Introduction

This tutorial is more of a tip than a tutorial. It just explains how to calculate offsets for jumps and calls within the program you are patching.

Types of Jumps/Calls

Here I will just describe the different types of jumps and calls which you will come across:

Short Jumps

Short jumps be they conditional or unconditional jumps are 2 bytes long (or 1 nibble if your Californian ;-). These are relative jumps taken from the first byte after the two bytes of the jump. Using short jumps you can jump a maximum of 127 bytes forward and 128 bytes backwards.

Long Jumps

Long jumps if they are relative are 6 bytes long for conditional jumps and are 5 bytes long for unconditional jumps. For conditional jumps 2 bytes are used to identify that it is a long jump and what type of jump (je, jg, jns etc) it is. The other 4 bytes are used to show how far away the target location is relative to the first byte after the jump. In an unconditional jump only 1 byte is used to identify it as a long unconditional jump and the other 4 are used to show it's target's relative position, as with the conditional jumps.

Calls

There are two different types of calls which we will use. The normal type of call works the same as the long jumps in that it is relative to it's current position. The other type gives a reference to a memory location, register or stack position which holds the memory location it will call. The position held by the later is direct e.g. the memory location referenced may contain 401036h which would be the exact position that you would call, not relative to the position of the call. The size of these types of calls depends on any calculations involved in the call i.e. you could do: 'call dword ptr [eax * edx + 2]'. Long jumps can also be made using this method, but I didn't say that earlier as to avoid repetition.

Tables

Here is a brief list of all the different types of jumps/calls and their appropriate op-codes. Where different jumps have the same Op-Codes I have grouped them:

Jump Description Short Op-Code Long Op-Code

call procedure call E8xxxxxxxx N/A

jmp u nconditional jump EBxx E9xxxxxxxx

ja/jnbe jump if above 77xx 0F87xxxxxxxx

jae/jnb/jnc jump if above or equal 73xx 0F83xxxxxxxx

jb/jc/jnae jump if below 72xx 0F82xxxxxxxx

jbe/jna jump if below or equal 76xx 0F86xxxxxxxx

jcxz/jecxz jump if cx/ecx equals zero E3xx N/A

je/jz jump if equal/zero 74xx 0F84xxxxxxxx

jne/jnz jump if not equal/zero 75xx 0F85xxxxxxxx

jg/jnle jump if greater 7Fxx 0F8Fxxxxxxxx

jge/jnl jump if greater or equal 7Dxx 0F8Dxxxxxxxx

jl/jnge jump if less 7Cxx 0F8Cxxxxxxxx

jle/jng jump if less or equal 7Exx 0F8Exxxxxxxx

jno jump if not overflow 71xx 0F81xxxxxxxx

jnp/jpo jump if no parity/parity odd 7Bxx 0F8Bxxxxxxxx

jns jump if not signed 79xx 0F89xxxxxxxx

jo jump if overflow 70xx 0F80xxxxxxxx

jp/jpe jump if parity/parity even 7Axx 0F8Axxxxxxxx

js jump if sign 78xx 0F88xxxxxxxx

Calculating Offsets (finding in the xx's in table)

You will need to be able to calculate offsets when you add jumps and make calls within and to the code you have added. If you choose to do this by hand instead of using a tool then here are the basics:

For jumps and calls further on in memory from your current position you take the address where you want to jump/call and subtract from it the memory location of the next instruction after your call/jump i.e.:

(target mem address) - (mem location of next instruction after call/jump)

Example

If we wanted to jump to 4020d0 and the next instruction *after* the jump is at location 401093 then we would use the following calculation:

4020d0 - 401093 = 103d

We then write the jump instruction in hex as e93d100000 where e9 is the hex op-code for a long relative jump and 3d100000 is the result of our calculation expanded to dword size and reversed.

For jumps and calls to locations *before* the current location in memory you take the address you want to call/jump to and subtract it from the memory location of the next instruction after your call/jump, then subtract 1 and finally perform a logical NOT on the result i.e.

NOT(mem address of next instruction - target mem address - 1)

Example

If we wanted to call location 401184 and the address of the next instruction after the call is 402190 then we do the following calculation:

NOT(402190 - 401184 - 1 ) = ffffeff4

We can then write our call instruction in hex as e8f4efffff where e8 is the hex op-code for relative call and f4efffff is the result of the calculation in reverse order.

