当前位置：首页 > news >正文

RM服务器研究（一）

news 来源：原创 2024/9/29 9:05:56

客户端默认端口是10100：
MultiPort.dll
BOOL sub_10001070()
{
UINT v0; // esi
BOOL result; // eax
CHAR KeyName; // [esp+Ch] [ebp-10Ch]
DWORD flOldProtect; // [esp+10h] [ebp-108h]
CHAR Buffer; // [esp+14h] [ebp-104h]
char v5; // [esp+15h] [ebp-103h]
__int16 v6; // [esp+115h] [ebp-3h]
char v7; // [esp+117h] [ebp-1h]

Buffer = 0;
memset(&v5, 0, 0x100u);
v6 = 0;
v7 = 0;
wsprintfA(&KeyName, aD, dword_10009A58);
GetCurrentDirectoryA(0x104u, &Buffer);
strcat(&Buffer, aInfoDll);
v0 = GetPrivateProfileIntA(AppName, &KeyName, 10100, &Buffer);
result = VirtualProtect((LPVOID)0x413E31, 4u, 0x40u, &flOldProtect);
if ( result )
MEMORY[0x413E31] = v0;
return result;
}

在配置文件info.dll中指定登录端口：
[IP]
Count=1
0=XX测试,XXip
[Port]
Count=1
0=50101

客户端默认登录端口由10100修改为10101
IDA打开MultiPort.dll，在Patched bytes界面将
68 74 27 00 00 51 68 38 70 00 10 FF 15 04 60 00
改为
68 75 27 00 00 51 68 38 70 00 10 FF 15 04 60 00
打开Apply patches to input file界面
点击【OK】

登录服多开，配置文件rmServer.ini改为ipServer.ini
IDA在Patched bytes界面将
6E 66 69 67 5C 72 6D 53 65 72 76 65 72 2E 69 6E
改为
6E 66 69 67 5C 69 70 53 65 72 76 65 72 2E 69 6E
打开Apply patches to input file界面
点击【OK】
修改后的svIP1.exe

C:\RedMoonSvr\Bin>svIP1.exe -i0 -msf -nosetfirst

C:\RedMoonSvr\Bin>netstat -ano|findstr "50101"
TCP 0.0.0.0:50101 0.0.0.0:0 LISTENING 7332
TCP 172.18.198.78:50101 59.173.180.3:25392 ESTABLISHED 7332

C:\RedMoonSvr\Bin>svIP1.exe -i0 -msf -nosetfirst

C:\RedMoonSvr\Bin>tasklist|findstr "svIP"
svIP.exe 6088 RDP-Tcp#0 2 11,360 K
svIP1.exe 1264 RDP-Tcp#0 2 10,500 K

C:\RedMoonSvr\Bin>netstat -ano|findstr "10101"
TCP 0.0.0.0:10101 0.0.0.0:0 LISTENING 1264

C:\RedMoonSvr\Bin>netstat -ano|findstr "10100"
TCP 0.0.0.0:10100 0.0.0.0:0 LISTENING 6088

无网关版本：
C:\Users\Administrator>tasklist|findstr "svIP"【相当于登录服，端口10100】
svIP.exe 6088 RDP-Tcp#0 2 11,068 K

C:\Users\Administrator>netstat -ano|findstr "10100"
TCP 0.0.0.0:10100 0.0.0.0:0 LISTENING 6088

C:\Users\Administrator>tasklist|findstr "svMapCenter"【统计在线人数，相当于协调服，端口10113】
svMapCenter.exe 6600 RDP-Tcp#0 2 14,324 K

C:\Users\Administrator>netstat -ano|findstr "6600"
TCP 0.0.0.0:10113 0.0.0.0:0 LISTENING 6600

IDA查询.exe中的端口号
选择Binary search
Enter binary search string:
单选框选中Decimal，String:10100
单选框选中Hex，String:2774【10100的16进制表示为2774】
复选框选中:Find all occurrences
点击【OK】

.data:0041EF64 aIp_0 db 'IP',0 ; DATA XREF: sub_413C60+1F7↑o
.data:0041EF9C aInfoDll db 'info.dll',0 ; DATA XREF: sub_413C60+8E↑o

