Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


[VB2008&C++] Packet Sending Program
Goto page Previous  1, 2, 3  Next
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
Valex37
How do I cheat?
Reputation: 0

Joined: 22 May 2009
Posts: 9
Location: United States of America
PostPosted: Wed Jun 03, 2009 5:15 pm    Post subject: Reply with quote
I see. Visual Basic just went down another notch in my book, that brings it to notch -20, glad I never really used it. Writing everything in assembly sounds like a lot of fun though. I only use it for special purposes, disassembly, or just fun.
_________________
Valex
Back to top
View user's profile Send private message MSN Messenger
Splizes
Grandmaster Cheater Supreme
Reputation: 0

Joined: 21 Jun 2006
Posts: 1944
Location: Florida
PostPosted: Wed Jun 03, 2009 5:36 pm    Post subject: Reply with quote
VB6 defintely can do a hook, atleaste itself... i dont think you can make a vb6 dll though.
Back to top
View user's profile Send private message
dnsi0
I post too much
Reputation: 0

Joined: 04 Jan 2007
Posts: 2674
PostPosted: Wed Jun 03, 2009 5:36 pm    Post subject: Reply with quote
Valex37 wrote:
I see. Visual Basic just went down another notch in my book, that brings it to notch -20, glad I never really used it. Writing everything in assembly sounds like a lot of fun though. I only use it for special purposes, disassembly, or just fun.


I don't even want to use it but you are being forced to when you do hooks and all that. So I prefer writing it in a language then using pure asm.
Back to top
View user's profile Send private message
Splizes
Grandmaster Cheater Supreme
Reputation: 0

Joined: 21 Jun 2006
Posts: 1944
Location: Florida
PostPosted: Wed Jun 03, 2009 5:42 pm    Post subject: Reply with quote
For example: a beta of a packet editing project that i tried to do over a year ago. This is close to functional with a lot commented out (that may or may not be neccessary(I dont remember).

Code:
Option Explicit

Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (ByRef lpvDest As Any, ByRef lpvSrc As Any, ByVal cbLen As Long)
Private Declare Function GetCurrentProcessId Lib "kernel32" () As Long
Private Declare Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As Long
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Private Declare Function HeapFree Lib "kernel32" (ByVal hHeap As Long, ByVal dwFlags As Long, lpMem As Any) As Long
Private Declare Function HeapAlloc Lib "kernel32" (ByVal hHeap As Long, ByVal dwFlags As Long, ByVal dwBytes As Long) As Long
Private Declare Sub CopyMemoryPut Lib "kernel32" Alias "RtlMoveMemory" (ByVal destination As Long, Source As Any, ByVal Length As Long)
Private Declare Function GetProcessHeap Lib "kernel32" () As Long
Public Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long
Public Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
Private Declare Function HeapCreate Lib "kernel32" (ByVal flOptions As Long, ByVal dwInitialSize As Long, ByVal dwMaximumSize As Long) As Long
Public hHeap As Long

Function DemoUsage()
    Dim jmpBack As Long
    jmpBack = HookAPI("recv", "ws2_32.dll", AddressOf DemoHook)
End Function

Function DemoHook(s As Integer, buf As String, leng As Integer, Flags As Integer) As Long
    'DemoHook = DemoHook(s, buf, leng, Flags) ' a recursive call signifies a dummy call that is used to set up the stack
                                             ' use PatchHook to turn this recursive call into a call to the unhooked original API
    Form1.Text1.Text = Val(Form1.Text1.Text) + 1
    fake
End Function

Function fake()

End Function



' ----------------------------- OFFICIAL MODULE APIS -----------------------------------------

Function CreateReturn(ByVal targetAddr As Long, ByVal patchedLen As Long, ByRef overwritten() As Byte) As Long
    Dim retn(0 To 5) As Byte
    Dim offset As Long

    If hHeap = 0 Then
        hHeap = HeapCreate(&H40000, 0, 0)
    End If

    CreateReturn = HeapAlloc(hHeap, 0, patchedLen + 6)
    If Not CreateReturn = 0 Then
        retn(0) = &H68
        retn(5) = &HC3

        offset = targetAddr + patchedLen

        CopyMemory ByVal CreateReturn, ByVal VarPtr(overwritten(0)), patchedLen
        CopyMemory ByVal CreateReturn + patchedLen, ByVal VarPtr(retn(0)), 6
        CopyMemory ByVal CreateReturn + patchedLen + 1, ByVal VarPtr(offset), 4
    End If
End Function

