mBot Loader (Assembly editing)

08/08/2019 12:02 JellyBitz#1
I wanna edit a piece of this loader but I don't know how to get rid exactly, I'm not skilled on it. I'm just moving to use mBot, just for educational purposes :rolleyes:

Somehow NOP the spam messages but with no lossing the loader functionability. Code as reference :

I'm not entirelly sure if it's working using a website (as the original crack) but I know is that not with it getip.joysro.com/custom/getMBotNews.php So I want to remove it with his OnExit event.

I'm trying to avoid using a loopback adapter or any other suspicious loaders (2mb+ just for injecting and/or getting a web response? funny enough!)

Also, there is an IP (46.28.206.6) that could be the reason for mBot login but my suspicious are low since is hosted from switzerland company. Please, think about me like Jon Snow when I'm looking asm.

Here the loader executable :
08/08/2019 16:18 #HB#2
I am not sure if I entirely got you. So, you're trying to remove joysro's website opening on mbot closing from the executable?
08/08/2019 21:54 florian0#3
The binary is a mess because it was compiled in debug mode. Seems to be a thing in sro ... no idea why ... its dumb and makes ppl get random missing dll errors leading them to download random dlls from malicious sites.

[Only registered and activated users can see links. Click Here To Register...]

I'm going to post some generated pseudo-code. It's easier to understand. I don't think going for pure assembly is necessary.

The code you got there is the "news download code". Doesn't seem to be really interesting. Just some WS2_32 communication stuff.

This part seems to open the web page: [Only registered and activated users can see links. Click Here To Register...]

Whats interesting is this part: [Only registered and activated users can see links. Click Here To Register...]
It loops a messagebox ... dafug ... and dword_811000 is set in .... GetNews!

[Only registered and activated users can see links. Click Here To Register...]

Ahhaaaa
[Only registered and activated users can see links. Click Here To Register...]
dword_811000 is the number of news available, and the loop from above just displays one news at a time. Very ... annoying ... (I actually purely guessed this part based on the "##" being also present in the news output [Only registered and activated users can see links. Click Here To Register...])

Anyway ... the heart of the crack ... the heart of about any mBotCrack out there ... is this:
[Only registered and activated users can see links. Click Here To Register...]

I think everyone is just reusing the crack.dll made by coldFever/NoEx. His server went offline long time ago, so the crack stopped working. Everyone is just replacing the ip inside the dll with a different one. Thats all. No crack magic performed by anyone.
I have no idea what this server is doing; what it has to answer; if it has to answer at all ... but it shouldnt be that hard to figure out since there is at least one left online.
08/08/2019 22:02 JellyBitz#4
Quote:
Originally Posted by #HB View Post
I am not sure if I entirely got you. So, you're trying to remove joysro's website opening on mbot closing from the executable?
Exactly. I tried other methods but this it's the "easier", working and less suspicious way to use mbot, so I'm using it but this dialog and the page open at the end is killing me in just a few days..

Quote:
Originally Posted by florian0 View Post
Everyone is just replacing the ip inside the dll with a different one. Thats all. No crack magic performed by anyone.
I have no idea what this server is doing; what it has to answer; if it has to answer at all.
I was doubt if the method shown has some data needed for the loading because I tried to nope a few things to see different results but with no success..

That's why it's so light, it's patching the IP from the original loader!
Some method to edit it nicely? (I mean the length issue, for future solutions) The data can be found easily at this forum!
08/09/2019 01:29 #HB#5
There you go, their latest mbot version, I removed their first success message box and closing web shell command. (Scan it on your own)

They simply keep the PID of the main mbot.exe in a static object, then keep checking if the process with this PID exists, if it doesn't, then it terminates itself, closing sockets n stuff as well as opening their website.


