[NEW] MagicSipac: Just click and get SIP data - NO MORE HEX!

kiler129 · Post by **kiler129** » Sat Jun 12, 2010 5:09 pm

Hi all!
I decide to share my tool for extractting SIP data for MagicJack. For now it can retrive server ip, server host, port, user and password.
You must know something: it`s private tool writed 4-5 months ago and for sure it`s not perfect but working.

Chagelog
v1.2
- Completely rewritten analizing algorithm
- Speed improvments
- More verbose
- Small appearance changes
- Now time values isn`t hardcoded - you must press enter immediately after small grey windows with loading bat or main app window appears to the screen [on some computers grey loading window is not shown][/list]

v1.1
- First public version
- Added username&hostname searching

v1.0
- First private version

Know issues
- You must press enter in the correct moment - formally it isn`t issue but need to be fixed
- Sometimes MagicJack(TM) start and freez for 2-3 sec - it cause the tool dump are too early - without data (I try to fix it in next realase) Fixed in v1.2
- Sometimes if you connect stick to USB and immediately run the tool it show junk data => It`s similar to 1st point but it`s easy to fix - after inserting stick wait 15-20 sec and start the tool Fixed in v1.2
- If you running Windows XP and application crash with error like "no entry point"/"missing component" try to install Visual C++ Runtimes (usually it`s not needed because many applications and games need it and install with itself)

How to use
0. Turn off windows autorun (Learn how), unplug the telephone adapter from USB
1. Plug MagicJack(TM) telephone stick into usb
2. Wait 15-20 seconds
3. Start the application
4. Follow on screen instructions
5. Report results here (include an error message if occure and lines "Found: ....")
6. Configure your favourite sip program like X-lite or ATA adapter (I prefere Linksys PAP2T - it`s cheap and good)

Screenshoot
v1.2 looks like this:

Code: Select all


|\/| _  _ . _(_ . _  _  _
|  |(_|(_)|(___)||_)(_|(_
       _/        |     v1.2

Searching stick >>*****<< [FOUND!]
Checking status of MagicJack... [OK]
Running MagicJack(TM) client >>******************<<[FOUND@3732]

!IMPORTANT!
HIT ENTER KEY IMMEDIATELY AFTER SMALL GREY WINDOW WITH LOADING BAR OR MAIN APPLI
CATION WINDOW APPEARS TO THE SCREEN
Dump #1 in progress [OK]
Dump #2 in progress [OK]
Dump #3 in progress [OK]
Dump #4 in progress [OK]
Dump #5 in progress [OK]
Dump #6 in progress [OK]
Done! Killing MagicJack(TM) client... [OK]

Next few operations will take about 2-5 minutes (depends on your computer speed)

=> Dump #1
  * Parsing...   [OK]
  * Analizing... [OK]
  * Found: 0 user(s), 107 password(s), 0 servers(s)

=> Dump #2
  * Parsing...   [OK]
  * Analizing... [OK]
  * Found: 0 user(s), 107 password(s), 0 servers(s)

=> Dump #3
  * Parsing...   [OK]
  * Analizing... [OK]
  * Found: 0 user(s), 107 password(s), 0 servers(s)

=> Dump #4
  * Parsing...   [OK]
  * Analizing... [OK]
  * Found: 10 user(s), 120 password(s), 78 servers(s)

=> Dump #5
  * Parsing...   [OK]
  * Analizing... [OK]
  * Found: 22 user(s), 127 password(s), 40 servers(s)

=> Dump #6
  * Parsing...   [OK]
  * Analizing... [OK]
  * Found: 22 user(s), 127 password(s), 40 servers(s)

Multiple-choice results, strict filtering is needed:
Doing strict filtering...
   * Multiple matches for password! Using the most appropriate. [OK]

***********************MagicSipac************************
**************************v1.2***************************
*********\/\/\/\/\/\/\/\/ DONE \/\/\/\/\/\/\/\/**********
*********************************************************
********SVIP: [CENSORED] ********************************
********SERV: proxy01.[CENSORED].talk4free.com **********
********PORT: 5070 **************************************
********USER: E[CENSORED][email protected] ***************
********PASS: 6[CENSORED]L ******************************
*********************************************************
************************For education purpose only*******
***********************************************from c4t**

p.s. If any of the fields show 'NOT FOUND' don`t worry - run this tool again ;)
 ENjoy! :>

/\
From v1.1 Version

Virus scan
v1.2
http://www.virustotal.com/en/analisis/4 ... 1276471914

v1.1
http://www.virustotal.com/en/analisis/b ... 1276376649
Note: F-secure show wrong results because exe is packed - it`s virus free.