If you want to practice with different examples then the best way to do this is to use a disassembler like WDASM which shows you the op-codes and try and work out the results yourself. Also as an end note you don't have to perform these calculations if you have enough room to make your jump or call instruction into an absolute jump call by doing the following as represented in assembler:

mov eax, 4020d0

call eax (or jmp eax)

Final Notes

Make life easier and use a program to do this ;-)

Introduction:

This is a tutorial on chaining proxies for the use of becoming more anonymous while online. There aren’t enough tutorials online about this subject so I decided to make an attempt at writing one. Since it’s on the subject, I included a section on chaining wingates to become anonymous on telnet.

------------------------------------------------------------------------------------

I’m going to assume that most of you have already used a proxy before to hide your real IP address or domain or maybe just used one to surf anonymously online. If you didn’t, well hopefully you can keep up and possibly learn how to use a proxy. Its also best if you know what an IP address or Domain is first, before reading this tutorial. Hmm, I guess I have to show you where to find a proxy too. Well I find that good, updated proxy websites are…

http://www.multiproxy.org/anon_list.htm

http://tools.rosinstrument.com/proxy/

It will be up to you to figure out which ones work or not. I’m not going to do all the work for you icon_smile.gif. You can check and see if the proxy works by going to http://www.privacy.net to see if your IP address changed.

------------------------------------------------------------------------------------

Proxy Servers

A proxy is a server that acts as a gateway between your computer and your destination (website, IRC chat, etc.). These proxies receive requests from users to view, for example, a web page. The proxy will then forward the request to the internet, find your requested page, then send the web page back to you, the user. Most proxies come with a cache (sounds like “cash”) feature that saves former websites that were visited on that proxy. Think of cache as a proxy’s storage room. Each site that you make the proxy visit, it saves in its own storage area (cache). So if the user or someone else requests the same site again later on, the proxy will go back into its cache, find the web page and send it back to the user. This saves time because the proxy doesn’t have to go search the Internet for the web page. It just pulls the site out of its cache.

The use of proxies to stay anonymous is a favorite thing to do among people on the Internet who are either paranoid or just security conscious. The anonymity factor comes from the proxy’s ability to hide your true Internet address. For example, if I were to run a scan on your computer right now, I would get the Internet address that was given to you by your ISP (internet service provider), but if I were to scan you while you were using a proxy, then I would get the Internet address of the proxy server. Basically the whole proxy picture looks like this…

[User]>>>>>[Proxy]>>>>>[Web Pages]

Simple enough, right? Right. So now let’s get to the chaining part.

Proxy Chaining

Proxy chaining is merely connecting to more than one proxy and then to your intended destination. You can use as many proxy servers as you can or want. The more you have, the more anonymous you will be. Remember, it doesn’t matter how many proxies you chain together, you will never be 100% anonymous. Let’s look at an example…

[User]>>>>>[Proxy1]>>>>>[Proxy2]>>>>>[Proxy3]>>>>>[Proxy4]>>>>>[Destination]

The example shows that for a proxy chain to be created, the user must first connect to Proxy1. Once the user is connected to Proxy1, from Proxy1, the user will connect to Proxy2, from Proxy2, the user will connect to Proxy3, from Proxy3, the user will connect to Proxy4, from Proxy4, the user will then connect to the intended destination (web page, Unix server, ftp server, etc.). All together we have 4 proxies in this example. Each proxy is a link in the chain. If the user would be scanned while on the proxy chain in the example, the IP address or domain of Proxy4 would appear on the scan. Now the problem with proxies is they tend to “die out” in a few weeks or less. It all depends. So if Proxy2 were to cease functioning, the chain wouldn’t work. You would need to get rid of Proxy2 and just use Proxy1, Proxy3, and Proxy4 or find another proxy to take Proxy2’s place. This is why proxy chaining can be a real pain if you are using them just to surf the net. If one dies, you have to figure out which one is the one not working, so you have to go through each one to check them or until you find the one that isn’t working.

Proxy chaining is a necessity if you plan on using proxies to execute a “hack”. If you are attempting to gain unauthorized remote access to any server, whether it is through telnet, ftp, or http, chaining is a must. As I said, you will never be 100% anonymous no matter what you do online so it is possible that you still can be tracked even if u chain proxies. Chaining just makes it a lot hard to track someone. To make it even harder, its best to use foreign proxies because if someone wanted to trace you, they would need to get logs of your use of each proxy from each proxy administrator. This could take quite a while or even never at all if one of the proxy’s, or all for that matter, belong to an admin in a country that isn’t too fond of the country you are located in. The longer it takes for the authorities to subpoena the logs of your usage of a single proxy from that proxy’s administrator, the more chance that the other proxies that you used in the chain will have their logs deleted by the time anyone gets to the server administrators of those proxies. So when attempting to do any kind of “hack”, it’s best to use at least five or six proxies in a chain.