Public Function PatchHook(ByVal hookAddr As Long, ByVal retn As Long, ByVal fake As Long) As Boolean
    Dim buffer(199) As Byte
    Dim processHandle As Long
    Dim current As Long, bytesRead As Long, bytesWritten As Long


    PatchHook = False

    processHandle = OpenProcess(&H1F0FFF, 0&, GetCurrentProcessId)
    If processHandle = 0 Then Exit Function
   
    current = 0
    PatchHook = True
    'Do Until PatchHook = True
    '    Call ReadProcessMemory(ByVal processHandle, ByVal hookAddr + current, ByVal VarPtr(buffer(0)), 200, ByVal VarPtr(bytesRead))
    '    If Not bytesRead = 200 Then Exit Function
'
   '     Dim i As Long, offset As Long
     '   For i = 0 To 199
      '      If buffer(i) = &HE8 And i <= 195 Then
     '           CopyMemory ByVal VarPtr(offset), ByVal VarPtr(buffer(i + 1)), 4

    '            If offset = 0 - (current + i + 5) Then ' Found the recursive call
    '                offset = retn - (hookAddr + current + i + 5)
       '             Call WriteProcessMemory(ByVal processHandle, ByVal hookAddr + current + i + 1, ByVal VarPtr(offset), 4, ByVal VarPtr(bytesWritten))
''
        '            PatchHook = True
      '              Exit For
      '          End If
'
     '       ElseIf buffer(i) = &H90 And i <= 197 Then
     '           If buffer(i + 1) = &H90 And buffer(i + 2) = &H90 Then
     '               PatchHook = True
    '                Exit For
    '            End If
    '        End If
    '    Next i
'
    '    current = current + 185
    'Loop
End Function


Public Function HookAPI(ByRef apiName As String, ByRef moduleName As String, ByVal newAddr As Long, Optional ByVal lenToPatch As Long = 5) As Long
    Dim moduleHandle As Long
    Dim targetAddr As Long

    HookAPI = 0

    ' get api address
    moduleHandle = GetModuleHandle(moduleName)
    If moduleHandle = 0 Then moduleHandle = LoadLibrary(moduleName)
    If moduleHandle = 0 Then Exit Function

    targetAddr = GetProcAddress(moduleHandle, apiName)
    If targetAddr = 0 Then Exit Function

    ' call Detour with api address
    HookAPI = Detour(targetAddr, newAddr, lenToPatch, True)
End Function

Public Function Detour(ByVal targetAddr As Long, ByVal newAddr As Long, ByVal lenToPatch As Long, Optional ByVal IsAPI As Boolean = False) As Long
    Dim trampoline() As Byte
    Dim backup() As Byte
    Dim processHandle As Long, bytesWritten As Long, bytesRead As Long
    ReDim trampoline(0 To lenToPatch - 1)
    ReDim backup(0 To lenToPatch - 1)
    Detour = 0

    ' get process handle
    processHandle = OpenProcess(&H1F0FFF, 0&, GetCurrentProcessId)
    If processHandle = 0 Then Exit Function

    ' create trampoline
    trampoline(0) = &HE9

    Dim offset As Long
    offset = newAddr - targetAddr - 5
    CopyMemory ByVal VarPtr(trampoline(1)), ByVal VarPtr(offset), 4

    If UBound(trampoline) > 4 Then
        Dim i As Long
        For i = 5 To UBound(trampoline)
            trampoline(i) = &H90
        Next i
    End If

    ' create backup
    ReadProcessMemory ByVal processHandle, ByVal targetAddr, ByVal VarPtr(backup(0)), ByVal lenToPatch, ByVal VarPtr(bytesRead)
    If bytesRead <> lenToPatch Then Exit Function


    ' create a jump to the original code
    Detour = CreateReturn(targetAddr, lenToPatch, backup)

    ' If it's an API hook patch the hook
    If IsAPI = True Then
        PatchHook newAddr, Detour, AddressOf fake
    End If

    ' apply trampoline
    WriteProcessMemory ByVal processHandle, ByVal targetAddr, ByVal VarPtr(trampoline(0)), ByVal lenToPatch, ByVal VarPtr(bytesWritten)
    If bytesWritten <> lenToPatch Then Exit Function

    ' close handle
    CloseHandle ByVal processHandle
End Function

edit: i forgot that everyone in this forum is a perfectionist so im sorry this isnt complete and doesnt fully function. but i dont know where my complete source is O.o.
Back to top
View user's profile Send private message
dnsi0
I post too much
Reputation: 0

