[C++]Hook all Recv function Problem

[Lazeboy]

Hi Leute
wenn ich send hooke egal welches läuft das alles super nur wenn ich irgendein recv hooke habe ich immer eine Packet size von 1000 bis 10000.

sry das ich schon wieder nerve

#include "WinSock2.h"
#include <cstdio>
#include <ctime>
#include <fstream>
#include <iomanip>
#include <string>
#include <windows.h>
#include <detours.h>
#include <iostream>


#pragma comment( lib, "Ws2_32.lib" )
#pragma comment( lib, "detours.lib" )

using namespace std;


int ( WINAPI *Real_Send )( SOCKET s, const char *buf, int len, int flags ) = send;
int ( __stdcall *Real_Recv )( SOCKET s, char *buf, int len, int flags ) = recv;

int (__stdcall *WSASend_o)(SOCKET s,LPWSABUF Buffer,DWORD BufferCount,LPDWORD NumberOfBytesSent,DWORD Flags,
		LPWSAOVERLAPPED Overlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE CompletionRoutine) = WSASend;

int (__stdcall *WSARecv_o)(SOCKET s,LPWSABUF Buffer,DWORD BufferCount,LPDWORD NumberOfBytesSent,LPDWORD Flags,
							LPWSAOVERLAPPED Overlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE CompletionRoutine)= WSARecv;





ofstream Logger;

void *DetourFunc(BYTE *src, const BYTE *dst, const int len)
{
    BYTE *jmp = (BYTE*)malloc(5+len);
    DWORD dwback;

    VirtualProtect(src,len,PAGE_READWRITE,&dwback);
   
    memcpy(jmp,src,len);
    jmp += len;
   
    jmp[0] = 0xE9;
    *(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;

    src[0] = 0xE9;
    *(DWORD*)(src+1) = (DWORD)(dst - src) - 5;

    VirtualProtect(src,len,dwback,&dwback);

    return (jmp-len);
} 

string NowToString() {
    time_t rawtime;
    tm *timeinfo = new tm();
    char buffer[32];

    time( &rawtime );
    localtime_s( timeinfo, &rawtime );

    strftime( buffer, 32, "%m/%d/%Y %I:%M:%S %p", timeinfo );

    delete timeinfo;

    return string( buffer );
}

string TimeToString() {
    time_t rawtime;
    tm *timeinfo = new tm();
    char buffer[32];

    time( &rawtime );
    localtime_s( timeinfo, &rawtime );

    strftime( buffer, 32, "%I:%M:%S %p", timeinfo );

    delete timeinfo;

    return string( buffer );
}

void LogPacket( const char *buf, int len ) {
    Logger << "        0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F\n";
    Logger << "       -- -- -- -- -- -- -- --  -- -- -- -- -- -- -- --\n";
    Logger << "0000   ";

    for ( int i = 0; i < len; ++i ) {
        if ( i != 0 && i % 16 == 0 ) {
                Logger << "  ";

                int line = ( i / 16 ) - 1;

                for ( int j = 0; j < 16; ++j ) {
                        char c = buf[line * 16 + j];

                        if ( c >= 32 && c <= 126 ) {
                                Logger << c;
                        } else {
                                Logger << '.';
                        }
                }

                Logger << "\n" << hex << setw( 4 ) << setfill( '0' ) << i << dec << setw( 0 ) << "   ";
        } else if ( i % 16 == 8 ) {
                Logger << ' ';
        }

        Logger << hex << setw( 2 ) << setfill( '0' ) << ( int( buf[i] ) & 0xFF ) << ' ';
        Logger << dec << setw( 0 );

        if ( i == len - 1 ) {
                int remaining = 16 - ( len % 16 );
                int fill = ( remaining * 3 ) + 2;

                if ( remaining >= 8 ) {
                        ++fill;
                }

                for ( int j = 0; j < fill; ++j ) {
                        Logger << ' ';
                }

                int line = ( i - ( ( len % 16 ) - 1 ) ) / 16 ;

                for ( int k = 0; k < ( len % 16 ); ++k ) {
                        char c = buf[line * 16 + k];

                        if ( c >= 32 && c <= 126 ) {
                                Logger << c;
                        } else {
                                Logger << '.';
                        }
                }
        }
    }

    Logger << "\n\n";
}

int WINAPI MyWSASend(SOCKET s,LPWSABUF buf,DWORD BufferCount,LPDWORD NumberOfBytesSent,DWORD Flags,
		LPWSAOVERLAPPED Overlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE CompletionRoutine) {
	
	
	Logger << "WSASend "<< TimeToString() << ": Client -> Server (Length: " << buf->len  << " bytes)\n\n";
    LogPacket( buf->buf ,  buf->len );
    Logger << endl;
	return WSASend_o( s, buf, BufferCount, NumberOfBytesSent, Flags,Overlapped,CompletionRoutine);
}

int WINAPI MyWSARecv(SOCKET s,LPWSABUF buf,DWORD BufferCount,LPDWORD NumberOfBytesSent,LPDWORD Flags,
		LPWSAOVERLAPPED Overlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE CompletionRoutine) {
	
