Anyone can share the new mouseovers' pointers & offsets ? I'm not able to retrieves them :/
Quote:
Originally Posted by whitea2
I'm able to log the packets using Wireshark which I assume are encrypted
|
Wireshark sniff all packets on your connection, so your will get all packets outgoing from your computer (eg : net browser ect..), a best way to deal with Gw2 packets is WPE Pro tool, who hook winsocks function (send/recv ect) 1.1 and 2.0. So you'll get encrypted packets as you assumed. The only way to deal with unencrypted packets is to detour/hook SendPacket or PacketEncrypt.
Here some ressource to doing this :
C++ :
Detours from Microsoft :
(here is 3.0 but i personnaly use 1.5, which is most firendly to use and don't need to be compiled, just use the .h and .lib)
Hand done detour :
Code:
void *detourFunction(BYTE *src, const BYTE *dst, const int len)
{
BYTE *jmp = (BYTE*)malloc(len + 5);
DWORD dwback;
VirtualProtect(src, len, PAGE_READWRITE, &dwback);
memcpy(jmp, src, len);
jmp += len;
jmp[0] = 0xE9;
*(DWORD*)(jmp + 1) = (DWORD)(src + len - jmp) - 5;
src[0] = 0xE9;
*(DWORD*)(src + 1) = (DWORD)(dst - src) - 5;
VirtualProtect(src, len, dwback, &dwback);
return (jmp - len);
}
(Beware this is highly detectable (public) but you can be inspired by this code to do it)
ASM:
Just save registers
copy firsts bytes
replace with a jmp to your own function
recopy copied bytes
???
jmp to last location
I'm not in ASM coding so this is probably wrong, but just a idea how this can be done :/