Joined: 04 Jan 2007
Posts: 2674
PostPosted: Wed Jun 03, 2009 6:36 pm    Post subject: Reply with quote
I know that it can hook its self. The real problem is hooking other processes since you have to relocate the variables and all that.
Back to top
View user's profile Send private message
pkedpker
Master Cheater
Reputation: 1

Joined: 11 Oct 2006
Posts: 412
PostPosted: Wed Jun 03, 2009 10:46 pm    Post subject: Reply with quote
winsock1.SendData "10 0 10 25 94 191 241 81 24 46"

would of never worked..

SenData only sends strings or byte arrays..

it would send that as a string.. but it's a bunch of decimals.. what you have to do is convert them to byte array

Code:

dim packet(SizeHere) as byte

packet(0) = 10
packet(1) = 0
packet(2) = 10
packet(3) = 25

etc...

then

winsock1.SendData packet


and it would send exactly what you want.


As a professional hacker who hacked mmorpgs for a few years now.. I can tell you this won't work..

Since you can send the packet everytime and it opens storage means your game doesn't have a encryption or it's encoded that it always ends up the same in the end..

Anyways what you are trying to do won't work unless you replicate the complete protocol (Process) as how the client connects to the server.. what you are building is a CLIENT.. and you cannot just send packets to a ip:port without authenticating yourself as a client.. that would involve usually a Username/password.. some character selection packet.. and login to world packet.. it would be pretty easy to do in this game since it doesn't involve any encryption..


If you want to make your own client.. usually called a Clientless Bot/Hack in the game hacking field. You don't only send packets.. you will also have to look at recv packets to find out what the server sends to your client you are trying to build.. usually it sends stuff like where monsters move.. what players around you are chatting nearby.. prices of shopkeepers etc.. it also sends data like in character selection it would send some unique ID's used in databases of all players which you have to replicate (Copy from recv packet) and send back to server telling it you picked this character to login...

As you can see making a clientless bot takes alot of time..

But there is a shortcut you can take and thats called a PROXY.. what is a proxy? a proxy is used in internet browsers to hide your identity. It's a process of whatever your trying to download/view on site.. it sends packets from your computer to a proxy ip:port (computer) and that proxy computer downloads the page/file and sends it back to your computer which means you never actually visited that website.. but another computer did, this is used to do illegal things and bypass IP protections..)

But proxies don't have to be only that.. you can make a proxy on your own computer..

the process is this..

You connect to your own computer on a different port and listen as a server..


so your computer is now a server.. 127.0.0.1 is your local IP and whatever port you pick..


Now you make the game.. connect to 127.0.0.1 the Proxy port you pick..

when your game connects now it will connect to your crappy proxy program you made.. what now? Now so you don't have to worry about anything.. you make another winsock control and when the REAL Client connects to your first winsock control you pass it's connection to another winsock control which connects to the REAL IP of the game.. what have we done?

Your first answer would be .. uhh.. you just redirected the game from from 1 ip to another.. big deal right?

No.. now you have access to those winsock controls you created..

First one will be used to RECV data from client and SEND Data to client..
Second one will be used to RECV data from server and SEND data to server.

Now you can send any fake data you want to client. like cheat engine.. give you self 999999 gold etc.. it will be fake because your acting as a game server.. and emulating the client you are running.. you INJECTING packets into your game client which thinks they came from the real game server.. but they came from your proxy server..



This is all basic stuff tbh.. What I told you in this method is usually called a pipe hack.. I used this in over 7 mmorpgs to find duplication hacks..

Best duplication hacks I found were in
Kalonline (geons (money) dupe exploit in friends list I was a kingpin in this game people would follow me around and when I stopped walking they would all open shops around me.. just for me to buy their shit.. this bug lasted a month because GM's dont give a shit about this game, yup screwed up economy here for a month).

Archlord (auction house buy sold item exploit wasn't that fun due to items don't mean much in archlord but class/skills do but i did buy out all the defense stones for a week until I screwed up the economy lol)

Rappelz (set skills to overflow gave 255% buffs to defense/attack which let me kill lvl 100 monsters at level 20 was very fun =P after 2nd day rappelz was released after I went from lvl 20 to 50 in a day.. I made my self seen when I went into the noob dungeon which was filled with people since it's only the 2nd day release they were all thinking I was a hacker since I was wearing crap armor/weapon.. GM teleported near me then and sent me to a place called the Abyss which was a very dark place with train tracks no monsters.. and uhh.. pretty much jailed my account I quit after that).

