Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


[VB6] DLL Injection - ws2_32 Hook?
Goto page Previous  1, 2, 3, 4  Next
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
4PR28U
How do I cheat?
Reputation: 0

Joined: 27 Jun 2010
Posts: 9
PostPosted: Sat Jul 03, 2010 11:53 am    Post subject: Reply with quote
Thats my problem ^^ I don't know how to hook them... (I do this my first time)
Back to top
View user's profile Send private message
ErrorMaker
Newbie cheater
Reputation: 0

Joined: 25 Jun 2010
Posts: 21
PostPosted: Sun Jul 11, 2010 7:01 am    Post subject: Reply with quote
Ok I'm using Microsoft Detours 2.1 now (I found a working source for hooking the connect function).

Here's the source:
Code:
#include <stdio.h>
#include <Winsock2.h>
#include <windows.h>

#include <iostream>
#include <fstream>
#include <string>

#pragma comment(lib,"detoured.lib")
#pragma comment(lib,"detours.lib")
#include <detours.h>

#pragma comment(lib, "ws2_32.lib")

#define log_filename "C:\\conlog.txt"

static int (WINAPI *orig_connect)(SOCKET s, const struct sockaddr *name, int namelen) = connect;
int WINAPI my_connect(SOCKET s, const struct sockaddr *name, int namelen);
//logger funktion
void log_to_file(const char * format, ...);


BOOL WINAPI DllMain(HINSTANCE hinst, DWORD dwReason, LPVOID reserved)
{
   if (dwReason == DLL_PROCESS_ATTACH) {
      DisableThreadLibraryCalls(hinst);

        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)orig_connect, my_connect);
        DetourTransactionCommit();
      log_to_file("API hooked\n");
   }
   return TRUE;
}

int WINAPI my_connect(SOCKET s, const struct sockaddr *name, int namelen)
{
   sockaddr_in *inName = (sockaddr_in *)(name);
   log_to_file("%s\n",inet_ntoa(inName->sin_addr));
   return orig_connect(s,name,namelen);
}

void log_to_file(const char * format, ...)
{
   if(!format) { return; }

   FILE * pFile;
   va_list va_alist;
    char logbuf[256] = {0};

    va_start (va_alist, format);
    _vsnprintf (logbuf+strlen(logbuf), sizeof(logbuf) - strlen(logbuf), format, va_alist);
    va_end (va_alist);

   if (fopen_s(&pFile,log_filename,"a") == NULL) {
      fputs(logbuf,pFile);
      fclose (pFile);
   }
}


Code:
log_to_file("%s\n",ntohs(inName->sin_port));


It logs the IP adress without any problems, but when I add the line of code above (for logging the ports) into the my_connect function (below the line "log_to_file("%s\n",inet_ntoa(inName->sin_addr));"), the process in which I inject the "detoured.dll" and my DLL crashes. Does someone know why the process crashes? Confused

Thanks in advance Wink
Back to top
View user's profile Send private message
pkedpker
Master Cheater
Reputation: 1

Joined: 11 Oct 2006
Posts: 412
PostPosted: Sun Jul 11, 2010 7:55 am    Post subject: Reply with quote
well i don't work on dll's anymore but i'm guessing port isn't read in htons which is why dll crashes but it would just give u wrong number so idk.

err.. i posted the source in some other topic on cheat engine's general programming section forgot where
_________________
Hacks I made for kongregate.
Kongregate Universal Badge Hack: http://forum.cheatengine.org/viewtopic.php?p=4129411
Kongreate Auto Rating/Voter hack: http://forum.cheatengine.org/viewtopic.php?t=263576
Took a test lol
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 205

Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
PostPosted: Sun Jul 11, 2010 8:25 am    Post subject: Reply with quote
inet_ntoa can fail and return null which in your case will crash the dll as well. You should add error checks and such to ensure your dll doesn't crash due to small issues.

ntohs does not return a string either. It's a number (u_short) which you need to alter your format to print out. %d should work fine.
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
ErrorMaker
Newbie cheater
Reputation: 0

Joined: 25 Jun 2010
Posts: 21
PostPosted: Sun Jul 11, 2010 8:30 am    Post subject: Reply with quote
Wiccaan wrote:
inet_ntoa can fail and return null which in your case will crash the dll as well. You should add error checks and such to ensure your dll doesn't crash due to small issues.

ntohs does not return a string either. It's a number (u_short) which you need to alter your format to print out. %d should work fine.