HTTP Chaining

HTTP chaining is basically chaining a proxy server in your browser’s address bar. Example:

http://proxy.magusnet.com/-_-http://www.google.com

Notice how the above proxy and destination (yahoo) are seperated by a (-_-) If you wanted to make a chain out of this you would simply add another proxy ex. ( http://proxy.server1.com/-_-http://proxy.server2.com/-_-http://www.destination.com)

Another way to use proxys in your address bar is by adding the proxy IP or domain then the port number. Example…

http://anon.free.anonymizer.com:80/http://www.google.com

Notice how the above proxy and destination server are seperated this time by a (/) forward slash instead of a (-_-) dash, underscore, dash. To make a chain out of this you would again simply add another proxy ex. ( http://proxy1:80/http://proxy2:80/proxy3:80/http://www.yahoo.com)

Browser Chaining

To browser chain is fairly easy. I’ll use Internet Explorer as an example since I believe it is the browser that most people have and use. First you need to find the Internet Options. You can do this by either finding the Explorer icon on the desktop, right click on it, then press properties or if you have a browser window already opened if you are online then you can go to Tools (or sometimes its View) and press Internet Options. Now that you have the Internet Options window up you can now go to the Connections tab, then go to the first Settings button (not LAN Settings, the one above it) and click it. Now you should be in the Settings box. Put a check in the box where it says to Use a proxy server. Now if you wanted to surf using one proxy you would merely put the proxy in the Address: space and put the proxy’s port number in the Port: space. To use a chain here you would put in a proxy along with a “:” colon then the port number followed by a space separting the next proxy then a “:” colon then the port number then a space and so on. The last proxy you add should have its port number placed inside the Port: space. If you did it, then it should look like this exactly…

Address: 213.234.124.23:80 121.172.148.23:80 143.134.54.67 Port: 80

***Notice that each proxy:port is separated by a space and that the last proxy has its port number placed in the Port: space. Do not check the box marked “Bypass proxy server for local addresses”. Press OK when you see that everything is in working order***

Wingates

A wingate is a proxy server that someone installs onto his/her computer which allows for a single or multiple online connection to take place through port 23, the default telnet port. Depending on their security, some wingates will allow anyone online to connect to them and usually stay “alive” or “working” anywhere from a few days to even months. There are people out there that scan for these Wingates and post the computer’s IP number or domain on their website to give anyone online a free list of them to use. You can also scan them yourself by using programs like WinScan.

Chaining Wingates Using Telnet

I’m going to assume you already know what telnet is so I will just get right down to it. To chain using telnet, you would first bring up the DOS prompt and type in “telnet” then your wingate. (Since telnet’s default port is 23 and all wingates run on port 23, the port number is not necessary but I will add it just to show you how you should type any port number out on screen) Example…

C:\WINDOWS>telnet 61.133.119.130 23

So now you have “telnet”, a space, the wingate IP, a space, then the port number 23. Once you are connected to the wingate it should look like this…

Wingate>

Now you would type your next wingate and port number in, then press enter like so…

Wingate> 203.207.173.166 23

You can continue to do this until you connected to as many Wingates as you need. Once you are finished with your wingates you would connect to your destination. Example…

WinGate>arbornet.org

So now the entire picture would look something like this…

C:\Windows> telnet 61.133.119.130 23

Wingate>203.207.173.166 23

Wingate>135.245.18.167 23

Wingate>m-net.arbornet.org

Connecting to host arbornet.org...Connected

Welcome to the Once and Future M-Net

FreeBSD 4.3 (m-net.arbornet.org) (ttypv)

Enter newuser at the login prompt to create a new account

Enter upgrade at the login prompt to find out about increased access

Your Own Home Server - Introduction

An Introduction

In this tutorial you will learn how to step up your own server. This server will be comprised of Apache 1.3.5, PHP 4.2.0, and MySQL 3.23.49. This tutorial will address the basic setup of a server on your own computer. This means the removal of hassles of dealing with the company that is running a remote web server. It will be easy to modify. You can add any thing you want to it, be it CGI/Perl, Zope, Roxen, etc, all by your self. You will have unlimited disk space, well at least as big as your hard drive is =) Now that you know the advantages, it is time that I tell you what i used, and what you will need.

