WSAsend/WSABUF

08/14/2009 16:44 oggs#1
hiho =)

i'm reversing a mmo which uses WSAsend to send it's packets
[Only registered and activated users can see links. Click Here To Register...]
as you can see the parameter lpBuffers [in] holds the adress to an array of WSABUF structs
[Only registered and activated users can see links. Click Here To Register...]
..which contains length and data

i'm trying to read the data of wsabuf -> but this differs from my parallel collected packet in WPE ->only the size of the packet is correct, the rest is rubbish =/

so my question: how would the WSABUF struct look in the memory dump?
<4byte.size><xbyte.data> <- thats what i thougt

pls have a look and help me :o ->
[Only registered and activated users can see links. Click Here To Register...]

greetz d0m
08/14/2009 17:00 12354#2
Quote:
typedef struct __WSABUF {
u_long len;
char FAR *buf;
}WSABUF, *LPWSABUF;
It's
(4 Byte) Lenght ;(4 Byte) Pointer to the buffer


[Only registered and activated users can see links. Click Here To Register...]
[Only registered and activated users can see links. Click Here To Register...]
08/14/2009 17:06 oggs#3
:handsdown:
LowL i'm stupid :D
ty =)