FLdtL9

Members
  • Content count

    70
  • Joined

  • Last visited

  • Days Won

    3

FLdtL9 last won the day on May 27

FLdtL9 had the most liked content!

Community Reputation

7 Neutral

1 Follower

About FLdtL9

  • Rank
    Junior Member
  • Birthday 06/25/1989
  1. It's SSL encrypted, I have found the domain urls, but the code looks for the certificate if I remember correctly. Maybe if OP patches this function and downgrade SSL so all traffic becomes plain text. But this will only work if the server runs the same application on a ''unsecure'' http 80 service).
  2. Try to patch the old swf file that worked, remove the version check.. And test if the protocol is still the same. Maybe it's server sided now? Look in login.as class. All other code is indeed "obfuscated" (variables names just randomized) but still understandable but it just takes a lot of time. Maybe if you enable debug flag in the swf file it will show hints, because I see a lot of debugging shit in the release version lol. hmm lol.... final public static function checkHack() : void { var _loc_2:Array = null; var _loc_3:int = 0; var _loc_1:int = 0; var _loc_4:int = 0; var _loc_5:* = obfuscatedName0DBE; for each(_loc_2 in _loc_5) { var _loc_6:int = 0; var _loc_7:* = _loc_2; for each(_loc_3 in _loc_7) { _loc_1 = _loc_1 + _loc_3; } } if(_loc_1 != obfuscatedName6078) { _log.logRemote("HACK.FORTIFICATION.checkHack", "Fortification CheckHack Fail! received:" + _loc_1 + ", expected:" + obfuscatedName6078); xxx600e46adacee48ffb1816c683a3764fe.errorMessage(xxxd399f2469a5545a79b09c650b7bf6d74.getString(xxxbb08d94205de4063a96903ed910c6360.MAIN, "fortification_error_unexpected_message"), "FORTIFICATION.checkHack", true); } }
  3. Strange, on android 4.4.4 the folder containing those files did not needed chmodding, but on Android 7 it must be chmodded. That was the actual problem.
  4. I have made a simple app. It uses the imports: process and apache.commons.io (FileUtils). When the user runs the app, it does set the permission using supersu (this works). But when it tries to delete a file or open it with FileUtils It will go to my catch function so it fails (while the code works on my android 4.4.4 phone). It should only catch if permissions are wrong, and if the file isn't in the file-system. Both are not the case. This is confusing, because this points to a root problem (not properly rooted device), but why would the permission runtime.exec for su work?! Any of you had similar problems? By the way It's LineageOS nightly build Maybe it's a bug.
  5. Seems to work fine for static binary analysis. But the older version has some small issues. Debugger is not working (or at least not in my case)..
  6. @Yash To be honest the private forum was dead too. So there's nothing lost. But yeah still, if people want me to dig up code, topic's or whatever just let me know by PM.
  7. Anyone tried this decompiler/debugger before? https://www.pnfsoftware.com/ It seems it only runs on java 1.7, if you have 1.8 you must downgrade? In my AS IDE envirment I have 1.8 and I don't feel like messing up my dev machine.
  8. A theme is just a useless freakin theme. Doesn't say anthing about the fora, and the people and it's content..
  9. I found out by reverse engineering another android application that adding the debuggable attribute to true, the applcation can indeed be debugged in a live device in user mode, but it's useless imho. I first had to build my own debuggable app and then deflate the pkz and cp the right hex bytes and added these to another xml manifest file, because apktool_2.0.x.x was broken on newer builds. Now in the new apktool_2.2.2 that I've tried yesterday it nicely works and manifest is ok. But I still didn't reach my goal yet.. Next vector was trying not to patch the dalvik executable in such way to be able to do what I wanted but to downgrade all secure SSL connections. Eventually it worked and did a man in the middle attack. Strangely enough I can't get the application to do what I want it to do. I debugged the application with AS IDE and it again was a pain in the arsh to find out the application really got feeded with my altered network reponse.. Problem is I can't find anything related in the source code, function names are all messed up hence there's no obfucator used of some kind. The src is just so big that it uses classes2.dex lol. If this worked I would have tried to mess with xposed framework, because I know the function name, but I haven't found the code that belongs to it (So I don't know what to alter..). Will try to give JEB a shot maybe I will be able to find what I am looking for.. Perhaps my expectations are a bit too high for a application that has a big financial budget in development and security.. Ah well, it was worth the time anyway.
  10. @Sebas https would indeed be cool, but it doesn't really add much of a benefit. Will make the latency a little bit higher and consume more bandwidth. It will only harden security for let's say when you use a hotel network or open wireless network, not even for modern formgrabbers (because they can grab https too). This is a public board, so the only protection it offers is so that nobody can do a mith on the same network and steal your cookie/session, maybe new pineapple with httpsstrip can look "close" (by the way the new IP.Board has better cookie/session hijack protection, so it could only be exploited/misused if the attacker is on the same IP or has a SOCK server / tunnel running on your network) .. Letsencrypt is indeed free now and finally up and working, maybe one of the administrators could add this feature to the webhost soon. I'm not sure what their opinion is about https for this forum.
  11. There's no default option on either one of these fora cms to do this. You will have to make it yourself or download a plugin. The easiest way is to edit your default forum theme which guests can only load when not registered and simply add it to the page. Here is a simple example, you should edit it and work with the right button class of your signup/reg button (to change it's properties and such) <html> <button id="signupBtn" onclick="location.href='http://google.com';">Register account</button> </html> <script src="https://code.jquery.com/jquery-3.2.1.js"></script> <script> function startTimer(){ var regbnt = document.getElementById("signupBtn"); var counter = 60; setInterval(function() { counter--; if (counter >= 0) { regbnt.disabled = true; document.getElementById("signupBtn").innerHTML = "Wait " + counter; } if (counter === 0) { regbnt.disabled = false; document.getElementById("signupBtn").innerHTML = "Register account"; clearInterval(counter); } }, 1000); } window.onload = function WindowLoad(event) { startTimer(); } </script> This is by no means "secure". It's just so that users will read your TOS or wait 60 seconds. Automated spam bots will still be able to register within these 60 seconds!
  12. You don't need a plugin at all. You could simply make that client sided by using javascript.
  13. I've been searching on the net for some benchmarks and stuff to cmp Win7(latest build) with Win10. So far it seems that Win7 performs better if not the same as Windows 10.. Windows 8.1 is somewhat a little bit faster than 7 (not worth the effort imho..) for the graphics performance it's also not worth it if you have a gpu that supports only up to DX11. Is this still the same or have there been major performance improvements over the past year?
  14. Here you go. https://github.com/rossja/TinyNuke
  15. Friend helped me with searching, he digged up a funny thread http://www.overclockers.com/forums/showthread.php/634092-Has-anyone-seen-foil-used-instead-of-heat-sink-compound
  • Who's Online   0 Members, 0 Anonymous, 4 Guests (See full list)

    There are no registered users currently online