well, first i want to thank the guy i wrote about there:
http://www.g3gg0.de/archives/16
more than half a year later he contacted me and sent twice the money he promised before.
obviously he really was busy for long time ;)
thanks Mr. S.C. ;)
okay now about Ventrilo v3.0.x:
i had a look at the protocol. the connection setup is nearly the same. but right after the sever sends the command 0x34, both client and server modify their encryption tables. This results in totally wrong en/decryption.
see http://g3gg0.de/projects/CEntrilo/modify_crypt_buffer.html
and http://g3gg0.de/projects/CEntrilo/modify_crypt_buffer_c.html
its from Ventrilo Server for Linux v3.0.1
i’m not exactly sure what sense this change makes. it’s re-allocating the buffer with a minimum size of 0x40, fills it up with [length]+pos byte values and adds up the old values.
that looks like some weird try to prevent another reversing?!
anyone an idea whats the sense of this code?