DOWNLOAD
v1.2
Server 1: http://www.megaupload.com/?d=KM61QISN
Server 2: http://www.sendspace.com/file/uin5uw
Server 3: http://www.filefactory.com/file/b4hcaa9 ... ac_1.2.exe

******OLD RELEASES******
v1.1
Server 1: http://www.megaupload.com/?d=OTS8YPP8
Server 2: http://www.sendspace.pl/file/ee9a87a1e2f8fdcdac8202e
Server 3: http://www.filefactory.com/file/b203acc ... cSipac.exe

Use at your own risk!
-----------------------------------
Sorry for my english - if you can`t understand something just ask.

sabresfan · Post by **sabresfan** » Sat Jun 12, 2010 6:13 pm

Thanks for sharing with the community. Being I have my sip info already many others may find this tool very helpful. That being said it's always prudent to warn people to use this at their own risk. I'm not saying anything is wrong with your tool but people need to use caution when hacking any device. From what I can see you are sincere in your desire to share with the community and have given great instructions for using this. It's going to be fun to see how MJ will block your tool from easily giving people their sip info again.

kiler129 · Post by **kiler129** » Sat Jun 12, 2010 6:23 pm

Sure, you right, I forgot about standard text "You are using it at your own risk blah blah"
....it`s generally no risk except MJ(TM) license violations

Unfortunatly (I am glad ;]) MagicJack can do nothing - it`s too hughe costs to write new application&server software and make big changes in SIP protocol.
Now I know only 2 real voice protocols - SIP and Skype.
MJ only can encrypt traffic but it`s pointless - application must work with unencrypted password and username to send it.

MagicJack can encrypt data but for few seconds it must be clear and sended (for eg. for time to reencrypt to https standard) = so I can catch it

p.s. sabresfan - can you test this tool?

gork · Post by **gork** » Sat Jun 12, 2010 11:36 pm

Off topic, but when you say you know the Skype protocol it makes me think you should hook up with the people over at Trillian. They have a plug in for their IM to work with Skype, but you have to have Skype running in the background. I wonder if you could help them create a native protocol for integration of Trillian IM with Skype voice and/or IM... They've posted that they've been unable to crack Skype...

Just a thought.

Everton · Post by **Everton** » Sun Jun 13, 2010 6:32 am

I download this tool, follow the directions and ran the tool twice and it did not return a password or proxy. I will attempt a third time to see if successful. I was able to get the password with genxweb's method, but I find this method a lot more appealing, but no success so far. BTW, I'm using Windows 7 Ultimate with all updates!!

EDIT: After 3 tries the software failed to find the password. Is there anything I should do to make this work?

x0r0 · Post by **x0r0** » Sun Jun 13, 2010 7:22 am

dont work try many times anyone else get this to work?

kiler129 · Post by **kiler129** » Sun Jun 13, 2010 7:45 am

Can you tell me when program start creating dumps? Timming is the important part of process so 1st dump must be created when program show main window.
I hardcoded time values for my computer.

Please report me when MagicSipac start to create 1st dump (possible moments are: before MJ start, first splash with "One minute of....", second splash with "Tell your friends...", grey box with black loading bar and text like "starting MagicJack aplication" and [correct time] just after client app window appears).
I'm working on better way of detecting status of MagicJack process.
One of helpful information for me is what program show as passwd: NOT FOUND or some junk.

@gork - Skype protocol is very complicated and uses many security tricks - it`s very hard to crack or work with that and it is often modified.
For now I don`t know any program with full impletation of Skype protocol (ofc with native support - not skype gateway or sth).

EDIT:
Becuase code is so old I`m must do some cleaning work with it. Now I`m hard working with new search algorithm.
It`s complicated because MagicJack(TM) developers cares about it - in newer versions of client variables in memory have similar names to the password structure. It makes algorithm complicated.

Everton · Post by **Everton** » Sun Jun 13, 2010 4:19 pm

kiler129 wrote:Can you tell me when program start creating dumps? Timming is the important part of process so 1st dump must be created when program show main window.
I hardcoded time values for my computer.

Please report me when MagicSipac start to create 1st dump (possible moments are: before MJ start, first splash with "One minute of....", second splash with "Tell your friends...", grey box with black loading bar and text like "starting MagicJack aplication" and [correct time] just after client app window appears).
I'm working on better way of detecting status of MagicJack process.
One of helpful information for me is what program show as passwd: NOT FOUND or some junk.

