• There is NO official Otland's Discord server and NO official Otland's server list. The Otland's Staff does not manage any Discord server or server list. Moderators or administrator of any Discord server or server lists have NO connection to the Otland's Staff. Do not get scammed!

Tibia OtLand IP Changer

When i just try to open, just auto closes.
Even with Anti Virus disabled

Did you download it from OTLand?
Do you have another antivirus?
Tried to disable the firewall?
Tried to disable Windows Defender?
 
It's sad that latest Mozilla is warning this thread as an unwanted software with malicious programs.
 
This puts things into perspective, some things were done to the exe file by Mark maybe to protect reverse engineering?
BTW. OTLAND IPCHANGER Should be open source.
If you run the OtLand IP Changer executable through an unpacker, like de4dot, you can see it's packed by SmartAssembly:
de4dot.PNG
Once unpacked, you can then open the clean executable in a deobfuscator, like dotPeek. Although the deobfuscator won't turn it back into 100% readable code, because of the packer, you can understand what the code is doing. Looking around, you'll come to a method that looks like the main function when you click the 'Apply' button; you'll see MessageBox.Show() calls such as:
Code:
MessageBox.Show("Please select a version.", "OtLand IP Changer");
MessageBox.Show("Tibia client not found.", "OtLand IP Changer");
and, at the end of the method, a call to SetWindowText:
Code:
Class6.SetWindowText(process_0.MainWindowHandle, string.Format("Tibia - {0}:{1}", (object) string_2, (object) *(ushort*) ((IntPtr) voidPtr + 4)));
However, right before this, you'll see this lovely if statement:
Code:
if (lower.Contains("aurera") || lower.Contains("reptera") || (lower.Contains("narozia") || lower.Contains("tibiaotserver.com")) || lower.Contains("evilserv"))
        return;
It seems Mark didn't want users to be able to connect to these OTs with his IP changer so he added this condition, then packed the client (I'm assuming at the time there wasn't a unpacker for SmartAssembly).
dotPeek.PNG

I have two open-source IP changers on my GitHub. One for the classic Tibia clients (7.0-10.00), and one for the Tibia 11 client. They're not advanced, or anything, but they are open-source and anyone is free to take the code and make a nice IP changer if they want (even incorporate both into one):
jo3bingham/tibia-ip-changer
jo3bingham/tibia-11-ip-changer
 
If you run the OtLand IP Changer executable through an unpacker, like de4dot, you can see it's packed by SmartAssembly:
View attachment 32359
Once unpacked, you can then open the clean executable in a deobfuscator, like dotPeek. Although the deobfuscator won't turn it back into 100% readable code, because of the packer, you can understand what the code is doing. Looking around, you'll come to a method that looks like the main function when you click the 'Apply' button; you'll see MessageBox.Show() calls such as:
Code:
MessageBox.Show("Please select a version.", "OtLand IP Changer");
MessageBox.Show("Tibia client not found.", "OtLand IP Changer");
and, at the end of the method, a call to SetWindowText:
Code:
Class6.SetWindowText(process_0.MainWindowHandle, string.Format("Tibia - {0}:{1}", (object) string_2, (object) *(ushort*) ((IntPtr) voidPtr + 4)));
However, right before this, you'll see this lovely if statement:
Code:
if (lower.Contains("aurera") || lower.Contains("reptera") || (lower.Contains("narozia") || lower.Contains("tibiaotserver.com")) || lower.Contains("evilserv"))
        return;
It seems Mark didn't want users to be able to connect to these OTs with his IP changer so he added this condition, then packed the client (I'm assuming at the time there wasn't a unpacker for SmartAssembly).
View attachment 32360

I have two open-source IP changers on my GitHub. One for the classic Tibia clients (7.0-10.00), and one for the Tibia 11 client. They're not advanced, or anything, but they are open-source and anyone is free to take the code and make a nice IP changer if they want (even incorporate both into one):
jo3bingham/tibia-ip-changer
jo3bingham/tibia-11-ip-changer

jo3 on fire!
 
So is this safe, I noticed it was edited yesterday by Mark..
 
So is this safe, I noticed it was edited yesterday by Mark..

The thread was taken down for a couple of weeks because it was causing OTLand to be flagged by search engines and web browsers. It was a false positive, most likely because it was obfuscated with a packer which might be common for malware. I recompiled and reuploaded it yesterday without obfuscation and without the auto updater (since there won't be any updates). If you're paranoid, you can use dotPeek to read the source code like @Jo3Bingham explained above, it should be fairly readable now that there's no obfuscation.
 
I can't run this on Windows 10, what's wrong? :(
I have framework 4.0

EDIT: Nevermind, I just had to activate old 3.5 framework versions at the windows control panel
 
Last edited:
[Edited because I no longer have the problem I first had]
Yeah, never mind, it worked now, must've had some internet issue or something.
 
Last edited:
Back
Top