What I used

* Windows 2000 - NOTE that if you are using 2k you WILL NEED Administrative Privileges. If you don't then get them somehow =) If you are on 95, 98, NT, XP, ME, I

* Apache 1.3.6 - I tried to use 2.0 but I could not get it work. I also feel that 1.3.6 is tried and true, so why mess with greatness.

* Mysql 3.23.49 - The newest version of MySQL when I set up my server. MySQL also the is the best PHP supported Database, and well love PHP don't we.

* PHP 4.2.1 - The latest and greatest PHP release. -nt

What you will need

* Apache 2 - Link: h**p://www.apache.org/dist/

* Mysql 3.23.49 - Link: h**p://www.mysql.com/downloads/mysql-3.23.html

* PHP 4.2.0 - Link: h**p://www.php.net/downloads.php

* Windows - This tutorial is ONLY written for new versions of Windows.

Once you have downloaded all the programs you are ready to continue.

1. Installing Apache

Installing Apache

The first step is to download Apache for Windows. Before you install it make sure that any other server software is removed. Remove it all via the control panel.On

Once you have clicked on the executable, a screen should com up that looks like this. Go ahead and click on next

user posted image

Of course you plan to abide be the license agreement, so click on I accept.... and click on next.

user posted image

You really don't need to read this, but if you want you can. Read it if you want feel informed. When you are ready click on next.

user posted image

Here is where the actual setup of Apache begins. For Network Domain put in localhost as for Server Name You want these both to be localhost because the server is running locally, on your computer. It doesn't matter what is in email field, just put in yours. No one will no it because it's just you.

user posted image

For the sake of this tutorial it is better to just leave it as it is because, later in the tutorial I will show you how to start the server with one click of the mouse, and for the sake of ease, it will be easier for you to follow along. You can change it if you want, but you will have to realize where to substitute it. For me the root drive is E: but for you will probably be C:

user posted image

Once you have all the jazz set up, it is time to install the server. If you are on w2k or XP be sure that you have Administrative permissions or you will get an error about half way through the install saving cannot access msvrt32.dll or something. If you get that error run it again when you have admin privileges. Once you are ready click on install.

user posted image

If all went well you just see a screen similar to this. Now it is time to test the install of apache. Click on Start > Program Files > Apache HTTP Server and look for start Start Apache in Console. Click it. Once it says Apache XXXXX running, press Windows Key + R and type -http://localhost/. If the install works you should see a page saying that it works. If all is set and done, continue to the next step.

user posted image

______________________________________________________________________

2. Installing PHP

Once you have clicked on the executable, a screen should come up that looks like this. Go ahead and click on next.

user posted image

Of course you plan to abide be the license agreement, so click on I accept.... and click on next.

user posted image

For this information, we will want the simple standard install. Chances are you if you are reading this tutorial, you will probably not even want to talk about advanced =)

user posted image

This is the mail setup, just enter localhost, and me@localhost.com. These are not important, because you, the admin, are the only person that will use the server, and you will be the one handling errors.

user posted image

We are going to want this install to work is Apache, so click on Apache, and move on.

user posted image

Once you have all the jazz set up, it is time to install the server. If you are on w2k or XP be sure that you have Administrative permission or you will get an error about half way through the install saving cannot access msvrt32.dll or something. If you get that error run it again when you have admin privileges. Once you are ready click on install.

user posted image

After the install is done you should get something that says you will have to manually configure apache to use php. Assuming you have a working Apache server installed, make sure that it is not running. Navigate to C:\Program Files\Apache Group\Apache\conf\ open the httpd.conf file. Note that you can also get to the http.conf from the start menu. Start > Program File > Apache HTTP Server > Configure Apache Server > Edit the Apache httpd.conf Configuration File and the window will open up in notepad. Now hit Ctrl + End if you see something like what follows, you can skip this step. If you do not see that code, copy it. This code will only work if you used the default install folder when you installed php. If you did, copy that code and paste it into the end of the file. Select the code to right, and hit crtl + c , then go into the httpd.conf file and hit ctrl + v and save the file.

