[C++]Hook all Recv function Problem

08/20/2010 18:35 Lazeboy#1
Hi Leute
wenn ich send hooke egal welches läuft das alles super nur wenn ich irgendein recv hooke habe ich immer eine Packet size von 1000 bis 10000.

sry das ich schon wieder nerve

Code:
#include "WinSock2.h"
#include <cstdio>
#include <ctime>
#include <fstream>
#include <iomanip>
#include <string>
#include <windows.h>
#include <detours.h>
#include <iostream>


#pragma comment( lib, "Ws2_32.lib" )
#pragma comment( lib, "detours.lib" )

using namespace std;


int ( WINAPI *Real_Send )( SOCKET s, const char *buf, int len, int flags ) = send;
int ( __stdcall *Real_Recv )( SOCKET s, char *buf, int len, int flags ) = recv;

int (__stdcall *WSASend_o)(SOCKET s,LPWSABUF Buffer,DWORD BufferCount,LPDWORD NumberOfBytesSent,DWORD Flags,
		LPWSAOVERLAPPED Overlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE CompletionRoutine) = WSASend;

int (__stdcall *WSARecv_o)(SOCKET s,LPWSABUF Buffer,DWORD BufferCount,LPDWORD NumberOfBytesSent,LPDWORD Flags,
							LPWSAOVERLAPPED Overlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE CompletionRoutine)= WSARecv;





ofstream Logger;

void *DetourFunc(BYTE *src, const BYTE *dst, const int len)
{
    BYTE *jmp = (BYTE*)malloc(5+len);
    DWORD dwback;

    VirtualProtect(src,len,PAGE_READWRITE,&dwback);
   
    memcpy(jmp,src,len);
    jmp += len;
   
    jmp[0] = 0xE9;
    *(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;

    src[0] = 0xE9;
    *(DWORD*)(src+1) = (DWORD)(dst - src) - 5;

    VirtualProtect(src,len,dwback,&dwback);

    return (jmp-len);
} 

string NowToString() {
    time_t rawtime;
    tm *timeinfo = new tm();
    char buffer[32];

    time( &rawtime );
    localtime_s( timeinfo, &rawtime );

    strftime( buffer, 32, "%m/%d/%Y %I:%M:%S %p", timeinfo );

    delete timeinfo;

    return string( buffer );
}

string TimeToString() {
    time_t rawtime;
    tm *timeinfo = new tm();
    char buffer[32];

    time( &rawtime );
    localtime_s( timeinfo, &rawtime );

    strftime( buffer, 32, "%I:%M:%S %p", timeinfo );

    delete timeinfo;

    return string( buffer );
}

void LogPacket( const char *buf, int len ) {
    Logger << "        0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F\n";
    Logger << "       -- -- -- -- -- -- -- --  -- -- -- -- -- -- -- --\n";
    Logger << "0000   ";

    for ( int i = 0; i < len; ++i ) {
        if ( i != 0 && i % 16 == 0 ) {
                Logger << "  ";

                int line = ( i / 16 ) - 1;

                for ( int j = 0; j < 16; ++j ) {
                        char c = buf[line * 16 + j];

                        if ( c >= 32 && c <= 126 ) {
                                Logger << c;
                        } else {
                                Logger << '.';
                        }
                }

                Logger << "\n" << hex << setw( 4 ) << setfill( '0' ) << i << dec << setw( 0 ) << "   ";
        } else if ( i % 16 == 8 ) {
                Logger << ' ';
        }

        Logger << hex << setw( 2 ) << setfill( '0' ) << ( int( buf[i] ) & 0xFF ) << ' ';
        Logger << dec << setw( 0 );

        if ( i == len - 1 ) {
                int remaining = 16 - ( len % 16 );
                int fill = ( remaining * 3 ) + 2;

                if ( remaining >= 8 ) {
                        ++fill;
                }

                for ( int j = 0; j < fill; ++j ) {
                        Logger << ' ';
                }

                int line = ( i - ( ( len % 16 ) - 1 ) ) / 16 ;

                for ( int k = 0; k < ( len % 16 ); ++k ) {
                        char c = buf[line * 16 + k];

                        if ( c >= 32 && c <= 126 ) {
                                Logger << c;
                        } else {
                                Logger << '.';
                        }
                }
        }
    }

    Logger << "\n\n";
}

int WINAPI MyWSASend(SOCKET s,LPWSABUF buf,DWORD BufferCount,LPDWORD NumberOfBytesSent,DWORD Flags,
		LPWSAOVERLAPPED Overlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE CompletionRoutine) {
	
	
	Logger << "WSASend "<< TimeToString() << ": Client -> Server (Length: " << buf->len  << " bytes)\n\n";
    LogPacket( buf->buf ,  buf->len );
    Logger << endl;
	return WSASend_o( s, buf, BufferCount, NumberOfBytesSent, Flags,Overlapped,CompletionRoutine);
}

int WINAPI MyWSARecv(SOCKET s,LPWSABUF buf,DWORD BufferCount,LPDWORD NumberOfBytesSent,LPDWORD Flags,
		LPWSAOVERLAPPED Overlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE CompletionRoutine) {
	
