Как я посидел и посмотрел, там куча хлама который не нужен, хуков процедур как таковы нету кроме AddNetworkQueue, я так понимаю тут перехват пакета идет?
Еще нашел bool SetHooks(void)
Жаль нет коментов к коду(
Не понял еще зачем ето?
unsigned int GetSendPacketAddress(void)
{
HMODULE hEngine = LoadLibraryA("engine.dll");
unsigned int startVMT = (unsigned int) hEngine + 0x51F658;
unsigned int AddNetworkQueue = (unsigned int) GetProcAddress(hEngine, "?AddNetworkQueue@UNetworkHandler@@UAEHPAUNetworkPa cket@@@Z");
unsigned int currVMT = startVMT;
if (AddNetworkQueue == 0)
{
return 0;
}
while (true)
{
if (*(unsigned int*) currVMT == AddNetworkQueue)
{
return *(unsigned int*) (currVMT - 0xA4);
}
currVMT++;
if (currVMT - startVMT > 10000)
{
return 0;
}
}
return 0;
}
И что это за дрянь?
typedef struct _IDENTIFY_DATA
{
USHORT GeneralConfiguration;
USHORT NumberOfCylinders;
USHORT Reserved1;
USHORT NumberOfHeads;
USHORT UnformattedBytesPerTrack;
USHORT UnformattedBytesPerSector;
USHORT SectorsPerTrack;
USHORT VendorUnique1[3];
USHORT SerialNumber[10];
USHORT BufferType;
USHORT BufferSectorSize;
USHORT NumberOfEccBytes;
USHORT FirmwareRevision[4];
USHORT ModelNumber[20];
UCHAR MaximumBlockTransfer;
UCHAR VendorUnique2;
USHORT DoubleWordIo;
USHORT Capabilities;
USHORT Reserved2;
UCHAR VendorUnique3;
UCHAR PioCycleTimingMode;
UCHAR VendorUnique4;
UCHAR DmaCycleTimingMode;
USHORT TranslationFieldsValid:1;
USHORT Reserved3:15;
USHORT NumberOfCurrentCylinders;
USHORT NumberOfCurrentHeads;
USHORT CurrentSectorsPerTrack;
ULONG CurrentSectorCapacity;
USHORT CurrentMultiSectorSetting;
ULONG UserAddressableSectors;
USHORT SingleWordDMASupport : 8;
USHORT SingleWordDMAActive : 8;
USHORT MultiWordDMASupport : 8;
USHORT MultiWordDMAActive : 8;
USHORT AdvancedPIOModes : 8;
USHORT Reserved4 : 8;
USHORT MinimumMWXferCycleTime;
USHORT RecommendedMWXferCycleTime;
USHORT MinimumPIOCycleTime;
USHORT MinimumPIOCycleTimeIORDY;
USHORT Reserved5[2];
USHORT ReleaseTimeOverlapped;
USHORT ReleaseTimeServiceCommand;
USHORT MajorRevision;
USHORT MinorRevision;
USHORT Reserved6[50];
USHORT SpecialFunctionsEnabled;
USHORT Reserved7[128];
} IDENTIFY_DATA, *PIDENTIFY_DATA;
Пример то замечательный,но очень трудно его вкурить для начала.
Добавлено через 2 часа 5 минут
Не знаю, будет ли пахать у меня такой код:
еще не поставил билдера под сишку(скачивает) а хочу спросить уже))
#include <winsock2.h>
#include <windows.h>
#include <iphlpapi.h>
#include <stdio.h>
#include <time.h>
#include <tlhelp32.h>
#include <psapi.h>
#include <icmpapi.h>
#include <io.h>
#include "hook.h"
#include "blowfish.h"
#include "resource.h"
#include "Obfuscator.h"
#include "stdafx.h"
#include "ThemidaSDK.h"
#include "splash.h"
#pragma comment(lib, "User32.lib")
#pragma comment(lib, "ws2_32.lib")
#pragma comment(lib, "iphlpapi.lib")
#pragma comment(lib, "psapi.lib")
struct TNetworkPacket
{
unsigned char id, p1;
unsigned short int subid, size, p2;
unsigned char *data;
};
#pragma pack(1)
typedef struct _IDENTIFY_DATA
{
USHORT GeneralConfiguration;
USHORT NumberOfCylinders;
USHORT Reserved1;
USHORT NumberOfHeads;
USHORT UnformattedBytesPerTrack;
USHORT UnformattedBytesPerSector;
USHORT SectorsPerTrack;
USHORT VendorUnique1[3];
USHORT SerialNumber[10];
USHORT BufferType;
USHORT BufferSectorSize;
USHORT NumberOfEccBytes;
USHORT FirmwareRevision[4];
USHORT ModelNumber[20];
UCHAR MaximumBlockTransfer;
UCHAR VendorUnique2;
USHORT DoubleWordIo;
USHORT Capabilities;
USHORT Reserved2;
UCHAR VendorUnique3;
UCHAR PioCycleTimingMode;
UCHAR VendorUnique4;
UCHAR DmaCycleTimingMode;
USHORT TranslationFieldsValid:1;
USHORT Reserved3:15;
USHORT NumberOfCurrentCylinders;
USHORT NumberOfCurrentHeads;
USHORT CurrentSectorsPerTrack;
ULONG CurrentSectorCapacity;
USHORT CurrentMultiSectorSetting;
ULONG UserAddressableSectors;
USHORT SingleWordDMASupport : 8;
USHORT SingleWordDMAActive : 8;
USHORT MultiWordDMASupport : 8;
