Bitcoin Forum
April 23, 2019, 11:09:03 AM *
News: Latest Bitcoin Core release: 0.17.1 [Torrent]
 
  Home Help Search Login Register More  
  Show Posts
Pages: [1]
1  Alternate cryptocurrencies / Mining (Altcoins) / Re: Claymore's Ethereum Mining NoDevFee v7.1 on: July 29, 2017, 02:06:00 AM
With a worker name of "default" ?
Is claymore also using the same ??

To be pricese.. did Falcon get the same from claymore for obvious reasons... ?


If you do not set a worker name, it shows up as default in ethermine. Claymore does that, and even if someone is running miner with no worker name, it will show up as default.

That was a detail i didn't know as i always had a worker name.
Thank you my friend Smiley
2  Alternate cryptocurrencies / Mining (Altcoins) / Re: Claymore's Ethereum Mining NoDevFee v7.1 on: July 28, 2017, 05:21:55 PM
With a worker name of "default" ?
Is claymore also using the same ??

To be pricese.. did Falcon get the same from claymore for obvious reasons... ?
3  Alternate cryptocurrencies / Mining (Altcoins) / Re: Claymore's Ethereum Mining NoDevFee v7.1 on: July 27, 2017, 11:04:55 PM
Hi,

I already found out, that this program is a scam by disassembling and debugging. Plus I proposed a method to patch it, so that it will behave like we would have expected. With this modification, all Claymore's DevFeeMining will go to your own ethereum-address and the NoDevFee71-program evolves into a very nice and smooth running tool.


Hi,

I have found no evidence of virus activity in the code and no evidence for the strange redirection to the private stratum-server IP I reported. It could be a result of using the nicehash-software for some time, in between (I use it as auto-fallback, if the main poolmining has a problem).
BUT it has a random redirection to the authors mining-address 0x78.. build in. After I patched the software, all DevFee arrives at my own account, without exception.
The following submitted-shares numbers are broken down for a 100MHs mining rig for easy comparision.

Unpatched NoDevFee (24h run): mean value 176 shares per hour
Patched NoDevFee (24h run): mean value 182 shares per hour

That makes an average of 6 shares per hour mined to the authors purse.

So, dear @Millenium Falcon, thank your for programming this software, but could you please remove the undocumented mining-redirection to your purse? Or, at least, add a note to your posting regarding this topic?


How do you patching the .exe? with x64dbg? Could you add a little guide for do it please?

For the easy-goin you can open the exe with some hex-editor, then either search ASCII for 0x78 or you direct jump to address 00008EE0 (hex). There you find the authors 0x78.. address. Change it to yours and you will be fine Smiley Take care not to change any other byte but the ether-address.


Patch-Tutorial:
  • Download & Install HxD Editor from here: https://mh-nexus.de/
  • Download NoDevFee71 and unpack into a folder
  • Start HxD & use "File->Open" (Ctrl-O), browse to the NoDevFee71-Folder
  • Open the File "NoDevFee.exe"
  • Now press "Search->Replace" (Ctrl-R)
  • enter 0x783231dEBa1FaFd90b4F146fDB21a374C29737fF into the field "Search for:" and your own Ethereum-Address into field "Replace with:"
  • make sure, the selection "Datatype:" is set to "Text-string" and "Search direction"->"All" is checked
  • now press "Replace all" (Alt-A)
  • HxD should now say "Replaced 2 occurences of 0x783231dEBa1FaFd90b4F146fDB21a374C29737fF"
  • Press "Ok" and then "File->Save" (Ctrl-S)
  • Done Smiley Now all detected DevFeeMining will go to your ethereum-address.

what to do, if an error pops up, after pressing "Replace all":
  • Error "This replace operation changes file size. Do you want to proceed?" - 1st deny by pressing "No"
      .. simply check exactly, if you entered the ethereum-addresses correctly. Check, if you copied in blanks in front, or after the address and remove them
  • Error "Can't find 0x783231dEBa1FaFd90b4F146fDB21a374C29737fF"
      .. repeat the search-and-replace with address 0x69b612b2088a75054de71d7ec10dc50d3be94f55 in field "Search for:"

Regards,

borox

Code:
Donations welcome :)
BTC 18AT1kRgSoGrw1TCPpduPnWnX7t1TK23Xo
ETH 0x3084a8657ccf9d21575e5dd8357a2deaf1904ef6


The addresses you refer are in version 7.1 (the first one) and in 5.5 (the second) .. as i'm still using v5.5 and already patched it..
What i noticed as i was surfing around.. take a look at these addresses on ethermine :

1) 0x3509f7bd9557f8a9b793759b3e3bfa2cd505ae31
2) 0x7fb21ac4cd75d9de3e1c5d11d87bb904c01880fc
3) 0xb9cf2da90bdff1bc014720cc84f5ab99d7974eba
4) 0x558d2e1a5786848dfc24080aff7928da1c7d5c3a

They all have just the classic "default" worker with that huge hashrate !! I looked for them via the hex-editor in both 7.1 and 5.5 binaries but my search didn't return anything..
Any ideas anyone ?? :/

Thank you guys !
4  Alternate cryptocurrencies / Mining (Altcoins) / Re: Claymore's Ethereum Mining NoDevFee v7.1 on: July 18, 2017, 02:42:35 PM
You are just replacing some "static" strings that show in the program.
There isn't anything being mined to this address.
Stop spreading misinformation.


Dear Falcon ( Smiley ) , whatever your assembly skills are (which i trully doubt..) one thing is for sure : Wireshark doesn't lie !!!


I also believe the program will steal the normal mining shares. Sometimes, my miner will not show in the pool. So it gives you the Claymore shares, but steals your normal share, even after the patch.

We need more analysis of (disassemble) the program.


I haven't patched it yet, but as soon as i do, i will be watching it through the days as my miners are rock solid !
Others should also post their experience after patching the program. That should be very helpful !
Thank you guys Smiley
5  Alternate cryptocurrencies / Mining (Altcoins) / Re: Claymore's Ethereum Mining NoDevFee v7.1 on: July 15, 2017, 05:43:13 PM
All my cards are AMD at the moment.. i'm just asking for :

1) Claymore version 9.6 or 9.7 for possible detection of noDevFee ..
2) NoDevFee version 7.1 .. if it's better than 5.5, what's changed ? Is it better ? Does it worth updating ?

I still have to patch it though..
What about stale shares using a proxy ?? Anybody has more experience on that ?

Thank you all guys !
6  Alternate cryptocurrencies / Mining (Altcoins) / Re: Claymore's Ethereum Mining NoDevFee v7.1 on: July 15, 2017, 12:33:24 AM
Hello guys !

i've read the whole thread and i would like to ask... which version is the best to use ? 7.1 or 5.5 ??
I'm using claymore 9.5 with 5.5 at the moment (not patched yet as i just read the last pages..) which works great except the shares that go to falcon's wallet as indicated ...

Is it worth updating to 9.7 with 7.1 ? Or maybe another combination ??
Thank you all and mostly to the guys who reverse engineered this "addon" and to falcon even if he should have told the whole truth...
Pages: [1]
Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!