	
	Logger << "WSARecv "<<TimeToString() << ": Server -> Client (Length: " <<  buf->len << " bytes)\n\n";
    LogPacket( buf->buf, buf->len );
    Logger << endl;
	return WSARecv_o( s, buf, BufferCount, NumberOfBytesSent, Flags,Overlapped,CompletionRoutine);
}


int WINAPI MySend( SOCKET s, const char *buf, int len, int flags ) {
	
	
	Logger << "Send "<< TimeToString() << ": Client -> Server (Length: " << len << " bytes)\n\n";
    LogPacket( buf, len );
    Logger << endl;
	return Real_Send( s, buf, len, flags );
}

int WINAPI MyRecv( SOCKET s, char *buf, int len, int flags ) {
	
	
	Logger << "Recv "<<TimeToString() << ": Server -> Client (Length: " << len << " bytes)\n\n";
	char buffer[100];
	sprintf(buffer,"%d",len);
	MessageBox(0,buffer,0,0);
    LogPacket( buf, len );
    Logger << endl;
	return Real_Recv( s, buf, len, flags );
}





BOOL WINAPI DllMain( HINSTANCE, DWORD dwReason, LPVOID ) {
    switch ( dwReason ) {
        case DLL_PROCESS_ATTACH:        
                Logger.open( "Packet.txt", std::ios::out | std::ios::app | std::ios::ate );
                if ( Logger.tellp() > 0 ) {
                        Logger << "\n\n\n";
                }

                Logger << "##\n## Logging Started (" << NowToString() << ")\n##\n\n\n";

				
                //Real_Send = (int(WINAPI*)(SOCKET,const char*,int,int))DetourFunction((PBYTE)Real_Send,(PBYTE)MySend);
				//WSASend_o= (int(WINAPI*)(SOCKET,LPWSABUF,DWORD,LPDWORD,DWORD,LPWSAOVERLAPPED,LPWSAOVERLAPPED_COMPLETION_ROUTINE))DetourFunction((PBYTE)WSASend_o,(PBYTE)MyWSASend);
				//WSARecv_o = (int(WINAPI*)(SOCKET,LPWSABUF,DWORD,LPDWORD,LPDWORD,LPWSAOVERLAPPED,LPWSAOVERLAPPED_COMPLETION_ROUTINE))DetourFunction((PBYTE)WSARecv_o,(PBYTE)MyWSARecv);
				Real_Recv = (int(WINAPI*)(SOCKET,char*,int,int))DetourFunction((PBYTE)Real_Recv,(PBYTE)MyRecv);
               
                break;

        case DLL_PROCESS_DETACH:
                Logger << "##\n## Logging Stopped (" << NowToString() << ")\n##";
                Logger.close();
				DetourRemove((PBYTE)send,(PBYTE)MySend);
				DetourRemove((PBYTE)recv,(PBYTE)MyRecv);

                break;
    }

    return TRUE;
}

[ms​]

Du musst zuerst die originale recv- bzw. WSARecv-Funktion durchlaufen lassen, damit diese den Buffer füllt. Dann lässt du diese zu deiner Funktion returnen.

Die Packet Size wird außerdem zurückgegeben und befindet sich nicht im len-Parameter.

[Lazeboy]

wie soll denn das aussehen ich hab versucht erst in noch eine myRev funktion zu returnen dann zurück aber kommt das gleiche raus dann hab ich versucht erst returnen dann auflisten auber das ist ja völliger schwachsinn.

[ms​]

Originally Posted by Lazeboy

wie soll denn das aussehen

So zum Beispiel:

DWORD RecvAddr;

void SetDetour(char *src, char *dst)
{
	DWORD temp;
	VirtualProtect(src, 5, PAGE_EXECUTE_READWRITE, &temp);
	src[0] = (BYTE)0xE9;
	DWORD jmp = dst - src - 5;
	memcpy(src + 1, &jmp, 4);
}

int __declspec(naked) WINAPI orig_recv(SOCKET s, char *buf, int len, int flags)
{
	__asm
	{
		push ebp
		mov ebp, esp
		mov eax, RecvAddr
		add eax, 5
		jmp eax
	}
}

int WINAPI my_recv(SOCKET s, char *buf, int len, int flags)
{
	int value = orig_recv(s, buf, len, flags);
	char c[20];
	sprintf(c, "%d", value);
	MessageBoxA(NULL, c, "", 0);
	return value;
}

RecvAddr = (DWORD)GetProcAddress(GetModuleHandleA("ws2_32.dll"), "recv");
SetDetour((char *)RecvAddr, (char *)my_recv);

Ist zwar noch etwas unschön, aber es funktioniert.

[wuewol]

cool danke

[Lazeboy]

Originally Posted by Disconnect

So zum Beispiel:

DWORD RecvAddr;

void SetDetour(char *src, char *dst)
{
	DWORD temp;
	VirtualProtect(src, 5, PAGE_EXECUTE_READWRITE, &temp);
	src[0] = (BYTE)0xE9;
	DWORD jmp = dst - src - 5;
	memcpy(src + 1, &jmp, 4);
}

int __declspec(naked) WINAPI orig_recv(SOCKET s, char *buf, int len, int flags)
{
	__asm
	{
		push ebp
		mov ebp, esp
		mov eax, RecvAddr
		add eax, 5
		jmp eax
	}
}

int WINAPI my_recv(SOCKET s, char *buf, int len, int flags)
{
	int value = orig_recv(s, buf, len, flags);
	char c[20];
	sprintf(c, "%d", value);
	MessageBoxA(NULL, c, "", 0);
	return value;
}

RecvAddr = (DWORD)GetProcAddress(GetModuleHandleA("ws2_32.dll"), "recv");
SetDetour((char *)RecvAddr, (char *)my_recv);

Ist zwar noch etwas unschön, aber es funktioniert.

danke schön funktioniert super ^^