Luigi Auriemma

Hi Hi :D

Lately I've been looking at ventrilo with a disassembler and I've found some strange events:
EG:

One of them says that your ventrilo server has been closed by the secret service...

What I'm trying to do is see what event triggers that. I really am a total newbie in ASM but you can follow and maybe help me along my path :]
Now I know db hold the message

First I found the db that holds the string




Then referenced backwards and got this


What I did is just change another function from "PUSH 000000" to "CALL 4379B4"

I don't even know if I'm doing it the right way but it does popup with the message that I wanted.. Anyways I'm really struggling to find out what triggers this to happen.

Keep in mind I only started to learn ASM yesterday :[


Also let's say a textbox can hold 177 characters, is it possible to change the value so it holds 200 characters with a disassembler?

Don't be afraid to link me to some ASM tutorials :D

ah ah ah those error messages are incredibly funny 8-)
In short they are the "human message" of the error opcode used for the packet type 6 (the first one received from the server).

the structure of the header of the packet is similar to the following:

so is the server which is so dumb to say that it has been disabled by this or that entity and so on

Thanks for the reply but I really have no idea what that means can you go into more detail of what code you posted means?

And how I might implement it.


I don't think you have understood what I'm trying to do.

I want to send the packet to my server that causes the

to happen

Sorry if it's alot but I gotta learn somewhere :D

that message is only in the client, in fact it's a message showed on the client and not on the server.
so probably you refer to how forcing that type of banning on the server, right?
I "think" (if you want I can check it later) that this banning is activated through the packets received by the centralized master servers when the server contacts them at the beginning.

at the moment replicating that thing is not so easy because ventrilo 3 uses that boring centralized stuff so all my tests were performed with a modified ventrilo_proxy which instead of forwarding the normal server packet sends a new one containing that data, so it sux a bit

If you don't mind you can check. I'd have no idea how to check for this.


But.. I just don't want you to do it, I wanted to learn how this is done. So I can help people later like you helped me :D

ok, let me think if I can give you some hints about learning assembly... uhmmm I learnt it mainly with real practice using debuggers and disassemblers.

in this case you can use the usual breakpoint on recv (for the Ventrilo data) or recvfrom (for the centralized Flagship servers data) and then the breakpoint on the received packet for following all the instructions performed over the memory and everytime you see an assembly instruction that you don't know just watch what happens in the debugger (registers, flags and sometimes memory) or refer to an x86 assembly manual or to the "intel set reference"

What debugger do you use?


Personally I use Ollydbg,w32dasm, I saw a post that you used something called IDA but never found it :[


EDIT: Now I always have this problem with debuggers lets use ventrilo for example.. and ollydbg I load up ventrilo in there and press F9 to run it. I'm trying to find where the comment input is. Is there anyway to find with a debugger where the current running code is?

Thanks, but ill stick with olly also :D


And I found a really good tutorial about memory and breakpoints that answer my question from before.





Here's the tutorial : http://www.youtube.com/watch?v=5lYCC65nl5Q

I don't understand what the last line of your point was supposed to mean "but i still would like to know if i saw the point this time :)"

And Luigi any luck with the funny messages?

no JD, except for that test made with the client to see the message "in action" I have not spent other time on Ventrilo due to the lack of interest (at the moment!) on this thing and generally on new projects.

This is kinda off topic but I don't see the point in making a new post:



On ventrilo I'm trying to find the address that makes the little green mic lite up (when you talk) with ollydbg. You got any tips on how I would go about finding the address of the action?

Thanks

I think that is called FillRect for placing the green speaker, it's called one time for placing --XMIT-- and a second time for that one

Old bump :]


Can someone help me on this from the original post. I'm stuck


I'm still trying to make my server think its "has been disabled by order of the United States Secret Service."

Do I need to send the packet to the ventrilo server or the centralized ones that flagship has put up?


And Luigi how do you set a breakpoint on Recv data I can't find it?

for the question about how to replicate that thing on the server at the moment I don't have an answer yet.
I have seen that also version 2.3 has this message implemented so I lost some time debugging it and found that the function which builds the packet (0040eca0) creates the packet 6 only through a function (0041d3b0) which gets its parameters from 10 different other functions but none of them passes the needed values (0x200 and 9 or other similar or dynamic values, they pass only 0,1, 2, 0x41 and 4).

and via udp (udp status packet) there are no additional instructions over those which handle the type 1, 2 and 7 (watch ventstat).

the name of the functions is "recv" (case sensitive)