I have a question about that I'm trying to EAT Hook recv function after injecting dll into engine.exe. The trick is that i don't really know if kal is using GetProcAddress to retrieve recv address on every call. I suppose it does because if we try simple jmp patch on it. It works for a short time after hs patches it.
My hook is also working i guess but, well i don't really know why it is not showing data
I found in EAT of ws2_32.dll address:
recv 0x74B80DA8
and it is const. Code snippet:
MyRecv
Code:
typedef int (WINAPI *myrecv)(SOCKET s, char *buf, int len, int flags);
myrecv NewRecv = NULL, OldRecv = NULL;
int WINAPI fRecv(SOCKET s, char *buf, int len, int flags)
{
cout << "Hooked recv: ";
for(int i=0;i<len;i++)
cout << hex << buf[i] << ' ';
return OldRecv(s,buf,len,flags);
}
if even "Hooked recv: " doesn't show up then your hook doesn'T work
does this work?
NewRecv(NULL,"aaa",3,NULL);
the idea is really interesting.
but manipulating the EAT is only usefull if GetProcAddress() is being called for every recv call.
this doesn't sound very likely to me.
how did you check the IAT? are you sure recv isn't included?
My hook partially works. GetProcAddress returns fRecv function adress instead of original recv from ws2_32. This was just to check and yes it works fine(just check).
Well after injecting I checked for IAT of engine.exe and it containts these functions:
So for me there's only 1 option left. As address of recv is const so i'm thinking that it is stored somewhere in engine and it's called directly and that's why it's not showing at IAT.
Or is there any other explanation why my hook is not working?
Simple:
Load debugger, ignore anti-debug, and bp ws2_32.recv. Break on that bp and return to user code. I think there should be an instruction to load ws2_32.recv using something like this
MOV EAX, DWORD PTR DS: [IAT]
CALL EAX
Change ProcAddress stored in IAT to your HookProc address.
I'll try that but this raises the question. Why isn't it showing up at IAT of engine.exe? Is it hidden some way? Lucky that i found a kernel driver that is letting me attach dbg to engine after hs loads. Game crashes after 10 min or so cuz i guess api hooks are detected somehow by HS even in kernel mode. Well this is old driver But OpenProcess works and i can read memory directly from running engine so it's ok.
@Edit 1.
Ok this is more tricky i guess Small update on what i've found.
In EDX we've got address of recv. We are in ehsvc module and i'm pretty sure it's check for jmp patch hook on recv function. So maybe I can modify this part so it won't be able to "see" my hook or does ehsvc got some crc check on it's module and i can't modify memory in it?
I will keep digging and see if i can get address of recv in IAT.
i said, just hook 5 bytes after the recv start function...
PHP Code:
PUSH EBP MOV EBP,ESP SUB ESP,8 MOV [LOCAL.2],ECX <---- just hook here, not at the start and GG, said it 20 times in the past 2 months? same in ur old thread i told U. just an example, only hook recv in ws32_2.dll or how the DLL was called, thx for my Bad english. MOV EAX,[ARG.4] PUSH EAX ; /Flags MOV ECX,[ARG.3] ; | PUSH ECX ; |BufSize MOV EDX,[ARG.2] ; | PUSH EDX ; |Buffer MOV EAX,[ARG.1] ; | PUSH EAX ; |Socket
Hackshield proof the whole Engine.exe i guess, so hook in ws32_2.dll the Recv, after the first 5 Bytes. Just the Start of Recv is proofed by Hackshield...
And i'm getting crash. Function is hooked, i can see message but it crashes. I'll try to check with olly if it's placed correctly but feel free to help
Edit.
It seems that everything should be fine. ;/
I traced back call to my function.
JMP at the end goes back directly to instruction after my jmp
So i have no idea why this is not working.
Edit 2.
**** how could i be so stupid xD That's why it crashed "PUSHF" and i was trying to pop later. heh works now. Anyway midfunc hook is in my opinion great thing. I had to read a bit about that but it works now. Thanks.
oO so I had this the whole time and I didn't know that was it. I'm guessing then that this is part of that obfuscated IAT. I was checking earlier dumped engine. Highlited address is add of recv in ws2 library.