Ahhh thanks Very Happy %d worked like a charm Wink

Code:
log_to_file("%d\n",ntohs(inName->sin_port));


Another question Embarassed

I'm listening with a socket on port 80 (with a VB6 program) for connections. Now i try to redirect an IP @ port 80 to localhost to hook up the connection with my VB6 program.

Code:
int WINAPI my_connect(SOCKET s, const struct sockaddr *name, int namelen)
{
   sockaddr_in *inName = (sockaddr_in *)(name);
   char* ip = inet_ntoa(inName->sin_addr);
   u_short port = ntohs(inName->sin_port);
   log_to_file("%s%s%s%i\n","Connect to: ",ip,":",port);

   // Check IP
   if (inName->sin_addr.s_addr == inet_addr("95.170.72.144"))
   {
      // Check Port
      if (inName->sin_port == htons(80))
      {
         inName->sin_family = AF_INET;
         inName->sin_addr.s_addr = inet_addr("127.0.0.1");
         inName->sin_port = htons(80);
         ip = inet_ntoa(inName->sin_addr);
         port = ntohs(inName->sin_port);
         log_to_file("%s%s%s%i\n","Redirect to: ",ip,":",port);
         return orig_connect(s, (struct sockaddr *)&inName, sizeof(inName));
      }
      else
      {
         return orig_connect(s, name, namelen);
      }
   }
   else
   { 
      return orig_connect(s, name, namelen);
   }
}


But this currently just blocks an IP when I visit the IP "95.170.72.144" in IE in which I've injected "detoured.dll" and my DLL. I don't get a connection on localhost Confused
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 205

Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
PostPosted: Mon Jul 12, 2010 11:37 am    Post subject: Reply with quote
Try debugging and finding out whats failing. Also try printing out the return from connect before returning to see if there is a specific code being returned.

connect will return 'SOCKET_ERROR' if it fails, which you can use 'WSAGetLastError' to get the specific error code afterward.

So you could setup the hook to do:
Code:
int WINAPI my_connect( SOCKET s, const struct sockaddr *name, int namelen )
{
   sockaddr_in* inName = (sockaddr_in*)name;
   char* ip = inet_ntoa(inName->sin_addr);
   u_short port = ntohs(inName->sin_port);
   log_to_file( "Connect to: %s : %i", ip, port );

   if( inName->sin_addr.s_addr == inet_addr( "95.170.72.144" ) && inName->sin_port == htons(80) )
   {
      inName->sin_family = AF_NET;
      inName->sin_addr.s_addr = inet_addr("127.0.0.1");
      inName->sin_port = htons(80);

      log_to_file( "Attempting to redirect to localhost.\n" );

      int nReturn = orig_connect( s, (struct sockaddr*)&inName, sizeof(inName) );
      if( nReturn == SOCKET_ERROR )
      {
         log_to_file( "connect failed with error: %d\n", WSAGetLastError() );
      }
      return nReturn;
   }

   return orig_connect( s, name, namelen );
}


I did that in notepad so theres bound to be a typo or something. So adjust any errors as needed.
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
ErrorMaker
Newbie cheater
Reputation: 0

Joined: 25 Jun 2010
Posts: 21
PostPosted: Mon Jul 12, 2010 6:26 pm    Post subject: Reply with quote
Thanks Wiccaan for the help Wink

My Source is now:
Code:
int WINAPI my_connect(SOCKET s, const struct sockaddr *name, int namelen)
{
   sockaddr_in *inName = (sockaddr_in *)(name);
   char* ip = inet_ntoa(inName->sin_addr);
   u_short port = ntohs(inName->sin_port);
   log_to_file("%s%s%s%i\n","Connect to: ",ip,":",port);

   // Check IP
   if (inName->sin_addr.s_addr == inet_addr("95.170.72.144"))
   {
      // Check Port
      if (inName->sin_port == htons(80))
      {
         inName->sin_family = AF_INET;
         inName->sin_addr.s_addr = inet_addr("127.0.0.1");
         inName->sin_port = htons(80);
         ip = inet_ntoa(inName->sin_addr);
         port = ntohs(inName->sin_port);
         log_to_file("%s%s%s%i\n","Redirect to: ",ip,":",port);

