Wofür packete sniffen?

Page 2 of 2 1 2
10/21/2011 16:24 .BritainAndy#16
wie shcon erwähnt wurde, schau dir tutorials an die thema sniffing behandeln ([Only registered and activated users can see links. Click Here To Register...]) und ladt dir dann mal ein Projekt runter, in der Flyff section hab ich mal eins Gedownloadet.
Daraus wird man teilweise schlauer ;)
10/21/2011 16:26 killertax#17
wenn du grad lust und zeit hast könntest mir denn link zum downloaden posten?

lade mir dann mal flyff und tue dann mal damit bisschen üben
10/21/2011 16:31 .BritainAndy#18
Hier der Source (PaketEditor von Flyff)

main.cpp
Code:
/******************************************************************************
  PacketFilter.cpp - PacketFilter class implemenation.
 
                                                 Mahesh S
                                                 [Only registered and activated users can see links. Click Here To Register...].in
                                                 http://swatrant.blogspot.com/


******************************************************************************/

#include "PacketFilter.h"

/******************************************************************************
PacketFilter::PacketFilter() - Constructor
*******************************************************************************/
PacketFilter::PacketFilter()
{
    try
    {
        // Initialize member variables.
        m_hEngineHandle = NULL;
        ::ZeroMemory( &m_subLayerGUID, sizeof( GUID ) );
    }
    catch(...)
    {
    }
}

/******************************************************************************
PacketFilter::~PacketFilter() - Destructor
*******************************************************************************/
PacketFilter::~PacketFilter()
{
    try
    {
        // Stop firewall before closing.
        StopFirewall();
    }
    catch(...)
    {
    }
}

/******************************************************************************
PacketFilter::CreateDeleteInterface - This method creates or deletes a packet
                                      filter interface.
*******************************************************************************/
DWORD PacketFilter::CreateDeleteInterface( bool bCreate )
{
    DWORD dwFwAPiRetCode = ERROR_BAD_COMMAND;
    try
    {
        if( bCreate )
        {
            // Create packet filter interface.
            dwFwAPiRetCode =  ::FwpmEngineOpen0( NULL,
                                                 RPC_C_AUTHN_WINNT,
                                                 NULL,
                                                 NULL,
                                                 &m_hEngineHandle );
        }
        else
        {
            if( NULL != m_hEngineHandle )
            {
                // Close packet filter interface.
                dwFwAPiRetCode = ::FwpmEngineClose0( m_hEngineHandle );
                m_hEngineHandle = NULL;
            }
        }
    }
    catch(...)
    {
    }
    return dwFwAPiRetCode;
}

/******************************************************************************
PacketFilter::BindUnbindInterface - This method binds to or unbinds from a
                                    packet filter interface.
*******************************************************************************/
DWORD PacketFilter::BindUnbindInterface( bool bBind )
{
    DWORD dwFwAPiRetCode = ERROR_BAD_COMMAND;
    try
    {
        if( bBind )
        {
            RPC_STATUS rpcStatus = {0};
            FWPM_SUBLAYER0 SubLayer = {0};

            // Create a GUID for our packet filter layer.
            rpcStatus = ::UuidCreate( &SubLayer.subLayerKey );
            if( NO_ERROR == rpcStatus )
            {
                // Save GUID.
                ::CopyMemory( &m_subLayerGUID,
                              &SubLayer.subLayerKey,
                              sizeof( SubLayer.subLayerKey ) );

                // Populate packet filter layer information.
                SubLayer.displayData.name = FIREWALL_SUBLAYER_NAMEW;
                SubLayer.displayData.description = FIREWALL_SUBLAYER_NAMEW;
                SubLayer.flags = 0;
                SubLayer.weight = 0x100;

                // Add packet filter to our interface.
                dwFwAPiRetCode = ::FwpmSubLayerAdd0( m_hEngineHandle,
                                                     &SubLayer,
                                                     NULL );
            }
        }
        else
        {
            // Delete packet filter layer from our interface.
            dwFwAPiRetCode = ::FwpmSubLayerDeleteByKey0( m_hEngineHandle,
                                                         &m_subLayerGUID );
            ::ZeroMemory( &m_subLayerGUID, sizeof( GUID ) );
        }
    }
    catch(...)
    {
    }
    return dwFwAPiRetCode;
}