Modifications: (in case you wanted to know how I've done it)
Code:
00265372 | EB 22                    | jmp mbotloader.265396                   | Pass first message box
0026542B | EB 1C                    | jmp mbotloader.265449                   | Pass closing shell command
08/09/2019 05:06 JellyBitz#6
Quote:
Originally Posted by #HB View Post
I removed their first success message box and closing web shell command.
...
Modifications: (in case you wanted to know how I've done it)
Code:
00265372 | EB 22                    | jmp mbotloader.265396                   | Pass first message box
0026542B | EB 1C                    | jmp mbotloader.265449                   | Pass closing shell command
Wow, seems easy. This is what I was trying to achieve, nop or redirect a jump address but no idea how. Actually nope a few things give me no results. Certainly I'm going to check what you change. Thanks!

Also, some advice for editing the IP previously mentioned?

- The first I noted was the incorrect file upload. Maybe that was the awkful looping messagebox? I actually made a mess, I even used an ollydbg plugin! Sorry florian!
08/09/2019 14:45 florian0#7
Quote:
Originally Posted by #HB View Post
Code:
00265372 | EB 22                    | jmp mbotloader.265396                   | Pass first message box
0026542B | EB 1C                    | jmp mbotloader.265449                   | Pass closing shell command
I just noticed that these addresses aren't easy to follow along as they are relocated to a different image base. When I try to look them up on my PC, I get nothing because the image-base is different. The image base might even change on your pc when running the binary again. Your image base was 0x250000 while mine is 0x400000. The "preferred" image base of the application is 0x7E0000.
There's nothing wrong with it. Just wanted to point that out so the offsets don't cause confusion.
08/09/2019 17:18 #HB#8
Quote:
Originally Posted by florian0 View Post
I just noticed that these addresses aren't easy to follow along as they are relocated to a different image base. When I try to look them up on my PC, I get nothing because the image-base is different. The image base might even change on your pc when running the binary again. Your image base was 0x250000 while mine is 0x400000. The "preferred" image base of the application is 0x7E0000.
There's nothing wrong with it. Just wanted to point that out so the offsets don't cause confusion.
Seems like you're right.

I'll give some binary then, so searching for them is possible.
Code:
00D75372 | EB 22                    | jmp mbotloader.D75396                   | Pass first message box
00D75374 | 68 90 CC D8 00           | push mbotloader.D8CC90                  | D8CC90:"mBot Started Successfully"
00D75379 | 8B 8D 38 EA FF FF        | mov ecx,dword ptr ss:[ebp-15C8]         |
00D7537F | C1 E1 05                 | shl ecx,5                               |
00D75382 | 81 C1 40 15 D9 00        | add ecx,mbotloader.D91540               |
00D75388 | E8 E1 C1 FF FF           | call mbotloader.D7156E                  |
00D7538D | 50                       | push eax                                |
00D7538E | 6A 00                    | push 0                                  |
00D75390 | FF 15 FC 29 D9 00        | call dword ptr ds:[<&MessageBoxA>]      |


00D7542B | EB 1C                    | jmp mbotloader.D75449                   | Pass closing shell command
00D7542D | 6A 00                    | push 0                                  |
00D7542F | 6A 00                    | push 0                                  |
00D75431 | B9 C0 17 D9 00           | mov ecx,mbotloader.D917C0               |
00D75436 | E8 33 C1 FF FF           | call mbotloader.D7156E                  | Get target website address
00D7543B | 50                       | push eax                                | Target website address
00D7543C | 68 74 CC D8 00           | push mbotloader.D8CC74                  | D8CC74:"open"
00D75441 | 6A 00                    | push 0                                  |
00D75443 | FF 15 C8 29 D9 00        | call dword ptr ds:[<&ShellExecuteA>]    |
02/21/2020 14:15 janicka#9
This is for what is mbot looking after crack:

[Only registered and activated users can see links. Click Here To Register...]
My very old guide:
[Only registered and activated users can see links. Click Here To Register...]
Original thread:
[Only registered and activated users can see links. Click Here To Register...]