         //connect to the server
         int iResult = orig_connect(s, (struct sockaddr*)&inName, namelen);
         //int iResult = orig_connect(s, name, namelen); <- this works
         
         if(iResult == SOCKET_ERROR)
         {
            int iError = WSAGetLastError();
            //check if error was WSAEWOULDBLOCK, where we'll wait
            if(iError == WSAEWOULDBLOCK)
            {
               log_to_file("%s\n","Attempting to connect.");
               fd_set Write, Err;
               TIMEVAL Timeout;
               int TimeoutSec = 10; // timeout after 10 seconds

               FD_ZERO(&Write);
               FD_ZERO(&Err);
               FD_SET(s, &Write);
               FD_SET(s, &Err);

               Timeout.tv_sec = TimeoutSec;
               Timeout.tv_usec = 0;

               iResult = select(0,         //ignored
                            NULL,      //read
                            &Write,   //Write Check
                            &Err,      //Error Check
                            &Timeout);
               if(iResult == 0)
               {
                  log_to_file("%s%d%s\n","Connect Timeout (",TimeoutSec," Sec).");
                  system("pause");
                  return 1;
                  
               }
               else
               {
                  if(FD_ISSET(s, &Write))
                  {
                     log_to_file("%s\n","Connected!");
                  }
                  if(FD_ISSET(s, &Err))
                  {
                     log_to_file("%s\n","Select error.");
                     system("pause");
                     return 1;
                  }
               }
            }
            else
            {
               log_to_file("%s\n","Failed to connect to server.");
               log_to_file("%s%d\n","Error: ",WSAGetLastError());
               log_to_file("%s%d\n","Error: ",iResult);
               log_to_file("%s%d\n","Error: ",iError);
               WSACleanup();
               system("pause");
               return 1;
            }
         }
         else
         {
            //connected without waiting (will never execute)
            log_to_file("%s\n","Connected!");
         }
      }
      else
      {
         // Wrong Port
         return orig_connect(s, name, namelen);
      }
   }
   // Wrong IP
   else
   { 
      return orig_connect(s, name, namelen);
   }
}


A cmd popups when i try to connect to that IP (95.170.72.144) -> system("pause"); -> after closing cmd, IE cannot connect to the site.

Output file:
Quote:
Connect to: 95.170.72.144:80
Redirect to: 127.0.0.1:80
Failed to connect to server.
Error: 183
Error: -1
Error: 10047


Error 183 has something todo with "Cannot create a file when that file already exists." -> it has a problem with one of the log_to_file calls (I think I can ignore that)

Quote:
WSAEAFNOSUPPORT
(10047)
Address family not supported by protocol family.
An address incompatible with the requested protocol was used. All sockets are created with an associated address family (that is, AF_INET for Internet Protocols) and a generic protocol type (that is, SOCK_STREAM). This error is returned if an incorrect protocol is explicitly requested in the socket call, or if an address of the wrong family is used for a socket, for example, in sendto


- I've tried to use my intern IP instead of the localhost, same result.
- I've tried to redirect the incoming IP & Port to the same IP & Port (using namelen for the size -> same result, so I dont think it has something to do with the size.

I think it has to do with my customer connect function, cause if I call the original connect function in my_connect it works fine Confused
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 205

Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
PostPosted: Tue Jul 13, 2010 4:46 am    Post subject: Reply with quote
If calling the original works fine then there is something wrong with your parameters. Are you properly setting up the connection structure? Meaning does the application expect you to use AF_INET?

Also are you proxying the connecting to a server you made on your machine? If so is that setup properly to accept the connection and on the proper protocol?
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
ErrorMaker
Newbie cheater
Reputation: 0

Joined: 25 Jun 2010
Posts: 21
PostPosted: Tue Jul 13, 2010 11:18 am    Post subject: Reply with quote
I dont think there's something wrong with this connection structure Confused

Code:
int WINAPI my_connect(SOCKET s, const struct sockaddr *name, int namelen)
{
   sockaddr_in *inName = (sockaddr_in *)(name);
   inName->sin_family = AF_INET;
   inName->sin_addr.s_addr = inet_addr("127.0.0.1");
   inName->sin_port = htons(80);


I can remove "inName->sin_family = AF_INET;" but I get the same error.