Turf Battles (found a item dupe hack.. got ipbanned in a few days really bad hacking experience)

Thats right they are not big games thats why hacking on them was easy.. if you are trying to do this to a big game... you will find much harder definitely
_________________
Hacks I made for kongregate.
Kongregate Universal Badge Hack: http://forum.cheatengine.org/viewtopic.php?p=4129411
Kongreate Auto Rating/Voter hack: http://forum.cheatengine.org/viewtopic.php?t=263576
Took a test lol
Back to top
View user's profile Send private message
majidemo
Cheater
Reputation: 0

Joined: 17 Apr 2009
Posts: 28
PostPosted: Thu Jun 04, 2009 1:42 am    Post subject: Reply with quote
owh...WOW,.. ill be testing all these codes imdiately.. thanks.. ill be back w/ results.. i hope..^_^ THANKS ALOT


@sir SnowFox

Quote:
i'd like to clear and ask something about this part.

Code:
processHandle = OpenProcess(&H1F0FFF, 0&, GetCurrentProcessId)


&H1F0FFF->is that your process? how do i code it to be my process?


Code:
i have Errors:
'As Any' is not supported in 'declare' statements..
'Option' statements must precede any decleration or 'import' statements.

ByVal<-this code seems to have an error too..
Any<-this code seems to have an error too..

Whats this? this is an error too.

Form1.Text1.Text = Val(Form1.Text1.Text) + 1



@sir pkedpker
i see.. that was really clear..

this game im trying to hack is not so big.. The name is Khan..
and only 2 servers are running in the whole word..

a Korean server and Thai server..
i play a thai server, only around 1000 below players come online in one day..

i have used WPE/RPE and resend packets alot of times in this game..

like i dont need to go to the NPC to buy stuff because i can just resend the buy packet and voila, i have the item..

i just record packets.. and resend them..

is their any other way of making my program?
yes im trying to create something like a BOT, but not exactly a bot
but a packet sender..

i hope you understand what i mean.

i thought it would be a simple code..

because all i do is just send a packet..

im a newbie to coding..

as i was looking for help for this program..

i found out that i must HOOK using ws_32.dll , right?

how do i code that? hahaha..

i cant find any good tuts on that one..

and i already have coded my program alot..

i already have long lines of code..

but the only code i lack is to send the packet..

the winsock,ws_32.dll ,

plz help me on this, to understand more.. or if you may spoon feed me w/ the code but that would be wrong, i wont learn.. so i'd want to have more info on this matters.. hehe^_^,..

im coding this on a Visual Basic 2008 express edition..

can i upload the source code i have made? can someone help me on this?

the game main website is H**P://khan DOT in DOT th


i cant use the proxy thing..

because i need the program to be like PLUG & PLAY hahaha..

so if my friends use it they dont need to do the proxy thing either.

i have a screenshot of my program it looks like this..

H**P://i288 DOT photobucket DOT com/albums/ll181/majidemo/KhanToolz2Preview1 DOT jpg

i added a select current map option because the packet will vary by map so if they choose a certain map ex. wroclaw when they click the repots HP it will send a packet that is compatible w/ wroclaw and buy Health Points Heal / POTS..

Code:
        Dim packet(10) As Byte

        packet(0) = 10
        packet(1) = 0
        packet(2) = 10
        packet(3) = 25
        packet(4) = 25
        packet(5) = 25
        packet(6) = 25
        packet(7) = 25
        packet(8) = 25
        packet(9) = 25
        packet(10) = 25

        then ->"this says syntax error"

        winsock1.SendData(packet)
Back to top
View user's profile Send private message
Splizes
Grandmaster Cheater Supreme
Reputation: 0

Joined: 21 Jun 2006
Posts: 1944
Location: Florida
PostPosted: Thu Jun 04, 2009 5:32 am    Post subject: Reply with quote
well incase you wanted to see a more complete version of my code this is litterally hella close to working Very Happy.
Code:
Option Explicit

Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (ByRef lpvDest As Any, ByRef lpvSrc As Any, ByVal cbLen As Long)
Private Declare Function GetCurrentProcessId Lib "kernel32" () As Long
Private Declare Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As Long
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Private Declare Function HeapFree Lib "kernel32" (ByVal hHeap As Long, ByVal dwFlags As Long, lpMem As Any) As Long
Private Declare Function HeapAlloc Lib "kernel32" (ByVal hHeap As Long, ByVal dwFlags As Long, ByVal dwBytes As Long) As Long
Private Declare Sub CopyMemoryPut Lib "kernel32" Alias "RtlMoveMemory" (ByVal destination As Long, Source As Any, ByVal Length As Long)
Private Declare Function GetProcessHeap Lib "kernel32" () As Long
Public Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long
Public Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long

Function DemoUsage()
    Dim jmpBack As Long
    jmpBack = HookAPI("recv", "ws2_32.dll", AddressOf DemoHook)
    PatchHook AddressOf DemoHook, jmpBack
End Function

Function DemoHook(S As Integer, buf As String, leng As Integer, flags As Integer) As Long
    Form1.Text1.Text = Val(Form1.Text1.Text) + 1
    DemoHook = DemoHook(S, buf, leng, flags) ' a recursive call signifies a dummy call that is used to set up the stack
                                             ' use PatchHook to turn this recursive call into a call to the unhooked original API
End Function


' ----------------------------- OFFICIAL MODULE APIS -----------------------------------------

Function CreateReturn(ByVal targetAddr As Long, ByVal patchedLen As Long, ByRef overwritten() As Byte) As Long
    Dim hHeap As Long, offset As Long, larJMPASM(1) As Long

    hHeap = GetProcessHeap
    CreateReturn = HeapAlloc(hHeap, 0, patchedLen + 6)
    If Not CreateReturn = 0 Then
        larJMPASM(0) = &HE9000000
        larJMPASM(1) = targetAddr - (CreateReturn + patchedLen)

        CopyMemory ByVal CreateReturn, &H8B, 1
        CopyMemory ByVal CreateReturn + 1, &HE58B55FF, 4
        CopyMemory ByVal CreateReturn + patchedLen, ByVal VarPtr(larJMPASM(0)) + 3, 5
    End If
End Function

Public Function PatchHook(ByVal hookAddr As Long, ByVal retn As Long) As Boolean
    Dim buffer(199) As Byte
    Dim processHandle As Long
    Dim current As Long, bytesRead As Long, bytesWritten As Long

    PatchHook = False

    ' get process handle
    processHandle = OpenProcess(&H1F0FFF, 0&, GetCurrentProcessId)
    If processHandle = 0 Then Exit Function

    ' scanning loop
    current = 0
    Do Until PatchHook = True
        Call ReadProcessMemory(ByVal processHandle, ByVal hookAddr + current, ByVal VarPtr(buffer(0)), 200, ByVal VarPtr(bytesRead))
        If Not bytesRead = 200 Then Exit Function

        Dim i As Long, offset As Long
        For i = 0 To 199
            If buffer(i) = &HE8 And i <= 195 Then
                CopyMemory ByVal VarPtr(offset), ByVal VarPtr(buffer(i + 1)), 1

                If offset = 0 - (current + i + 5) Then ' Found the recursive call
                    offset = retn - (hookAddr + current + i + 5)
                    Call WriteProcessMemory(ByVal processHandle, ByVal hookAddr + current + i + 1, ByVal VarPtr(offset), 4, ByVal VarPtr(bytesWritten))

                    PatchHook = True
                    Exit For
                End If

            ElseIf buffer(i) = &H90 And i <= 197 Then
                If buffer(i + 1) = &H90 And buffer(i + 2) = &H90 Then
                    PatchHook = True
                    Exit For
                End If
            End If
        Next i

        current = current + 185
    Loop
End Function

Public Function HookAPI(ByRef apiName As String, ByRef moduleName As String, ByVal newAddr As Long, Optional ByVal lenToPatch As Long = 5) As Long
    Dim moduleHandle As Long
    Dim targetAddr As Long

    HookAPI = 0

    ' get api address
    moduleHandle = GetModuleHandle(moduleName)
    If moduleHandle = 0 Then moduleHandle = LoadLibrary(moduleName)
    If moduleHandle = 0 Then Exit Function

    targetAddr = GetProcAddress(moduleHandle, apiName)
    If targetAddr = 0 Then Exit Function

    ' call Detour with api address
    HookAPI = Detour(targetAddr, newAddr, lenToPatch)
End Function

Public Function Detour(ByVal targetAddr As Long, ByVal newAddr As Long, Optional ByVal lenToPatch As Long = 5) As Long
    Dim trampoline() As Byte
    Dim backup() As Byte
    Dim test As String
    Dim processHandle As Long, bytesWritten As Long, bytesRead As Long
    ReDim backup(lenToPatch - 1)
    ReDim trampoline(lenToPatch - 1)
   
