#include "stdio.h"
#include "winsock2.h"
#include "windows.h"
#include <iostream>
#include "Detours.h"
#include "log.h"
#include <string>
#include <time.h>
#include "resource.h"
using namespace std;
#pragma comment(lib, "ws2_32.lib")
bool brecv,bsend;
typedef int (WINAPI* t_WSARecv)(SOCKET,LPWSABUF,DWORD,LPDWORD,LPDWORD,L PWSAOVERLAPPED,LPWSAOVERLAPPED_COMPLETION_ROUTINE) ;
typedef int (WINAPI* t_WSASend)(SOCKET,LPWSABUF,DWORD,LPDWORD,DWORD,LPW SAOVERLAPPED,LPWSAOVERLAPPED_COMPLETION_ROUTINE );
t_WSASend o_WSASend;
t_WSARecv o_WSARecv;
char Byte[300];
void *DetourFunction(BYTE *src, const BYTE *dst, const int len) // credits to gamedeception
{
BYTE *jmp = (BYTE*)malloc(len+5);
DWORD dwback;
VirtualProtect(src, len, PAGE_READWRITE, &dwback);
memcpy(jmp, src, len); jmp += len;
jmp[0] = 0xE9;
*(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;
src[0] = 0xE9;
*(DWORD*)(src+1) = (DWORD)(dst - src) - 5;
VirtualProtect(src, len, dwback, &dwback);
return (jmp-len);
}
DWORD dwPtr[12];
int WINAPI hook_WSARecv(SOCKET s,LPWSABUF lpBuffers,DWORD dwBufferCount,LPDWORD lpNumberOfBytesRecvd,LPDWORD lpFlags,LPWSAOVERLAPPED lpOverlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine)
{
dwPtr[0] = lpBuffers->buf[0];
dwPtr[1] = lpBuffers->buf[1];
dwPtr[2] = lpBuffers->buf[2];
dwPtr[3] = lpBuffers->buf[3];
dwPtr[4] = lpBuffers->buf[4];
dwPtr[5] = lpBuffers->buf[5];
dwPtr[6] = lpBuffers->buf[6];
dwPtr[7] = lpBuffers->buf[7];
dwPtr[8] = lpBuffers->buf[8];
dwPtr[9] = lpBuffers->buf[9];
dwPtr[10] = lpBuffers->buf[10];
dwPtr[11] = lpBuffers->buf[11];
dwPtr[12] = lpBuffers->buf[12];
if(dwPtr[0] == 0x5e && dwPtr[1] == 0x08 && dwPtr[2] == 0x00 && dwPtr[3] == 0x00 &&dwPtr[4] == 0x00 &&dwPtr[5] == 0x00 &&dwPtr[6] == 0x00 &&dwPtr[7] == 0x00)
{
cout<<"Session ID gefunden!!!"<<endl;
cout<<hex<<dwPtr[9]<<dwPtr[10]<<dwPtr[11]<<dwPtr[12]<<endl;
}
return o_WSARecv(s,lpBuffers,dwBufferCount,lpNumberOfByte sRecvd,lpFlags,lpOverlapped,lpCompletionRoutine);
}
int WINAPI hook_WSASend(SOCKET s,LPWSABUF lpBuffers,DWORD dwBufferCount,LPDWORD lpNumberOfBytesSent,DWORD dwFlags,LPWSAOVERLAPPED lpOverlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine)
{
for(size_t x = 0; x < lpBuffers->len;++x)
{
if(lpBuffers->buf[x]!=NULL)
{
sprintf(Byte,"%x",lpBuffers->buf[x]);
cout<<Byte<<" ";
}}
cout<<endl;
return o_WSASend(s,lpBuffers,dwBufferCount,lpNumberOfByte sSent,dwFlags,lpOverlapped,lpCompletionRoutine);
}
BOOL APIENTRY DllMain(HMODULE hModule, DWORD Ergebnis, LPVOID lpReserved)
{
UNREFERENCED_PARAMETER(lpReserved);
switch(Ergebnis)
{
case DLL_PROCESS_ATTACH:
MessageBox(0,"Injection erfolgreich","bla",MB_OK);
AllocConsole();
freopen("conin$", "r", stdin);
freopen("conout$", "w", stdout);
freopen("conout$", "w", stderr);
//o_WSASend = (t_WSASend)DetourFunction((PBYTE)GetProcAddress(Ge tModuleHandle("ws2_32.dll"), "WSASend"), (PBYTE)hook_WSASend,5);
o_WSARecv = (t_WSARecv)DetourFunction((PBYTE)GetProcAddress(Ge tModuleHandle("ws2_32.dll"), "WSARecv"), (PBYTE)hook_WSARecv,5);
break;
}
return true;
}
|