search

blackdtools / Blackd-Proxy-CLASSIC

Blackd Proxy CLASSIC
MIT License
9 stars 7 forks source link

make AutoUpdateRSA immune to ASLR #54

Closed divinity76 closed 8 years ago

divinity76 commented 8 years ago

using CreateToolhelp32Snapshot and Module32First to get the tibia main module address, close to where the RSA key is located, even after ASLR has moved it. as of writing, it is tested successfully on Windows 7 x64, ASLR enabled (and removing adrRSA in config.ini), on versions: 1090 960 860

1 caveat: its pretty CPU intensive to search for the RSA key, it takes about 2 minutes on my Intel Core i7 6700HQ running at 3.5GHz, using about 100% cpu of 1 core

credits to samle code at http://wiki.robotz.com/index.php/Process_List_and_Locate_VB6

divinity76 commented 8 years ago

i don't really understand how the static adrRSA from config.ini can be valid when ASLR is supposed to move everything around though ??? im so confused

blackdtools commented 8 years ago

Don't worry. Blackd Proxy probably converts it to the final address before using it.

divinity76 commented 8 years ago

http://blackdtools.com/blackdproxy.php

OS - Supports WIN 95,98,2000,2003,ME,SE,XP,VISTA,WINDOWS 7

CreateToolhelp32Snapshot was introduced in Windows 2000.. this wont work in 95/98/ME, sorry :p