rainbow new api

hi

i found some of sentinel api functiong which are changed.
and none of sig's(killer,cyberheg..)can distinguish the function
1-have you any new sig
2-anyone have any experiance for reversing new rainbow dongle for sharing

thanx

this is part of firstfindunit
----------------------------------------------text:10005B30 var_46 = word ptr -46h
.text:10005B30 var_44 = word ptr -44h
.text:10005B30 var_40 = byte ptr -40h
.text:10005B30 arg_0 = dword ptr 4
.text:10005B30 arg_4 = word ptr 8
.text:10005B30
.text:10005B30 sub esp, 48h
.text:10005B33 mov [esp+48h+var_46], 0
.text:10005B3A push ebx
.text:10005B3B push esi
.text:10005B3C mov ebx, [esp+50h+arg_0]
.text:10005B40 push edi
.text:10005B41 push ebp
.text:10005B42 test ebx, ebx
.text:10005B44 jz loc_10005DD5
.text:10005B4A mov bp, [esp+58h+arg_4]
.text:10005B4F test bp, bp
.text:10005B52 jz loc_10005DD5
.text:10005B58 cmp bp, 0FFFFh
.text:10005B5D jnz short loc_10005B6D
.text:10005B5F mov ax, 3
.text:10005B63 pop ebp
.text:10005B64 pop edi
.text:10005B65 pop esi
.text:10005B66 pop ebx
.text:10005B67 add esp, 48h
.text:10005B6A retn 8
.text:10005B6D ; ---------------------------------------------------------------------------
.text:10005B6D
.text:10005B6D loc_10005B6D: ; CODE XREF: RNBOsproFindFirstUnit+2Dj
.text:10005B6D push ebx
.text:10005B6E call sub_1000F2A0
.text:10005B73 mov esi, eax
.text:10005B75 mov ax, [esi]
.text:10005B78 cmp ax, 7242h
.text:10005B7C jz short loc_10005B89
.text:10005B7E cmp ax, 7243h
.text:10005B82 jz short loc_10005B89
.text:10005B84 mov edi, [ebx+54h]
.text:10005B87 jmp short loc_10005B94
.text:10005B89 ; ---------------------------------------------------------------------------
.text:10005B89
.text:10005B89 loc_10005B89: ; CODE XREF: RNBOsproFindFirstUnit+4Cj
.text:10005B89 ; RNBOsproFindFirstUnit+52j
.text:10005B89 mov [esp+58h+var_46], 1
.text:10005B90 mov edi, dword ptr [esp+58h+var_40]
.text:10005B94
.text:10005B94 loc_10005B94: ; CODE XREF: RNBOsproFindFirstUnit+57j
.text:10005B94 lea eax, [esp+58h+var_40]
.text:10005B98 push 40h
.text:10005B9A push eax
.text:10005B9B push ebx
.text:10005B9C call RNBOsproGetContactServer
.text:10005BA1 test ax, ax
.text:10005BA4 jnz loc_10005DD9
.text:10005BAA lea eax, [esp+58h+var_40]
.text:10005BAE push offset aRnbo_standalon ; char *
.text:10005BB3 push eax ; char *
.text:10005BB4 call ds:_stricmp
.text:10005BBA add esp, 8
.text:10005BBD test eax, eax
.text:10005BBF jz loc_10005CF1
.text:10005BC5 lea eax, [esp+58h+var_40]
.text:10005BC9 push offset aRnbo_spn_drive ; char *
.text:10005BCE push eax ; char *
.text:10005BCF call ds:_stricmp
.text:10005BD5 add esp, 8
.text:10005BD8 test eax, eax
.text:10005BDA jz loc_10005CF1
.text:10005BE0 lea eax, [esp+58h+var_40]
.text:10005BE4 push offset aNoNet ; char *
.text:10005BE9 push eax ; char *
.text:10005BEA call ds:_stricmp
.text:10005BF0 add esp, 8
.text:10005BF3 test eax, eax
.text:10005BF5 jz loc_10005CF1
.text:10005BFB lea eax, [esp+58h+var_40]
.text:10005BFF push offset aRnbo_spn_all_m ; char *
.text:10005C04 push eax ; char *
.text:10005C05 call ds:_stricmp
.text:10005C0B add esp, 8
.text:10005C0E test eax, eax
.text:10005C10 jz short loc_10005C2A
.text:10005C12 cmp [esp+58h+var_40], 0
.text:10005C17 jz short loc_10005C2A
.text:10005C19 push ebp
.text:10005C1A push ebx
.text:10005C1B call sub_10007140
.text:10005C20 pop ebp
.text:10005C21 pop edi
.text:10005C22 pop esi
.text:10005C23 pop ebx
.text:10005C24 add esp, 48h
.text:10005C27 retn 8
.text:10005C2A ; ---------------------------------------------------------------------------
.text:10005C2A
.text:10005C2A loc_10005C2A: ; CODE XREF: RNBOsproFindFirstUnit+E0j
.text:10005C2A ; RNBOsproFindFirstUnit+E7j
.text:10005C2A cmp word ptr [esi], 7242h
.text:10005C2F jz short loc_10005C60
.text:10005C31 push 404h
.text:10005C36 push ebx
.text:10005C37 call sub_10004BF0
.text:10005C3C push ebx
.text:10005C3D call sub_10004C10
.text:10005C42 test ax, ax
.text:10005C45 jz short loc_10005C60
.text:10005C47 push ebp
.text:10005C48 mov [ebx+54h], edi
.text:10005C4B mov word ptr [esi], 8DBDh
.text:10005C50 push ebx
.text:10005C51 call sub_10007140
.text:10005C56 pop ebp
.text:10005C57 pop edi
.text:10005C58 pop esi
.text:10005C59 pop ebx
.text:10005C5A add esp, 48h
.text:10005C5D retn 8
.text:10005C60 ; ---------------------------------------------------------------------------
.text:10005C60
.text:10005C60 loc_10005C60: ; CODE XREF: RNBOsproFindFirstUnit+FFj
.text:10005C60 ; RNBOsproFindFirstUnit+115j
.text:10005C60 push 1
.text:10005C62 push ebp
.text:10005C63 push ebx
.text:10005C64 call sub_10004C40
.text:10005C69 mov [esp+58h+var_44], ax
.text:10005C6E test ax, ax
.text:10005C71 jz short loc_10005C8C
.text:10005C73 push ebp
.text:10005C74 mov [ebx+54h], edi
.text:10005C77 mov word ptr [esi], 8DBDh
.text:10005C7C push ebx
.text:10005C7D call sub_10007140
.text:10005C82 pop ebp
.text:10005C83 pop edi
.text:10005C84 pop esi
.text:10005C85 pop ebx
.text:10005C86 add esp, 48h
.text:10005C89 retn 8

[peterg70]

why not create new signatures using IDA that way we can tell.
Also document what version of driver and sentinel coding you find or think it is.

hi
I posted towice ur answer but i dontknow why they r not shown.
the driver version (is 5.42.1 32bit).but i dont know how can i make sig
with a dissasembeled a dll file in ida .by the way i found new sentinel superpro some where (up to 6.3 ver).so if it posible tel me in detail
1-how can imake sig with ida pro(i'm working with 4.7 ver)

thanx