- This topic has 3 replies, 3 voices, and was last updated 1 month, 1 week ago by
.
-
Posts
-
I just ran the Sculpt Tool dll through virustotal and while no scanner rang any alarm the sandbox tests came out somewhat interesting.
-there was rundll32.exe execution, which I'd say is ok, but then
-it does DebugPort check, so it tries to determine if it runs in a sandbox or a debugger. Why would it. So far it triggers 4 MITRE checks in 2 sandboxes.
-it inits UDP traffic to cloudflare DNS. What for? Haven't traced what it resolves there yet, bit scarce on time.If this was any reputable author, alright.
But all the shops go "we're just the marketplace, the author is your guy to talk to if things go sideways".
-the author appeared out of nowhere and when I contacted this "freelancer" about a company address or anything alike they fell silent.
-the package does not provide a license key that needs to be entered in Daz, hence not check only for key validity. It is a sculpting tool, so not something that draw external information from the cloud. Not being on Daz updates are announced through sites/mail and need manual install.
So, there is no good reason for this tool to contact the cloud. If this megabyte of binary code shreds my storage or spies out my IP or whatever I have zero recourse on the author.Your thoughts?
I haven't used the sculpt tool so can't say for sure what's happening in the background. But there a few instances where the vendor has resorted to their own proprietary activation mechanism instead of just using Daz serial numbers. For example, see this old product called Look At My Hair where the vendor handled the activation on their own site. It is possible that something similar was planned here as well, or may be just a scaffolding for a yet to be implemented feature, or just a remnant of an abandoned idea, that only the author can say.
Or, it could be just be collecting and sending benign analytics data on feature usage, or worse, auditing unique installations to check piracy by comparing against reported sales numbers.
Most of the reputed marketplaces like app stores and plugin stores have rules requiring the developers to disclose what information they collect. Not sure if Daz mandates the vendors to disclose such information.
For the debug port check, I think it's trying to check if a memory scanner/injector is trying to interfere with it, probably as an anti-piracy measure. All I can suggest is to monitor the traffic using a network/packet sniffer and report any transmission of suspicious/encrypted data.
Block the EXE/DLL in your firewall and see if it still works.
If so, you're good to go.
If not, time for wireshark or process_monitor.
If you're curious, you can open the dll in HXD, do a text search for 'http' and see if it finds some domains for you to further investigate (make sure to open in read-only mode).
If you find some (and you will), you can alternatively just block those domains instead.
If you're concerned about issues other than internet, get procmon.exe and you can see everything the program does when run (might require a little reading).
procmon won't trigger any anti-debugging that may be built in since it just follows process ids through their execution on the platform.
If it turns out internet is required for authentication, you can use ghidra to locate and 'jump around' the issue. To circumvent any anti-debugging that's in-place, use: https://github.com/LAC-Japan/Ghidra_AntiDebugSeeker/ to remove it.
Having said all that, it's probably just fine. The author would be 'shooting himself in the foot' to pull anything that would take a potentially well received, money-making, app and ruin it with any 'funny business'.
- You must be logged in to reply to this topic.
