How to Reverse Engineering NosTale?

Quote:

Originally Posted by FI0w I would try nmake ?

Quote:

Originally Posted by Koffy1 Hi, could someone tell me if this piece of code is well-written or have any issue? It's the hooking of send function in NosTale. Also, when I try to read the packet in the console it just doesn't appear in it. And when It opens the console it appears this message. [Only registered and activated users can see links. Click Here To Register...] PS: What can I make once I know how to read the packets? Should I try to make a simple packetlogger? To send packets? Code: #include "stdafx.h" #include <iostream> #include <fstream> #include <detours.h> #include <winsock.h> int (WINAPI *originalSend)(SOCKET s, const char *buf, int len, int flags); // SEND int WINAPI hookedSend(SOCKET s, const char *buf, int len, int flags) // HOOKED SEND { std::ofstream myfile; myfile.open("example.txt", std::ofstream::out | std::ofstream::trunc); myfile << len << std::endl; for (int i = 0; i < len; i++) { myfile << std::hex << (char)((buf[i] - 0x0F) ^ 0XC3); // DECRYPT LOGIN PACKET } myfile.close(); return originalSend(s, buf, len, flags); } BOOL APIENTRY DllMain(HMODULE module, DWORD reason, LPVOID reserved) { switch (reason) { case DLL_PROCESS_ATTACH: AllocConsole(); DetourTransactionBegin(); DetourUpdateThread(GetCurrentThread()); originalSend = (int (WINAPI *)(SOCKET s, const char *buf, int len, int flags))DetourFindFunction("WS2_32.dll", "send"); DetourAttach(&(PVOID&)originalSend, hookedSend); DetourTransactionCommit(); case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: case DLL_PROCESS_DETACH: break; } return TRUE; }

Quote:

Originally Posted by FI0w You dont need to hook winsocket. Just hook the Function of game where the Packets arent Encrypted.

DWORD addrToHook = 0x4D5989;

typedef int(*tHook)(SOCKET s, const char *buf, int len, int flags);
tHook oHook; // our original function

BOOL APIENTRY DllMain(HMODULE hModule,
	DWORD  ul_reason_for_call,
	LPVOID lpReserved
)
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
		AllocConsole();
		DetourTransactionBegin();
		DetourUpdateThread(GetCurrentThread());
		oHook = (tHook)DetourFindFunction("WS2_32.dll", "send");
		oHook = (tHook)DetourAttach(&(PVOID&)addrToHook, hHook);
		DetourTransactionCommit();
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		break;
	}
	return TRUE;
}

Quote:

Originally Posted by Koffy1 How could I do that? Could you show me please? Something like this? I need help :(

Quote:

Originally Posted by WalrossGreat If you want to do it with original clients, you can open for example local TCP connections and communicate with other processes, or use pipes, or even simpler, make the bot to watch certain character and watch his "mv" packets, and then send correct "walk", however the third way has some limitations

Quote:

Shared memory is the fastest interprocess communication mechanism. The operating system maps a memory segment in the address space of several processes, so that several processes can read and write in that memory segment without calling operating system functions. However, we need some kind of synchronization between processes that read and write shared memory.

Quote:

Originally Posted by Cryless~ Search for string -> c_skill -> Enter -> Few lines below you can see a call. Hook the function pointed by it.

AllocConsole();
		DetourTransactionBegin();
		DetourUpdateThread(GetCurrentThread());
		"function" = "parameters"DetourFindFunction("WS2_32.dll", 
                "send");
		DetourAttach(&(PVOID&)"function", "hookfunction";
		DetourTransactionCommit();

Quote:

Originally Posted by Koffy1 Cryless, to hook a function using Microsoft Detours do you need to use always this code? Code: AllocConsole(); DetourTransactionBegin(); DetourUpdateThread(GetCurrentThread()); "function" = "parameters"DetourFindFunction("WS2_32.dll", "send"); DetourAttach(&(PVOID&)"function", "hookfunction"; DetourTransactionCommit(); Do we need to specify always the dll and the name of the function that we're going to hook? How would you hook a function knowing only the addres, like instead of using the name of function "send", typing his memory address. (0x004D5989). I tried to put instead of "send" this memory address, but it doesn't be the argument that DetourFindFunction() accepts. Could you show me how it would be the code please?

LONG DetourAttach(
    _Inout_ PVOID * ppPointer,
    _In_    PVOID pDetour
    );

// Probably need some casts
DetourAttach(0x004D5989, my_detour_fn_addy);

Quote:

Originally Posted by DarkyZShadow [Only registered and activated users can see links. Click Here To Register...] Code: LONG DetourAttach( _Inout_ PVOID * ppPointer, _In_ PVOID pDetour ); The DetourAttach function takes 2 parameters: the address of the original function you want to hook and the address of the detour function. You just have to call this function without call DetourFindFunction. Code: // Probably need some casts DetourAttach(0x004D5989, my_detour_fn_addy);