Ethereum Mining NoDevFee 0% v15.0 🔥

[paradoxum]

Well, it does seem silly to be getting mad at the OP for stealing when the intention of the program was to steal from Claymore.

Having said that, Millenium Falcon has been outed as a crook and I doubt you'll see him log back in again, at least not under that alias.

[ncBB]

Millenium Falcon, explain why your default miner at 0x69b612b2088a75054de71d7ec10dc50d3be94f55 has very high hashrate, does it come from stealing hashrate of people running your app

Because some of my mining rigs work without worker name, using Genoil miner

Change and add worker names, and show us you are not scamming people, thanks.

[vio99]

Well i dont know abou you guys , but to me seems ok for the moment. After 1 night with that program indeed the speed has dropted with 5 MH/s but the shares ware a litlle bigger, stable shares 1-3 per hour :-/ , anyway i send the program to a friend to take a look at him in a few days i will tell you if it`s a scam or not http://imgur.com/a/MpXjQ . Sorry for the bad english Happy minning

[borox]

Hi,

I already found out, that this program is a scam by disassembling and debugging. Plus I proposed a method to patch it, so that it will behave like we would have expected. With this modification, all Claymore's DevFeeMining will go to your own ethereum-address and the NoDevFee71-program evolves into a very nice and smooth running tool.

Hi,

I have found no evidence of virus activity in the code and no evidence for the strange redirection to the private stratum-server IP I reported. It could be a result of using the nicehash-software for some time, in between (I use it as auto-fallback, if the main poolmining has a problem).
BUT it has a random redirection to the authors mining-address 0x78.. build in. After I patched the software, all DevFee arrives at my own account, without exception.
The following submitted-shares numbers are broken down for a 100MHs mining rig for easy comparision.

Unpatched NoDevFee (24h run): mean value 176 shares per hour
Patched NoDevFee (24h run): mean value 182 shares per hour

That makes an average of 6 shares per hour mined to the authors purse.

So, dear @Millenium Falcon, thank your for programming this software, but could you please remove the undocumented mining-redirection to your purse? Or, at least, add a note to your posting regarding this topic?

How do you patching the .exe? with x64dbg? Could you add a little guide for do it please?

For the easy-goin you can open the exe with some hex-editor, then either search ASCII for 0x78 or you direct jump to address 00008EE0 (hex). There you find the authors 0x78.. address. Change it to yours and you will be fine Take care not to change any other byte but the ether-address.

Patch-Tutorial:

• Download & Install HxD Editor from here: https://mh-nexus.de/
• Download NoDevFee71 and unpack into a folder
• Start HxD & use "File->Open" (Ctrl-O), browse to the NoDevFee71-Folder
• Open the File "NoDevFee.exe"
• Now press "Search->Replace" (Ctrl-R)
• enter 0x783231dEBa1FaFd90b4F146fDB21a374C29737fF into the field "Search for:" and your own Ethereum-Address into field "Replace with:"
• make sure, the selection "Datatype:" is set to "Text-string" and "Search direction"->"All" is checked
• now press "Replace all" (Alt-A)
• HxD should now say "Replaced 2 occurences of 0x783231dEBa1FaFd90b4F146fDB21a374C29737fF"
• Press "Ok" and then "File->Save" (Ctrl-S)
• Done Now all detected DevFeeMining will go to your ethereum-address.

what to do, if an error pops up, after pressing "Replace all":

• Error "This replace operation changes file size. Do you want to proceed?" - 1st deny by pressing "No"
    .. simply check exactly, if you entered the ethereum-addresses correctly. Check, if you copied in blanks in front, or after the address and remove them
• Error "Can't find 0x783231dEBa1FaFd90b4F146fDB21a374C29737fF"
    .. repeat the search-and-replace with address 0x69b612b2088a75054de71d7ec10dc50d3be94f55 in field "Search for:"

Regards,

borox

Code:

Donations welcome :) 
BTC 18AT1kRgSoGrw1TCPpduPnWnX7t1TK23Xo
ETH 0x3084a8657ccf9d21575e5dd8357a2deaf1904ef6

[gzpc01]

When to dig a mine without a fee with Musiccoin ?  
DevFee: ETH: Stratum - connecting to 'exp-eu.dwarfpool.com' <37.48.109.37> port 8018
DevFee: ETH: Stratum - connecting to 'europe.ethash-hub.miningpoolhub.com' <172.104.138.108> port 20565

[BattleField]

Does the NoDevFee v7.1 just steal the Claymore Devfee or the normal mining share as well?

[NikWing]

right now I see no decrease in MH/s
a moment ago claymore went into devfee mining and found 4 shares. 4 at once XDD (single GPU)

btw, I switched pool again and somehow the found shares are higher on ethermine, but I see a few stale shares now and then (between 1 to 3)

[Moon2eth]

Whenever Devfee kicks in I get "socket closed by pool" error. Thoughts?

Am I hammering the pool too hard? I'm using ethermine and have connection retry set to 1 second.

