Comments on: Workaround for Juniper VPN Split Tunneling Restriction

By: bR

bR — Mon, 07 Nov 2011 19:32:04 +0000

Thanks. Thing is I was pathing the wrong file dsNetworkConnect.exe shares code with the service executable, so the hex values I was looking for (6c 24 0c c6 44 24 07 00 ->75 3a<- 68 74) were there.

It's working now! Thank you all

By: Rob

Rob — Mon, 07 Nov 2011 18:43:27 +0000

I mean #5, lol – see how confusing it is.

By: Rob

Rob — Mon, 07 Nov 2011 18:41:24 +0000

That was my post actually, this forum is not labeled very well and puts the authors name after the post (with a confusing linebreak).

You likely did not alter the file correctly, see my post #4 for details.

By: bR

bR — Sun, 06 Nov 2011 13:51:34 +0000

After patching 6.5, I have the same problem @someguy has. When I try to modify the routes juniper disconects.

Can anyone help me please?

By: Thibaud

Thibaud — Sun, 06 Nov 2011 02:16:09 +0000

It works! When I open dsNcService.exe in OllyDbg I didn’t realize it was showing the code for ntdll. I had to go into the Modules window and select dsNcService.exe. Then I successfully disassembled, NOP’d, re-assembled, and tested, following the instructions above. Thanks a lot!!

By: Tony

Tony — Sat, 05 Nov 2011 18:53:05 +0000

Ok I figured out the problem- you have to nop out the entire jump conditional (so 75 3A -> 90 90)…

I was only noping out 75 OR 3A, not both.

By: Tony

Tony — Sat, 05 Nov 2011 18:42:00 +0000

Can someone help me out here? I have version 6.5.0.14951. I have very basic ASM knowledge)

I am able to find the string “no route to monitor” using IDA, I go to the associated function (sub_414890) and I do see the jump that is right before the push. The jump is “jnz short loc_4148DF”… I look in hex view and this jump is “75 3A” (75 is the opcode for jnz so I know I am looking in the right spot.)

So the next step (Open the executable in a Hex Editor and search for the hexadecimal data and patch the jump instruction to 0×90) is where I am slightly confused, and I have tried noping (90) both the 75 and 3A. Each time I try to connect to the VPN I get an error saying that the program has quit unexpectedly. Am I missing something?

By: ibrahim

ibrahim — Sat, 05 Nov 2011 11:59:51 +0000

@Thibaud, I can find the string in both 6.5.0.15255 and 7.0.0.17925. This means that the string should also be found in 6.5.0.14951. You can confirm this by trying to search for the string after opening the executable in a hex editor such as UltraEdit.

By: ibrahim

ibrahim — Sat, 05 Nov 2011 11:44:00 +0000

@Kodak, I am still on 7.0. I have not had any chance to try out 7.1.

By: Thibaud

Thibaud — Thu, 03 Nov 2011 21:05:16 +0000

I have Network Connect 6.5.0.14951 and OllyDbg can’t find the string ‘no routes to monitor’, not even the word route or monitor. Anybody lucky?