C++ Detour on winsock recv hooking - custom packet

Question

I'm trying to add additional packet in MyRecv function, but I don't know why it doesn't working. I tried to parse incoming packets and function works fine. So probably my way to sending custom packet to application isn't properly.

In general assumption I just want send prepared packet to application. This packet i took from WPE PRO.

Code with MyRecv function:

INT WINAPI MyRecv(SOCKET sock, CHAR* buf, INT len, INT flags) {
  CHAR buffer[256];

  char msg2[] = { 0x1B, 0, 0x04, 0x06, 0, 0x5A, 0x65, 0x6E, 0x74, 0x61,
                  0x78, 0x06, 0, 0x5A, 0x65, 0x6E, 0x74, 0x61, 0x78, 0x05, 0x07, 0,
                  0x66, 0x61, 0x6A, 0x6E, 0x69, 0x65, 0x65 };

  int ret = precv(sock, buf, len, flags);
  if (ret <= 0) {
    return ret;
  }

  if (fake_recv) {
    char tmp[256];
    fake_recv = false;
    printf("Fake1-> Lenght:%d Size:%d", len, strlen(buf));
    strcat(buf, msg2);
    printf("Fake2-> Lenght:%d Size:%d", len, strlen(buf));
    return ret;
  }

  return ret;
}

score 0 · Accepted Answer · answered May 14 '15 at 04:30

msg2 isn't a null-terminated string. In fact it has an interior null. So using strlen() and strcat() with it is never going to work.

Similarly you neither know nor care what's already in buf, so calling strcat() and strlen() on that is both pointless and dangerous: if it contains no nulls at all you will over-run it, and at best over-report the length, and at worst crash.

And you're not adjusting ret for the extra data added into the buffer.

And no useful purpose is accomplished by declaring the unused tmp[] variable.

Try this:

if (fake_recv) {                                        
    fake_recv = false;
    printf("Fake1-> Length:%d Received:%d", len, ret);
    int len2 = min(len-ret, sizeof msg2);
    memcpy(&buf[ret], msg2, len2);
    ret += len2;
    printf("Fake2-> Length:%d Received:%d", len, ret);
    return ret;         
}

C++ Detour on winsock recv hooking - custom packet

1 Answers1