.text:00413E2D mov dword ptr [esp+174h+hostshort], 2774h

C:\Users\Administrator>cd C:\RedMoonSvr\Bin
C:\RedMoonSvr\Bin>svIP.exe -i0 -msf -nosetfirst
C:\RedMoonSvr\Bin>netstat -ano|findstr "20220"
TCP 0.0.0.0:20220 0.0.0.0:0 LISTENING 90548
C:\RedMoonSvr\Bin>tasklist|findstr "svIP"
svIP.exe 90548 RDP-Tcp#1 2 14,952 K
C:\RedMoonSvr\Bin>msconfig

C:\Documents and Settings\Administrator>wmic process where processid=3316 get ex
ecutablepath
ExecutablePath
E:\网关\红月网关.exe

C:\Documents and Settings\Administrator>wmic process where processid=3876 get ex
ecutablepath
ExecutablePath
D:\RedMoonSvr\Bin\svIP.exe

C:\Documents and Settings\Administrator>wmic process where processid=3700 get ex
ecutablepath
ExecutablePath
D:\GMTool带监控\redmoon_as.exe

C:\Documents and Settings\Administrator>wmic process where processid=3828 get ex
ecutablepath
ExecutablePath
D:\RedMoonSvr\Bin\svMapCenter.exe

RM网关
C:\Documents and Settings\Administrator>netstat -ano|findstr "3104"
TCP 0.0.0.0:3760 0.0.0.0:0 LISTENING 3104
TCP 0.0.0.0:10100【监听端口，暴露给客户端】 0.0.0.0:0 LISTENING 3104
TCP 123.99.199.149:1054 127.0.0.1:20220【地图网关/登录服端口，服务器内部用到】 ESTABLISHED 3104
TCP 123.99.199.149:1057 45.248.9.53:80 ESTABLISHED 3104
TCP 123.99.199.149:1058 127.0.0.1:20220 ESTABLISHED 3104
TCP 123.99.199.149:1061 127.0.0.1:20220 ESTABLISHED 3104
TCP 123.99.199.149:3760 27.186.142.127:22501 ESTABLISHED 3104
TCP 123.99.199.149:3760 60.209.147.122:21765 ESTABLISHED 3104
TCP 123.99.199.149:3760 171.40.173.101:31965 ESTABLISHED 3104
TCP 123.99.199.149:10100 27.186.142.127:22498 ESTABLISHED 3104
TCP 123.99.199.149:10100 60.209.147.122:21756 ESTABLISHED 3104
TCP 123.99.199.149:10100 171.40.173.101:31958 ESTABLISHED 3104
TCP 127.0.0.1:1050 127.0.0.1:1433【mssql2000关系数据库端口，服务器内部用到】 ESTABLISHED 3104
TCP 127.0.0.1:1051 127.0.0.1:1433 ESTABLISHED 3104

中心服svMapCenter
C:\Documents and Settings\Administrator>netstat -ano|findstr "4052"
TCP 0.0.0.0:10113 0.0.0.0:0 LISTENING 4052
TCP 127.0.0.1:10113 127.0.0.1:1036【某个地图服端口】 ESTABLISHED 4052
TCP 127.0.0.1:10113 127.0.0.1:1037【某个地图服端口】 ESTABLISHED 4052
TCP 127.0.0.1:10113 127.0.0.1:1053【某个地图服端口】 ESTABLISHED 4052

地图网关/登录服svIP
C:\Documents and Settings\Administrator>netstat -ano|findstr "148"
TCP 0.0.0.0:20220 0.0.0.0:0 LISTENING 148
TCP 127.0.0.1:1036 127.0.0.1:10113 ESTABLISHED 148
TCP 127.0.0.1:20220 123.99.199.149:1054 ESTABLISHED 148
TCP 127.0.0.1:20220 123.99.199.149:1070 ESTABLISHED 148
TCP 127.0.0.1:20220 123.99.199.149:1071 ESTABLISHED 148
TCP 127.0.0.1:20220 123.99.199.149:1074 ESTABLISHED 148