- UID
- 7067
- 帖子
- 2823
- 主題
- 67
- 精華
- 0
- 積分
- 225
- 楓幣
- 20085
- 威望
- 181
- 存款
- 19856
- 贊助金額
- 0
- 推廣
- 0
- GP
- 1671
- 閱讀權限
- 100
- 性別
- 保密
- 在線時間
- 870 小時
- 註冊時間
- 2012-3-23
- 最後登入
- 2024-11-2
|
本帖最後由 Doem 於 2015-7-10 20:19 編輯
- //TwMs V1.81.3 SendHook (Logger) [CRC]
- //Credit to AIRRIDE for Hook method
- [ENABLE]
- Label(Return)
- Alloc(SendHook,128)
- GlobalAlloc(Packets,4096)
- GlobalAlloc(PacketSize,04)
- GlobalAlloc(RetAddress,04)
- SendHook:
- DB 55 8B EC 6A FF
- PUSHAD
- MOV EAX,[EBP+08]
- PUSH [EBP+04]
- POP [RetAddress]
- PUSH [EAX+08]
- POP [PacketSize]
- MOV EAX,[EAX+04]
- MOV [Packets],EAX //[Packets] = Pointer of Packets
- POPAD
- JMP Return
- Return:
- JMP 00594049+5
- 00594049:
- JMP SendHook
- [DISABLE]
- 00594049:
- DB 55 8B EC 6A FF
- DeAlloc(SendHook)
- DeAlloc(RetAddress)
- DeAlloc(Packets)
- DeAlloc(PacketSize)
複製代碼 I just updated and rewrote it with foreign informations, not a author!
忘了說! 已確認過某些攔截到的是明碼, 但不保證全部都是明碼喔~ |
|