@gork - Skype protocol is very complicated and uses many security tricks - it`s very hard to crack or work with that and it is often modified.
For now I don`t know any program with full impletation of Skype protocol (ofc with native support - not skype gateway or sth).

EDIT:
Becuase code is so old I`m must do some cleaning work with it. Now I`m hard working with new search algorithm.
It`s complicated because MagicJack(TM) developers cares about it - in newer versions of client variables in memory have similar names to the password structure. It makes algorithm complicated.

I no longer have my MJ dongle with me, as I was setting up the MJ on a SPA-3102 for a family member. In my case the first dump (& possible the second) occurred before the "When you see it starts to load and see the ad on the left hand side start to show". So it is definitely a timing issue and I would think is dependent on the PC processor speed and other variables.

The password shown was "HHHHHHHHHHHHHHHHHHHH", with "SVIP, SERV as "UNKNOWN" and USER was the correct information.

I hope this helps with your debugging!

kiler129 · Post by **kiler129** » Sun Jun 13, 2010 5:00 pm

Starting dumping when ad show is wrong way - in eg. at my computer ad show after login process.
Best time to start dumping is immediately after main window appears at screen.

Password like HHHHHHH... isn`t in-line caused by timing but can - I strongly modified this tool (+100 lines of code).
Now I`m wokrking with timing, now I building package with question to user "When you see the application window immediately press enter".
In next realase I will use windows user32 api to detect time the window appears but I never use winapi so I must read some manuals

EDIT:
So ..... after few hours of hard-workingI updated 1st post with new version.
Download and try

joevv · Post by **joevv** » Sun Jun 13, 2010 10:06 pm

I actually got version 1.1 to work by pausing it for a few seconds.
Testing version 1.2 now

EDIT: ver 1.2 working...win 7 ultimate

You may still have to play with the timing when pressing the enter key.

kiler129 · Post by **kiler129** » Sun Jun 13, 2010 10:56 pm

joevv wrote:I actually got version 1.1 to work by pausing it for a few seconds.

What do you exactly mean by "pause for few seconds"?

EDIT: ver 1.2 working...win 7 ultimate

Nice to hear it

Good question is XP compatibility.

You may still have to play with the timing when pressing the enter key.

I know, I know ... it`s confusing for me and users. Automation of this process is possible but hard to do. I must use User32 WinAPI to detect currently opened windows and do this in for() many times util on list I see real MagicJack app.
What I mean by real? So... autorun.exe execute splash and preloader and next magicjack.exe process.
Now my tool detects magicjack.exe process but getting from this moment to app window may take 1-10sec (depends on computer speed - there predict how many seconds it will take).

I`m still working

Information must be free.

genxweb · Post by **genxweb** » Mon Jun 14, 2010 7:41 am

Dude you are making it to complex. I applaud your efforts but think about it this way.

1. Everyone already knows their username: ETELEPHONE_NUMBER01
2. Everyone knows their proxy. Choose the closet majority. This helps cut latency and other issues.

3. What you need to do is as soon as the ad starts to load on the left hand side of the magic jack, start your dumping.

Thats why when I wrote mine I did not fully automate there are so many variables out there from end user cpu speeds to different versions of code and so on. Take the simple approach to improve your code.

sabresfan · Post by **sabresfan** » Mon Jun 14, 2010 11:03 am

With windows XP I get an error saying warning no disk followed by a bunch of numbers. I installed, uninstalled and repaired Visual C++ Runtimes. Maybe it's time to upgrade to Windows 7.

genxweb · Post by **genxweb** » Mon Jun 14, 2010 11:09 am

I don't like thread hijacking and asked him to start this thread to avoid it. But for those that are having issues with his code and want the password check out my thread and perl script.

kiler129 · Post by **kiler129** » Mon Jun 14, 2010 1:27 pm

@sabresfan can you post a screenshoot?
@genxweb your algorithm is too simple - it return many "passwords" - false-positive passing regex.
btw. Password can be 21 OR 20 ch.

sabresfan · Post by **sabresfan** » Mon Jun 14, 2010 2:21 pm

Can't seem to get a screen shot to work but this is the message Exception Processing Message c0000013 Parameters 75b6bf7c 4 75b6bf7c 75b6b7c I googled it and there are a bunch of different things to try so this one might be on the back burner for me. Thanks again for giving a tool to the community.

kiler129 · Post by **kiler129** » Mon Jun 14, 2010 3:03 pm

sabresfan wrote:Can't seem to get a screen shot to work but this is the message Exception Processing Message c0000013 Parameters 75b6bf7c 4 75b6bf7c 75b6b7c I googled it and there are a bunch of different things to try so this one might be on the back burner for me. Thanks again for giving a tool to the community.

