Quote:
Originally Posted by linksus
KBOT = cracked IBOT (injected kbot.dll)<--- LoL^^
you know what that is for a work? never
|
I am confident in my words.
For the sake of the experiment:
1) Copy the file ispolnyaemy ibot.exe of distribution from the official site in the folder containing the KBot
2) Start Ibot.exe
3) Surprise.
4) It's not all. Click on the empty space under the elements of a login and password. Open official site KBot `a. All this because, quite simply replaced by the string.
5) And this is not all. kbot.dll loaded by the Java virtual machine patch to address spaces IBOT`a and run code:
Code:
Align 4
L10002380:
push esi
mov esi,[esp+0Ch]
mov eax,SWC10024C5C_IBot_3_56_GG
mov edx,esi
push edi
mov ecx,00000018h
sub edx,eax
L10002394:
mov edi,[edx+eax]
cmp edi,[eax]
jnz L100023B6
sub ecx,00000004h
add eax,00000004h
cmp ecx,00000004h
jnc L10002394
pop edi
pop esi
mov dword ptr [esp+08h],SWC10024C78_KBot_5_56_GG
jmp [L1002D9DC]
L100023B6:
mov eax,[esp+0Ch]
push esi
push eax
call [L1002D9DC]
pop edi
pop esi
retn 0008h