[C#] Vsro redirect

[cyberninjah]

Hey,

Is there anyway to redirect vSRO client with C# i have seen pwerRsro loader more that one is for rSRO.

I don't understand how his redirect pattern works anyone got any tip how i can make it work for vSRO client ?

[theonly112]

Address   Hex dump          Command                                  Comments
004B0870  /$  55            PUSH EBP                                 ; sro_client.004B0870(guessed void)

Here's the address of the function that calls ws2.connect
That should be a good point to start at.

[cyberninjah]

Originally Posted by theonly112

Address   Hex dump          Command                                  Comments
004B0870  /$  55            PUSH EBP                                 ; sro_client.004B0870(guessed void)

Here's the address of the function that calls ws2.connect
That should be a good point to start at.

Thanks i need find some tutorials how this stuff working beacuse i have no idea at the moment ^^

[cyberninjah]

hmm i still dont understand a **** about this xD got maybe any tutorial for it ?

or can explain me more about it ?

[sarkoplata]

Mate i found this ^^

I also try to do the same, will post if i can achieve

Edit:
There you go dude: (All credits to NoN_Stop)

 Spoiler

PHP Code:

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using System.Diagnostics;

namespace Loader
{
    public partial class Form1 : Form
    {
        [DllImport("kernel32.dll")]
        static extern IntPtr LoadLibrary(string dllToLoad);
        [DllImport("kernel32.dll")]
        static extern IntPtr OpenProcess(uint dwDesiredAccess, int bInheritHandle, int dwProcessId);
        [DllImport("kernel32.dll")]
        static extern uint ReadProcessMemory(IntPtr hProcess, uint lpBaseAddress, uint lpbuffer, uint nSize, uint lpNumberOfBytesRead);
        [DllImport("kernel32.dll")]
        static extern uint WriteProcessMemory(IntPtr hProcess, uint lpBaseAddress, byte[] lpBuffer, int nSize, uint lpNumberOfBytesWritten);
        [DllImport("kernel32.dll")]
        static extern uint VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, uint flAllocationType, uint flProtect);
        [DllImport("kernel32.dll")]
        static extern IntPtr CreateMutex(IntPtr lpMutexAttributes, bool bInitialOwner, string lpName);
        [DllImport("kernel32.dll")]
        static extern IntPtr GetModuleHandle(string lpModuleName);
        [DllImport("kernel32")]
        static extern uint GetProcAddress(IntPtr hModule, string procName);
        [DllImport("kernel32.dll")]
        static extern uint WritePrivateProfileString(string section, string key, string val, string filePath);
        [DllImport("kernel32.dll")]
        static extern uint GetPrivateProfileString(string lpAppName, string lpKeyName, string lpDefault, StringBuilder lpReturnedString, int nSize, string lpFileName);

        public static IntPtr Handle;

        public Form1()
        {
            InitializeComponent();
        }

        private void Form1_Load(object sender, EventArgs e)
        {
            CreateMutex(IntPtr.Zero, false, "Silkroad Online Launcher");
            CreateMutex(IntPtr.Zero, false, "Ready");
            uint count = 0;
            Process SilkProcess;
            SilkProcess = new Process();
            SilkProcess.StartInfo.FileName = @"D:\Program Files\Creddy Avengers Loki\sro_client.exe";
            SilkProcess.StartInfo.Arguments = "0/22 0 0";
            SilkProcess.Start();
            Handle = OpenProcess((uint)(0x000F0000L | 0x00100000L | 0xFFF), 0, SilkProcess.Id);
            uint ConnectionStack = VirtualAllocEx(Handle, IntPtr.Zero, 8, 0x1000, 0x4);
            byte[] ConnectionStackArray = BitConverter.GetBytes(ConnectionStack);
            byte[] Connection = {
                                    0x02,0x00,
                                    0x3D, 0xA2, // PORT (15778)
                                    0x7F,0x00,0x00,0x01 // IP (127.0.0.1)
                                };
            uint Codecave = VirtualAllocEx(Handle, IntPtr.Zero, 16, 0x1000, 0x4);
            byte[] CodecaveArray = BitConverter.GetBytes(Codecave - 0x004B08A1 - 5);
            byte[] CodeCaveFunc = {
                                      0xBF,ConnectionStackArray[0],ConnectionStackArray[1],ConnectionStackArray[2],ConnectionStackArray[3],
                                      0x8B,0x4E,0x04,
                                      0x6A,0x10,
                                      0x68,0xA6,0x08,0x4B,0x00,
                                      0xC3
                                  };
            byte[] JMPCodeCave = { 0xE9, CodecaveArray[0], CodecaveArray[1], CodecaveArray[2], CodecaveArray[3] };
            WriteProcessMemory(Handle, ConnectionStack, Connection, Connection.Length, count);
            WriteProcessMemory(Handle, Codecave, CodeCaveFunc, CodeCaveFunc.Length, count);
            WriteProcessMemory(Handle, 0x004B08A1, JMPCodeCave, JMPCodeCave.Length, count);
        }
    }
} 