And how on earth did u find this on running engine Normally my olly crashes the game and I can't use it that's why i have to rely on dump. Even with this drivers as i mentioned hs after some time crashes game because of "some hacking software".
I tried to find that ur way and all i got was this check in ehsvc module then when i tried to execute till user code game was crashing due some exceptions or something.
I'm really just starting with olly and this type of coding so thx for help and understanding .
Oh and I have another question. Because of some kal update they are now able to detect proxy dlls. Even the one with detoured functions. I guess they added some new things, so I had to use injector + this driver in order to inject my dll, but as I said it's only for 10min-1h after game closes. So any idea how to fix that
And how on earth did u find this on running engine Normally my olly crashes the game and I can't use it that's why i have to rely on dump. Even with this drivers as i mentioned hs after some time crashes game because of "some hacking software".
Just kidding I replaced the EHSvc by the HS Interactor from my old project.
Quote:
Originally Posted by iszoPL
Oh and I have another question. Because of some kal update they are now able to detect proxy dlls. Even the one with detoured functions. I guess they added some new things, so I had to use injector + this driver in order to inject my dll, but as I said it's only for 10min-1h after game closes. So any idea how to fix that
1) Patch the dll checks in the Engine startup code. Then unpatch them.
OR
2) Inject DLL at startup before the HS gets loaded.
There are other ways, more complex or requires special tools.
Second sounds pretty easy and I already tried that. Unfortunately even that it injects before hs there is a problem with my thread. It seems like they are blocking each other with main thread. If i put for example. cin in it then hs won't load till cin gets some stuff and thread moves on. Like it's suspended. After that game loads correctly but my injected dll doesn't seem to be working . Just blank console xD. Weird.
And I would love to try first one but will i get those check addresses just form dump? I mean aren't they changing or something?
[Help]recv midfunction hooking 07/17/2012 - C/C++ - 15 Replies Hey,
ich versuche die Funktion recv zu hooken ohne das der hook entdeckt wird. Kurzsichtig wie ich bin hab ich bei send nen midfunction hook gemacht nur bei recv muss sich der buffer ja erstmal füllen also kann ich erst fast am ende der Funktion hooken. Das hab ich auch probiert nur irgendwie funktioniert das nicht.
recv ollydbg
CPU Disasm
Address Hex dump Command Comments
76AA47DF /$ 8BFF MOV EDI,EDI
76AA47E1 |. 55 ...
recv/send int kal 06/01/2012 - Kal Online - 9 Replies Does anyone have a working recv/send for int today?
[help] recv 08/02/2009 - Kal Online - 3 Replies Soo,
man man behinderter tag.
naja wayne.
bin grad dabei mich etwas mehr mit den recv packets außeinander zu setzen.
unter anderem mit den zahlen dahinter.
Borsti sagte das ist die größe (size)
naja also ich hab mir das mal als hex ausgeben lassen (das packet für empfangene nachrichten im chat )
ich hab mir das folgendermaßen "notiziert"
0c 00 3c //size
44 65 6e 4a 61 73//name
[How to Get Recv Information] 05/30/2009 - Kal Online - 14 Replies have write Tutorial there how to Analyse the Recv Packet...
SoniKk69 – Blog
hf who dont know it already..
[Question] Hooking send() & recv() works, but recv hiding data for co??? 05/06/2009 - CO2 Programming - 2 Replies Hey guys, I've been making a DLL to allow another program to intercept the packets of conquer using windows pipes. (Then its the job of the main program to decrypt the packets, the DLL only gives a communication channel for the main program)
(winsock functions btw)
- hooking send() works fine for my internet browser
- hooking recv() works fine for my internet browser
- hooking send() works fine for conquer online
I'm trying to EAT Hook recv function after injecting dll into engine.exe. The trick is that i don't really know if kal is using GetProcAddress to retrieve recv address on every call. I suppose it does because if we try simple jmp patch on it. It works for a short time after hs patches it.
