All credits for the reverse go to:
OldTimeDev (ragezone)
qwertzpaul for some hints (ragezone)
me (pwet99 on ragezone)
First you need to know this will only work with an ipv4 or a domain name that takes up to 15 bytes.
1) Download a 120k dll (unpacked ones), I uploaded plenty from different sources there:
You must be registered to see links
I will take "conquestaion" dll as an example.
They use "qcai.zapto.org" as their domain name so it's 14 bytes if you count each character as 1 byte.
2) Open the dll in any good hexadecimal editor like
You must be registered to see links
3) Go to offset 0x3C3E (with 16 bytes per line on HxD)
4) You will find a byte, 0x0E for conquest aion's dll, it's the length of the string you will use as an ip/dns so you have to count how many bytes you need to put here.
Example: 127.0.0.1 takes 9 bytes so "9" in hexadecimal is 0x09, you will need to replace 0x0E you found earlier by 0x09.
5) Go to offset 0x16C84 (with 16 bytes per line on HxD)
This is the start of the ip/dns that is encrypted and you will need to edit those bytes to put your own.
In conquest aion's dll you should have: 0F 39 3F 07 4C 10 3F 0E 0A 0D 4C 0D 08 05 00
00
It's 16 bytes and it means "qcai.zapto.org" (you will see why in part 6)
That string has to be terminated with a NULL byte and that's what the 16th byte (in
red) is for.
Since "qcai.zapto.org" only takes 14 bytes the 15th byte is also NULL.
6) Since those bytes are crypted you will need the table to know what to write, here's the one we made:
Code:
0 1 2 3 4 5 6 7 8 9
4E 4F 48 49 4A 5B 54 55 56 57
a b c d e f g h i j k l m n o p q r s t u v w x y z . -
3F 38 39 3A 0B 04 05 06 07 00 01 02 33 0C 0D OE 0F 08 09 0A 1B 14 15 16 17 10 4C 73
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
5F 58 59 5A 2B 24 25 26 27 20 21 22 53 2C 2D 2E 2F 28 29 2A 3B 34 35 36 37 30
So as you can see any character has a corresponding hexadecimal code, that's what you will need to write in hxd at the offset you are.
Let's take 127.0.0.1 as an example again.
1 2 7 . 0 . 0 . 1
if you look at the table, should be
4F 48 55 4C 4E 4C 4E 4C 4F
which takes exactly 9 bytes.
So let's replace 0F 39 3F 07 4C 10 3F 0E 0A 0D 4C 0D 08 05 00
00
by 4F 48 55 4C 4E 4C 4E 4C 4F 00 00 00 00 00 00
00
7) There you go, save the file put in in aion's bin32 folder and your ip/dns won't be blocked
I won't make any support for this guide it's just something I wanted to write quickly to help you and share.
A better tutorial/tool which is more user friendly and easy to use will probably come on ragezone.
Regards.
Loxo/Pwet99
Can't wait for a tool!