    Detour = 0

    ' get process handle
    processHandle = OpenProcess(&H1F0FFF, 0&, GetCurrentProcessId)
    If processHandle = 0 Then Exit Function

    ' create trampoline
    trampoline(0) = &HE9

    Dim offset As Long
    offset = newAddr - targetAddr - 5
    CopyMemory ByVal VarPtr(trampoline(1)), ByVal VarPtr(offset), 4

    If UBound(trampoline) > 4 Then
        Dim i As Long
        For i = 5 To UBound(trampoline)
            trampoline(i) = &H90
        Next i
    End If

    ' create backup
    ReadProcessMemory ByVal processHandle, ByVal targetAddr, ByVal VarPtr(backup(0)), ByVal lenToPatch, ByVal VarPtr(bytesRead)
    If bytesRead <> lenToPatch Then Exit Function

    ' apply trampoline
    WriteProcessMemory ByVal processHandle, ByVal targetAddr, ByVal VarPtr(trampoline(0)), ByVal lenToPatch, ByVal VarPtr(bytesWritten)
    If bytesWritten <> lenToPatch Then Exit Function

    ' create a jump to the original code
    Detour = CreateReturn(targetAddr, lenToPatch, backup)

    ' close handle
    CloseHandle ByVal processHandle
End Function
Back to top
View user's profile Send private message
majidemo
Cheater
Reputation: 0

Joined: 17 Apr 2009
Posts: 28
PostPosted: Thu Jun 04, 2009 5:34 am    Post subject: Reply with quote
whoa.. thanks.. ill be going over it imdiately.. heheh

id really like to finish this program before monday...^_^

THANKS...!

::edit

was trying it but my newbieness had alot of questions again.. i hope you wont mind..^_^

This part seems to say ERROR = statement is not a valid space name
it gave 19 ERRORS..

im trying to add spaces.. then it had 17 ERRORS but that all^_^ haha..

any tip on how to fix it?


Code:
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (ByRef lpvDest As Any, ByRef lpvSrc As Any, ByVal cbLen As Long)
Private Declare Function GetCurrentProcessId Lib "kernel32" () As Long
Private Declare Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As Long
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, ByVal lpBuffer As Any, ByVal nSize As Long, ByVal lpNumberOfBytesWritten As Long) As Long
Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, ByVal lpBuffer As Any, ByVal nSize As Long, ByVal lpNumberOfBytesWritten As Long) As Long
Private Declare Function HeapFree Lib "kernel32" (ByVal hHeap As Long, ByVal dwFlags As Long, ByVal lpMem As Any) As Long
Private Declare Function HeapAlloc Lib "kernel32" (ByVal hHeap As Long, ByVal dwFlags As Long, ByVal dwBytes As Long) As Long
Private Declare Sub CopyMemoryPut Lib "kernel32" Alias "RtlMoveMemory" (ByVal destination As Long, ByVal Source As Any, ByVal Length As Long)
Private Declare Function GetProcessHeap Lib "kernel32" () As Long
Public Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long
Public Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
Back to top
View user's profile Send private message
Splizes
Grandmaster Cheater Supreme
Reputation: 0

Joined: 21 Jun 2006
Posts: 1944
Location: Florida
PostPosted: Thu Jun 04, 2009 9:01 am    Post subject: Reply with quote
i highly doubt youll be able to do it xD... that shit is hella complicated and your obviously new.
Back to top
View user's profile Send private message
majidemo
Cheater
Reputation: 0

Joined: 17 Apr 2009
Posts: 28
PostPosted: Thu Jun 04, 2009 9:20 am    Post subject: Reply with quote
yeah.. i see^_^,..

will you still try to help me?

please?^_^

here is my source code.. can you help me do something about it? if your not busy.. thanks..

or can anyone help me?

h**p://www.mediafire.com/download.php?o5kybrmxdon //source code
h**p://www.mediafire.com/download.php?zvyf5dt4xt4 // the client file im trying to hook to.. KhanClient.exe

thanks..

the password is 5642693

Last edited by majidemo on Thu Jun 04, 2009 8:29 pm; edited 1 time in total
Back to top
View user's profile Send private message
pkedpker
Master Cheater
Reputation: 1

