{"action":"created","issue":{"url":"https://api.github.com/repos/carmaa/inception/issues/123","repository_url":"https://api.github.com/repos/carmaa/inception","labels_url":"https://api.github.com/repos/carmaa/inception/issues/123/labels{/name}","comments_url":"https://api.github.com/repos/carmaa/inception/issues/123/comments","events_url":"https://api.github.com/repos/carmaa/inception/issues/123/events","html_url":"https://github.com/carmaa/inception/issues/123","id":169058136,"number":123,"title":"Inception can't find signature for Windows 7 Enterprise SP1 (6.1.7601.23418)","user":{"login":"n0rdik","id":20809684,"avatar_url":"https://avatars.githubusercontent.com/u/20809684?v=3","gravatar_id":"","url":"https://api.github.com/users/n0rdik","html_url":"https://github.com/n0rdik","followers_url":"https://api.github.com/users/n0rdik/followers","following_url":"https://api.github.com/users/n0rdik/following{/other_user}","gists_url":"https://api.github.com/users/n0rdik/gists{/gist_id}","starred_url":"https://api.github.com/users/n0rdik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/n0rdik/subscriptions","organizations_url":"https://api.github.com/users/n0rdik/orgs","repos_url":"https://api.github.com/users/n0rdik/repos","events_url":"https://api.github.com/users/n0rdik/events{/privacy}","received_events_url":"https://api.github.com/users/n0rdik/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2016-08-03T06:32:16Z","updated_at":"2016-08-15T10:14:06Z","closed_at":null,"body":"Hi! Im trying to get into a Windows 7 enterprise SP1 x64, 4GB of ram, with Inception, and it cannot get signature. Also, I try to dump memory, but it gets nothing, only 0's (with unlock I get a lot of data), and the victim PC hangs. This is what I have:\r\n\r\nC:\\Windows\\System32\\msv1_0.dll (File version: 6.1.7601.23418)\r\n\r\nMD5: 4a3c137270473f865fb652ce5eff2d95\r\n\r\nC:\\Windows\\SysWow64\\msv1_0.dll (File version: 6.1.7601.23418)\r\n\r\nMD5: 4a3c137270473f865fb652ce5eff2d95 (files are the same)\r\n\r\nI cannot find the pattern \"C6 0F 85 ?? ?? ?? ?? B8\" in the file, maybe it has changed? Thanks!"},"comment":{"url":"https://api.github.com/repos/carmaa/inception/issues/comments/239770617","html_url":"https://github.com/carmaa/inception/issues/123#issuecomment-239770617","issue_url":"https://api.github.com/repos/carmaa/inception/issues/123","id":239770617,"user":{"login":"n0rdik","id":20809684,"avatar_url":"https://avatars.githubusercontent.com/u/20809684?v=3","gravatar_id":"","url":"https://api.github.com/users/n0rdik","html_url":"https://github.com/n0rdik","followers_url":"https://api.github.com/users/n0rdik/followers","following_url":"https://api.github.com/users/n0rdik/following{/other_user}","gists_url":"https://api.github.com/users/n0rdik/gists{/gist_id}","starred_url":"https://api.github.com/users/n0rdik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/n0rdik/subscriptions","organizations_url":"https://api.github.com/users/n0rdik/orgs","repos_url":"https://api.github.com/users/n0rdik/repos","events_url":"https://api.github.com/users/n0rdik/events{/privacy}","received_events_url":"https://api.github.com/users/n0rdik/received_events","type":"User","site_admin":false},"created_at":"2016-08-15T10:14:06Z","updated_at":"2016-08-15T10:14:06Z","body":"Hello!\r\n\r\nOk, I found this:\r\n\r\n.text:6D48C635 loc_6D48C635:                           ; CODE XREF: MsvpPasswordValidate(x,x,x,x,x,x,x)+8E\u0018j\r\n.text:6D48C635                                         ; MsvpPasswordValidate(x,x,x,x,x,x,x)+EA4C\u0019j\r\n.text:6D48C635                 push    10h             ; Length\r\n.text:6D48C637                 add     ebx, 34h\r\n.text:6D48C63A                 push    ebx             ; Source2\r\n.text:6D48C63B                 push    esi             ; Source1\r\n.text:6D48C63C                 call    ds:__imp__RtlCompareMemory@12 ; RtlCompareMemory(x,x,x)\r\n.text:6D48C642                 cmp     eax, 10h\r\n.text:6D48C645                 jnz     loc_6D497979\r\n\r\n\r\nBut now, I don't know hoy to adapt the unlock.py module. ¿Should I change the offset or the chunk? This is the SysWow64/msv1_0.dll file, should I search the same way in the system32 file? Sorry, I'm a newbie in Windows programming :("}}
{"actor":{"display_login":"n0rdik"}}