冰楓論壇

標題: TWMS 201 Hook Recv Packet [打印本頁]

---

作者: 祤痕    時間: 2017-10-6 20:10
標題: TWMS 201 Hook Recv Packet

1. [ENABLE]
   
2. // TWMS 201 Hook Recv Packet
   
3. // Author : t4si
   
4. // Blog : https://blog.tasi.tw
   
5. Alloc(InterlockedIncrementHook, 256)
   
6. Label(HookESP)
   
7. Alloc(HookRecv, 512)
   
8. Label(GetPacket)
   
9. Label(Lab1)
   
10. Label(Lab2)
    
11. RegisterSymbol(HookRecv)
    
12. RegisterSymbol(pPacket)
    
13. RegisterSymbol(nPcket)
    
14. Alloc(pPacket, 4)
    
15. Alloc(nPcket, 4)
    
16. 
    
17. InterlockedIncrementHook:
    
18. cmp [esp], 006AA7D7
    
19. je HookESP
    
20. cmp [esp], 006AA7EE
    
21. je HookESP
    
22. cmp [esp], 006AA7FD
    
23. je HookESP
    
24. jmp InterlockedIncrement
    
25. HookESP:
    
26. Mov [Esp+1C],HookRecv
    
27. jmp InterlockedIncrement
    
28. 
    
29. 
    
30. HookRecv:
    
31. mov [ebp-28],eax
    
32. push 00
    
33. mov ecx,[ebp-24]
    
34. call 00B33BE0
    
35. test eax,eax
    
36. je Lab1
    
37. mov ecx,[ebp-14]
    
38. add ecx,40
    
39. call 00B34C80
    
40. Lab1:
    
41. cmp dword ptr [ebp-28],00
    
42. jle Lab2
    
43. cmp dword ptr [ebp-2C],00
    
44. jg Lab2
    
45. mov eax,[ebp-14]
    
46. mov ecx,[eax+00000090]
    
47. push ecx
    
48. mov ecx,[ebp-14]
    
49. add ecx,68
    
50. call 00B34650
    
51. movzx edx,ax
    
52. cmp edx,0000FF36
    
53. je Lab3
    
54. jmp 00B2F78A // Skip
    
55. Lab3: // 00B2F799
    
56. mov ecx,[ebp-14]
    
57. add ecx,68
    
58. call 00B347B0
    
59. cmp eax,00040000
    
60. jna Lab2
    
61. jmp 00B2F7AB // Skip
    
62. Lab2: // 00B2F7B7
    
63. cmp dword ptr [ebp-28],02
    
64. jne 00B2F823 // back Loop
    
65. mov eax,[ebp-14]
    
66. add eax,68
    
67. push eax
    
68. lea ecx,[ebp-48]
    
69. call 006AA570   // CInPacket::CInPacket
    
70. mov [ebp-04],00000000
    
71. mov ecx,[ebp-18]
    
72. push ecx
    
73. mov edx,[ebp-14]
    
74. mov eax,[edx+00000090]
    
75. push eax
    
76. lea ecx,[ebp-48]
    
77. call 006AA820 // CInPacket::DecryptData
    
78. lea ecx,[ebp-48]
    
79. call GetPacket
    
80. jmp 00B2F7E9 // Skipped
    
81. 
    
82. GetPacket:
    
83. push esi
    
84. mov esi, [ecx+8]
    
85. add esi, 4 // packet data
    
86. mov [pPacket], esi
    
87. mov esi, [ecx+c]
    
88. sub esi, 4
    
89. mov [nPcket], esi
    
90. pop esi
    
91. jmp 00B2F7E9
    
92. 
    
93. 02A0B158:
    
94. DD InterlockedIncrementHook
    
95. [DISABLE]
    
96. 02A0B158:
    
97. DD InterlockedIncrement
    
98. Dealloc(InterlockedIncrementHook)
    
99. Dealloc(HookRecv)
    
100. Dealloc(pPacket)
     
101. Dealloc(nPacket)

複製代碼

Screenshot :

---

作者: cool8892187    時間: 2017-10-6 20:23
請問這個的功能是?

---

作者: 匿名    時間: 2017-10-6 20:36

cool8892187 發表於 2017-10-6 20:23
請問這個的功能是?

收封包

---

作者: tusbasa002    時間: 2017-10-12 17:32
請問樓主有收包那有發包的嗎?

---

作者: 7802398    時間: 2017-10-12 20:37
丟ce使用嗎@@?
能用在私服嗎xDDD????
雖然我不會修封包....

---

作者: prt    時間: 2017-10-19 10:32
大大
[ENABLE]
// TwMS 202.1 Hook Recv Packet
// Author : t4si
// Blog : https://blog.tasi.tw
Alloc(InterlockedIncrementHook, 256)
Label(HookESP)
Alloc(HookRecv, 512)
Label(GetPacket)
Label(Lab1)
Label(Lab2)
RegisterSymbol(HookRecv)
RegisterSymbol(pPacket)
RegisterSymbol(nPcket)
Alloc(pPacket, 4)
Alloc(nPcket, 4)

InterlockedIncrementHook:
cmp [esp], 006AA957
je HookESP
cmp [esp], 006AA96E
je HookESP
cmp [esp], 006AA97D
je HookESP
jmp InterlockedIncrement
HookESP:
Mov [Esp+1C],HookRecv
jmp InterlockedIncrement


HookRecv:
mov [ebp-28],eax
push 00
mov ecx,[ebp-24]
call 00B33520
test eax,eax
je Lab1
mov ecx,[ebp-14]
add ecx,40
call 00B345F0
Lab1:
cmp dword ptr [ebp-28],00
jle Lab2
cmp dword ptr [ebp-2C],00
jg Lab2
mov eax,[ebp-14]
mov ecx,[eax+00000090]
push ecx
mov ecx,[ebp-14]
add ecx,68
call 00B33F90
movzx edx,ax
cmp edx,0000FF35
je Lab3
jmp 00B2F0DA // Skip
Lab3: // 00B2F0E9
mov ecx,[ebp-14]
add ecx,68
call 00B340F0
cmp eax,00040000
jna Lab2
jmp 00B2F0FB // Skip
Lab2: // 00B2F107
cmp dword ptr [ebp-28],02
jne 00B2F173 // back Loop
mov eax,[ebp-14]
add eax,68
push eax
lea ecx,[ebp-48]
call 006AA570   // CInPacket::CInPacket
mov [ebp-04],00000000
mov ecx,[ebp-18]
push ecx
mov edx,[ebp-14]
mov eax,[edx+00000090]
push eax
lea ecx,[ebp-48]
call 006AA9A0 // CInPacket:ecryptData
lea ecx,[ebp-48]
call GetPacket
jmp 00B2F139 // Skipped

GetPacket:
push esi
mov esi, [ecx+8]
add esi, 4 // packet data
mov [pPacket], esi
mov esi, [ecx+c]
sub esi, 4
mov [nPcket], esi
pop esi
jmp 00B2F139

02A0F158:
DD InterlockedIncrementHook
[DISABLE]
02A0F158:
DD InterlockedIncrement
Dealloc(InterlockedIncrementHook)
Dealloc(HookRecv)
Dealloc(pPacket)
Dealloc(nPacket) 我不確定我這樣更新隊ㄟ  我不道怎麼測是@@

---

歡迎光臨 冰楓論壇 (https://bingfong.com/)

Powered by 冰楓