USHORT MultiWordDMAActive : 8;
USHORT AdvancedPIOModes : 8;
USHORT Reserved4 : 8;
USHORT MinimumMWXferCycleTime;
USHORT RecommendedMWXferCycleTime;
USHORT MinimumPIOCycleTime;
USHORT MinimumPIOCycleTimeIORDY;
USHORT Reserved5[2];
USHORT ReleaseTimeOverlapped;
USHORT ReleaseTimeServiceCommand;
USHORT MajorRevision;
USHORT MinorRevision;
USHORT Reserved6[50];
USHORT SpecialFunctionsEnabled;
USHORT Reserved7[128];
} IDENTIFY_DATA, *PIDENTIFY_DATA;
#pragma pack()
typedef int (__fastcall *_AddNetworkQueue) (unsigned int This, unsigned int EDX, TNetworkPacket *NetworkPacket);
_AddNetworkQueue true_AddNetworkQueue;
typedef void (__cdecl *_SendPacket) (unsigned int This, char *Format, ...);
_SendPacket true_SendPacket;
HWND hWND;
unsigned int hEngineStart, hEngineEnd, mainThread, lastPing = 0, KiUserExceptDispADR, hNtDllStart, hNtDllEnd;
HANDLE ghMutex;
int __fastcall new_AddNetworkQueue(unsigned int This, unsigned int EDX, TNetworkPacket *NetworkPacket)
{
return true_AddNetworkQueue(This, EDX, NetworkPacket);
}
void __cdecl new_SendPacket(unsigned int This, char *Format, ...)
{
unsigned char buf[10240];
int size = 0, len;
wchar_t *wstr;
va_list args;
va_start(args, Format);
while (*Format != 0)
{
switch (*Format)
{
case 'c':
*(unsigned char*) (buf + size) = va_arg(args, unsigned char);
size++;
break;
case 'h':
*(unsigned short int*) (buf + size) = va_arg(args, unsigned short int);
size += 2;
break;
case 'd':
*(unsigned int*) (buf + size) = va_arg(args, unsigned int);
size += 4;
break;
case 'Q':
*(unsigned __int64*) (buf + size) = va_arg(args, unsigned __int64);
size += 8;
break;
case 'b':
len = va_arg(args, unsigned int);
memcpy(buf + size, va_arg(args, void*), len);
size += len;
break;
case 'S':
wstr = va_arg(args, wchar_t*);
if (wstr == 0)
{
len = 2;
*(unsigned short int*) (buf + size) = 0;
}
else
{
len = wcslen(wstr) * 2 + 2;
memcpy(buf + size, wstr, len);
}
size += len;
break;
}
Format++;
}
va_end(args);
true_SendPacket(This, "b", size, (int)buf);
}
unsigned int GetSendPacketAddress(void)
{
HMODULE hEngine = LoadLibraryA("engine.dll");
unsigned int startVMT = (unsigned int) hEngine + 0x51F658;
unsigned int AddNetworkQueue = (unsigned int) GetProcAddress(hEngine, "?AddNetworkQueue@UNetworkHandler@@UAEHPAUNetworkPa cket@@@Z");
unsigned int currVMT = startVMT;
if (AddNetworkQueue == 0)
{
return 0;
}
while (true)
{
if (*(unsigned int*) currVMT == AddNetworkQueue)
{
return *(unsigned int*) (currVMT - 0xA4);
}
currVMT++;
if (currVMT - startVMT > 10000)
{
return 0;
}
}
return 0;
}
bool SetHooks(void)
{
FARPROC addr;
HMODULE hEngine = LoadLibraryA("engine.dll"), hNtDlll = LoadLibraryA("ntdll.dll");
MODULEINFO modinfo;
GetModuleInformation(GetCurrentProcess(), hEngine, &modinfo, sizeof(MODULEINFO));
hEngineStart = (unsigned int) hEngine;
hEngineEnd = hEngineStart + modinfo.SizeOfImage - 1;
GetModuleInformation(GetCurrentProcess(), hNtDlll, &modinfo, sizeof(MODULEINFO));
hNtDllStart = (unsigned int) hNtDlll;
hNtDllEnd = hNtDllStart + modinfo.SizeOfImage - 1;
if ((KiUserExceptDispADR = (unsigned int) GetProcAddress(LoadLibraryA("ntdll.dll"), "KiUserExceptionDispatcher")) == 0)
return false;
if (*(unsigned char*) (KiUserExceptDispADR) == 0xFC)
KiUserExceptDispADR++;
if ((addr = GetProcAddress(hEngine, "?AddNetworkQueue@UNetworkHandler@@UAEHPAUNetworkPa cket@@@Z")) == 0)
return false;
true_AddNetworkQueue = (_AddNetworkQueue) splice((unsigned char*) addr, new_AddNetworkQueue);
if ((addr = (FARPROC) GetSendPacketAddress()) == 0)
return false;
true_SendPacket = (_SendPacket) splice((unsigned char*) addr, new_SendPacket);
return true;
}
LRESULT CALLBACK WndProc(HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
return DefWindowProc(hWnd, uMsg, wParam, lParam);
}
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
if (fdwReason == DLL_PROCESS_ATTACH)
{
DisableThreadLibraryCalls(hinstDLL);
if (!SetHooks())
{
Sleep(INFINITE);
}
}
return true;
}