[Release] Advanced hooking

Quote:

Originally Posted by Synsia Either call the client's own disconnect wrapper function or call closesocket() with the correct socket (which you can get from hooking connect()) There's no need to append packets with TQ stamps when you're using the client functions, they will do this for you.

Quote:

Originally Posted by Synsia Either call the client's own disconnect wrapper function or call closesocket() with the correct socket (which you can get from hooking connect()) There's no need to append packets with TQ stamps when you're using the client functions, they will do this for you.

Quote:

Originally Posted by Belth Patch 5532: private const int SendPacketFxnAddress = 0x6E72A3; private const int RecvPacketFxnAddress = 0x6E7578; private const int RecvLoopAddress = 0x6E6DC7; private const int Return8Address = 0x69A3D6; private const int NetworkClass = 10082968; As for how to find addresses I just do it the obvious/noob way; just find any "landmarks" near the previous addresses in the new client. For example find "catch error in process msg:" and search upwards to the first "Test EAX, EAX" command gives you the RecvLoopAddress. For NetworkClass I attach, login, break at SendPacketFxnAddress and use the value in ECX.

Quote:

Originally Posted by Belth Here are two issues I've experienced while playing around with this library. 1. After setting a hardware break point (bp) at RecvLoopAddress and running for about 20 minutes, the client freezes up and it's cpu usage goes way up. This happens with a fresh official client. After removing debug checks via Lateralus' Create-A-Client this issue disappears. Neither SendPacketFxnAddress nor RecvPacketFxnAddress produces this issue with a clean client. If it matters, the RecvLoopAddres bp is hit every 74 ms while for RecvPacketFxnAddress it is every 300+ ms. Link to the exact code to replicate this issue: [Only registered and activated users can see links. Click Here To Register...] 2. Even with Lat's client I experience client crashes after various amounts of time depending on how much activity is going on. For example, I get crashes 3-4 times during CTF (so every 15-20 minutes) and every 2-4 hours under "normal" conditions. To test whether the first issue was specific to RecvLoopAddress or not I set bps at Send and Recv and left the client on overnight for 7+ hours so this issue seems also to be related with the RecvLoop. Any help is appreciated.

public class Client
{

	private HookManager _hookManager;

	public Client(Process process)
	{
		_hookManager = new HookManager(process);
	}

	public bool Attach()
	{

		if (!_hookManager.Attach) {
			return false;
		}

		if (!_hookManager.AddHook("shell32.dll", "ShellExecuteA", ShellExecuteAHook)) {
			return false;
		}

		return true;

	}


	private void ShellExecuteAHook(ref CONTEXT ctx)
	{
		int filePointer = 0;

		_hookManager.MemRead(filePointer, ctx.Esp + 12);

		if (filePointer > 0) {

			string file = new string("", 255);

			_hookManager.MemRead(file, filePointer);

			if (file == "http://co.91.com/signout/") {
				_hookManager.MemWrite(" " + Convert.ToChar(0).ToString(), filePointer);
			}

	}
     
}

Quote:

Originally Posted by IAmHawtness This library is quite old, and it does have some flaws. If people are interested, I have a newer (yet somewhat old) hooking class that is slightly more stable, a bit easier to use and has some more functions. For example, a client hooking class would look something like this: Code: public class Client { private HookManager _hookManager; public Client(Process process) { _hookManager = new HookManager(process); } public bool Attach() { if (!_hookManager.Attach) { return false; } if (!_hookManager.AddHook("shell32.dll", "ShellExecuteA", ShellExecuteAHook)) { return false; } return true; } private void ShellExecuteAHook(ref CONTEXT ctx) { int filePointer = 0; _hookManager.MemRead(filePointer, ctx.Esp + 12); if (filePointer > 0) { string file = new string("", 255); _hookManager.MemRead(file, filePointer); if (file == "http://co.91.com/signout/") { _hookManager.MemWrite(" " + Convert.ToChar(0).ToString(), filePointer); } } }

Quote:

Originally Posted by IAmHawtness This library is quite old, and it does have some flaws. If people are interested, I have a newer (yet somewhat old) hooking class that is slightly more stable, a bit easier to use and has some more functions.

Quote:

Originally Posted by IAmHawtness This library is quite old, and it does have some flaws. If people are interested, I have a newer (yet somewhat old) hooking class that is slightly more stable, a bit easier to use and has some more functions. For example, a client hooking class would look something like this: Code: public class Client { private HookManager _hookManager; public Client(Process process) { _hookManager = new HookManager(process); } public bool Attach() { if (!_hookManager.Attach) { return false; } if (!_hookManager.AddHook("shell32.dll", "ShellExecuteA", ShellExecuteAHook)) { return false; } return true; } private void ShellExecuteAHook(ref CONTEXT ctx) { int filePointer = 0; _hookManager.MemRead(filePointer, ctx.Esp + 12); if (filePointer > 0) { string file = new string("", 255); _hookManager.MemRead(file, filePointer); if (file == "http://co.91.com/signout/") { _hookManager.MemWrite(" " + Convert.ToChar(0).ToString(), filePointer); } } }

Quote:

Originally Posted by xmen01235 address change again? so bad that i did not able to screenshot the old one.

Quote:

Originally Posted by { Angelius } current patch. SendPacketAddress = 0x6F09D0; RecvPacketAddress = 0x6F0CA5; i think thats all you need atm.