ghost and huhuhaha

Post by **charlie** » Wed Dec 10, 2003 12:03 pm

hey i got korean test server exe off a friend and it looks like siementech is trying a new type of protection its still protected with asp and all but when you execute the file it asks you to run from helbreath.exe (the updater program i assume) ive been trying what i know to try and bypass it but im not really sure where to add nops and all ill upload the program ive work out its at 49D9**

huhuhaha · Post by **huhuhaha** » Wed Dec 10, 2003 6:41 pm

:huh: Protection?

Judging from their abilities in handling simple bug/loophole I doubt this any protection at all & I'm right. They're using commandline parameter.
"TestServer" or "TestServermihosoft".

Code: Select all

0049D8D7 &nbsp;|. BF 14454C00 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; edi, _TeHelGa.004C4514 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&#59; &nbsp;ASCII "TestServer"
0049D8DC &nbsp;|. 83F9 0F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;cmp &nbsp; &nbsp; ecx, 0F
0049D8DF &nbsp;|. B9 05000000 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; ecx, 5
0049D8E4 &nbsp;|. 8BF2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; esi, edx
0049D8E6 &nbsp;|. 76 46 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jbe &nbsp; &nbsp; short _TeHelGa.0049D92E
0049D8E8 &nbsp;|. 33C0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; xor &nbsp; &nbsp; eax, eax
0049D8EA &nbsp;|. 66&#58;F3&#58;A7 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; repe &nbsp; &nbsp;cmps word ptr es&#58;&#91;edi&#93;, word ptr &#91;esi&#93;
0049D8ED &nbsp;|. 75 72 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jnz &nbsp; &nbsp; short _TeHelGa.0049D961

into

0049D8E6 &nbsp; &nbsp; EB 79 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jmp &nbsp; &nbsp; short _TeHelGa.0049D961

Post by **charlie** » Wed Dec 10, 2003 10:16 pm

thanks dude :wub: