Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


[VB6] DLL Injection - ws2_32 Hook?
Goto page Previous  1, 2, 3, 4  Next
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
ErrorMaker
Newbie cheater
Reputation: 0

Joined: 25 Jun 2010
Posts: 21
PostPosted: Thu Jul 15, 2010 2:14 pm    Post subject: Reply with quote
4PR28U, what exactlly do you wanna do? Redirect one IP & Port to another? Redircect more than one IP & Port to another?
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 205

Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
PostPosted: Thu Jul 15, 2010 2:41 pm    Post subject: Reply with quote
ErrorMaker wrote:
@Wiccaan: Winject just gives me the follow error: "Both injection-methods failed! (RemoteLoadLibray and DetourInjecting) ConnectDLL.dll -> chrome.exe Target is protected? err:0"
But never mind, I can inject my DLL with an VB6 Injector.

@slovach: Yea thats a really nice function of chrome Smile

I'm currently trying to inject my DLL with the AppInit_DLLs method.
I've insert the path to my DLL into the registrykey ("Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs") and changed the registrykey ("Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs") to value "1". But it doesn't load my DLL if I start for example IE Confused

Does someone have an idea what I'm doing wrong?
I'm working on a Windows 7 Ultimate X86 machine (I've heard that Microsoft Detours sometimes doesn't work on X64 machines).


You're using a global hooking method which loads your DLL into every application. This is far from an ideal method of injection.

As for Winject failing, would be access issues. Try running it as Administrator or disable UAC if you haven't already.

Detours doesn't contain any of the x64 bit code in the public versions. You would have to pay in order to get the x64bit material. As for it working or not, I've personally never tested it on an x64 bit machine but it should work if the process is x86 bit process.
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
ErrorMaker
Newbie cheater
Reputation: 0

Joined: 25 Jun 2010
Posts: 21
PostPosted: Sat Jul 17, 2010 5:37 pm    Post subject: Reply with quote
Yea thats true, but i thought it would be ok, cause my DLL doesnt crash any processes. Whatever, I've now done it with inject the dll into each process of a application, and it works really well Wink

I've tried to run Winject as Administrator and I've disabled UAC a long time ago, but no success.

Alright thanks for the infos Very Happy

I'm now looking for a way to unject my DLL with VB6. Everything I find is about injecting a DLL but I wanna unject my DLL after :/
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 205

Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
PostPosted: Sat Jul 17, 2010 6:15 pm    Post subject: Reply with quote
ErrorMaker wrote:
Yea thats true, but i thought it would be ok, cause my DLL doesnt crash any processes. Whatever, I've now done it with inject the dll into each process of a application, and it works really well Wink

I've tried to run Winject as Administrator and I've disabled UAC a long time ago, but no success.

Alright thanks for the infos Very Happy

I'm now looking for a way to unject my DLL with VB6. Everything I find is about injecting a DLL but I wanna unject my DLL after :/


I would suggest coding your own loader rather then injecting into every process. If you plan to distribute the dll to others you run the risk of getting them banned or blocked on other applications or games based on your hooks.

As for uninjecting, the only "safe" way to uninject would be to export a function in your module that can be called to unhook then unload your DLL from the given process. Forcing it to unload through FreeLibrary and so on isn't the best of methods.
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
4PR28U
How do I cheat?
Reputation: 0

Joined: 27 Jun 2010
Posts: 9
PostPosted: Sun Jul 18, 2010 7:27 am    Post subject: Reply with quote
ErrorMaker wrote:
4PR28U, what exactlly do you wanna do? Redirect one IP & Port to another? Redircect more than one IP & Port to another?


I need to redirect one Connection (I have the ip and the port, that's no problem) over my programm so that I can modificate the packets wich are send by and to the server...
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 205

Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
PostPosted: Sun Jul 18, 2010 8:53 am    Post subject: Reply with quote
4PR28U wrote:
ErrorMaker wrote:
4PR28U, what exactlly do you wanna do? Redirect one IP & Port to another? Redircect more than one IP & Port to another?


I need to redirect one Connection (I have the ip and the port, that's no problem) over my programm so that I can modificate the packets wich are send by and to the server...


Are you looking to redirect the connection or just hook the packet flow?

If the packets aren't encrypted, just hook send/recv and you will have access to the packets. (You may need to hook sendto/recvfrom depending on the applications programming.)

If they are encrypted, try locating the encryption and decryption functions and hook those instead. So you can get the packets before they are encrypted, and after they are decrypted. Rather then attempting to implement the encryption methods and such yourself.
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
4PR28U
How do I cheat?
Reputation: 0

Joined: 27 Jun 2010
Posts: 9
PostPosted: Sun Jul 18, 2010 9:01 am    Post subject: Reply with quote
Wiccaan wrote:
4PR28U wrote:
ErrorMaker wrote:
4PR28U, what exactlly do you wanna do? Redirect one IP & Port to another? Redircect more than one IP & Port to another?


I need to redirect one Connection (I have the ip and the port, that's no problem) over my programm so that I can modificate the packets wich are send by and to the server...


Are you looking to redirect the connection or just hook the packet flow?

If the packets aren't encrypted, just hook send/recv and you will have access to the packets. (You may need to hook sendto/recvfrom depending on the applications programming.)

If they are encrypted, try locating the encryption and decryption functions and hook those instead. So you can get the packets before they are encrypted, and after they are decrypted. Rather then attempting to implement the encryption methods and such yourself.


They aren't encryptet and I know that I have to hook the send and recv function but I have no Idea how I do this! I tried some examples with detoured but it wont work... It were amazing for me If you can help me Smile
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 205

Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
PostPosted: Sun Jul 18, 2010 9:03 am    Post subject: Reply with quote
4PR28U wrote:
Wiccaan wrote:
4PR28U wrote:
ErrorMaker wrote:
4PR28U, what exactlly do you wanna do? Redirect one IP & Port to another? Redircect more than one IP & Port to another?


I need to redirect one Connection (I have the ip and the port, that's no problem) over my programm so that I can modificate the packets wich are send by and to the server...


Are you looking to redirect the connection or just hook the packet flow?

If the packets aren't encrypted, just hook send/recv and you will have access to the packets. (You may need to hook sendto/recvfrom depending on the applications programming.)

If they are encrypted, try locating the encryption and decryption functions and hook those instead. So you can get the packets before they are encrypted, and after they are decrypted. Rather then attempting to implement the encryption methods and such yourself.


They aren't encryptet and I know that I have to hook the send and recv function but I have no Idea how I do this! I tried some examples with detoured but it wont work... It were amazing for me If you can help me Smile


Which version of Detours are you using? 1.5 or 2.1?
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
4PR28U
How do I cheat?
Reputation: 0

Joined: 27 Jun 2010
Posts: 9
PostPosted: Sun Jul 18, 2010 10:29 am    Post subject: Reply with quote
detours 2.1 and VC++
Back to top
View user's profile Send private message
justa_dude
Grandmaster Cheater
Reputation: 23

Joined: 29 Jun 2010
Posts: 893
PostPosted: Sun Jul 18, 2010 10:48 am    Post subject: Reply with quote
As an alternative, you could create a stub dll to proxy socket calls. Just put it earlier in the DLL search path and you're golden.
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 205

Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
PostPosted: Sun Jul 18, 2010 12:29 pm    Post subject: Reply with quote
4PR28U wrote:
detours 2.1 and VC++


Here is a very small example for hooking send. I'll leave recv up to you and such. You will need to add whatever else you plan to do as well. I wrote this in notepad real quick so no guarantee there isn't a typo or two as well.

Code:

#pragma comment( lib, "WS2_32.lib" )
#include <winsock2.h>
#include <Windows.h>

// Change paths to where you have Detours installed
// or add them to your global directories.
#pragma comment( lib, "detours.lib" )
#include <detours.h>

// Add detoured.lib and .h as well if you did not modify
// your install of detours to remove them.

extern "C"
{
    int ( WINAPI* Real_send )( SOCKET, const char*, int, int ) = send;
}

int WINAPI Mine_send( SOCKET s, const char* buf, int len, int flags )
{
    // Here you can alter the packet before the original
    // send is called.
   
    return Real_send( s, buf, len, flags );
}

BOOL WINAPI DllMain( HMODULE hModule, DWORD dwReason, LPVOID lpReserved )
{
    switch( dwReason )
    {
    case DLL_PROCESS_ATTACH:
        DisableThreadLibraryCalls( hModule );
        DetourTransactionBegin();
        DetourUpdateThread( GetCurrentThread() );
        DetourAttach( &(PVOID&)Real_send, Mine_send );
        DetourTransactionCommit();
        break;
    case DLL_PROCESS_DETACH:
        DetourTransactionBegin();
        DetourUpdateThread( GetCurrentThread() );
        DetourDetach( &(PVOID&)Real_send, Mine_send );
        DetourTransactionCommit();
        break;
    }
    return TRUE;
}


Again, very straight-forward dll.

You will need to change the paths to your detours .lib and header files if you haven't added them to your global directories with the IDE. You will also need to add the 'detoured' header and lib to the project if you haven't modified your install of Detours to remove them.
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
ErrorMaker
Newbie cheater
Reputation: 0

Joined: 25 Jun 2010
Posts: 21
PostPosted: Sun Jul 18, 2010 1:12 pm    Post subject: Reply with quote
If you're going to use Detours 2.1, here's a short tutorial on using Detours 2.1 with Visual Studio 2008.