/******************************************************************************
PacketFilter::AddRemoveFilter - This method adds or removes a filter to an
                                existing interface.
*******************************************************************************/
DWORD PacketFilter::AddRemoveFilter( bool bAdd )
{
    DWORD dwFwAPiRetCode = ERROR_BAD_COMMAND;
    try
    {
        if( bAdd )
        {
            if( m_lstFilters.size() )
            {
                IPFILTERINFOLIST::iterator itFilters;
                for( itFilters = m_lstFilters.begin(); itFilters != m_lstFilters.end(); itFilters++ )
                {
                    if( ( NULL != itFilters->bIpAddrToBlock ) && ( 0 != itFilters->uHexAddrToBlock ) )
                    {
                        FWPM_FILTER0 Filter = {0};
                        FWPM_FILTER_CONDITION0 Condition = {0};
                        FWP_V4_ADDR_AND_MASK AddrMask = {0};

                        // Prepare filter condition.
                        Filter.subLayerKey = m_subLayerGUID;
                        Filter.displayData.name = FIREWALL_SERVICE_NAMEW;
                        Filter.layerKey = FWPM_LAYER_INBOUND_TRANSPORT_V4;
                        Filter.action.type = FWP_ACTION_BLOCK;
                        Filter.weight.type = FWP_EMPTY;
                        Filter.filterCondition = &Condition;
                        Filter.numFilterConditions = 1;

                        // Remote IP address should match itFilters->uHexAddrToBlock.
                        Condition.fieldKey = FWPM_CONDITION_IP_REMOTE_ADDRESS;
                        Condition.matchType = FWP_MATCH_EQUAL;
                        Condition.conditionValue.type = FWP_V4_ADDR_MASK;
                        Condition.conditionValue.v4AddrMask = &AddrMask;

                        // Add IP address to be blocked.
                        AddrMask.addr = itFilters->uHexAddrToBlock;
                        AddrMask.mask = VISTA_SUBNET_MASK;

                        // Add filter condition to our interface. Save filter id in itFilters->u64VistaFilterId.
                        dwFwAPiRetCode = ::FwpmFilterAdd0( m_hEngineHandle,
                                                           &Filter,
                                                           NULL,
                                                           &(itFilters->u64VistaFilterId) );
                    }
                }
            }
        }
        else
        {
            if( m_lstFilters.size() )
            {
                IPFILTERINFOLIST::iterator itFilters;
                for( itFilters = m_lstFilters.begin(); itFilters != m_lstFilters.end(); itFilters++ )
                {
                    if( ( NULL != itFilters->bIpAddrToBlock ) && ( 0 != itFilters->uHexAddrToBlock ) )
                    {
                        // Delete all previously added filters.
                        dwFwAPiRetCode = ::FwpmFilterDeleteById0( m_hEngineHandle,
                                                                  itFilters->u64VistaFilterId );
                        itFilters->u64VistaFilterId = 0;
                    }
                }
            }
        }
    }
    catch(...)
    {
    }
    return dwFwAPiRetCode;
}

/******************************************************************************
PacketFilter::ParseIPAddrString - This is an utility method to convert
                                  IP address in string format to byte array and
                                  hex formats.
*******************************************************************************/
bool PacketFilter::ParseIPAddrString( char* szIpAddr, UINT nStrLen, BYTE* pbHostOrdr, UINT nByteLen, ULONG& uHexAddr )
{
    bool bRet = true;
    try
    {
        UINT i = 0;
        UINT j = 0;
        UINT nPack = 0;
        char szTemp[2];

