[Release] Advanced hooking

[pro4never]

So I was trying to figure out why my old PacketHooker test wasn't working and noticed something interesting....

After a decent amount of debugging and bashing my head against the wall i found out that it's not able to attach to the process (but being as the exceptions are all handled so nicely it doesn't complain).


For my client selector I have a simple PopulateClientList() which runs through each process on the computer, checks if it's a conquer process and if so tries to pull a client name from it.


I've tried ReadString as well as using ReadByteArray and ofc cause I cant attach it doesn't work (with trying to attach or not)


Anything I'm missing? I know it worked the first time I tested all this out.

 foreach (Process theprocess in processlist)
                    {
                        if (theprocess.ProcessName == "Conquer")
                        {
                            Console.WriteLine("Process name found with: " + theprocess.ProcessName);
                            Console.WriteLine("Attached successfully? " + new Debuggee(theprocess.Id).AttachDebugger());
                        }
                    }

Always says false when I'm trying to attach debugger.

[KraHen]

It might be something trivial but is the process` name Conquer? Didn`t really start the client for a while.

[pro4never]

Hawtness already showed me the issue.

Run as administrator if you wanna mess with memory ahaha.

Because I was just debugging it from inside vs i wasn't running it as admin which causes it to not be able to hook into most processes successfully.

[xmen01235]

Originally Posted by pro4never

So I was trying to figure out why my old PacketHooker test wasn't working and noticed something interesting....

After a decent amount of debugging and bashing my head against the wall i found out that it's not able to attach to the process (but being as the exceptions are all handled so nicely it doesn't complain).


For my client selector I have a simple PopulateClientList() which runs through each process on the computer, checks if it's a conquer process and if so tries to pull a client name from it.


I've tried ReadString as well as using ReadByteArray and ofc cause I cant attach it doesn't work (with trying to attach or not)


Anything I'm missing? I know it worked the first time I tested all this out.

 foreach (Process theprocess in processlist)
                    {
                        if (theprocess.ProcessName == "Conquer")
                        {
                            Console.WriteLine("Process name found with: " + theprocess.ProcessName);
                            Console.WriteLine("Attached successfully? " + new Debuggee(theprocess.Id).AttachDebugger());
                        }
                    }

Always says false when I'm trying to attach debugger.

Try running on as admin.

[Jonny999]

Originally Posted by IAmHawtness

Oh yeah, RecvPacketAddress = &H6E01B7

Have i ever mentioned, you have a radiant glow of sexyness?

[IAmHawtness]

Originally Posted by Jonny999

Have i ever mentioned, you have a radiant glow of sexyness?

Why thank you, handsome

[Belth]

What's the best way to detect when the client disconnects?

[IAmHawtness]

Originally Posted by Belth

What's the best way to detect when the client disconnects?

This requires that you log in through the bot though so that it can capture when WS2_32.connect gets called.

Edit:
Another option is to just hook the MessageBoxA function in user32.dll and check if the message box is saying "Error: Disconnected with the game server"

[Cyanogen]

Just a thought here, since my proxy dosn't use hooking (it uses loopbacks), I've never really looked into it. But, if I'm not mistaken, doesn't the client use a Mutex to check for already running clients in order to limit it to 3? Most tuts on making multi-clients that I have read seem to be to do with that. Seeing as hexing the client is now more dangerous than it used to be, wouldn't it be possible to hook CreateMutexA, intercept the multi-client mutex check, change the name of the mutex to something random, call the original CreateMutexA and return the HANDLE to the client. Would that allow multi clienting with an unmodified client?

[IAmHawtness]

Originally Posted by Cyanogen

Just a thought here, since my proxy dosn't use hooking (it uses loopbacks), I've never really looked into it. But, if I'm not mistaken, doesn't the client use a Mutex to check for already running clients in order to limit it to 3? Most tuts on making multi-clients that I have read seem to be to do with that. Seeing as hexing the client is now more dangerous than it used to be, wouldn't it be possible to hook CreateMutexA, intercept the multi-client mutex check, change the name of the mutex to something random, call the original CreateMutexA and return the HANDLE to the client. Would that allow multi clienting with an unmodified client?

Yes it would, in fact I once released a versionless multi-client here that did exactly that

[Cyanogen]

Does it still work?

[IAmHawtness]

Originally Posted by Cyanogen

Does it still work?

Yeah it does

[PKDemon]

how do you find the send and recv address thorugh memory so you could be able to make a bot for liek a pserver or something

[phize]

You trace it from winsock api calls with a debugger.

[PKDemon]

Originally Posted by Synsia

You trace it from winsock api calls with a debugger.

never used a debugger before :-s