It`s window with 3 buttons like Cancel, Try again and Continue?
I tested it and windows show it when you insert magic jack, run aplliacion manually, close it and run this tool.

sabresfan · Post by **sabresfan** » Mon Jun 14, 2010 3:40 pm

kiler129 wrote:
sabresfan wrote:Can't seem to get a screen shot to work but this is the message Exception Processing Message c0000013 Parameters 75b6bf7c 4 75b6bf7c 75b6b7c I googled it and there are a bunch of different things to try so this one might be on the back burner for me. Thanks again for giving a tool to the community.
It`s window with 3 buttons like Cancel, Try again and Continue?
I tested it and windows show it when you insert magic jack, run aplliacion manually, close it and run this tool.

Thats it. It's almost like the application does not see my MJ running.

kiler129 · Post by **kiler129** » Mon Jun 14, 2010 3:56 pm

sabresfan wrote:
kiler129 wrote:
sabresfan wrote:Can't seem to get a screen shot to work but this is the message Exception Processing Message c0000013 Parameters 75b6bf7c 4 75b6bf7c 75b6b7c I googled it and there are a bunch of different things to try so this one might be on the back burner for me. Thanks again for giving a tool to the community.
It`s window with 3 buttons like Cancel, Try again and Continue?
I tested it and windows show it when you insert magic jack, run aplliacion manually, close it and run this tool.
Thats it. It's almost like the application does not see my MJ running.

It`s a windows bug

You must unplug and replug device and next run my tool.

genxweb · Post by **genxweb** » Mon Jun 14, 2010 8:02 pm

kiler129 wrote:@sabresfan can you post a screenshoot?
@genxweb your algorithm is too simple - it return many "passwords" - false-positive passing regex.
btw. Password can be 21 OR 20 ch.

Dude I have hacked over 300 + magic jacks for call centers and others not one had a 21 char password and mine returns all the passwords in the file not once have I had a false positive. I have tested each account during development of the script to ensure accuracy.

Some times simplicity is the best.

kiler129 · Post by **kiler129** » Tue Jun 15, 2010 2:45 am

genxweb wrote:not one had a 21 char password

I have one with 21 ch. pwd in my house

Some times simplicity is the best.

I agree but for coders and generally it-peoples - for normal users who only know how to plug stick into usb is so complicated.

mavro6000 · Post by **mavro6000** » Tue Jun 15, 2010 1:21 pm

I got all the information, minus the server information. How important is to get the server information? Can I just use any one? Also, where is the link that I can configure the ATA?

kiler129 · Post by **kiler129** » Tue Jun 15, 2010 1:53 pm

mavro6000 wrote:I got all the information, minus the server information. How important is to get the server information? Can I just use any one? Also, where is the link that I can configure the ATA?

Recomended is your nearst nerver. If you live in eg. chicago use proxy01.chiacgo.talk4free.com

oldtimercurt · Post by **oldtimercurt** » Tue Jun 15, 2010 2:03 pm

mavro6000

Search is your friend. Here's one link of pages on the subject.

http://www.phoneservicesupport.com/magi ... t5066.html

OTC

Spider210 · Post by **Spider210** » Tue Aug 24, 2010 6:53 pm

can't seem to get the same password twice. I renewed my mj service today and then my sip credentials stopped working today after my mj software updated anyone else have this problem?

neo2121 · Post by **neo2121** » Tue Aug 24, 2010 8:06 pm

I have you tired dumping the old way and manually searching for your password? If not give that a Try i have yet to upgrade, might try it to night. If you still cant find it I have some free time tonight I will pull your password for you no charge if you e-mail me your dump file.

Spider210 · Post by **Spider210** » Wed Aug 25, 2010 5:25 pm

I emailed you my dump maybe you can find it. Been trying everything that looks like a password but nothing seems to work. This will piss me off if i just renewed only to not be able to use it the way i've been...

neo2121 · Post by **neo2121** » Thu Aug 26, 2010 4:35 am

found

Spider210 · Post by **Spider210** » Thu Aug 26, 2010 1:31 pm

eh the password you sent me doesn't work

thasan · Post by **thasan** » Thu Aug 26, 2010 1:39 pm

MagicJack has now updating their password/proxy scheme. The older passwords no longer work. The username is not ending with 04 instead of 01 and the logs aren't the same any more and hence, MagicSipac can no longer decipher.

