0

Im trying to hook the send/recv functions from Ultima Online client usinf MS Detour. I've found a c++ dll/injector source out there, but it is not working. The dll is injected but the functions is not being hooked. When the injector start the client, the dll throw 3 box saying that it was injected and hooked both recv/send, but nothing happens when the client start the comminication

injector.cpp

#include <windows.h>
#include <detours.h>
#include <cstdio>

#pragma comment(lib,"detours.lib")

int main(int argc, char *argv[])
{
STARTUPINFO si;
PROCESS_INFORMATION pi;

ZeroMemory(&si, sizeof(si));
ZeroMemory(&pi, sizeof(pi));
si.cb = sizeof(si);
si.dwFlags = STARTF_USESHOWWINDOW;
si.wShowWindow = SW_SHOW;

if(!DetourCreateProcessWithDllEx("D:\\UO\\UO Game\\client.exe", 
                                    NULL, NULL, NULL, TRUE, 
                                    CREATE_DEFAULT_ERROR_MODE | CREATE_SUSPENDED,
                                    NULL, "D:\\UO\\UO Game\\", &si, &pi, 
                                    "C:\\Users\\Felipe\\Desktop\\mydll\\Debug\\mydll.dll", NULL))
    printf("Failed");
else
    printf("Success");

ResumeThread(pi.hThread);

//WaitForSingleObject(pi.hProcess, INFINITE);

//CloseHandle(&si);
//CloseHandle(&pi);

return EXIT_SUCCESS;
}

dll.cpp

#include <cstdio>
#include <windows.h>
#include <detours.h>

#pragma comment(lib,"detours.lib")
#pragma comment(lib,"ws2_32.lib")

int (WINAPI *pSend)(SOCKET s, const char* buf, int len, int flags) = send;
int WINAPI MySend(SOCKET s, const char* buf, int len, int flags);
int (WINAPI *pRecv)(SOCKET s, char* buf, int len, int flags) = recv;
int WINAPI MyRecv(SOCKET s, char* buf, int len, int flags);

FILE* pSendLogFile;
FILE* pRecvLogFile;

BOOL msg_once = false;

int WINAPI MySend(SOCKET s, const char* buf, int len, int flags)
{
MessageBoxA(0,"MyRecv",0,0);
return pSend(s, buf, len, flags);
}

int WINAPI MyRecv(SOCKET s, char* buf, int len, int flags)
{
MessageBoxA(0,"MyRecv",0,0);
return pRecv(s, buf, len, flags);
}

extern "C" __declspec(dllexport) void dummy(void){
return;
}

BOOL WINAPI DllMain(HINSTANCE hinst, DWORD dwReason, LPVOID reserved)
{
if (!msg_once)
{
    MessageBoxA(0,"loaded",0,0);
    msg_once = true;
}

if (DetourIsHelperProcess()) {
    return TRUE;
}

if (dwReason == DLL_PROCESS_ATTACH) {
    DetourRestoreAfterWith();

    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourAttach(&(PVOID&)pSend, MySend);
    if(DetourTransactionCommit() == NO_ERROR)
        MessageBox(0,"send() detoured successfully","asd",MB_OK);

    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourAttach(&(PVOID&)pRecv, MyRecv);
    if(DetourTransactionCommit() == NO_ERROR)
        MessageBox(0,"recv() detoured successfully","asd",MB_OK);
}
else if (dwReason == DLL_PROCESS_DETACH) {
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourDetach(&(PVOID&)pSend, MySend);
    DetourTransactionCommit();

    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourDetach(&(PVOID&)pRecv, MyRecv);
    DetourTransactionCommit();
}
return TRUE;
}
Feeh
  • 33
  • 1
  • 5
  • Does data get sent or received to/from the peer? – user207421 Sep 28 '13 at 01:16
  • 1
    Are you sure that `send`/`recv` are the right functions to hook? If you run it in a debugger without the detour and breakpoint those are they getting called? – Retired Ninja Sep 28 '13 at 02:30
  • RetiredNinja is right. The app being hooked might be calling `WSASend()`/`WSARecv()` instead, for instance. – Remy Lebeau Sep 28 '13 at 06:29
  • Yes the data get sent, the client can communicate with no problem depends.exe points to both send/recv.. I will try with WSASend and WSARecv, but Im sure that the app calls recv, send, connect, select, socket and closesocket (I just want send/recv) – Feeh Sep 28 '13 at 19:19
  • Just figured out how to properly hook just replaced: int (WINAPI *pSend)(SOCKET s, const char* buf, int len, int flags) = send; with: HMODULE hLib = LoadLibrary("wsock32.dll"); typedef int (WINAPI *SendPtr)(SOCKET s, const char* buf, int len, int flags); SendPtr pSend = (SendPtr)GetProcAddress(hLib, "send"); (same with recv) Anyway, thanks for the feedback – Feeh Sep 28 '13 at 21:00

0 Answers0