| View previous topic :: View next topic |
| Author |
Message |
Stylo
Grandmaster Cheater Supreme
![]() Reputation: 3
Joined: 16 May 2007
Posts: 1073
Location: Israel
|
 Posted: Sat Mar 14, 2009 6:59 am Post subject: [C++ / asm] getting socket's id?! |
 |
|
how would i get the socket's id after i hooked send api?
after i redirected the api call to jump to my code how would i locate where is the socket's id stores?
|
|
| Back to top |
|
 |
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Sat Mar 14, 2009 7:27 am Post subject: Re: [C++ / asm] getting socket's id?! |
|
|
| 1qaz wrote: | how would i get the socket's id after i hooked send api?
after i redirected the api call to jump to my code how would i locate where is the socket's id stores? |
I guess toy could declare a variable. Wait until the client sends a packet. Record the first parameter into the global variable. Now you can send packets with that socket.
|
|
| Back to top |
|
|
Stylo
Grandmaster Cheater Supreme
![]() Reputation: 3
Joined: 16 May 2007
Posts: 1073
Location: Israel
|
| Posted: Sat Mar 14, 2009 8:02 am Post subject: Re: [C++ / asm] getting socket's id?! |
|
|
| dnsi0 wrote: | | 1qaz wrote: | how would i get the socket's id after i hooked send api?
after i redirected the api call to jump to my code how would i locate where is the socket's id stores? |
I guess toy could declare a variable. Wait until the client sends a packet. Record the first parameter into the global variable. Now you can send packets with that socket. |
and that's my question :]
how would i get the value?
i know it somewhere in the stack but what's the size of each parameter?
|
|
| Back to top |
|
|
Splizes
Grandmaster Cheater Supreme
![]() Reputation: 0
Joined: 21 Jun 2006
Posts: 1944
Location: Florida
|
| Posted: Sat Mar 14, 2009 8:39 am Post subject: |
|
|
| after you hook it, you'll have your redirected function in that function record your first parameter O.o
|
|
| Back to top |
|
|
Zerith
Master Cheater
 Reputation: 1
Joined: 07 Oct 2007
Posts: 468
|
| Posted: Sat Mar 14, 2009 9:22 am Post subject: |
|
|
The stack can only hold dwords and values smaller than dwords, then you can just use this formula:
| Code: |
Param = [ESP + Param Number*4]
|
assuming the first parameter is 0 and the second is 1.
|
|
| Back to top |
|
|
Stylo
Grandmaster Cheater Supreme
![]() Reputation: 3
Joined: 16 May 2007
Posts: 1073
Location: Israel
|
| Posted: Sat Mar 14, 2009 9:40 am Post subject: |
|
|
so index starts from 0 right?
and if i'm pusing ebp register b4 that so it will be located at index 1 is that correct?
|
|
| Back to top |
|
|
Zerith
Master Cheater
Reputation: 1
Joined: 07 Oct 2007
Posts: 468
|
| Posted: Sat Mar 14, 2009 9:42 am Post subject: |
|
|
| 1qaz wrote: | so index starts from 0 right?
and if i'm pusing ebp register b4 that so it will be located at index 1 is that correct? |
yes.
|
|
| Back to top |
|
|
Stylo
Grandmaster Cheater Supreme
![]() Reputation: 3
Joined: 16 May 2007
Posts: 1073
Location: Israel
|
| Posted: Sat Mar 14, 2009 9:47 am Post subject: |
|
|
well i guess i'm doing something wrong cuz when i load the dll i get some very long number
and i know it's not the socket id since i use a socket sniffer and it shows me something else
here's the code for you
hook function
| Code: |
__declspec(naked) void HookFunc (void)
{
push ebp
mov ebp,esp
mov eax,[ebp+4] // after pushing ebp then socket's id will be at index 1
push eax
call dword ptr ds:[RecordSocketId]
pop eax
jmp dword ptr ds:[Address]
}
|
RecordSocketId is the function that suppose to save the socket's id
|
|
| Back to top |
|
|
&Vage
Grandmaster Cheater Supreme
![]() Reputation: 0
Joined: 25 Jul 2008
Posts: 1053
|
| Posted: Sat Mar 14, 2009 9:49 am Post subject: |
|
|
| Zerith wrote: | The stack can only hold dwords and values smaller than dwords, then you can just use this formula:
| Code: |
Param = [ESP + Param Number*4]
|
assuming the first parameter is 0 and the second is 1. |
Why can't you just do it the C++ way? int mySend( __in SOCKET s....
then make a wrapper then call it.
|
|
| Back to top |
|
|
Zerith
Master Cheater
Reputation: 1
Joined: 07 Oct 2007
Posts: 468
|
| Posted: Sat Mar 14, 2009 9:54 am Post subject: |
|
|
1qaz: and what's RecordSocketId? are we supposed to guess?