I've tried both, proxying the connection to a server on my machine and proxying the connection to a remote server.

When I proxying the connection to a server on my machine, I use VB6 to hook the connection -> my VB6 program uses a socket with the protocol "sckTCPProtocol" and is listening on my machine @ port 80 for incoming connections.

There must be something wrong with the parameters. Maybe something with AF_INET:
Code:
inName->sin_family = AF_INET;


Because if I proxying the connection to the same IP and Port as IE wants to connect to and I'm using the original parameters:
Code:
orig_connect(s, name, namelen);

it works fine. But if I'm using the custom parameters:
Code:
orig_connect(s, (struct sockaddr*)&inName, namelen);

It gives my the 10047 error.
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 205

Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
PostPosted: Tue Jul 13, 2010 1:10 pm    Post subject: Reply with quote
You're passing namelen instead of the length of the new connection structure.
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
ErrorMaker
Newbie cheater
Reputation: 0

Joined: 25 Jun 2010
Posts: 21
PostPosted: Tue Jul 13, 2010 10:50 pm    Post subject: Reply with quote
Ok I finally got it working now (thanks for the great help) Very Happy

My DLL can now redirect IP's from a textfile.

Example textfile:
Quote:
217.164.278.12:80->127.0.0.1:80
264.143.244.210:80->127.0.0.1:80


For each line 1 Redirection.

It works fine on IE and Firefox. But Winject cant inject my DLL into Google Chrome. Does someone know if its possible to inject DLL's with Winject & DLL created with Detours 2.1?

EDIT: I'm able to inject the DLL into Google Chrome with a VB6 Injector Wink
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 205

Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
PostPosted: Wed Jul 14, 2010 2:00 am    Post subject: Reply with quote
Yes it is possible to do so. Glad to hear it's working out now.

As for Winject failing to inject into Chrome, could be one of many reasons. Does it give any specific error when it fails to inject? I'm not sure if Chrome has any anti-injection techniques installed to prevent malicious things, I personally never used it.
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
hcavolsdsadgadsg
I'm a spammer
Reputation: 26

Joined: 11 Jun 2007
Posts: 5801
PostPosted: Wed Jul 14, 2010 5:33 am    Post subject: Reply with quote
I don't see why chrome would do anything to prevent it, though it does spawn a new process for every tab you have open. If you kill that process, you'll get greeted with a lovely message in your browser telling you your poor tab is a goner for whatever reason.

Pretty nice because if something horrific manages to happen in one tab, it doesn't bother the rest of the browser.
Back to top
View user's profile Send private message
ErrorMaker
Newbie cheater
Reputation: 0

Joined: 25 Jun 2010
Posts: 21
PostPosted: Wed Jul 14, 2010 6:03 pm    Post subject: Reply with quote
@Wiccaan: Winject just gives me the follow error: "Both injection-methods failed! (RemoteLoadLibray and DetourInjecting) ConnectDLL.dll -> chrome.exe Target is protected? err:0"
But never mind, I can inject my DLL with an VB6 Injector.

@slovach: Yea thats a really nice function of chrome Smile

I'm currently trying to inject my DLL with the AppInit_DLLs method.
I've insert the path to my DLL into the registrykey ("Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs") and changed the registrykey ("Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs") to value "1". But it doesn't load my DLL if I start for example IE Confused

Does someone have an idea what I'm doing wrong?
I'm working on a Windows 7 Ultimate X86 machine (I've heard that Microsoft Detours sometimes doesn't work on X64 machines).
Back to top
View user's profile Send private message
4PR28U
How do I cheat?
Reputation: 0

Joined: 27 Jun 2010
Posts: 9
PostPosted: Thu Jul 15, 2010 2:11 pm    Post subject: Reply with quote
@ ErrorMaker
can u post your source here please I need it! I searched the whole web for something like you do...
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Goto page Previous  1, 2, 3, 4  Next
Page 2 of 4

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites