c++ - Detour on winsock recv doesn't return anything -


i injected dll server because needed block bad packets server isn't discarding.

snippet code:

#pragma comment(lib, "detours.lib") #pragma comment(lib, "ws2_32.lib") #pragma comment(lib, "mswsock.lib")  (...)  int (winapi *precv)(socket s, char* buf, int len, int flags) = recv; int winapi myrecv(socket s, char* buf, int len, int flags);  (...)  allocconsole(); freopen("conout$", "w", stdout);  detourtransactionbegin(); detourupdatethread(getcurrentthread()); detourattach(&(pvoid&)precv, myrecv); if(detourtransactioncommit() == no_error)     cout << "[" << myrecv << "] detoured." << endl; 

and testing purposes i'm printing data out.

int winapi myrecv(socket s, char* buf, int len, int flags) {      cout << "[ recv " << len << " ] ";     ( int = 0; < len; i++ )      {          printf( "%02x ", unsigned char (buf[i]) );     }     printf( "\n" );      return precv(s, buf, len, flags);  } 

now hooked , displays [ address ] detoured..
guess hooked , working.

now go client , start sending packets.
example log in, sends packet server.
, successful in logging in server should've recieved packet have sent.

now check console hooked server , nothing gets printed.
odd, tried hooking wpe_pro on server , started communicating client again. found out wpe can't log packets.

how possible? why happening?

i'm trying build packet logger/filter on server keep bad packets out.
hackers using packets crash our servers.

info on application i'm trying hook:

it works relay server. receives info client sends right server inside internal network.  client <-> `application` <-> servers i'm trying hook application . 

update

tried setting breakpoint on recv(), wsarecv() function , doesn't break.

address  ordinal name                        library  -------  ------- ----                        -------  004121a8 23      socket                      ws2_32   004121a4 20      sendto                      ws2_32   004121e8 3       closesocket                 ws2_32   0041219c 9       htons                       ws2_32   004121a0 17      recvfrom                    ws2_32   004121e4 111     wsagetlasterror             ws2_32   004121e0 115     wsastartup                  ws2_32   004121dc 11      inet_addr                   ws2_32   004121d8         wsaioctl                    ws2_32   004121d4         wsaconnect                  ws2_32   004121d0 22      shutdown                    ws2_32   004121cc 12      inet_ntoa                   ws2_32   004121c8 2       bind                        ws2_32   004121c4 8       htonl                       ws2_32   004121b4 16      recv                        ws2_32   004121bc         wsasocketa                  ws2_32   004121b8 19      send                        ws2_32   004121b0         wsaaccept                   ws2_32   004121ac 13      listen                      ws2_32   004121c0 21      setsockopt                  ws2_32   

only these dll being imported, when checked pe:

pdh.dll ws2_32.dll kernel32.dll user32.dll gdi32.dll winmm.dll 

update

just test if code works, hooked dll client , yes packets got logged/printed. confirms code works. hmmmm.


update

also tried detour ff.

int ( winapi *psend )( socket s, const char *buf, int len, int flags ) = send; int ( winapi *precv )( socket s, char *buf, int len, int flags ) = recv; int ( winapi *precvfrom )( socket s, char *buf, int len, int flags, sockaddr *from, int *fromlen ) = recvfrom; int ( winapi *pwsarecvex )( socket s, char *buf, int len, int *flags ) = wsarecvex; 

and still nothing.


update

so used wireshark , saw packets passing through.
i've been debugging program day setting breakpoints on winsock calls , still got nothing.


Comments

Popular posts from this blog

linux - xterm copying to CLIPBOARD using copy-selection causes automatic updating of CLIPBOARD upon mouse selection -

c++ - qgraphicsview horizontal scrolling always has a vertical delta -