Quote:
Originally posted by blinko@Jan 12 2007, 13:59
ok elementary you lost me lol..maybe u can give me a better example of hooking or rather injecting this dll into it ..,
as far as disconnecting im not too worried about..just finding the bluename value of the other player first lol, Maybe u can use a packet Editor to capture the packets of when u jump back and forth and d/c yourself..then maybe resend that packet to the client causing it to error out..I could have a memory writing one but it'll crash the whol client not just d/c you.
|
1.Inline hooking is done in a DLL in which i rewrite entrypoint of function send() from ws2_32.dll to a push address of my function then a ret
delphi code for it:
function IHook(DllName:Pchar;ProcName:Pchar;NewProc:Pointer ;var ACode:NewCode;var BackupCode:Oldcode):Pointer;
var LHandle:THandle;
p:pointer;
cRead:cardinal;
cWrite:cardinal;
begin
ACode.op_push :=$68;
ACode.op_address:=Cardinal(NewProc);
ACode.op_ret :=$C3;
Result:=Nil;
LHandle:= LoadLibrary(Dllname);
if LHandle<>0 then begin
p:=GetProcAddress(LHandle,ProcName);
if p<>NIL then begin
ReadProcessMemory(INVALID_HANDLE_VALUE,p,@BackupCo de,6,cRead);
WriteProcessMemory(INVALID_HANDLE_VALUE,p,@ACode,6 ,cWrite);
Result:=P;
end;
end;
end;
inside my function i put back the BackupCode (which is overwritten by the 6 bytes of push addr, ret) and call to old send :
function sendw(s: integer; var Buf; len, flags: Integer): Integer; stdcall;
begin
//restore old call
WriteProcessMemory(INVALID_HANDLE_VALUE,p_send,@OC ode_send,6,eWrite);
oldsend:=p_send;
result:=oldsend(s,buf,len,flags);
//restore new
WriteProcessMemory(INVALID_HANDLE_VALUE,p_send,@NC ode_send,6,eWrite);
//here i log the socket and packet
logs(s,buf,len);
end;
so in dll at load i do
p_send:=ihook('ws2_32.dll','send',@sendw,NCode_sen d,OCode_send);
and as soon as this library is loaded in co...it hooks send()
as for loading the dll into co...i use a createremotethread in my loader.
Here you have the example...i'll post an proof of concept in few hours if needed :)