	
	Logger << "WSARecv "<<TimeToString() << ": Server -> Client (Length: " <<  buf->len << " bytes)\n\n";
    LogPacket( buf->buf, buf->len );
    Logger << endl;
	return WSARecv_o( s, buf, BufferCount, NumberOfBytesSent, Flags,Overlapped,CompletionRoutine);
}


int WINAPI MySend( SOCKET s, const char *buf, int len, int flags ) {
	
	
	Logger << "Send "<< TimeToString() << ": Client -> Server (Length: " << len << " bytes)\n\n";
    LogPacket( buf, len );
    Logger << endl;
	return Real_Send( s, buf, len, flags );
}

int WINAPI MyRecv( SOCKET s, char *buf, int len, int flags ) {
	
	
	Logger << "Recv "<<TimeToString() << ": Server -> Client (Length: " << len << " bytes)\n\n";
	char buffer[100];
	sprintf(buffer,"%d",len);
	MessageBox(0,buffer,0,0);
    LogPacket( buf, len );
    Logger << endl;
	return Real_Recv( s, buf, len, flags );
}





BOOL WINAPI DllMain( HINSTANCE, DWORD dwReason, LPVOID ) {
    switch ( dwReason ) {
        case DLL_PROCESS_ATTACH:        
                Logger.open( "Packet.txt", std::ios::out | std::ios::app | std::ios::ate );
                if ( Logger.tellp() > 0 ) {
                        Logger << "\n\n\n";
                }

                Logger << "##\n## Logging Started (" << NowToString() << ")\n##\n\n\n";

				
                //Real_Send = (int(WINAPI*)(SOCKET,const char*,int,int))DetourFunction((PBYTE)Real_Send,(PBYTE)MySend);
				//WSASend_o= (int(WINAPI*)(SOCKET,LPWSABUF,DWORD,LPDWORD,DWORD,LPWSAOVERLAPPED,LPWSAOVERLAPPED_COMPLETION_ROUTINE))DetourFunction((PBYTE)WSASend_o,(PBYTE)MyWSASend);
				//WSARecv_o = (int(WINAPI*)(SOCKET,LPWSABUF,DWORD,LPDWORD,LPDWORD,LPWSAOVERLAPPED,LPWSAOVERLAPPED_COMPLETION_ROUTINE))DetourFunction((PBYTE)WSARecv_o,(PBYTE)MyWSARecv);
				Real_Recv = (int(WINAPI*)(SOCKET,char*,int,int))DetourFunction((PBYTE)Real_Recv,(PBYTE)MyRecv);
               
                break;

        case DLL_PROCESS_DETACH:
                Logger << "##\n## Logging Stopped (" << NowToString() << ")\n##";
                Logger.close();
				DetourRemove((PBYTE)send,(PBYTE)MySend);
				DetourRemove((PBYTE)recv,(PBYTE)MyRecv);

                break;
    }

    return TRUE;
}
08/20/2010 20:33 ms​#2
Du musst zuerst die originale recv- bzw. WSARecv-Funktion durchlaufen lassen, damit diese den Buffer füllt. Dann lässt du diese zu deiner Funktion returnen.

Die Packet Size wird außerdem zurückgegeben und befindet sich nicht im len-Parameter.
08/21/2010 10:22 Lazeboy#3
wie soll denn das aussehen ich hab versucht erst in noch eine myRev funktion zu returnen dann zurück aber kommt das gleiche raus dann hab ich versucht erst returnen dann auflisten auber das ist ja völliger schwachsinn.
08/21/2010 11:09 ms​#4
Quote:
Originally Posted by Lazeboy View Post
wie soll denn das aussehen
So zum Beispiel:

Code:
DWORD RecvAddr;

void SetDetour(char *src, char *dst)
{
	DWORD temp;
	VirtualProtect(src, 5, PAGE_EXECUTE_READWRITE, &temp);
	src[0] = (BYTE)0xE9;
	DWORD jmp = dst - src - 5;
	memcpy(src + 1, &jmp, 4);
}

int __declspec(naked) WINAPI orig_recv(SOCKET s, char *buf, int len, int flags)
{
	__asm
	{
		push ebp
		mov ebp, esp
		mov eax, RecvAddr
		add eax, 5
		jmp eax
	}
}

int WINAPI my_recv(SOCKET s, char *buf, int len, int flags)
{
	int value = orig_recv(s, buf, len, flags);
	char c[20];
	sprintf(c, "%d", value);
	MessageBoxA(NULL, c, "", 0);
	return value;
}
Code:
RecvAddr = (DWORD)GetProcAddress(GetModuleHandleA("ws2_32.dll"), "recv");
SetDetour((char *)RecvAddr, (char *)my_recv);
Ist zwar noch etwas unschön, aber es funktioniert.
08/21/2010 12:02 wuewol#5
cool danke
08/21/2010 19:42 Lazeboy#6
Quote:
Originally Posted by Disconnect View Post
So zum Beispiel:

Code:
DWORD RecvAddr;

void SetDetour(char *src, char *dst)
{
	DWORD temp;
	VirtualProtect(src, 5, PAGE_EXECUTE_READWRITE, &temp);
	src[0] = (BYTE)0xE9;
	DWORD jmp = dst - src - 5;
	memcpy(src + 1, &jmp, 4);
}

int __declspec(naked) WINAPI orig_recv(SOCKET s, char *buf, int len, int flags)
{
	__asm
	{
		push ebp
		mov ebp, esp
		mov eax, RecvAddr
		add eax, 5
		jmp eax
	}
}

int WINAPI my_recv(SOCKET s, char *buf, int len, int flags)
{
	int value = orig_recv(s, buf, len, flags);
	char c[20];
	sprintf(c, "%d", value);
	MessageBoxA(NULL, c, "", 0);
	return value;
}
Code:
RecvAddr = (DWORD)GetProcAddress(GetModuleHandleA("ws2_32.dll"), "recv");
SetDetour((char *)RecvAddr, (char *)my_recv);
Ist zwar noch etwas unschön, aber es funktioniert.


danke schön funktioniert super ^^