        // Build byte array format from string format.
        for( ; ( i < nStrLen ) && ( j < nByteLen ); )
        {
            if( '.' != szIpAddr[i] ) 
            {
                ::StringCchPrintf( szTemp, 2, "%c", szIpAddr[i] );
                nPack = (nPack*10) + ::atoi( szTemp );
            }
            else
            {
                pbHostOrdr[j] = nPack;
                nPack = 0;
                j++;
            }
            i++;
        }
        if( j < nByteLen )
        {
            pbHostOrdr[j] = nPack;

            // Build hex format from byte array format.
            for( j = 0; j < nByteLen; j++ )
            {
                uHexAddr = ( uHexAddr << 8 ) + pbHostOrdr[j];
            }
        }
    }
    catch(...)
    {
    }
    return bRet;
}

/******************************************************************************
PacketFilter::AddToBlockList - This public method allows caller to add
                               IP addresses which need to be blocked.
*******************************************************************************/
void PacketFilter::AddToBlockList( char* szIpAddrToBlock )
{
    try
    {
        if( NULL != szIpAddrToBlock )
        {
            IPFILTERINFO stIPFilter = {0};

            // Get byte array format and hex format IP address from string format.
            ParseIPAddrString( szIpAddrToBlock,
                               ::lstrlen( szIpAddrToBlock ),
                               stIPFilter.bIpAddrToBlock,
                               BYTE_IPADDR_ARRLEN,
                               stIPFilter.uHexAddrToBlock );

            // Push the IP address information to list.
            m_lstFilters.push_back( stIPFilter );
        }
    }
    catch(...)
    {
    }
}

/******************************************************************************
PacketFilter::StartFirewall - This public method starts firewall.
*******************************************************************************/
BOOL PacketFilter::StartFirewall()
{
    BOOL bStarted = FALSE;
    try
    {
        // Create packet filter interface.
        if( ERROR_SUCCESS == CreateDeleteInterface( true ) )
        {
            // Bind to packet filter interface.
            if( ERROR_SUCCESS == BindUnbindInterface( true ) )
            {
                // Add filters.
                AddRemoveFilter( true );

                bStarted = TRUE;
            }
        }
    }
    catch(...)
    {
    }
    return bStarted;
}

/******************************************************************************
PacketFilter::StopFirewall - This method stops firewall.
*******************************************************************************/
BOOL PacketFilter::StopFirewall()
{
    BOOL bStopped = FALSE;
    try
    {
        // Remove all filters.
        AddRemoveFilter( false );
        m_lstFilters.clear();

        // Unbind from packet filter interface.
        if( ERROR_SUCCESS == BindUnbindInterface( false ) )
        {
            // Delete packet filter interface.
            if( ERROR_SUCCESS == CreateDeleteInterface( false ) )
            {
                bStopped = TRUE;
            }
        }
    }
    catch(...)
    {
    }
    return bStopped;
}

#ifdef SAMPLE_APP
/******************************************************************************
main - Entry point.
*******************************************************************************/
void main()
{
    try
    {
        PacketFilter pktFilter;

        // Add IP addresses which are to be blocked.
        pktFilter.AddToBlockList( "209.160.73.61" );
        pktFilter.AddToBlockList( "69.10.233.10" );

        // Start firewall.
        if( pktFilter.StartFirewall() )
        {
            printf( "\nFirewall started successfully...\n" );
        }
        else
        {
            printf( "\nError starting firewall. GetLastError() 0x%x", ::GetLastError() );
        }

        // Wait.
        printf( "\nPress any key to stop firewall...\n" );
        _getch();

        // Stop firewall.
        if( pktFilter.StopFirewall() )
        {
            printf( "\nFirewall stopped successfully...\n" );
        }
        else
        {
            printf( "\nError stopping firewall. GetLastError() 0x%x", ::GetLastError() );
        }

        // Quit.
        printf( "\nPress any key to exit...\n" );
        _getch();
    }
    catch(...)
    {
    }
}
#endif //SAMPLE_APP
PacketFilter.h
Code:
/******************************************************************************
  PacketFilter.h  - PacketFilter class declaration.
 
                                                 Mahesh S
                                                 [Only registered and activated users can see links. Click Here To Register...].in
                                                 http://swatrant.blogspot.com/


******************************************************************************/

#ifndef _PACKETFILTER_H_
#define _PACKETFILTER_H_

#define SAMPLE_APP  // Comment this line to disable the main().

// Standard includes.
#include <Winsock2.h>
#include <windows.h>
#include <stdio.h>
#include <conio.h>
#include <strsafe.h>
#include <fwpmu.h>
#include <list>

// Firewall sub-layer names.
#define FIREWALL_SUBLAYER_NAME  "MyVistaFirewall"
#define FIREWALL_SUBLAYER_NAMEW L"MyVistaFirewall"
#define FIREWALL_SERVICE_NAMEW  FIREWALL_SUBLAYER_NAMEW

// Byte array IP address length
#define BYTE_IPADDR_ARRLEN    4

// String format IP address length
#define STR_IPADDR_LEN        32

// Vista subnet mask
#define VISTA_SUBNET_MASK   0xffffffff

// Structure to store IP address filter.
typedef struct _IPFILTERINFO {
    BYTE bIpAddrToBlock[BYTE_IPADDR_ARRLEN];
    ULONG uHexAddrToBlock;
    UINT64 u64VistaFilterId;
} IPFILTERINFO, *PIPFILTERINFO;

// List of filters.
typedef std::list<IPFILTERINFO> IPFILTERINFOLIST;

class PacketFilter
{
private:
    // Firewall engine handle.
    HANDLE m_hEngineHandle;

    // Firewall sublayer GUID.
    GUID m_subLayerGUID;

    // List of filters.
    IPFILTERINFOLIST m_lstFilters;

    // Method to get byte array format and hex format IP address from string format.
    bool ParseIPAddrString( char* szIpAddr, UINT nStrLen, BYTE* pbHostOrdr, UINT nByteLen, ULONG& uHexAddr );

    // Method to create/delete packet filter interface.
    DWORD CreateDeleteInterface( bool bCreate );

    // Method to bind/unbind to/from packet filter interface.
    DWORD BindUnbindInterface( bool bBind );

    // Method to add/remove filter.
    DWORD AddRemoveFilter( bool bAdd );

public:

    // Constructor.
    PacketFilter();

    // Destructor.
    ~PacketFilter();

    // Method to add IP addresses to m_lstFilters list.
    void AddToBlockList( char* szIpAddrToBlock );

    // Method to start packet filter.
    BOOL StartFirewall();

    // Method to stop packet filter.
    BOOL StopFirewall();
};

#endif
10/21/2011 23:31 MrSm!th#19
Leichte XOR Verschlüsselung sicher nicht, aber es gibt diverse Spiele ohne oder zumindest mit einfach zu findender Verschlüsselung.
Zb. nutzen recht einfache Spiele oft die Windows Krypto-API oder zumindest große Libraries wie CryptoPP mit bekannten Verfahren wie AES und Key, IV etc. sind dann wenigstens recht leicht zu finden.
Auf Obfuscation beim Verschlüsselungsvorgang setzen eher größere Unternehmen mit bekannteren und "stärker gefährdeten" Spielen.
10/22/2011 13:58 kurrbis#20
Quote:
Originally Posted by xKraizy View Post
z.B. mit einem TCPClient zum Gameserver verbinden, und über die Send-Funktion dein Paket (musst davor natürlich eines aufbauen) an den Server senden.
Das wird nicht funktionieren. Du musst die selbe Verbindung wie dein Client nutzen. Du holst dir durch einen Hook das enstprechende Socket und benutzt dann einfach die send(..) Methode.
10/22/2011 14:20 MrSm!th#21
Quote:
Originally Posted by kurrbis View Post
Das wird nicht funktionieren. Du musst die selbe Verbindung wie dein Client nutzen. Du holst dir durch einen Hook das enstprechende Socket und benutzt dann einfach die send(..) Methode.
Ein Clientless Bot würde die Verbindung an Stelle des Clients aufbauen.
Page 2 of 2 1 2