[INFO] IBot datas and tip to make a crack

[Regwin32]

Originally Posted by RBence13

it doesn't so hard cause,the number is the last number of your id.
and the rest of 7 are letters,so if you catch sometimes the first packet,and send me the results,I will find out,believe me

But you made me curious..what's that thing?

That thing is look up at kBOT they have an "KBOTCC", this little Programm it is receive packed's? It is forwarding packet's? The KBOTCC must have an important function!

[RBence13]

Originally Posted by Regwin32

That thing is look up at kBOT they have an "KBOTCC", this little Programm it is receive packed's? It is forwarding packet's? The KBOTCC must have an important function!

Look,KBotcc has a lot of afterwards,for example all of your bought lincese can be watched in the same time without open a browser,or you are able to buy license much easier and faster.
On the other hand harder to trick it out.
Cause we now find out how to "crack" ibot,but if we wanted to trick kbot in this way...do you understand?

[Regwin32]

Originally Posted by RBence13

Look,KBotcc has a lot of afterwards,for example all of your bought lincese can be watched in the same time without open a browser,or you are able to buy license much easier and faster.
On the other hand harder to trick it out.
Cause we now find out how to "crack" ibot,but if we wanted to trick kbot in this way...do you understand?

Yeah, can u send me the iBOT install files?
kBOT is making a Update i cant recive the USER-ID packed
Btw:
kBOT is Sending on 56224 and get on 80
look's like WinHTTP but it isnt

[RBence13]

Originally Posted by Regwin32

Yeah, can u send me the iBOT install files?
kBOT is making a Update i cant recive the USER-ID packed
Btw:
kBOT is Sending on 56224 and get on 80
look's like WinHTTP but it isnt

[Regwin32]

Originally Posted by RBence13

Cant find the Packet witch transport the User-ID can you make a Screenshot or something like that?

€DIT my Packet

[killer87581]

Guys what do u mean with block major.mail,com or somethink i dont know the name sry^^
But how can i do that without a programm ?

ty

[RBence13]

I use a crack what doesn't work good,and let the id go through itself,so I can see it here:


Edit: IBot_crack.exe 5144 TCP bence-pc 9133 xeon27.ua-hosting.com.ua 8084 ESTABLISHED 1 49 49 1

[Regwin32]

Originally Posted by RBence13

I use a crack what doesn't work good,and let the id go through itself,so I can see it here:

 Spoiler

 Spoiler

Did you buy the Crack or you're investigate how it work?
BTW: Posted my Packet on the 5Site

€DIT: iBOT connect 2

[RBence13]

I didn't buy anything,I just investigate,but as I said it doesn't work
Can I ask which program do you use for see the packet?
I haven't found yet. : D

Edit: I don't know how,but the ibot's server camouflage itself.
Yesterday the web address was mail.majar.com and now xeon27.ua-hosting.com.ua.
Unfortunately we can't ping it longer,but I got the ip so I write it again but for last time:
82.98.86.167

[Regwin32]

Originally Posted by RBence13

I didn't buy anything,I just investigate,but as I said it doesn't work
Can I ask which program do you use for see the packet?
I haven't found yet. : D

I'm using TCP-View like you and Wireshark
Wireshark sniff everything so you have all Packet's
I hate in TCP-View that the Packet's refreshed in 1,2 or 5 sec's
Wireshark save them in a log

[Christophur]

You could take a look in the iBot install folder.

I found this:

\Profibot\IBot 4.31\darkorbit\resources\IBot.properties


Lines 303 - 313

#License
license.title=License
license.loading=LOADING
license.message.expire=Your license has expired.
license.message.update=The license server is being updated, please try again later.
license.message.oldVersion=This version is no longer supported, please install the update.
license.expire.pay=Pay
license.wp=Detected running Wicked Patcher (WP), please close it.
license.kt=License Key
license.km=<html>Please enter License Key for <font color="#008000">User ID %UID%</font><br><font color="#808080" size="-2">License key can be fount in <a href="http://profibot.net/en/account/license">My Account - Licenses</a><br>To insert key use Ctrl + V</font></html>
license.ke=Invalid License Key

[RBence13]

Originally Posted by Christophur

You could take a look in the iBot install folder.

I found this:

\Profibot\IBot 4.31\darkorbit\resources\IBot.properties


Lines 303 - 313

#License
license.title=License
license.loading=LOADING
license.message.expire=Your license has expired.
license.message.update=The license server is being updated, please try again later.
license.message.oldVersion=This version is no longer supported, please install the update.
license.expire.pay=Pay
license.wp=Detected running Wicked Patcher (WP), please close it.
license.kt=License Key
license.km=<html>Please enter License Key for <font color="#008000">User ID %UID%</font><br><font color="#808080" size="-2">License key can be fount in <a href="http://profibot.net/en/account/license">My Account - Licenses</a><br>To insert key use Ctrl + V</font></html>
license.ke=Invalid License Key

It's just the appearing message.
If you change it and open the ibot as default language you will see it.
It's funny but has no sense

[Christophur]

Originally Posted by RBence13

It's just the appearing message.
If you change it and open the ibot as default language you will see it.
It's funny but has no sense

I noticed that right after I posted it ):, It's just the texts for the program.

[Regwin32]

license.wp=Detected running Wicked Patcher (WP), please close it.

This is an Interesting Line. iBOT detect WP

€DIT

kBot use a dll. called KBot.dll, this .dll is the Crack im nearly 100% sure.
ipworks8.dll is for Kbotcc.exe...

[Rock!]

yes but was old the power97 or onother guy made another script and dont say nothing about license.wp=Detected running Wicked Patcher (WP), please close it.
when wasn't update with the new script say "license.wp=Detected running Wicked Patcher (WP), please close it."