Cheat Engine

[Tilosag]

Hi,

First, I should say that I'm debugging C++ in Java.

I have a problem with finding the place in memory where the RAW packet data is being stored.

As you can see in the picture below I stopped because I couldn't find the place where data array of WSASend changes (encrypted password, packed packet data).
I can't find the previous call or procedure this procedure was called from.

i30*photobucket*com/albums/c316/Tilosag/debug_PP3*jpg

Moreover the data in OllyDbg doesn't match data captured with WireShark. There are some things added at beginning. I don't understand why.

[Slugsnack]

raw packet data can be found by hooking/breakpointing at send apis. let's say send(). you can go ctrl-g 'send' and then breakpoint there or write a jmp to an inline asm hook procedure.

it is probably appending header information to the packets before being sent. go to that instruction where it is the CALL to WSASend. and press enter. then press f2 on the location reached. that is wsasend. then when the program hits there, it should break. then read off from the stack as how i described yesterday. it should be the same at that point

what you're looking at now appears to be the wrapper to the sending functions. probably somewhere between the start of that proc and when wsasend is actually called, the buffers are being changed slightly. if you are gonna read it off, read it at the start of the called function or directly before the call itself is done

[Tilosag]

[Slugsnack]

oh i didn't realise you were comparing your results to wireshark. try to use something which employs usermode hooks such as wpe pro and i think you'll find the results match.

and yes, i meant wsasend. when i say inline asm hook procedure, i mean to write a jmp at the start of wsasend to a codecave. inside that codecave, you will record or display the parameters by reading them off the stack. then you will execute the bytes you overwrote ( should be 5 ), then return to the instruction after the jmp you wrote.

anyway try a usermode packet sniffer first, and see if the results match.

[Tilosag]

WPE Pro does not work! I don't know why, maybe because I try to hook java process whereas code responsible for sending packets is somewhere else.
I've also tried to attach WPE Pro to every process listed but no results!

Honestly, I don't know any user mode packet sniffers apart from WPE Pro but I downloaded source code of Packet Monitor in C# and compiled it. Results are the same as in the WireShark:

i30*photobucket*com/albums/c316/Tilosag/PPH4*png


Anyway, do you know how to explain this extraordinary jump without a jump?
i30*photobucket*com/albums/c316/Tilosag/PPH3*png


Regards
Tilo

[Slugsnack]

do you know how this 'Packet Monitor' works ?

if possible, you should try breakpointing on wsasend and read off the buffers when the code breaks. i would be very very confused if the buffers did not match at that point. if they do ( should do ), then you can slowly start tracing back and see where the extra bytes are being appended.

the thing is, you've said you've been breaking on wsasend but from your screenshots you appear to be in java.nio opposed to Ws2_32.dll. i am suspecting java.nio's send functions to be wrappers to windows apis which do sending. see if you are able to break on the real wsasend.

and i'm not sure what you mean about your 'jump without a jump' thing :/

how big is the executable ? perhaps i can dl it and take a look myself

[Tilosag]

I don't know how 'Packet Monitor' works, however I achieved my goal. I found that data added at the begging is connected with some kind of socket information. So your method of finding RAW packets data works perfectly! Thank you for that.

By 'jump without a jump' i meant that (on 3rd screen) Olly did not show how he get to that point. He just immediately jumped there, it seemed like without a reason. However I don't want to dig that far.

I don't know how big executable is, because program is executed by short cut on desktop with some parameters:

[sponge]

Do you realize you can decompile .jar files?

[nwongfeiying]

[NINTENDO]

[Tilosag]

[sponge]