Intercept not working on int server ?

[MenPirate]

Hello guys.
when i try to hook send or recv functions xtrap is detect the intercept
can anyone tell me where is the problem ?

[nokia999]

If u read at last few posts u will know that:
a) don't hook recv / send function in kal (or you must patch xtrap to work it)
b) hook recv / send in ws2_32 and place hook 5 bytes after func start to work ( xtrap check this functions prolog).
c) use other magic metods xD
d) 0xfffffffffffff topics about it here and on other forums.....

[MenPirate]

If u read at last few posts u will know that:
a) don't hook recv / send function in kal (or you must patch xtrap to work it)
b) hook recv / send in ws2_32 and place hook 5 bytes after func start to work ( xtrap check this functions prolog).
c) use other magic metods xD
d) 0xfffffffffffff topics about it here and on other forums.....

thanks now hooked is success ,but packet is encrypted right ?

[meak1]

on Recv not, on Send yes

[MenPirate]

on Recv not, on Send yes

Ok thanks meak1, but how to decrypt it ?

[meak1]

Originally Posted by MenPirate

Ok thanks meak1, but how to decrypt it ?

you dont need to decrypt, just 'use' the send

[luki180pl]

If he wants to sniff send packets then yes he need to decrypt.

Or there exist another send function which can be hooked by viable and undetected

[meak1]

Originally Posted by luki180pl

If he wants to sniff send packets then yes he need to decrypt.

Or there exist another send function which can be hooked by viable and undetected

you can hook for some minutes or Secounds, its enough to get the Needed Send packets

otherwise, yes u need to decrypt the Packets, have fun

[MenPirate]

you dont need to decrypt, just 'use' the send

really i dont understand.
we hooked winsock send function and this is end point of packet senden.
as i know
step 1: Generate send packet
step 2: Push generated packet to the engine send function
step 3: encrypt the packet
step 4: send the packet to server with winsock send function

and now if i want to send packet to the server i must start from step 3 until step 4
this what i understood, is that correct?

[nokia999]

READ THIS..... its easy like 1+1 ffs

[MenPirate]

Note " im working with int server not private "

thx nokia999
really i understand this tutorial,
as u said if i want sniff the send packet i must decrypt it to be readable,
after that i will going to send my packet to the server already this will be decrypt packet
and we also send the packet with the end point ws2_32.dll send function .
and meak1 said send packet is encrypted this mean the data of packet must go to server encrypted ,
now if i send my decrypted packet the server will understand it?

[nokia999]

I want that you read from tut i posted link:

DWORD PBACK = 0x000000;// <- U need to get the Back Adress with IDA etc. Or do it with SearchPattern. PBACK = KALONLINE INTERNAL SEND FUNCTION ADRESS + PROLOG !!

#define SendASM __asm{ push ebp };__asm{ mov ebp, esp };__asm{ sub esp, 18h};__asm{ JMP PBACK}; // CHECK WITH IDA PROLOG OF KAL SEND FUNCTION ITS NOW A LITTLE CHANGED, THIS ONE HER IS FROM OLD KALONLINE!!

__declspec(naked) int __cdecl SendPacket (BYTE Header , LPCSTR Format , ... ){SendASM;} // AND THIS IS DEFINITION OF SEND FUNCTION THAT YOU USE IN YOUR DLL. USE LIKE: SendPacket(146, "bbb", 0, 10, 0) - it send move stop by 10 on y axis packet.....

[MenPirate]

dude in int kal we cant detour send function in engine cuz xtrap is detect it....
we hook winsocket function to avoid it ...

[nokia999]

Where you see detour... Just call oryginal kalonline send function like i show you.
You call kalonline send function with parameters thats all not DETOURS / HOOK it^^.
Adress of send function finde with IDA or use pattern search in your dll.

[luki180pl]

Xtra detects changes in engine code section. But it will allow you to use send function as your own