3 ms·

agreed, I don't see any transmission code... btw, help me understand the use of the DnsFree variable... why is it often exor'd with 0x23dc67e8? is that the a

by diydsp 13y ago

agreed, I don't see any transmission code... btw, help me understand the use of the DnsFree variable... why is it often exor'd with 0x23dc67e8? is that the addr of a routine and exor is faster than adding? thank you.

yoha 13y ago
From the reddit comments: http://www.reddit.com/r/GlobalOffensive/comments/1y0kc1/vac_now_reads_all_the_domains_you_have_visited/cfgtkev http://www.reddit.com/r/GlobalOffensive/comments/1y0kc1/vac_...
TheAnimus 13y ago
As it tests if it it's equal to 0x23dc67e8 after XOR, I'm guessing this is a protection against some patching or similar. It get's XOR'd once after the GetProcAddress, then XOR'd back before the STDCALL invocation. This is done for both the GetProcAddress calls, so I'm going to just guess that this is some anti-patching anti-cheat shenanigans.
- yoha 13y ago
  That's just in-memory obfuscation. The value is xored with 0x23dc67e8 when set and the variable xored again whenever is used. Its first use is to check that the symbol was resolved correctly, that implies testing for NULL/0. The compiling-decompiling process made it so that it is actually just comparing the variable to the mask.