mircv6 by davy hollevoet - Version 1.0.3.2
$Id: mircv6.h,v 1.6 2006/08/03 17:45:05 davy Exp $
$Id: mircv6.c,v 1.8 2006/08/03 18:57:55 davy Exp $
$Id: binarypatcher.c,v 1.5 2006/08/03 18:57:55 davy Exp $
$Id: utils.c,v 1.4 2005/10/09 15:53:42 davy Exp $
$Id: faked.c,v 1.6 2006/08/03 17:45:05 davy Exp $
$Id: sockets.c,v 1.5 2006/08/03 17:45:05 davy Exp $
$Id: funcutils.c,v 1.2 2006/08/03 08:59:59 davy Exp $
mirc.exe at 0x400000
4 sections
optional header size: 224
found datasection on 005A4000 (len 191fc)
import table rva: 0x1ba814
name rva: 0x1bb270
dll name: WINMM.dll
name rva: 0x1bb27a
dll name: WSOCK32.dll
two arrays are at 0x5bb0b8 and 0x5a478c
Image is looking for ordinal 0x70
Image is looking for ordinal 0x14
set ordinal 0x14 to 0x5ba828
Image is looking for ordinal 0x6
set ordinal 0x6 to 0x5ba828
Image is looking for ordinal 0x2
set ordinal 0x2 to 0x5ba828
Image is looking for ordinal 0x11
set ordinal 0x11 to 0x5ba828
Image is looking for ordinal 0x17
set ordinal 0x17 to 0x5ba828
Image is looking for ordinal 0xd
set ordinal 0xd to 0x5ba828
Image is looking for ordinal 0xb
set ordinal 0xb to 0x5ba828
Image is looking for ordinal 0x66
Image is looking for ordinal 0x67
set ordinal 0x67 to 0x5ba828
Image is looking for ordinal 0x6c
Image is looking for ordinal 0xe
Image is looking for ordinal 0x39
Image is looking for ordinal 0x10
set ordinal 0x10 to 0x5ba828
Image is looking for ordinal 0x13
set ordinal 0x13 to 0x5ba828
Image is looking for ordinal 0x9
Image is looking for ordinal 0x4
set ordinal 0x4 to 0x5ba828
Image is looking for ordinal 0x6f
Image is looking for ordinal 0x1
set ordinal 0x1 to 0x5ba828
Image is looking for ordinal 0x65
set ordinal 0x65 to 0x5ba828
Image is looking for ordinal 0x16
set ordinal 0x16 to 0x5ba828
Image is looking for ordinal 0x3
set ordinal 0x3 to 0x5ba828
Image is looking for ordinal 0xa
set ordinal 0xa to 0x5ba828
Image is looking for ordinal 0x8
Image is looking for ordinal 0x74
Image is looking for ordinal 0x15
set ordinal 0x15 to 0x5ba828
Image is looking for ordinal 0x73
Image is looking for ordinal 0xf
patched 17/17 functions
libeay32.dll at 0x10000000
5 sections
optional header size: 224
import table rva: 0xcd654
name rva: 0xcd8f4
dll name: WSOCK32.dll
two arrays are at 0x100cd88c and 0x100a51ac
Image is looking for ordinal 0x11
set ordinal 0x11 to 0x100cd654
Image is looking for ordinal 0x14
set ordinal 0x14 to 0x100cd654
Image is looking for ordinal 0x2
set ordinal 0x2 to 0x100cd654
Image is looking for ordinal 0xd
set ordinal 0xd to 0x100cd654
Image is looking for ordinal 0x1
set ordinal 0x1 to 0x100cd654
Image is looking for ordinal 0xe
Image is looking for ordinal 0xc
Image is looking for ordinal 0x71
Image is looking for ordinal 0x74
Image is looking for ordinal 0x73
Image is looking for ordinal 0x34
Image is looking for ordinal 0x7
Image is looking for ordinal 0x37
Image is looking for ordinal 0xf
Image is looking for ordinal 0x9
Image is looking for ordinal 0x8
Image is looking for ordinal 0x17
set ordinal 0x17 to 0x100cd654
Image is looking for ordinal 0x15
set ordinal 0x15 to 0x100cd654
Image is looking for ordinal 0x4
set ordinal 0x4 to 0x100cd654
Image is looking for ordinal 0x13
set ordinal 0x13 to 0x100cd654
Image is looking for ordinal 0x70
Image is looking for ordinal 0x10
set ordinal 0x10 to 0x100cd654
Image is looking for ordinal 0x6f
Image is looking for ordinal 0x16
set ordinal 0x16 to 0x100cd654
Image is looking for ordinal 0x3
set ordinal 0x3 to 0x100cd654
patched 12/17 functions
found version at 0x5a77a8
newsocket()
makenewsocketstruct()
sockcount: 1
bind()
intercepted identd startup, using ipv6
makenewsocketstruct()
sockcount: 2
listen()
also listen()ing on ipv6 (identd)
newWSAAsyncSelect()
inet_addr(irc.dream-irc.de)
WSAAsyncGetHostByName(irc.dream-irc.de)
newinet_ntoa()
newinet_ntoa()
newinet_ntoa()
newinet_ntoa()
newsocket()
makenewsocketstruct()
sockcount: 3
bind()
setsockopt()
newWSAAsyncSelect()
connect()
newWSAAsyncSelect()
shutdown()
closesocket()
sockcount: 2
shutdown()
closesocket()
also closing ipv6identsocket
sockcount: 1
sockcount: 0
unload called!