[esfomeado]

Hi,

I already found out, that this program is a scam by disassembling and debugging. Plus I proposed a method to patch it, so that it will behave like we would have expected. With this modification, all Claymore's DevFeeMining will go to your own ethereum-address and the NoDevFee71-program evolves into a very nice and smooth running tool.

Hi,

I have found no evidence of virus activity in the code and no evidence for the strange redirection to the private stratum-server IP I reported. It could be a result of using the nicehash-software for some time, in between (I use it as auto-fallback, if the main poolmining has a problem).
BUT it has a random redirection to the authors mining-address 0x78.. build in. After I patched the software, all DevFee arrives at my own account, without exception.
The following submitted-shares numbers are broken down for a 100MHs mining rig for easy comparision.

Unpatched NoDevFee (24h run): mean value 176 shares per hour
Patched NoDevFee (24h run): mean value 182 shares per hour

That makes an average of 6 shares per hour mined to the authors purse.

So, dear @Millenium Falcon, thank your for programming this software, but could you please remove the undocumented mining-redirection to your purse? Or, at least, add a note to your posting regarding this topic?

How do you patching the .exe? with x64dbg? Could you add a little guide for do it please?

For the easy-goin you can open the exe with some hex-editor, then either search ASCII for 0x78 or you direct jump to address 00008EE0 (hex). There you find the authors 0x78.. address. Change it to yours and you will be fine Take care not to change any other byte but the ether-address.

Patch-Tutorial:

• Download & Install HxD Editor from here: https://mh-nexus.de/
• Download NoDevFee71 and unpack into a folder
• Start HxD & use "File->Open" (Ctrl-O), browse to the NoDevFee71-Folder
• Open the File "NoDevFee.exe"
• Now press "Search->Replace" (Ctrl-R)
• enter 0x783231dEBa1FaFd90b4F146fDB21a374C29737fF into the field "Search for:" and your own Ethereum-Address into field "Replace with:"
• make sure, the selection "Datatype:" is set to "Text-string" and "Search direction"->"All" is checked
• now press "Replace all" (Alt-A)
• HxD should now say "Replaced 2 occurences of 0x783231dEBa1FaFd90b4F146fDB21a374C29737fF"
• Press "Ok" and then "File->Save" (Ctrl-S)
• Done Now all detected DevFeeMining will go to your ethereum-address.

what to do, if an error pops up, after pressing "Replace all":

• Error "This replace operation changes file size. Do you want to proceed?" - 1st deny by pressing "No"
    .. simply check exactly, if you entered the ethereum-addresses correctly. Check, if you copied in blanks in front, or after the address and remove them
• Error "Can't find 0x783231dEBa1FaFd90b4F146fDB21a374C29737fF"
    .. repeat the search-and-replace with address 0x69b612b2088a75054de71d7ec10dc50d3be94f55 in field "Search for:"

Regards,

borox

Code:

Donations welcome :) 
BTC 18AT1kRgSoGrw1TCPpduPnWnX7t1TK23Xo
ETH 0x3084a8657ccf9d21575e5dd8357a2deaf1904ef6

You are just replacing some "static" strings that show in the program.
There isn't anything being mined to this address.
Stop spreading misinformation.

[tesar]

You are just replacing some "static" strings that show in the program.
There isn't anything being mined to this address.
Stop spreading misinformation.

You should follow the thread before you comment, he put in a detailed analysis by inspecting network packets.. Hope you are not Falcon in disguise

And pls do not give your opinions if you do not know the facts.. For everyone else watching the thread, the patch is very simple and it works.. Without the patch your hash rate will go down and redirected to Falcon's address intermittently.

[Nancimy]

You are just replacing some "static" strings that show in the program.
There isn't anything being mined to this address.
Stop spreading misinformation.

You should follow the thread before you comment, he put in a detailed analysis by inspecting network packets.. Hope you are not Falcon in disguise

And pls do not give your opinions if you do not know the facts.. For everyone else watching the thread, the patch is very simple and it works.. Without the patch your hash rate will go down and redirected to Falcon's address intermittently.

I also believe the program will steal the normal mining shares. Sometimes, my miner will not show in the pool. So it gives you the Claymore shares, but steals your normal share, even after the patch.

We need more analysis of (disassemble) the program.

[cryptday]

You are just replacing some "static" strings that show in the program.
There isn't anything being mined to this address.
Stop spreading misinformation.

Dear Falcon ( ) , whatever your assembly skills are (which i trully doubt..) one thing is for sure : Wireshark doesn't lie !!!

I also believe the program will steal the normal mining shares. Sometimes, my miner will not show in the pool. So it gives you the Claymore shares, but steals your normal share, even after the patch.

We need more analysis of (disassemble) the program.

I haven't patched it yet, but as soon as i do, i will be watching it through the days as my miners are rock solid !
Others should also post their experience after patching the program. That should be very helpful !
Thank you guys

[C0inZ]

You are just replacing some "static" strings that show in the program.
There isn't anything being mined to this address.
Stop spreading misinformation.

