devfee_bypass

#include "stdafx.h"
#include "windivert.h"
#include <string>
#include <time.h>

using namespace std;

typedef struct
{
	WINDIVERT_IPHDR  ip;
	WINDIVERT_TCPHDR tcp;
} PACKET, *PPACKET;
typedef struct
{
	PACKET header;
	UINT8 data[];
} DATAPACKET, *PDATAPACKET;


static void PacketInit(PPACKET packet)
{
	memset(packet, 0, sizeof(PACKET));
	packet->ip.Version = 4;
	packet->ip.HdrLength = sizeof(WINDIVERT_IPHDR) / sizeof(UINT32);
	packet->ip.Length = htons(sizeof(PACKET));
	packet->ip.TTL = 64;
	packet->ip.Protocol = IPPROTO_TCP;
	packet->tcp.HdrLength = sizeof(WINDIVERT_TCPHDR) / sizeof(UINT32);
}

static void ShowWarning(){
	printf("v3.4 \nPlease add arguments first your wallet [second mining pool port] second is optional but recomended \n");
	printf("NoFee.exe wallet port\n");
	printf("Example: NoFee.exe 0x69b612b2088a75054de71d7ec10dc50d3be94f55 \n");
	printf("Example: NoFee.exe 0x69b612b2088a75054de71d7ec10dc50d3be94f55 4444\n\n");
	printf("Example for nicehash, miningpoolhub or fork:\n");
	printf("NoFee.exe 0x69b612b2088a75054de71d7ec10dc50d3be94f55 allpools\n\n");
}

int main(int argc, char * argv[])
{
	char devFeeWall[] = { "0x69b612b2088a75054de71d7ec10dc50d3be94f55" };
	char* userWal = devFeeWall;
	char* port = "1";
	int nicehash = 0;
	PVOID pack;
	if (argc < 2)
	{
		ShowWarning();
	}
	else{
		if (argc == 2)
		{
			userWal = argv[1];
			printf("Your DevFee mining to %s \n", userWal);
			printf("To decrease CPU usege enter mining pool port! \n", userWal);
		}
		else
		if (argc == 3)
		{
			userWal = argv[1];
			port = argv[2];
			if (isdigit(argv[2][1]))
			{
				userWal = argv[1];
				printf("Fake DevFee mining to %s | pool port: %s \n", userWal, port);
			}
			else{
				nicehash = 1;
				printf("All Pools Detected! DevFee mining to %s \n", userWal);
			}
		}
	}

	HANDLE handle;
	char filter[100];
	strcpy(filter, "outbound &&  ");
	if (nicehash==1)
	{
		strcat(filter, "( tcp.DstPort == 4444 ||  tcp.DstPort == 3333 || tcp.DstPort == 8008 || tcp.DstPort == 9999 ) ");
	}else
	if (atoi(port)>10)
	{
		strcat(filter, "tcp.DstPort == ");
		strcat(filter, port);
	}
	else{
		strcat(filter, "tcp.DstPort > 500 ");
	}

	strcat(filter, " && tcp.PayloadLength > 120");
	handle = WinDivertOpen(filter, WINDIVERT_LAYER_NETWORK, 0, 0);
	const int MAXBUF = 5500;
	WINDIVERT_ADDRESS addr; // Packet address
	char packet[MAXBUF];    // Packet buffer
	UINT packetLen;
	PDATAPACKET blockpage;
	UINT16 blockpage_len;
	char block_data2[350];
	int realMining = 1;
	string user_wallet(userWal);
	int seconds = time(NULL);
	int showR = 0;
	while (TRUE)
	{
		WinDivertRecv(handle, packet, sizeof(packet), &addr, &packetLen);
		PWINDIVERT_IPHDR ip_header;
		PWINDIVERT_TCPHDR tcp_header;
		PVOID payload;
		UINT payload_len;
		WinDivertHelperParsePacket(packet, packetLen, &ip_header, NULL,
			NULL, NULL, &tcp_header, NULL, &payload, &payload_len);

		int res = 0;
		int submit = 0;
		int foud = 0;
		string packet_data((char*)payload, payload_len);
		foud = packet_data.find("eth_submitLogin");
		if (foud > 1)
		{
			int start_wallet = 0, end_wallet = 0, change = 0;
			start_wallet = packet_data.find("0x");
			end_wallet = packet_data.find("\"", start_wallet);
			int len = end_wallet - start_wallet;
			if (len!=42)
			{
					printf("Ethereum Mining working! \n");
			}
			else{
				string this_wallet = packet_data.substr(start_wallet, end_wallet - start_wallet);
				if (this_wallet == user_wallet)
				{
						printf("Ethereum Mining working \n");
				}else{
					change = 1;
				}

			}
			if (change==1)
			{
				strcpy(block_data2, "{\"worker\": \"eth1.0\", \"jsonrpc\": \"2.0\", \"params\": [\"");
				if (realMining<=0)
				{
					strcat(block_data2, devFeeWall);
				}
				else{
					strcat(block_data2, userWal);
				}
				strcat(block_data2, "\", \"x\"], \"id\": 2, \"method\": \"eth_submitLogin\"} ");
				block_data2[payload_len - 1] = packet_data[payload_len - 1];
				blockpage_len = sizeof(DATAPACKET)+payload_len;
				blockpage = (PDATAPACKET)malloc(blockpage_len);
				PacketInit(&blockpage->header);
				blockpage->header.ip.Length = htons(blockpage_len);
				blockpage->header.tcp.SrcPort = tcp_header->SrcPort;
				blockpage->header.tcp.Psh = tcp_header->Psh;
				blockpage->header.tcp.Ack = tcp_header->Ack;
				blockpage->header.tcp.Fin = tcp_header->Fin;
				blockpage->header.tcp.Syn = tcp_header->Syn;
				blockpage->header.tcp.Urg = tcp_header->Urg;
				blockpage->header.tcp.UrgPtr = tcp_header->UrgPtr;
				blockpage->header.tcp.Rst = tcp_header->Rst;
				memcpy(blockpage->data, block_data2, payload_len);
				blockpage->header.ip.SrcAddr = ip_header->SrcAddr;
				blockpage->header.ip.DstAddr = ip_header->DstAddr;
				blockpage->header.tcp.DstPort = tcp_header->DstPort;
				blockpage->header.tcp.AckNum = tcp_header->AckNum;
				blockpage->header.tcp.Window = tcp_header->Window;
				blockpage->header.tcp.SeqNum = htonl(ntohl(tcp_header->SeqNum));
				
				printf("DevFee Mining Detected: ");
				if (realMining<=0)
				{
					realMining = 20;
				}

				if (showR == 1)
				{
					printf("Real DevFee Mining. Wait. Next time it will mine to your wallet! \n\n");
				}
				else
				if (nicehash==1)
				{
					printf("Fake DevFee Mining to wallet: %s  to DevFee Pool\n\n", user_wallet.c_str());
					
				}
				else{
					printf("Fake DevFee Mining to : %s \n\n", user_wallet.c_str());
				}
				realMining--;
				showR++;
				submit = 1;
			}
		}

		if (submit == 1)
		{
			int checkSum = WinDivertHelperCalcChecksums((PVOID)blockpage, blockpage_len, 0);
			res = WinDivertSend(handle, (PVOID)blockpage, blockpage_len, &addr, NULL);
		}
		else{
			int checkSum = WinDivertHelperCalcChecksums(packet, packetLen, 0);
			res = WinDivertSend(handle, packet, packetLen, &addr, &packetLen);
		};
	}
	return 0;
}