[cyberninjah]

hmm with your code its not redirect my client o.O ?

Edit: Oops sorry my bad i forgot give visual studio admin rights ^^

[iNiperx]

I'm using this from a class (not form), i call it from a form it loads etc, i put my ID/PW and then the captcha image appears, when i enter it the client wont go to the char list, instead it will give me C9 error, im using edx's simple proxy, when i use this for redirect loader its C9 when i use edx's loader i dont get the C9...

[ZeraPain]

this happens because the client is redirected to port 15778 and won't change it anymore (the proxy tries to redirect the client to an other port if it connects to the worldserver)

[iNiperx]

So what could i do ?

The server has 4 gateways, and the IPs kind of change over time so i made it get the ip from the host name which is the same, it works..

When i'm going to use the loader the proxy starts to listen, and it gets connected to 127.0.0.1, and port 13000 (0x32, 0xC8) it gets connected to the login server, i can get wrong/pw, blocked/image captcha etc.. but when its going to connect to the world server it throws an error "An existing connection was forcibly closed by the remote host" and throws the C9...

If i just take off the part that calls the launcher function just leaving the proxy and i use edx same ip/port (127.0.0.1/13000) does work.. so idk.. Im playing with it to see if i get it to work.

[ZeraPain]

well you got 2 choices:
1 - you use edx loader which redirects only the ip of the loginserver
2 - you create your own proxy which listens only to one port

[iNiperx]

2) im using edx's simple proxy (with the silkroadapi he made) i changed it etc and now im using it for WinForm, and the proxy in a different class which is kind of working... just trying to figure it out why its works with edxLoader and not like i do it.. My proxy starts listening, the client redirects to the proxy the proxy gets connected to the login server, but no success to world server

[ZeraPain]

like i said:

with your method you redirect the client permanently to the given port so it cannot be changed anymore by the response packet with the new ip / port.

if you create the proxy with using only 1 port it should work fine.

[iNiperx]

edit: If i use same port for both gateway and agent i can access the world server but my question is.. having both with same port could be a problem in the future or anything with packets ?

[sarkoplata]

@iNiper
The code I posted will simply redirect both gateway/agentserver. The solution for that is simple. Connect to agentserver on the same port you connect to gateway.

Done (Thats what I do on my autofuser)

[iNiperx]

Originally Posted by sarkoplata

@iNiper
The code I posted will simply redirect both gateway/agentserver. The solution for that is simple. Connect to agentserver on the same port you connect to gateway.

Done (Thats what I do on my autofuser)

Actually im using your code, just changed it a lil (not much) and its in c# but the problem was that i didnt use gate/agent on same port, but now its working..

What im trying to do is change from thread or having both gate/agent in 1 thread without having an error like when changing from login to world server the login will say something like "an existing connection has closed" or w.e but its not an error it just means it changed from gate to agent.. so i want to try to remove (not just ignore it)

Edit: What i meant to say im using your code for the simple proxy but in C#, but in vb.net heres is where the message appears "An existing connection was forcibly closed by the remote host" when changing from login server to world server:

While True

For Each context As Context In contexts
' Network input event processing
If context.Socket.Poll(0, SelectMode.SelectRead) Then
Dim count As Integer = context.Socket.Receive(context.Buffer.Buffer)
If count = 0 Then
Throw New Exception("The remote connection has been lost.")
End If
context.Security.Recv(context.Buffer.Buffer, 0, count)
End If
Next