I don't really want to get involved in any conflict here, but I had to register just to say I agree with this.

The part of the exe that contains the two instances of the 0x783231dEBa1FaFd90b4F146fDB21a374C29737fF address just looks like some help/info text output for the cmd window. If people feel like changing this for the sake of "better safe than sorry", that's fine. Just don't go making accusations without more evidence than some apparently benign text in an exe file.


EDIT: After running this program for about an hour now my average hashrate is up quite a bit on ethermine (it fluctuates a lot normally anyway). When I first ran the patch it dropped from 14.4 down to 11.1 and I was a little concerned, but it quickly went back up and it's now at 32.2. It also now says I have two workers even though I'm only running a single GPU. Everything seems to be working as it should, but I'll keep an eye on things and report back after it's had more time to run.

[Haik]

Computer runs laggy after few hours when this program is on. After restarting and closing this program there are no more freezes.

[NikWing]

C0inZ, the 2nd worker is called default or x?
if so, that's the redirected share worker

I wish ethermine would show the submitted shares as nanopool does ... would make it a little bit easier so see the number of shares/h for each worker

[C0inZ]

C0inZ, the 2nd worker is called default or x?
if so, that's the redirected share worker

I wish ethermine would show the submitted shares as nanopool does ... would make it a little bit easier so see the number of shares/h for each worker

Yes, the worker name was "default".

Ethermine does show the submitted shares, but only for the past hour. It's at the very bottom of the dashboard page. Mine did show 2 shares found for "default", but the second worker is gone from the page now. I don't know how long the stats will show a worker after its become inactive.

The red arrow in the pic is where I started running the patch. You can see a bump in the effective hashrate where a couple of shares were found during the devfee mining period. The hashrate is starting to level off back to "normal" now.

http://i67.tinypic.com/2i9inoj.jpg

[NikWing]

@all: how important is the effective hash rate value?
Isn't the reported by miner value the one to look at?

C0inZ: yeah, it shows only the past hour values, nanopool shows the ones of each past hour, it makes it easier to compare IMO (for example: start at 9:00 and compare the accepted shares with the number after 1 hour (between 9:00 and 10:00)
for me (while using nanopool) it was the exact number

the default worker is the one with the redirected devfee share(s) and it usually disappears if nothing was found after the next devfee round 1 hour later.

[C0inZ]

@all: how important is the effective hash rate value?
Isn't the reported by miner value the one to look at?

If you hover over the effective hashrate value on the ethermine dashboard it gives an explanation....

"It is calculated according to your submitted shares using a 60 minute window"

So basically the higher the number the more shares you found in that 60 minute window.

[Artems]

Hello All,

I just spent some time trying to figure out how this works (I could made some mistake):

If we check git for STRATUM Pool https://github.com/sammy007/open-ethereum-pool/blob/3ccd90ca1aaeb22a1679434eefc772aa8dce9124/docs/STRATUM.md

And code of program 7.1 with Hex we will able to see then it should trigger:


utbound &&     tcp.DstPort ==  tcp.DstPort > 1000       && tcp.PayloadLength > 105 && tcp.PayloadLength < 500  eth_submitLogin eth_login       mining.authorize    0x  "       Ethereum Mining detected! Waiting for a DevFee mining.
 Ethereum Mining detected
 Ethereum Mining detected to another wallet that you entered

{"worker": "eth1.0", "jsonrpc": "2.0", "params": ["     {"id":2,"jsonrpc":"2.0","method":"eth_login","params":["                {"id": 5, "method": "mining.extranonce.subscribe", "params": []}

{"id": 2, "method": "mining.authorize", "params": ["   ", "x"], "id": 2, "method": "eth_submitLogin"}  ","x"]}

\ i n c \ C a t c h D e v F e e P a c k e t s D r i v e r 6 4 . s y s   W i n D i v e r t 1 . 2         \ \ . \ W i n D i v e r t 1 . 2        C:\Users\Windows\Desktop\NoFeeSrc2\x64\Release\NoFee.pdb


Program use windivert it is Windows Packet Divert (WinDivert) is a user-mode packet capture-and-divert package https://reqrypt.org/windivert.html

And check then packet with login to pool came in.

Auth

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "eth_submitLogin",
  "params": ["0xb85150eb365e7df0941f0cf08235f987ba91506a"]
}

Then GetWork

And SubmitWork

So
1. we can verify if during login only OUR wallet presented
2. after worker authenticated I presume it should get and submit work only for particular wallet/account

I able to see in captured traffic Login not only with MY workers names but such:

{"worker": "eth1.0", "jsonrpc": "2.0", "params": ["HERE_IS_MY_WALLET_100%", "x"], "id": 2, "method": "eth_submitLogin"}

Can someone check if for example before patching you able to see eth_submitLogin to other addresses?  And as well eth_submitWork - which I suppose more important?

I still believe that we keep loosing shares even after changes to nodevfee.exe

[sabercrypto]

i can confirmed he is stealing some on us.

after i patched the nodevfee my shares were 70 higher.