[C#] Vsro redirect

Page 1 of 2

08/21/2012 09:55 cyberninjah#1

Hey,

Is there anyway to redirect vSRO client with C# i have seen pwerRsro loader more that one is for rSRO.

I don't understand how his redirect pattern works anyone got any tip how i can make it work for vSRO client ?

08/24/2012 23:14 theonly112#2

Code:

Address   Hex dump          Command                                  Comments
004B0870  /$  55            PUSH EBP                                 ; sro_client.004B0870(guessed void)

Here's the address of the function that calls ws2.connect
That should be a good point to start at.

08/26/2012 23:28 cyberninjah#3

Quote:
Originally Posted by theonly112
Code:
Address   Hex dump          Command                                  Comments
004B0870  /$  55            PUSH EBP                                 ; sro_client.004B0870(guessed void)
Here's the address of the function that calls ws2.connect
That should be a good point to start at.

Thanks i need find some tutorials how this stuff working beacuse i have no idea at the moment ^^

08/29/2012 21:13 cyberninjah#4

hmm i still dont understand a shit about this xD got maybe any tutorial for it ?

or can explain me more about it ?

08/30/2012 22:43 sarkoplata#5

Mate i found this ^^
[Only registered and activated users can see links. Click Here To Register...]
I also try to do the same, will post if i can achieve

Edit:
There you go dude: (All credits to NoN_Stop)

Spoiler

PHP Code:


			
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using System.Diagnostics;

namespace Loader
{
    public partial class Form1 : Form
    {
        [DllImport("kernel32.dll")]
        static extern IntPtr LoadLibrary(string dllToLoad);
        [DllImport("kernel32.dll")]
        static extern IntPtr OpenProcess(uint dwDesiredAccess, int bInheritHandle, int dwProcessId);
        [DllImport("kernel32.dll")]
        static extern uint ReadProcessMemory(IntPtr hProcess, uint lpBaseAddress, uint lpbuffer, uint nSize, uint lpNumberOfBytesRead);
        [DllImport("kernel32.dll")]
        static extern uint WriteProcessMemory(IntPtr hProcess, uint lpBaseAddress, byte[] lpBuffer, int nSize, uint lpNumberOfBytesWritten);
        [DllImport("kernel32.dll")]
        static extern uint VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, uint flAllocationType, uint flProtect);
        [DllImport("kernel32.dll")]
        static extern IntPtr CreateMutex(IntPtr lpMutexAttributes, bool bInitialOwner, string lpName);
        [DllImport("kernel32.dll")]
        static extern IntPtr GetModuleHandle(string lpModuleName);
        [DllImport("kernel32")]
        static extern uint GetProcAddress(IntPtr hModule, string procName);
        [DllImport("kernel32.dll")]
        static extern uint WritePrivateProfileString(string section, string key, string val, string filePath);
        [DllImport("kernel32.dll")]
        static extern uint GetPrivateProfileString(string lpAppName, string lpKeyName, string lpDefault, StringBuilder lpReturnedString, int nSize, string lpFileName);

        public static IntPtr Handle;

        public Form1()
        {
            InitializeComponent();
        }

        private void Form1_Load(object sender, EventArgs e)
        {
            CreateMutex(IntPtr.Zero, false, "Silkroad Online Launcher");
            CreateMutex(IntPtr.Zero, false, "Ready");
            uint count = 0;
            Process SilkProcess;
            SilkProcess = new Process();
            SilkProcess.StartInfo.FileName = @"D:\Program Files\Creddy Avengers Loki\sro_client.exe";
            SilkProcess.StartInfo.Arguments = "0/22 0 0";
            SilkProcess.Start();
            Handle = OpenProcess((uint)(0x000F0000L | 0x00100000L | 0xFFF), 0, SilkProcess.Id);
            uint ConnectionStack = VirtualAllocEx(Handle, IntPtr.Zero, 8, 0x1000, 0x4);
            byte[] ConnectionStackArray = BitConverter.GetBytes(ConnectionStack);
            byte[] Connection = {
                                    0x02,0x00,
                                    0x3D, 0xA2, // PORT (15778)
                                    0x7F,0x00,0x00,0x01 // IP (127.0.0.1)
                                };
            uint Codecave = VirtualAllocEx(Handle, IntPtr.Zero, 16, 0x1000, 0x4);
            byte[] CodecaveArray = BitConverter.GetBytes(Codecave - 0x004B08A1 - 5);
            byte[] CodeCaveFunc = {
                                      0xBF,ConnectionStackArray[0],ConnectionStackArray[1],ConnectionStackArray[2],ConnectionStackArray[3],
                                      0x8B,0x4E,0x04,
                                      0x6A,0x10,
                                      0x68,0xA6,0x08,0x4B,0x00,
                                      0xC3
                                  };
            byte[] JMPCodeCave = { 0xE9, CodecaveArray[0], CodecaveArray[1], CodecaveArray[2], CodecaveArray[3] };
            WriteProcessMemory(Handle, ConnectionStack, Connection, Connection.Length, count);
            WriteProcessMemory(Handle, Codecave, CodeCaveFunc, CodeCaveFunc.Length, count);
            WriteProcessMemory(Handle, 0x004B08A1, JMPCodeCave, JMPCodeCave.Length, count);
        }
    }
}