ScriptAlias /php/ "c:/php/"

AddType application/x-httpd-php .php .phtml

Action application/x-httpd-php "/php/php.exe"

Now that we have php installed, it is time to test it. Open up notepad and type the code to the right. Save it as phpinfo.php. Remember to set it as all files in the drop down menu, or the file will be a text file. Save in the Directory: C:\Program Files\Apache Group\Apache\htdocs. htdocs is the directory where all the files go. You can create endless dir's and browse them. For Example E:\Program Files\Apache Group\Apache\htdocs\mydir\myfile.php could be accessed as http://localhost/mydir/myfile.php. Once you have that file saved. You will need to start the Server. Click: Start > Program File > Apache HTTP Server >; and look for something like Start Apache in Console. After you have found it, launch it. You should get a window saying that Apache is running. Now go to Start > Run > and type in -http://localhost/phpinfo.php. If you don't see anything, php is not installed correctly. If php is installed correctly, you will see a few large tables, displaying php's configuration. Now Your are 1/2 done!

______________________________________________________________________

3. Installing MySQL

Once you have clicked on the executable, a screen should com up that looks like this. Go ahead and click on next.

user posted image

Of course you plan to abide be the license agreement, so click on I accept.... and click on next.

Just like before you should leave the default dir alone, so you will be able to follow along with me when I show you how to start and stop all the aspects of the server.

Stay with the typical installation. Just like before, if you don't have admin privileges, the install will be faulty. After you click next, the install will begin. After the install has finished, move on to the next step.

Now you have to set up the root account. The root account is the absolute admin of the system, the highest possible. Click on Start > Run and type cmd to open up the command prompt. You are going to have to navigate to where MySQL is installed. Type C: > Enter > cd mysql > Enter > cd bin > Enter. Now you have to tell setup the root settings. Type mysqladmin -uroot password InsertYourPasswordHere then hit enter.

To see an image of the screen, -h**p://www.webmasterstop.com/tutorials/images/doscreen1.gif

What is the point of having a database if you can't easily administer it! That is where phpMyAdmin comes into play. phpMyAdmin is a free piece of software written in php that makes the administration of a mysql or many other types of databases easy. You will want to download (h**p://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.2.6-php.zip?downloadrelease_id=85832)the latest version. Save it in the htdocs folder. Once it is done downloading it, right click on it and select Extract > To Here. When it is done you should end up with a directory in the htdocs folder called phpMyAdmin-2.2.6 To make it easier to access, rename it to phpMyAdmin. After you have renamed it, click on it and look for a file called config.inc Open it. This is where you set the configuration of phpMyAdmin. When you open it up, it should look similar to the image to your side. On yours there should be a few things missing. The $cfgPmaAbsoulteUrl and $cfgservers[$i]['password']. You will need to fill those in between the quotes. for the $cfgPmaAbsoulteUrl enter -http://localhost/phpMyAdmin/ if you followed my instructions to the letter. If you did not rename it or extracted to a different directory, put that in there. For the $cfgservers[$i]['password'] enter the password you entered when you were setting MySQL in the set above. You can refer to the image for help. After you have put the right things in save the file.

To see an image of the screen, -h**p://www.webmasterstop.com/tutorials/images/phpmyadminscreen1.gif

Now we want to test the install of mysql, php, phpmyadmin, and apache all at once. Start apache in console like we did before. Now, you are going to need to start mysql. For myself I made a file that would start mysql for me. Open notepad and type: start c:\mysql\bin\mysqld-nt.exe --standalone and save that as Start MySQL.bat. Once you have saved it, click it. A window should open and then close. Mysql is now running on your computer. After mysql and apache are started go to run again and type -http://localhost/phpMyAdmin/index.php and if everything is installed correctly phpmyadmin should so up. You are almost done! Now we have the easy part =)

4. Finishing it all up

Wow! We mad it through the whole process. Now we want to simplify the whole process of controlling the server. I made a toolbar with all the things I needed. I made a new folder on my desktop and called it Server Folder and put all the stuff there. I made a new shortcut and gave it a value of -http://localhost/ made a shortcut to the PHP Documentation page. Another shortcut to my php editor, which is now unavailable. The phpMyAdmin shortcut is set to -http://localhost/phpMyAdmin/index.php. I made another shortcut htdocs. I moved the Start Apache in Console program that was in the start menu folder and moved it to the server folder. You can take the Start Mysql file you made in the last page and move it to the new folder. After you have put all the desired things into that folder, right click on a blank space in stat menu task bar (where the program boxes lie) and select Toolbars > New Toolbar and navigate to the folder. Voila!

Now all you have to do is click Start Apache in Console , Start Mysql, and Lauch browser biggrin.gif