Hello ! In this tutorial i'm gonna show you how to let sniffers like "WPE Pro" or "Cain and Abel" fail.
What we know if we inform us a a bit about Sniffers is, that they Hook the ws2_32.dll function "send" to log outgoing packets. We also know that
has the argument 'SOCKET s'. The usual way to retrieve the IP Address / Port from this socket is
Since we know that, we gotta find a opportunity to let 'getpeername' fail. The answer is: Hooking !
There are several methods to hook a function. I'll keep it as simple as possible and use the 0xE9-jmp-method.
Now open up a new Project in VS (i use 08) and select DLL->empty project.
Since we also want to see the original Packets, we have to use the ws2_32.dll functions.
Create a Main.h and add:
should be clear.
We also know what we want to hook:
-"send" to see the original packets
-"getpeername" (of course ;))
It writes a jump (0xe9) to our function to the given address.
We also want to add a console to print our logged original packets !
Thats all for the Main.h (for the functions, you can also add a Functions-header or smth.)
Now open up the Main.cpp:
And the usual DLLMain:
As you see it contains a CreateThread for "SetupHook". Should be self-explaining.
Now we want to get the Address of our first function (send).
We do that as following:
You can add some error handling if you want - this works for me.
Now we have our address and can install the Hook itself:
and the same for getpeername:
Alright. Now the hooked functions containing our own code:
As you can see, we retrieve the Address from the Socket using "getpeername". inet_ntoa(ip.sin_addr) formats it to the usual ip format (e.g. 127.0.0.1)
Afer that we simply print the single parameters to the console we allocated below.
Now lets come to getpeername:
If we check out MSDN link of getpeername ([Only registered and activated users can see links. Click Here To Register...]) we will see:
Now compile it and inject it to ur exe (i took gw.exe from Guild Wars)
[Only registered and activated users can see links. Click Here To Register...]
As you can see, the destination is always zero. Some networksniffers dont even display the packet if they dont have the destination (e.g. Cane and Abel).
I hope this tutorial helped you in some way.
It's not meant to fully hide your connection.
However, it will probably prevent the kidz from sniffing your data.
Though its not hard to bypass.
What we know if we inform us a a bit about Sniffers is, that they Hook the ws2_32.dll function "send" to log outgoing packets. We also know that
Code:
int send( __in SOCKET s, __in const char *buf, __in int len, __in int flags );
Code:
int getpeername( __in SOCKET s, __out struct sockaddr *name, __inout int *namelen );
There are several methods to hook a function. I'll keep it as simple as possible and use the 0xE9-jmp-method.
Now open up a new Project in VS (i use 08) and select DLL->empty project.
Since we also want to see the original Packets, we have to use the ws2_32.dll functions.
Create a Main.h and add:
Code:
#include <windows.h> #include <stdio.h> #pragma comment(lib, "ws2_32.lib")
We also know what we want to hook:
-"send" to see the original packets
Code:
typedef int (__stdcall * send_t)(SOCKET sock, const char* buffer, int len,int flags); send_t pSend;
Code:
typedef int (__stdcall * getpeername_t)(SOCKET sock, struct sockaddr* name, int* namelen); getpeername_t pGetPeerName;
Code:
void* detourFunc(BYTE *src, const BYTE *dst, const int len) //gamedeception. i rather use windows detours, but however :P
{
BYTE *jmp = (BYTE*)malloc(len+5);
DWORD dwback;
VirtualProtect(src, len, PAGE_READWRITE, &dwback);
memcpy(jmp, src, len); jmp += len;
jmp[0] = 0xE9;
*(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;
src[0] = 0xE9;
*(DWORD*)(src+1) = (DWORD)(dst - src) - 5;
VirtualProtect(src, len, dwback, &dwback);
return (jmp-len);
}
We also want to add a console to print our logged original packets !
Code:
void GetConsole(LPCSTR sTitle) {
FILE *fh;
AllocConsole();
freopen_s(&fh, "CONOUT$", "wb", stdout);
SetConsoleTitleA(sTitle);
}
Now open up the Main.cpp:
Code:
#include "Main.h"
Code:
int __stdcall DllMain(HANDLE _HDllHandle, DWORD _Reason, LPVOID _Reserved)
{
if(_Reason == DLL_PROCESS_ATTACH)
{
CreateThread(0, 0, (LPTHREAD_START_ROUTINE)SetupHook, 0, 0, 0);
return 1;
}
return 0;
}
Code:
void SetupHook()
{
GetConsole("Sendlog");
}
We do that as following:
Code:
DWORD dwSend = (DWORD)GetProcAddress(GetModuleHandleA("ws2_32.dll"), "send");
Now we have our address and can install the Hook itself:
Code:
if( GetLastError() == 0)
{
pSend = (send_t)detourFunc((byte*)dwSend, (byte*)hkSend, 5);
}
Code:
DWORD dwGetPeerName = (DWORD)GetProcAddress(GetModuleHandleA("ws2_32.dll"), "getpeername");
if( GetLastError() == 0)
{
pGetPeerName = (getpeername_t)detourFunc((byte*)dwGetPeerName, (byte*)hkGetPeerName, 5);
}
Code:
int WINAPI hkSend(SOCKET sock, const char* buffer, int len,int flags)
{
sockaddr_in ip;
int length;
getpeername(sock, (struct sockaddr*)&ip, &length);
printf("ip: %s\n", inet_ntoa(ip.sin_addr));
printf("buffer: %p\n", buffer);
printf("length: %i\n", len);
printf("flags: %i\n", flags);
printf("---------------------\n");
return pSend(sock, buffer, len, flags);
}
Afer that we simply print the single parameters to the console we allocated below.
Now lets come to getpeername:
Code:
int WINAPI hkGetPeerName(SOCKET sock, struct sockaddr* name, int* namelen)
{
}
That means, we will simply return out of getpeername without doing anything !Quote:
If no error occurs, getpeername returns zero. Otherwise, a value of SOCKET_ERROR is returned, and a specific error code can be retrieved by calling WSAGetLastError.
Code:
int WINAPI hkGetPeerName(SOCKET sock, struct sockaddr* name, int* namelen)
{
return 0;
}
[Only registered and activated users can see links. Click Here To Register...]
As you can see, the destination is always zero. Some networksniffers dont even display the packet if they dont have the destination (e.g. Cane and Abel).
I hope this tutorial helped you in some way.
It's not meant to fully hide your connection.
However, it will probably prevent the kidz from sniffing your data.
Though its not hard to bypass.