S3NS4: Which is equivalent to what i told him to do, what you suggested is clearer though.
Edit: oh yes, i forgot about the return address being pushed to the stack, you need to account that also.
just use S3NS4's way if it gets too tricky.
Last edited by Zerith on Sat Mar 14, 2009 9:59 am; edited 1 time in total |
|
| Back to top |
|
|
Stylo
Grandmaster Cheater Supreme
![]() Reputation: 3
Joined: 16 May 2007
Posts: 1073
Location: Israel
|
| Posted: Sat Mar 14, 2009 9:59 am Post subject: |
|
|
look agian i changed it a bit
| Code: |
SOCKET SockId;
// RecordSocketId function
void RecordSocketId (void)
{
SetDlgItemInt(hWnd,TEXT_SOCKET_ID,(int)SockId,FALSE);
}
//Hooking
_declspec(naked) void HookFunc (void)
{
push ebp
mov ebp,esp
push eax
mov eax,[ebp+4]
mov dword ptr ds:[SockId],eax
call dword ptr ds:[RecordSocketId]
pop eax
jmp dword ptr ds:[Address]
}
|
hope that's more clear
edit: oh right the return address was my bad xP
thanks that's great now :>
|
|
| Back to top |
|
|
Zerith
Master Cheater
Reputation: 1
Joined: 07 Oct 2007
Posts: 468
|
| Posted: Sat Mar 14, 2009 10:02 am Post subject: |
|
|
| Look at my edited post, and you don't have to push/pop eax, it is used for the return value and will be changed later anyway.
|
|
| Back to top |
|
|
&Vage
Grandmaster Cheater Supreme
![]() Reputation: 0
Joined: 25 Jul 2008
Posts: 1053
|
| Posted: Sat Mar 14, 2009 10:08 am Post subject: |
|
|
On side note, you can't always use mov eax, [ebp+4]... Some APIs use parameters that are bigger then 4 bytes... Ex-: SendInput with it's INPUT struct. http://msdn.microsoft.com/en-us/library/ms646270(VS.85).aspx
If you want to still use the asm procedure, I suggest using sizeof();
|
|
| Back to top |
|
|
smartz993
I post too much
 Reputation: 2
Joined: 20 Jun 2006
Posts: 2013
Location: USA
|
| Posted: Sat Mar 14, 2009 10:11 am Post subject: |
|
|
| S3NS4 wrote: | On side note, you can't always use mov eax, [ebp+4]... Some APIs use parameters that are bigger then 4 bytes... Ex-: SendInput with it's INPUT struct. http://msdn.microsoft.com/en-us/library/ms646270(VS.85).aspx
If you want to still use the asm procedure, I suggest using sizeof(); |
Last time i checked, SendInput takes a pointer to the INPUT struct.
Still 4 bytes 
|
|
| Back to top |
|
|
&Vage
Grandmaster Cheater Supreme
![]() Reputation: 0
Joined: 25 Jul 2008
Posts: 1053
|
| Posted: Sat Mar 14, 2009 10:19 am Post subject: |
|
|
| smartz993 wrote: | | S3NS4 wrote: | On side note, you can't always use mov eax, [ebp+4]... Some APIs use parameters that are bigger then 4 bytes... Ex-: SendInput with it's INPUT struct. http://msdn.microsoft.com/en-us/library/ms646270(VS.85).aspx
If you want to still use the asm procedure, I suggest using sizeof(); |
Last time i checked, SendInput takes a pointer to the INPUT struct.
Still 4 bytes |
Didn't know that. But my statement is true; some APIs use parameters that are bigger than 4 bytes.
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
