posted this on another forum a long time ago but it didnt gain any traction so maybe people here will have use
Quote:
I decided to meddle around into guild wars 2 and found that their client/server architecture is roughly the same as the first game so, made for easy reverse engineering work :D
Code:template <typename T> class gw_array { protected: T* arr_; DWORD allocatedsize_; DWORD currentsize_; DWORD unk_; public: inline T& operator[](DWORD index) { return arr_[index]; } inline const DWORD& size() const { return currentsize_; } }; using CtoSSend_t = void(__fastcall*)(void* thisptr, DWORD size, BYTE* packet); template <typename packet> using StoCHandler = bool(__fastcall*)(DWORD unk,packet* pak); struct StoCPacketbase { WORD header; }; struct CtoSTableIndex { DWORD paramcount; DWORD* params; }; template <typename packet> struct StoCTableIndex { DWORD paramcount; DWORD* params; DWORD unk; StoCHandler<packet> handler; }; class GameServer { GameServer(){} GameServer(GameServer&){} public: BYTE pad1[0xC]; struct { BYTE pad1[0x2C]; gw_array<CtoSTableIndex> ctos_table; DWORD unk1; gw_array<StoCTableIndex<StoCPacketbase>> stoc_table; } *consts; }; GWCA::Hook ctos_log; CtoSSend_t ctos_trampoline; ConsoleEx* con = nullptr; void __fastcall ctos_detour(GameServer* thisptr, DWORD size, CtoGS::Packet* packet) { CtoGS::P010_UpdatePlayerPosition* spec; switch (packet->header){ default: con->printf("<CtoS> Sz: %X Header: %X\n", size, *(WORD*)packet); for (DWORD i = 0; i < size; ++i){ if (i % 16 == 0) con->printf("\n"); con->printf("%02X ", ((BYTE*)packet)[i]); } con->printf("\n --------------------- \n"); break; } return ctos_trampoline(thisptr, size, (BYTE*)packet); } void WINAPI init_consoleex(HMODULE module) { con = ConsoleEx::GenerateLogger(module, "[CtoGS] Packet Log", CONSOLEEX_PARAMETERS(80, 20, 500, true)); GWCA::PatternScanner scan; BYTE* ctos_hook = (BYTE*)scan.FindPattern("\x55\x8B\xEC\x83\xEC\x2C\x53\x56\x57\x8B\xF1\x8B\xFA", "xxxxxxxxxxxxx", 0); if (ctos_hook){ con->printf("ctos = %X\n", ctos_hook); ctos_trampoline = (CtoSSend_t)ctos_log.Detour(ctos_hook, (BYTE*)ctos_detour, 6); } else{ con->printf("ctos = ERR"); } while (con->isOpen()) Sleep(100); ctos_log.Retour(); delete con; FreeLibraryAndExitThread(module, EXIT_SUCCESS); } BOOL WINAPI DllMain(HMODULE hDllHandle, DWORD dwReason, LPVOID lpreserved) { if (dwReason == DLL_PROCESS_ATTACH){ DisableThreadLibraryCalls(hDllHandle); CreateThread(0, 0, (LPTHREAD_START_ROUTINE)init_consoleex, hDllHandle, 0, 0); } return TRUE; }
The function hooked is the outgoing packet sender for the gameserver, this is before encryption so you can see the juicy details. It is an object method so ECX is the thisptr. In this object using what is provided, you can find a table holding handlers to each incoming packet handler. Along with encodings for parameters to expect in the packet. The encodings also exist for the ctos packets in a table above.
You can hook the stoc handlers using a simple vmt-like swap if desired.
GWCA::PatternScanner is a simple pattern scanner with wildcard support, nothing fancy, can use your own. (Make sure you start the scan from the module base, it changes)
GWCA::Hook is just a wrapper for a JMP hook w/ trampoline, so again, just use your own.
ConsoleEx can be found in the hacklib project [Only registered and activated users can see links. Click Here To Register...].
Have fun, would love to see some documentation on the ctos packets :D.
Also note, there are references to the thisptr in static mem, so you can retrieve it and emulate calls to the sender for hacks/bots if one were so inclined.