Joined: 11 Oct 2006
Posts: 412
PostPosted: Thu Jun 04, 2009 7:20 pm    Post subject: Reply with quote
I post my C++ winsock hook here you go it worked I used it once.. to hack some stupid game and after that I never used it

Code:

#include <Winsock2.h>
#include <Windows.h>
#include <iostream>
#include <fstream>
#include <stdio.h>

#pragma comment(lib, "ws2_32.lib")

using namespace std;

FILE* pSendLogFile;
FILE* pRecvLogFile;

typedef int (WINAPI* r_send)(SOCKET sock, char* buf, int len, int flags);
r_send osend;

typedef int (WINAPI* r_recv)(SOCKET sock, char* buf, int len, int flags);
r_recv orecv;

int   WINAPI custom_send         (SOCKET sock, char* buf, int len, int flags);
int   WINAPI custom_recv         (SOCKET sock, char* buf, int len, int flags);

void InitDebugConsole();
void *DetourFunc(BYTE *src, const BYTE *dst, const int len);
bool RetourFunc(BYTE *src, BYTE *restore, const int len);
bool bCompare(const BYTE* pData, const BYTE* bMask, const char* szMask);
DWORD dwFindPattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask);

void DumpIt(char v,int size,char* buf);
char score[18];

BOOL WINAPI DllMain(HINSTANCE hinst, DWORD reason, LPVOID reserved)
{
    if (reason == DLL_PROCESS_ATTACH)
    {
   
      osend         = (r_send) GetProcAddress(GetModuleHandle("ws2_32.dll"), "send"); //gets original address for send
        orecv         = (r_recv) GetProcAddress(GetModuleHandle("ws2_32.dll"), "recv"); //for recv same as above
      
      //DWORD dwSendOriAddr = GetProcAddress(GetModuleHandle("ws2_32.dll"), "send"); //gets original address for send
      //DWORD dwRecvOriAddr = GetProcAddress(GetModuleHandle("ws2_32.dll"), "recv"); //for recv same as above
      printf("[In Application] Ori Send Address = %x\n", osend);
      printf("[In Application] Ori Recv Address = %x\n", orecv);

        osend         = (r_send)         DetourFunc((BYTE*)osend, (BYTE*)&custom_send, 5);
        orecv         = (r_recv)         DetourFunc((BYTE*)orecv, (BYTE*)&custom_recv, 5);

      printf("[This DLL] Ori Send Address = %x\n", osend);
      printf("[This DLL] Ori Recv Address = %x\n", orecv);

      printf("The score should look like this 73%%2E0440539 (%%2E = dot) accuracy after the dot)\n");
      printf("Lowest score is 0%%2E000\n");
      printf("Type score you want to get : ");
      cin.getline (score,18);
      printf("loaded score to be = %s\n", score);
    }
    else if (reason == DLL_PROCESS_DETACH)
    {
    }   
    return true;
}


void *DetourFunc(BYTE *src, const BYTE *dst, const int len)
{
   BYTE *jmp = (BYTE*)malloc(len+5);
   DWORD dwback;
   
   VirtualProtect(src, len, PAGE_READWRITE, &dwback);
   memcpy(jmp, src, len); jmp += len;
   
   jmp[0] = 0xE9;
   *(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;
   
   src[0] = 0xE9;
   *(DWORD*)(src+1) = (DWORD)(dst - src) - 5;
   
   VirtualProtect(src, len, dwback, &dwback);
   
   return (jmp-len);
}

bool RetourFunc(BYTE *src, BYTE *restore, const int len)
{
   DWORD dwback;
      
   if(!VirtualProtect(src, len, PAGE_READWRITE, &dwback))   { return false; }
   if(!memcpy(src, restore, len))                     { return false; }

   restore[0] = 0xE9;
   *(DWORD*)(restore+1) = (DWORD)(src - restore) - 5;

   if(!VirtualProtect(src, len, dwback, &dwback))         { return false; }
   
   return true;
}   

bool bCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
   for(;*szMask;++szMask,++pData,++bMask)
      if(*szMask=='x' && *pData!=*bMask )
         return false;
   return (*szMask) == NULL;
}

DWORD dwFindPattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask)
{
   for(DWORD i=0; i < dwLen; i++)
      if( bCompare( (BYTE*)( dwAddress+i ),bMask,szMask) )
         return (DWORD)(dwAddress+i);

   return 0;
}

int WINAPI custom_send(SOCKET sock, char* buf, int len, int flags)
{
   //struct sockaddr_in socketClient = (struct sockaddr_in*)sock;
   //printf("ip = %s\n", inet_ntoa(socketClient.sin_addr));
   //DumpIt('S',len,buf);
   
   char* pch;
   char makeOne[10000];
   char endString[5000]; //500 bytes max for now?

