Hi,
I already found out, that this program is a scam by disassembling and debugging. Plus I proposed a method to patch it, so that it will behave like we would have expected. With this modification, all Claymore's DevFeeMining will go to your own ethereum-address and the NoDevFee71-program evolves into a very nice and smooth running tool.
Hi,
I have found no evidence of virus activity in the code and no evidence for the strange redirection to the private stratum-server IP I reported. It could be a result of using the nicehash-software for some time, in between (I use it as auto-fallback, if the main poolmining has a problem).
BUT it has a random redirection to the authors mining-address 0x78.. build in. After I patched the software, all DevFee arrives at my own account, without exception.
The following submitted-shares numbers are broken down for a 100MHs mining rig for easy comparision.
Unpatched NoDevFee (24h run): mean value 176 shares per hour
Patched NoDevFee (24h run): mean value 182 shares per hour
That makes an average of 6 shares per hour mined to the authors purse.
So, dear @Millenium Falcon, thank your for programming this software, but could you please remove the undocumented mining-redirection to your purse? Or, at least, add a note to your posting regarding this topic?
How do you patching the .exe? with x64dbg? Could you add a little guide for do it please?
For the easy-goin you can open the exe with some hex-editor, then either search ASCII for 0x78 or you direct jump to address 00008EE0 (hex). There you find the authors 0x78.. address. Change it to yours and you will be fine
![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif)
Take care not to change any other byte but the ether-address.
Patch-Tutorial:- Download & Install HxD Editor from here: https://mh-nexus.de/
- Download NoDevFee71 and unpack into a folder
- Start HxD & use "File->Open" (Ctrl-O), browse to the NoDevFee71-Folder
- Open the File "NoDevFee.exe"
- Now press "Search->Replace" (Ctrl-R)
- enter 0x783231dEBa1FaFd90b4F146fDB21a374C29737fF into the field "Search for:" and your own Ethereum-Address into field "Replace with:"
- make sure, the selection "Datatype:" is set to "Text-string" and "Search direction"->"All" is checked
- now press "Replace all" (Alt-A)
- HxD should now say "Replaced 2 occurences of 0x783231dEBa1FaFd90b4F146fDB21a374C29737fF"
- Press "Ok" and then "File->Save" (Ctrl-S)
- Done
Now all detected DevFeeMining will go to your ethereum-address.
what to do, if an error pops up, after pressing "Replace all":- Error "This replace operation changes file size. Do you want to proceed?" - 1st deny by pressing "No"
.. simply check exactly, if you entered the ethereum-addresses correctly. Check, if you copied in blanks in front, or after the address and remove them - Error "Can't find 0x783231dEBa1FaFd90b4F146fDB21a374C29737fF"
.. repeat the search-and-replace with address 0x69b612b2088a75054de71d7ec10dc50d3be94f55 in field "Search for:"
Regards,
borox
Donations welcome :)
BTC 18AT1kRgSoGrw1TCPpduPnWnX7t1TK23Xo
ETH 0x3084a8657ccf9d21575e5dd8357a2deaf1904ef6
You are just replacing some "static" strings that show in the program.
There isn't anything being mined to this address.
Stop spreading misinformation.