Quote:
1. Download and install "DetoursExpress.msi" from their page. The default folder is: "C:\Program Files\Microsoft Research\Detours Express 2.1"

2. Start -> Programs -> Microsoft Visual C++ 2008 Express Edition -> Visual Studio Tools -> Visual Studio 2008-Commandline

3. Type "cd C:\Program Files\Microsoft Research\Detours Express 2.1\src" -> Type "nmake"

4. Copy all files from C:\Program Files\Microsoft Research\Detours Express 2.1\lib to C:\Program Files\Microsoft Visual Studio 9.0\VC\lib

5. Copy all files from C:\Program Files\Microsoft Research\Detours Express 2.1\include -> C:\Program Files\Microsoft Visual Studio 9.0\VC\include

6. In your project add this to use Detours 2.1

#pragma comment(lib,"detoured.lib")
#pragma comment(lib,"detours.lib")
#include <detours.h>
#include <detoured.h>
Back to top
View user's profile Send private message
4PR28U
How do I cheat?
Reputation: 0

Joined: 27 Jun 2010
Posts: 9
PostPosted: Mon Jul 19, 2010 2:56 am    Post subject: Reply with quote
Thank you both Smile I will try and tell you if it works Smile

EDIT:\\ There are no typos... Thank you Smile no I go to hook the recv and modificate the packets!
Back to top
View user's profile Send private message
ErrorMaker
Newbie cheater
Reputation: 0

Joined: 25 Jun 2010
Posts: 21
PostPosted: Wed Jul 21, 2010 6:47 pm    Post subject: Reply with quote
@Wiccaan: My DLL Inject works fine with the browsers IE and Chrome, but not with Firefox. Do you know if Firefox uses another connect function than IE and Chrome?

Maybe the WSAConnect() function instead of the Connect() function?

I've tried to hook WSAConnect in Firefox, without a success.

The declaration for the original connect and my connect function is:
Code:
static int (WINAPI *orig_connect)(SOCKET s, const struct sockaddr *name, int namelen) = connect;

int WINAPI my_connect(SOCKET s, const struct sockaddr *name, int namelen);


So this should be the declaration for the original WSAConnect and my WSAConnect function:
Code:
static int (WINAPI *orig_wsaconnect)(SOCKET s, const struct sockaddr* name, int namelen, LPWSABUF lpCallerData, LPWSABUF lpCalleeData, LPQOS lpSQOS, LPQOS lpGQOS) = WSAConnect;

int WINAPI my_wsaconnect(SOCKET s, const struct sockaddr* name, int namelen, LPWSABUF lpCallerData, LPWSABUF lpCalleeData, LPQOS lpSQOS, LPQOS lpGQOS);


- Thanks in advance.
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 205

Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
PostPosted: Thu Jul 22, 2010 2:31 am    Post subject: Reply with quote
I'm assuming you are attempting to hack a flash game, so simple answer is no. I have no idea if Firefox uses anything different. I don't play or hack flash games.

As for your declarations, WSAConnect is defined as:
http://msdn.microsoft.com/en-us/library/ms741559%28VS.85%29.aspx
Code:
int WSAConnect(
  __in   SOCKET s,
  __in   const struct sockaddr *name,
  __in   int namelen,
  __in   LPWSABUF lpCallerData,
  __out  LPWSABUF lpCalleeData,
  __in   LPQOS lpSQOS,
  __in   LPQOS lpGQOS
);


With Detours 2.1 you would do:
Code:
extern "C"
{
    int ( WINAPI* Real_WSAConnect )( SOCKET, const struct sockaddr, int, LPWSABUF, LPWSABUF, LPQOS, LPQOS ) = WSAConnect;
}

int WINAPI Mine_WSAConnect( SOCKET s, const struct sockaddr *name, int namelen, LPWSABUF lpCallerData, LPWSABUF lpCalleeData, LPQOS lpSQOS, LPQOS lpGQOS )
{
    return Real_WSAConnect( s, name, namelen, lpCallerData, lpCalleeData, lpSQOS, lpGQOS );
}


Again, this is untested and done in notepad. So sorry if there are any typos.

Assuming you are hacking a flash game, the games will use whatever Flash specifically exports for the browser. Also if it is flash, Firefox does not (any more) directly link flash inside the browser, instead if sits inside a new process called plugin-container.exe
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Goto page Previous  1, 2, 3, 4  Next
Page 3 of 4

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites