Hi again,
the error about pageurl I told before happens inside of strsplit function calling it with wrong paramters.In the patch.diff file you can read it here..at line 1251
Code:
+ if (strlen(pageUrl) > 7)
+ {
+ strsplit(pageUrl + 7, FALSE, '/', ¶ms);
+ av_ModelName.av_val = params[1];
+ av_ModelName.av_len = strlen(params[1]);
It does add 8 bytes (
https://) to pageurl = ch..com and if no slash is used then it dosent fill / copy the location [eax+4] = access violation after that function.In other rtmpdump versions it does add 7 bytes instead of 8 and calling that function like this... /ch..com = success.The question is whether its a compiling or error!?In all older Patch.diff files I can see almost same code there same as above and the compiled rtmpdump files (not from me) are working and using 7 instead of 8.Why does it add 8 and not 7?Somehow strange.Maybe the strsplit function was changed and works else now etc.
Code:
My compiled version with MinGW
----------------------------------------------------------
$ ==> 0040ECFF > \31D2 XOR EDX,EDX
$+2 0040ED01 . 83CE FF OR ESI,0xFFFFFFFF
$+5 0040ED04 . 89DF MOV EDI,EBX
$+7 0040ED06 . 89D0 MOV EAX,EDX
$+9 0040ED08 . 89F1 MOV ECX,ESI
$+B 0040ED0A . 885424 38 MOV BYTE PTR SS:[ESP+0x38],DL
$+F 0040ED0E . F2:AE REPNE SCAS BYTE PTR ES:[EDI]
$+11 0040ED10 . 89C8 MOV EAX,ECX
$+13 0040ED12 . F7D0 NOT EAX
$+15 0040ED14 . 83E8 01 SUB EAX,0x1
$+18 0040ED17 83F8 08 CMP EAX,0x8 ; <-- 8
$+1B 0040ED1A . 0F86 F2000000 JBE 0040EE12
$+21 0040ED20 . 8D8424 88000000 LEA EAX,DWORD PTR SS:[ESP+0x88]
$+28 0040ED27 83C3 08 ADD EBX,0x8 ; <-- 8
$+2B 0040ED2A . C74424 08 2F000000 MOV DWORD PTR SS:[ESP+0x8],0x2F
$+33 0040ED32 . 891C24 MOV DWORD PTR SS:[ESP],EBX
$+36 0040ED35 . C74424 04 00000000 MOV DWORD PTR SS:[ESP+0x4],0x0
$+3E 0040ED3D . 8D9C24 90010000 LEA EBX,DWORD PTR SS:[ESP+0x190]
$+45 0040ED44 . 894424 0C MOV DWORD PTR SS:[ESP+0xC],EAX
$+49 0040ED48 . E8 73BCFFFF CALL 0040A9C0 ; strsplit
$+4E 0040ED4D . 8B8424 88000000 MOV EAX,DWORD PTR SS:[ESP+0x88]
$+55 0040ED54 . 0FB65424 38 MOVZX EDX,BYTE PTR SS:[ESP+0x38]
$+5A 0040ED59 . 89F1 MOV ECX,ESI
$+5C 0040ED5B . 8DB424 90030000 LEA ESI,DWORD PTR SS:[ESP+0x390]
$+63 0040ED62 . 8B78 04 MOV EDI,DWORD PTR DS:[EAX+0x4] ; <-- none address
$+66 0040ED65 . 89D0 MOV EAX,EDX
$+68 0040ED67 . 89BC24 58010000 MOV DWORD PTR SS:[ESP+0x158],EDI
$+6F 0040ED6E . F2:AE REPNE SCAS BYTE PTR ES:[EDI] ; AVio
Other compiled rtmpdump
----------------------------------------------------------
$ ==> 0040EEBA 83CE FF OR ESI,0xFFFFFFFF
$+3 0040EEBD 31D2 XOR EDX,EDX
$+5 0040EEBF 89F1 MOV ECX,ESI
$+7 0040EEC1 89DF MOV EDI,EBX
$+9 0040EEC3 89D0 MOV EAX,EDX
$+B 0040EEC5 F2:AE REPNE SCAS BYTE PTR ES:[EDI]
$+D 0040EEC7 F7D1 NOT ECX
$+F 0040EEC9 83E9 01 SUB ECX,0x1
$+12 0040EECC 83F9 07 CMP ECX,0x7 ; <-- 7
$+15 0040EECF 0F86 ED000000 JBE 0040EFC2
$+1B 0040EED5 8D4424 78 LEA EAX,DWORD PTR SS:[ESP+0x78]
$+1F 0040EED9 83C3 07 ADD EBX,0x7 ; <-- 7
$+22 0040EEDC 891C24 MOV DWORD PTR SS:[ESP],EBX
$+25 0040EEDF 8D9C24 80010000 LEA EBX,DWORD PTR SS:[ESP+0x180]
$+2C 0040EEE6 894424 0C MOV DWORD PTR SS:[ESP+0xC],EAX
$+30 0040EEEA C74424 08 2F000000 MOV DWORD PTR SS:[ESP+0x8],0x2F
$+38 0040EEF2 C74424 04 00000000 MOV DWORD PTR SS:[ESP+0x4],0x0
$+40 0040EEFA 895424 30 MOV DWORD PTR SS:[ESP+0x30],EDX
$+44 0040EEFE E8 2DBCFFFF CALL 0040AB30 ; strsplit
$+49 0040EF03 8B4424 78 MOV EAX,DWORD PTR SS:[ESP+0x78]
$+4D 0040EF07 89F1 MOV ECX,ESI
$+4F 0040EF09 8B5424 30 MOV EDX,DWORD PTR SS:[ESP+0x30]
$+53 0040EF0D 8DB424 80030000 LEA ESI,DWORD PTR SS:[ESP+0x380]
$+5A 0040EF14 8B78 04 MOV EDI,DWORD PTR DS:[EAX+0x4]
$+5D 0040EF17 89D0 MOV EAX,EDX
$+5F 0040EF19 89BC24 48010000 MOV DWORD PTR SS:[ESP+0x148],EDI
$+66 0040EF20 F2:AE REPNE SCAS BYTE PTR ES:[EDI]
PS: About the difine issue.I tried to change it to this...
Code:
#define __off_t __off64_t
....and it seems to work without getting a error about it anymore but I am not sure of course.Found something here...
https://stackoverflow.com/questions/...e-name-off64-t
Not sure about that suite j_cool so I didnt tried it yet and I am also using MinGW very rarly to compile something and in this case I am no expert or advanced user.
greetz