.
•Once its unpack you can simply hex it, and find the ip. But if the host bother packing his client, he will probably edit out the word checksum.
But lucky for you, the IP is always on the 000BA500 line. So just use ur hex editor, search for that line, and you get the IP.
•Btw… once the client is unpacked, you can easily code it using OllyDbg, Charlie’s code and directly edit the client with the hacks.

If you don't want to bother unpacking the hole client
•Connect urself to the server, using the client.
•Alt-tab back to window.
•Click on START --- then RUN --- type in CMD
•There a plenty of different command you can type in to get the IP, but probably the best one is: netstat –no
Where n show the address and port of the connection
Where o display the PID of the application.
•And if at that point, you still can’t figure how what you’ve just done, then press CTRL+ALT+DEL, click in the VIEW menu, and select “Select columns” and check the option PID. Then match the PID of ur HB process with the IP you got.

Feel free to comment my procedure, and add yours if you know other way.

-MySeLF-
*pinned* -tyteman

James! · Post by **James!** » Sat Mar 12, 2005 2:54 am

The Link Of The Unpacker is false B)

James! · Post by **James!** » Sat Mar 12, 2005 2:58 am

This it is a Link that it works correctly
<a href='http://www.fortunecity.com/millenium/fi ... f-pd14.zip' target='_blank'>http://www.fortunecity.com/millenium/fi ... d14.zip</a>

bolex17 · Post by **bolex17** » Sat Mar 12, 2005 5:34 am

Another way to do it is..

Tools Required.
TSearch Edited Edtion.
Look on a few pages back, i posted E-Search

Direction
Open up your client, then use Tsearch to target the client, open up the hex editor in tsearch and click the small magnify glass in the hex editor window and search
"magiccfg" without the quotes, scroll a few lines up and you should see the Ip.

hummmu · Post by **hummmu** » Sat Mar 12, 2005 7:27 pm

yeah but depending on the version, the magiccfg is not always at the same place.
The IP is always on the 000BA500 line.

powermage · Post by **powermage** » Sat Mar 19, 2005 9:04 am

actually u can get the ip when u create the acc then u go to history then u look for the numbers ^^ simple and easy =)

hummmu · Post by **hummmu** » Sat Mar 19, 2005 10:04 am

true... but that requires more than 2 brain cells, what most of the ppl who need a TUT to find the IP of a client, have...

soooo drunk, so fuck it, if it dsoesn;t make sense.

SexyJake · Post by **SexyJake** » Tue Jul 05, 2005 4:03 am

Here's a working link for Proc....

<a href='http://www.fortunecity.com/millenium/fi ... f-pd14.zip' target='_blank'>http://www.fortunecity.com/millenium/fi ... d14.zip</a>

Lopo · Post by **Lopo** » Tue Jul 05, 2005 5:48 pm

What happened to the good old cntrl+f checksum error?????????

diwx · Post by **diwx** » Tue Jul 05, 2005 7:55 pm

Lopo wrote: What happened to the good old cntrl+f checksum error?????????

compressed :unsure:

sahar · Post by **sahar** » Tue Aug 30, 2005 4:15 pm

What do you mean by compressed

:huh: :huh:

HzK · Post by **HzK** » Fri Sep 09, 2005 11:58 am

sahar wrote: What do you mean by compressed :huh: :huh:

I think he means that the person packed the client.

Cleroth · Post by **Cleroth** » Mon Oct 31, 2005 9:53 pm

Find the IP of a client? lol. Just go to www.whatismyip.com
:ph34r: :ph34r: :ph34r:

Btw Petite is sux packer.

James! · Post by **James!** » Tue Nov 01, 2005 12:40 am

ProcDump32 Sucks

Inf3ktion · Post by **Inf3ktion** » Tue Nov 01, 2005 5:09 pm

-Clears throat-
Ahem..
Alt+Tab
Start>Run>Cmd
netstat -n