Recently appeared virus supposed to be from the German BKA :)

[OHPen]

Hi,

im the happy recepient of a virus which was spreading last week.
Otensible done by the german Federal Criminal Police Office but of course it isnt' the so called "Bundestrojaner"
Just another virus in the hood. Antivir was recognizing the zip in which the virus was wrapper but not the exe itself. So maybe it has polymorph code, i dont know.

I included my idb from iDA_v5.0

If someone wants to play with:

MALWARE - Password: malware

[deroko]

hmm nod32 detected it immidiately after unpacking as some TrojanDownloader

[OHPen]

Seems that my antivirus is not the best, but its free

[reverser]

"Sorry, this database has been created by a pirate version of IDA Pro"
oops...

[OHPen]

Damn !

I bought a pirated IDA version

[fr33ke]

Well, why don't you give us a non-pirated IDA 5.1 then? For most people it's simply impossible to get the latest IDA version legally, and even if you have it there are good reasons not to share its IDB's.

Quote:

[Originally Posted by http://www.openrce.org/articles/full_view/28]Although I own IDA 5.0, these IDBs are linked with the pirated 5.0 key. This is due to the fact that IDB files contain the majority of your personal keyfile. Hence, the IDBs will stop working under 5.1, unless you patch out the blacklist code (which is trivial).

[esther]

hmm I thought posting any commerical software attachments are not allowed in here,especially pirates softwares....

[Maximus]

eheh, technically speaking he can
for the very same reason that if a person buy something stolen whilst thinking it is not stolen, the sell cannot be undone (unless very rare cases).

This is especially evident in the Art market -stolen art crafts gets sold and, unless you can prove the buyer didn't reasonably know it were stolen from an excavation or a museum, sell cannot be undone.
(he 'discovered' he 'bought' the pirated version of IDA )

Otherwise, 9/10 of the world should pass its time giving back things

he didnt attach a pirated software, but a derivative. The IDB file is not property of DataRescue, or every IDB file would then be property of DataRescue ==> none would ever buy IDA, Word, etc etc...

(of course, if the IDB were about a commercial software, then it would violate an agreement, the anti-reversing clause...)

[Silkut]

Quote:

for the very same reason that if a person buy something stolen whilst thinking it is not stolen, the sell cannot be undone (unless very rare cases). This is especially evident in the Art market -stolen art crafts gets sold and, unless you can prove the buyer didn't reasonably know it were stolen from an excavation or a museum, sell cannot be undone.

Well then, it depends on the country because in mine, this is a crime.
We call it recel d'objet volé (possession or selling stolen things). They have to prove you accepted it. If you did (and discovered that it was stolen, or not) you're guilty. And then they cut ur balls off.

Dura lex, Sed lex.

[schizim]

Quote:

[Originally Posted by fr33ke;65569]... For most people it's simply impossible to get the latest IDA version legally, ...

fr33ke, why would you say it's impossible for some people to get legally? I heard someone else mention something similar and am curious as to why? He made it seem that the author of IDA was only selling to credited people like AV companies and the like. Just curious.

On a side note, if it's problematic now (or starting to be) to get a legit version of IDA for what ever reason then what would be a good alternate for it?

[JMI]

The comapny attempt to strictly control to whom they sell their software in an effort to prevent release of their products into the warez channels. Generally, they will not sell to anyone who doesn't appear to be a legitimate software business and then make efforts to mark their software in ways which will allow them to identify the source of a leaked copy, if it hits the warez channels. When a copy does reach the warez channels, that person may "generally" anticipate that they will not be able to buy future copies of the software or get customer support for the product.

There is a "free" version of the software available. It's simply not the "latest and greatest and does not have all of the features of the latest versions.

Regards,

[Maximus]

mmh...
about what you said, Silkut: not exactly. As long as you have bought it in a 'clear' way, using a lawful contract, the contract will not be nullified so easily, unless additional events can take place (i.e. you bought it at an unfair price, you have a standing chance to know/suspect it was illegal etc.).

It is an usual part of the disciple about contracts, and there are very few exceptions.

Say you (A) got X stolen, tricked or whatever by (B) which then sell making a _valid_ contract to (C).

While the first 'contract' can be declared as non-existent, the second cannot. At very best, it can be nullified under favourable circumstances, but not declared null (mostly).

Long time no study this disciple, however ^^

@JMI: yeah, but their fingerprint of IDB files can be pretty tedious for people who care about their privacy... I wonder _how_ they deal with EU privacy laws.

[reverser]

Sounds like an urban legend to me. I realize Pierre might make DataRescue seem a bit too paranoic, but they do sell IDA to private persons as long as you order it properly (i.e. real name, real address, faxed/mailed order form etc.). It might help though if you're a visible person in RE/security community.

[OHPen]

Good that this isn't an offtopic related discussion

[ancev]

Hey,

For me, its impossible get IDA legally: i dont have the money they ask

ancev

[Anticode]

Quote:

[Originally Posted by OHPen;65567]Damn ! I bought a pirated IDA version

Maybe its time for IGA - IDA Genuine Advantage?

[OHPen]

hehe, yeah maybe you are right

[Soul]

hi,
yes i think data rescue are giving it a very high price specially the pro version .

[Thomas___]

BTW IDA 4.3 is free ....

[OHPen]

There is no need to use IDA v4.3 if you get IDA v5.1. It is also for free but probably not so legal like the v4.3

OHPen

[Maximus]

People buy IDA for legal issues, not for its need.

_ANY datarescue customer is a customer because they need IDA. Becaue you are a company, either individually or juridically.

So, DR loses maybe 1-3% of their customers with cracked IDA's. Because anyone who got it illegally would not buy it anyway.

Sometime I wonder how difficult to comprehend this is. I still remind the laughable chalk of Pierre about their 'drop of sells' with his double failing logic (ehhh logic... it works).

So, the presence of a freeware or not freeware version of IDA changes nothing. Who need IDA buy it for legal reasons. Who do not need it legally, buy it not.
Should I remind you that almost all sells of IDA are to companies? They need it legally. They buy it. They dont use cracked versions, for the same reason they buy Windows legally-dot-

[LLXX]

I just tried freeware IDA 4.3 and it's not bad at all. Will probably consider using it over (legit) IDA 3.7 I previous used due to some useful features they added.

(Of course, I'm slowly working on a rather more powerful replacement for IDA... with complete decompilation and whatever else. )

[wtbw]

Supposedly they're releasing 4.9 as freeware soon too

[OHPen]

@maximus: i agree with you maximus, my company has a couple of ida licenses due to the fact that they need it and they are a company which can pay for it.

Maybe some small companies which are still at the starting phase have to use a carded one but not "settled" companies.

Anyway, at home im still using the illegal ida version , because it changes nothing.

PS: MORE THAN OFFTOPIC !!!!!