   pch = strstr(buf,"score=");
   if(pch != NULL) { //found match
      pch = strstr(buf, "&"); //<-score finish
      if(pch != NULL) {

         int size = pch-buf;
         memcpy(endString,buf+size, len-size);
         endString[len-size] = '\0';

         sprintf(makeOne, "%s%s%s%s","score=", score,"%2D1195345", endString);
         size = strlen(makeOne);
         char* sendPacket = new char[size];
         memcpy(sendPacket, makeOne, size);
         DumpIt('S',size, makeOne);
         return osend(sock, sendPacket, size, flags);
      }
   }

    //pSendLogFile = fopen("C:\\sndlog.txt", "a+");
    //fprintf(pSendLogFile, "\n", buf);
    //fclose(pSendLogFile);
    return osend(sock, buf, len, flags);
}
int WINAPI custom_recv(SOCKET sock, char* buf, int len, int flags)
{
    //pRecvLogFile = fopen("C:\\rcvlog.txt", "a+");
    //fprintf(pRecvLogFile, "\n", buf);
    //fclose(pRecvLogFile);
    return orecv(sock, buf, len, flags);
}

void DumpIt(char v,int size,char* buf)
{
        printf("\n\n");
        if (v == 'S')
                printf("SEND PACKET");
        else
                printf("RECV PACKET");
        printf(" SIZE: %3d \n    ",size);
        int col=14;
        int pc=0;
        int lasti=0;
        bool notfull=true;
        for (int i=0;i<size;i++)
        {
                printf("%02x ",BYTE(buf[i]));
                if (pc++>col)
                {
                        //PRINT the text to it XD
                        printf("       ");
                        for (int x=lasti;x<=i;x++)
                        {
                                if (BYTE(buf[x]) >= 33)
                                        printf("%c",char(buf[x]));
                                else
                                        printf(".");
                        }
                        printf("\n    ");
                        pc=0;
                        lasti=i+1;
                        notfull=false;
                } else
                         notfull=true;
        }
        if (notfull)
        {
                while(1)
                {
               //FINISH LAST ROW !
               printf("   "); //no hex here
               if (pc++>col)
               {
                     //PRINT the text to it XD
                     printf("       ");
                     for (int x=lasti;x<=i;x++)
                     {
                           if (x <size)
                           if (BYTE(buf[x]) >= 33)
                                 printf("%c",char(buf[x]));
                           else
                                 printf(".");
                           else
                                 printf(" ");
                     }
                     printf("\n                   ");
                     pc=0;
                     lasti=i+1;
                     notfull=false;
                     break;
               }
                }
        }
        printf("\n");
}

_________________
Hacks I made for kongregate.
Kongregate Universal Badge Hack: http://forum.cheatengine.org/viewtopic.php?p=4129411
Kongreate Auto Rating/Voter hack: http://forum.cheatengine.org/viewtopic.php?t=263576
Took a test lol
Back to top
View user's profile Send private message
majidemo
Cheater
Reputation: 0

Joined: 17 Apr 2009
Posts: 28
PostPosted: Thu Jun 04, 2009 10:17 pm    Post subject: Reply with quote
@SnowFox

the code you gave me.. im starting work things out.. i know why i got the error namespave thingy.. because i did not put it in a class.. sorry..

im now trying to fix other errors.. i hope if i can work it out.. you may help me on more^_^
Back to top
View user's profile Send private message
Splizes
Grandmaster Cheater Supreme
Reputation: 0

Joined: 21 Jun 2006
Posts: 1944
Location: Florida
PostPosted: Fri Jun 05, 2009 10:44 am    Post subject: Reply with quote
apparently you dont realize that that code only hooks itself lol
Back to top
View user's profile Send private message
rapion124
Grandmaster Cheater Supreme
Reputation: 0

Joined: 25 Mar 2007
Posts: 1095
PostPosted: Fri Jun 05, 2009 8:47 pm    Post subject: Reply with quote
You can't send packets without hooking to get the socket id. You need to inject a DLL into the target game and hook send() or recv() to get the socket id. Then, you use send() to send your packet using the socket id.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Goto page Previous  1, 2, 3  Next
Page 2 of 3

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites