just want to let you know that i will not support ventrilo v3.0.
the reason is, the ventrilo guys are authenticating the server against some of their servers.
just have a look at port 6100 when you start ventrilo…

as stated on: http://ventrilo.com/forums/showthread.php?t=23257
they require you to let the client authenticate the server.
if you are behind a firewall, so u’re fucked.

• server calculates some seed (?) and sends this to the client (UDP)
• client contacts flagship-servers and gets some other token (UDP)
• client calculates encryption keys from this
• server sends 0×34 command during TCP-handshake
• client receives 0×34 command
• server modifies encryption lookup tables using the keys from above
• client modifies encryption lookup tables using the keys from above
• both communicate with modified tables now

i hate that “we want control everything”-way everyone goes.

well, i was able to let the win32 client authenticate my server and then use that authentication token to decode the protocol without any problems.
that token seems just to change when the server is restarted – but neither i want to make a dumper for that token nor do i want to re-implement their authentication procedure.
maybe i’ll find another way like bruteforcing the encryption while the server sends pings and information blocks, but i dont think its the right way.

P.S.: these guys really suck!

http://www.g3gg0.de/wordpress/archives/16

more than half a year later he contacted me and sent twice the money he promised before.
obviously he really was busy for long time ;)
thanks Mr. S.C. ;)
okay now about Ventrilo v3.0.x:

i had a look at the protocol. the connection setup is nearly the same. but right after the sever sends the command 0×34, both client and server modify their encryption tables. This results in totally wrong en/decryption.

see http://g3gg0.de/projects/CEntrilo/modify_crypt_buffer.html
and http://g3gg0.de/projects/CEntrilo/modify_crypt_buffer_c.html
its from Ventrilo Server for Linux v3.0.1

i’m not exactly sure what sense this change makes. it’s re-allocating the buffer with a minimum size of 0×40, fills it up with [length]+pos byte values and adds up the old values.
that looks like some weird try to prevent another reversing?!

anyone an idea whats the sense of this code?

it took some hmm 10 hours to implement nearly(!) the whole ARM32 instruction set.
now you can code like this:

.sub useless
.org 0xDEAD1000
.inj 0×00001000
.imp some_call 0xDEAD0100
.code 32

MOVCSS R0, 0xDE000000
@loop:
ADDCS R0, R0, 0×00AD0000
TST R0, R0 LSR 2
BEQ @loop
BL @some_call

.end

this example would inject the generated ARM32-code at offset 0×1000 into the loaded file,
doing some nonsense-operations and after that it will call the function ’some_call’ at address 0xDEAD0100.
since the code is told to be at 0xDEAD1000 (the ‘.org 0xDEAD1000′), the BL will automatically
get calculated to jump about 0×0E00 bytes backwards, where the function ’some_call’ is said to be.

now its not just useful for hacking firmwares, but also very good for crack..erh customizing e.g. symbian apps.

just one note…
ARMada sometimes crashes when typing too long. i dont know why – that happens during the GUI update,
but i really cannot figure out why. but simply use a notepad to code in a clean style, then copy paste it into ARMada ;)
i will try to fix in an upcoming release in which i will also include the last two missing opcodes (coprocessor data and register transfers)

to download, click Projects->ARMada

here some screenshot of the device in action:

really an interesting project :)
won’t tell you exactly what its for, but its used to stream RF radio data with speeds up to 32MB/s to a Win32 program used for recoring and decoding etc.

i’m using Microsoft Visual C++ together with SDCC (Small Devices C Compiler) to compile the firmware for the Cypress chip. the used Win32 driver is the standard Cypress driver for those chips, but interfaced with a DLL i wrote.

i’m using shared memory for distributing data to one or more applications which may preprocess the data stream they get. they redistribute it again over shared memory areas. made also TCP Client/Server tools so that whole thing works via network too.

that project looks quite mature now.
at least everything is working as intended ;)