c++ - Detour on winsock recv doesn't return anything -
i injected dll server because needed block bad packets server isn't discarding.
snippet code:
#pragma comment(lib, "detours.lib") #pragma comment(lib, "ws2_32.lib") #pragma comment(lib, "mswsock.lib") (...) int (winapi *precv)(socket s, char* buf, int len, int flags) = recv; int winapi myrecv(socket s, char* buf, int len, int flags); (...) allocconsole(); freopen("conout$", "w", stdout); detourtransactionbegin(); detourupdatethread(getcurrentthread()); detourattach(&(pvoid&)precv, myrecv); if(detourtransactioncommit() == no_error) cout << "[" << myrecv << "] detoured." << endl;
and testing purposes i'm printing data out.
int winapi myrecv(socket s, char* buf, int len, int flags) { cout << "[ recv " << len << " ] "; ( int = 0; < len; i++ ) { printf( "%02x ", unsigned char (buf[i]) ); } printf( "\n" ); return precv(s, buf, len, flags); }
now hooked , displays [ address ] detoured.
.
guess hooked , working.
now go client , start sending packets.
example log in, sends packet server.
, successful in logging in server should've recieved packet have sent.
now check console hooked server
, nothing gets printed.
odd, tried hooking wpe_pro on server , started communicating client again. found out wpe can't log packets.
how possible? why happening?
i'm trying build packet logger/filter on server keep bad packets out.
hackers using packets crash our servers.
info on application i'm trying hook:
it works relay server. receives info client sends right server inside internal network. client <-> `application` <-> servers i'm trying hook application .
update
tried setting breakpoint on recv()
, wsarecv()
function , doesn't break.
address ordinal name library ------- ------- ---- ------- 004121a8 23 socket ws2_32 004121a4 20 sendto ws2_32 004121e8 3 closesocket ws2_32 0041219c 9 htons ws2_32 004121a0 17 recvfrom ws2_32 004121e4 111 wsagetlasterror ws2_32 004121e0 115 wsastartup ws2_32 004121dc 11 inet_addr ws2_32 004121d8 wsaioctl ws2_32 004121d4 wsaconnect ws2_32 004121d0 22 shutdown ws2_32 004121cc 12 inet_ntoa ws2_32 004121c8 2 bind ws2_32 004121c4 8 htonl ws2_32 004121b4 16 recv ws2_32 004121bc wsasocketa ws2_32 004121b8 19 send ws2_32 004121b0 wsaaccept ws2_32 004121ac 13 listen ws2_32 004121c0 21 setsockopt ws2_32
only these dll being imported, when checked pe:
pdh.dll ws2_32.dll kernel32.dll user32.dll gdi32.dll winmm.dll
update
just test if code works, hooked dll client , yes packets got logged/printed. confirms code works. hmmmm.
update
also tried detour ff.
int ( winapi *psend )( socket s, const char *buf, int len, int flags ) = send; int ( winapi *precv )( socket s, char *buf, int len, int flags ) = recv; int ( winapi *precvfrom )( socket s, char *buf, int len, int flags, sockaddr *from, int *fromlen ) = recvfrom; int ( winapi *pwsarecvex )( socket s, char *buf, int len, int *flags ) = wsarecvex;
and still nothing.
update
so used wireshark
, saw packets passing through.
i've been debugging program day setting breakpoints on winsock calls , still got nothing.
Comments
Post a Comment