09/02/2012 14:49 cyberninjah#6

hmm with your code its not redirect my client o.O ?

Edit: Oops sorry my bad i forgot give visual studio admin rights ^^

09/12/2012 06:57 iNiperx#7

I'm using this from a class (not form), i call it from a form it loads etc, i put my ID/PW and then the captcha image appears, when i enter it the client wont go to the char list, instead it will give me C9 error, im using edx's simple proxy, when i use this for redirect loader its C9 when i use edx's loader i dont get the C9...

09/12/2012 08:34 ZeraPain#8

this happens because the client is redirected to port 15778 and won't change it anymore (the proxy tries to redirect the client to an other port if it connects to the worldserver)

09/12/2012 21:42 iNiperx#9

So what could i do ?

The server has 4 gateways, and the IPs kind of change over time so i made it get the ip from the host name which is the same, it works..

When i'm going to use the loader the proxy starts to listen, and it gets connected to 127.0.0.1, and port 13000 (0x32, 0xC8) it gets connected to the login server, i can get wrong/pw, blocked/image captcha etc.. but when its going to connect to the world server it throws an error "An existing connection was forcibly closed by the remote host" and throws the C9...

If i just take off the part that calls the launcher function just leaving the proxy and i use edx same ip/port (127.0.0.1/13000) does work.. so idk.. Im playing with it to see if i get it to work.

09/12/2012 22:42 ZeraPain#10

well you got 2 choices:
1 - you use edx loader which redirects only the ip of the loginserver
2 - you create your own proxy which listens only to one port

09/13/2012 00:26 iNiperx#11

2) im using edx's simple proxy (with the silkroadapi he made) i changed it etc and now im using it for WinForm, and the proxy in a different class which is kind of working... just trying to figure it out why its works with edxLoader and not like i do it.. My proxy starts listening, the client redirects to the proxy the proxy gets connected to the login server, but no success to world server

09/13/2012 18:21 ZeraPain#12

like i said:

with your method you redirect the client permanently to the given port so it cannot be changed anymore by the response packet with the new ip / port.

if you create the proxy with using only 1 port it should work fine.

09/13/2012 21:52 iNiperx#13

edit: If i use same port for both gateway and agent i can access the world server but my question is.. having both with same port could be a problem in the future or anything with packets ?

09/14/2012 01:40 sarkoplata#14

@iNiper
The code I posted will simply redirect both gateway/agentserver. The solution for that is simple. Connect to agentserver on the same port you connect to gateway.

Done (Thats what I do on my autofuser)

09/14/2012 02:29 iNiperx#15

Quote:

Originally Posted by sarkoplata

@iNiper
The code I posted will simply redirect both gateway/agentserver. The solution for that is simple. Connect to agentserver on the same port you connect to gateway.

Done (Thats what I do on my autofuser)

Actually im using your code, just changed it a lil (not much) and its in c# but the problem was that i didnt use gate/agent on same port, but now its working..

What im trying to do is change from thread or having both gate/agent in 1 thread without having an error like when changing from login to world server the login will say something like "an existing connection has closed" or w.e but its not an error it just means it changed from gate to agent.. so i want to try to remove (not just ignore it)

Edit: What i meant to say im using your code for the simple proxy but in C#, but in vb.net heres is where the message appears "An existing connection was forcibly closed by the remote host" when changing from login server to world server:

Quote:

While True

For Each context As Context In contexts
' Network input event processing
If context.Socket.Poll(0, SelectMode.SelectRead) Then
Dim count As Integer = context.Socket.Receive(context.Buffer.Buffer)
If count = 0 Then
Throw New Exception("The remote connection has been lost.")
End If
context.Security.Recv(context.Buffer.Buffer, 0, count)
End If
Next

Page 1 of 2