Spider210 · Post by **Spider210** » Thu Aug 26, 2010 2:06 pm

so whats the username /password scheme now

arcadia2uk · Post by **arcadia2uk** » Wed Sep 15, 2010 9:47 am

As from now, MagicSipac only work correctly if your user is E<your MJ#>01, otherwise it return blank. This has recently been changed by MJ.
Though, this is not a major inconvenience since you just continue to try manually by incrementing the last digit, one step at the time.
Mine was E<my MJ#>02, why it still work, sort of:)

Great, convenient app.
Many Thanks,
arc

degarb · Post by **degarb** » Mon Sep 27, 2010 12:35 pm

just keeps asking me to put a cd in my cd drive , d:, on run. I disabled auto run. MJ is on h: and I:

The english typing is poor of some posts and vague. I don't get the username scheme. One post says it ends in @talk4free.com One E#1 and another alludes to needing to increase last digit, indefinitely, and guess.

arcadia2uk · Post by **arcadia2uk** » Mon Sep 27, 2010 1:24 pm

Until recently MJ's userID always ended with 01, now it could be 01, 02, 03... (this might have something to do with how many devices are registered under your e-mail ?)
MagicSipac only give you a userID if it has a 01 ending, reason why you might have to do trial and error, if the field is blank.
This is not a major issue since the string is "Exxxyyyzzzz0x", where xxxyyyzzzz is your 10-digit MJ#, and the 0x is the 01, 02 or 03....
The @talk4free.com extension is referring to your domain (which is always "talk4free.com") and not to the user ID.
AccountID = UserID @ domain
Depending on your Sip client, you use either AccountID or UserID as your registrarID.
arc

degarb · Post by **degarb** » Mon Sep 27, 2010 2:33 pm

I could not get this program to work. Either an exception crash, or it would probe my dvd drive, not H:. Stroth's did same thing.

I did figure out that if I ran the dos line: pmdump.exe pidofMagicJack out.txt
then line: strings.exe out.txt >>parsed.txt
then did a editpad search for Connection.refresh
Then my password was 5 lines down from it.

This worked, but 6 months from now, I will have no recollection of how I determined my pw.

Well, thanks MJ for the rolling passwords. I now am a paying customer of a competitor to your service called Nettalk. Which should be more headache free (no computer or software that breaks), and so, tempt me not to renew.

arcadia2uk · Post by **arcadia2uk** » Mon Sep 27, 2010 3:22 pm

You could try using MJSIP instead:
http://www.digitaloffensive.com/2010/06 ... retrieval/

genxweb · Post by **genxweb** » Mon Sep 27, 2010 7:42 pm

Iam the creator of mjsip and owner of digitaloffensive.com so if you guys have questions please feel free to ask.

bgfrmnyc · Post by **bgfrmnyc** » Sun Oct 03, 2010 4:08 pm

Just wanted to say thanks! Using Windows7, followed instructions and the very first try was a success. Great work!

yazyazoo · Post by **yazyazoo** » Sat Oct 16, 2010 10:06 pm

Should disabling autorun not let MJ load up?

I did the Hotfix for winxp for disabling autorun. However when I plug in my MJ it seems to run like it always has.

Moe_Ale · Post by **Moe_Ale** » Wed Oct 20, 2010 11:13 pm

worked from first try.

I am using windows 7 home premium 64. I followed the OP's instructions and it worked like a charm from the first try. Great Job. Thanks

adam3914 · Post by **adam3914** » Thu Oct 21, 2010 9:51 am

Thanks, the program worked great, except it would not start the magic jack application automatically. so I just started it manually when it said starting Running MagicJack(TM) client. And it found my new password with no problems after the recent change.

JOFTAA · Post by **JOFTAA** » Sun Oct 24, 2010 5:50 am

I am hoping that I am not breaking any rules here. I am only posting to say thank you.

I got my password using MagicSipac. It did take me three tries, but that is just a timing thing.

Mucho gracias!!!

farazars · Post by **farazars** » Fri Jan 28, 2011 12:45 am

hi,
the program needs to detect a usb plugged in...i have an account with the new magictalk product, without a USB but the same software ... SIPdump worked to dump it, but I cannot connect still .. perhaps your program will give me the correct username/password -- but is there a way of doing it wihtout the USB method?

magicJack and magicJack Plus Support, Reviews, FAQs and Tricks

[NEW] MagicSipac: Just click and get SIP data - NO MORE HEX!

[NEW] MagicSipac: Just click and get SIP data - NO MORE HEX!

MagicSipac: Just click and get SIP data - NO MORE HEX!

MJ Changed their stream

Success after first try

great job

magictalk