I have a question about that ;) I'm trying to EAT Hook recv function after injecting dll into engine.exe. The trick is that i don't really know if kal is using GetProcAddress to retrieve recv address on every call. I suppose it does because if we try simple jmp patch on it. It works for a short time after hs patches it.
My hook is also working i guess but, well i don't really know why it is not showing data ;)
I found in EAT of ws2_32.dll address:
recv 0x74B80DA8
and it is const. Code snippet:
MyRecv
Hooking
dll is object of my class that is handling getting data from dll/exe.
This is part of hooking function. Directly in EAT.
I checked also IAT of engine.exe and it doesn't contain recv function so it has to be EAT hook i guess. Any idea why it doesn't work?
My hook is also working i guess but, well i don't really know why it is not showing data ;)
I found in EAT of ws2_32.dll address:
recv 0x74B80DA8
and it is const. Code snippet:
MyRecv
Code:
typedef int (WINAPI *myrecv)(SOCKET s, char *buf, int len, int flags);
myrecv NewRecv = NULL, OldRecv = NULL;
int WINAPI fRecv(SOCKET s, char *buf, int len, int flags)
{
cout << "Hooked recv: ";
for(int i=0;i<len;i++)
cout << hex << buf[i] << ' ';
return OldRecv(s,buf,len,flags);
}
Code:
OldRecv = (myrecv)dll.hookEAT(fname,(void*)fRecv); NewRecv = (myrecv)GetProcAddress(GetModuleHandle(L"ws2_32.dll"),"recv"); cout << "Checking hook...\n"; NewRecv(NULL,"aaa",3,NULL);
This is part of hooking function. Directly in EAT.
Code:
for(WORD i = 0 ; i < ied->NumberOfFunctions ; i++)
{
name = reinterpret_cast<char*>(*tmp + (DWORD)dllBase);
PWORD pOrdinal = (WORD *)(ied->AddressOfNameOrdinals +
(sizeof(WORD) * i) +
dllBase);
address = reinterpret_cast<PDWORD>(dllBase + ied->AddressOfFunctions + 4 * (*pOrdinal));
if(strcmp(functionName.c_str(),name)==0)
{
DWORD oldprot, oldprot2;
oldAddress = reinterpret_cast<PDWORD>(dllBase + *address);
VirtualProtect(address, sizeof(DWORD), PAGE_READWRITE, (DWORD *)&oldprot);
*address = (DWORD)(newFunction) - (DWORD)dllHandler;
VirtualProtect(address, sizeof(DWORD), oldprot, (DWORD *)&oldprot2);
return oldAddress;
}
tmp++;
}
