Advertisement
Riremito

SendFormat

Nov 19th, 2014
520
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 2.89 KB | None | 0 0
  1. v334.0 JMS SendHook2
  2. ////////////////////////////////////////////////
  3. bool bCreatingPacket = false;
  4. char Buffer[1024*4];
  5. DWORD p;
  6.  
  7. void _stdcall StartHook(){
  8.     ZeroMemory(Buffer, 1024*4);
  9.     p = 0;
  10.     bCreatingPacket = true;
  11. }
  12.  
  13. void _stdcall ReadBYTE(BYTE b){
  14.     Air2::CreateFormatString(&Buffer[p], " %b", b);
  15.     p += 2 + 1;
  16. }
  17.  
  18. void _stdcall ReadWORD(WORD w){
  19.     if(!p){
  20.         Air2::CreateFormatString(&Buffer[p], "%w", w);
  21.         p += 4;
  22.     }
  23.     else{
  24.         Air2::CreateFormatString(&Buffer[p], " %w", w);
  25.         p += 4 + 1;
  26.     }
  27. }
  28.  
  29. void _stdcall ReadDWORD(DWORD d){
  30.     Air2::CreateFormatString(&Buffer[p], " %d", d);
  31.     p += 8 + 1;
  32. }
  33.  
  34. void _stdcall ReadString(char *s){
  35.     DWORD i;
  36.     for(i=0; s[i]; i++){}
  37.     Air2::CreateFormatString(&Buffer[p], " \"%s\"", s);
  38.     p += i + 2 + 1;
  39. }
  40.  
  41. void _stdcall ReadData(BYTE *Data, DWORD dwSize){
  42.     Air2::CreateFormatString(&Buffer[p], " %a", Data, dwSize);
  43.     p += dwSize*2 + 1;
  44. }
  45.  
  46. void _stdcall ReadQWORD(DWORD dw1, DWORD dw2){
  47.     Air2::CreateFormatString(&Buffer[p], " %q", dw1, dw2);
  48.     p += 16 + 1;
  49. }
  50.  
  51.  
  52. void _stdcall EndHook(){
  53.     bCreatingPacket = false;
  54. }
  55.  
  56.  
  57. DWORD WriteQWORD = 0x00528CC1;
  58.  
  59. void _declspec(naked) WriteQWORD_Hook(){
  60.     _asm{
  61.         pop edi
  62.         pop esi
  63.         push eax
  64.         mov eax,esp
  65.         pushad
  66.         push [eax+0x0C]
  67.         push [eax+0x08]
  68.         call ReadQWORD
  69.         popad
  70.         pop eax
  71.         ret 0x0008
  72.     }
  73. }
  74.  
  75. DWORD CreatePacket = 0x00AE9BDE;//jmp
  76.  
  77. void _declspec(naked) CreatePacket_Hook(){
  78.     _asm{
  79.         push esi
  80.         mov esi,[esp+0x08]
  81.         pushad
  82.         call StartHook
  83.         push esi
  84.         call ReadWORD
  85.         popad
  86.         pop esi
  87.         ret 0x0004
  88.     }
  89. }
  90.  
  91. DWORD WriteBYTE = 0x00499A46;//jmp
  92.  
  93. void _declspec(naked) WriteBYTE_Hook(){
  94.     _asm{
  95.         pop edi
  96.         pop esi
  97.         push eax
  98.         mov eax,[esp+0x08]
  99.         pushad
  100.         push eax
  101.         call ReadBYTE
  102.         popad
  103.         pop eax
  104.         ret 0x0004
  105.     }
  106. }
  107.  
  108. DWORD WriteWORD = 0x00499A9B;//jmp
  109.  
  110. void _declspec(naked) WriteWORD_Hook(){
  111.     _asm{
  112.         pop edi
  113.         pop esi
  114.         push eax
  115.         mov eax,[esp+0x08]
  116.         pushad
  117.         push eax
  118.         call ReadWORD
  119.         popad
  120.         pop eax
  121.         ret 0x0004
  122.     }
  123. }
  124.  
  125. DWORD WriteDWORD = 0x00491819;//jmp
  126.  
  127. void _declspec(naked) WriteDWORD_Hook(){
  128.     _asm{
  129.         pop edi
  130.         pop esi
  131.         push eax
  132.         mov eax,[esp+0x08]
  133.         pushad
  134.         push eax
  135.         call ReadDWORD
  136.         popad
  137.         pop eax
  138.         ret 0x0004
  139.     }
  140. }
  141.  
  142. DWORD WriteString = 0x00529BB7;//jmp
  143.  
  144. void _declspec(naked) WriteString_Hook(){
  145.     _asm{
  146.         add esp,0x10
  147.         push eax
  148.         mov eax,[esp+0x08]
  149.         pushad
  150.         push eax
  151.         call ReadString
  152.         popad
  153.         pop eax
  154.         ret 0x0004
  155.     }
  156. }
  157.  
  158. DWORD WriteData = 0x005986A5;//jmp
  159.  
  160. void _declspec(naked) WriteData_Hook(){
  161.     _asm{
  162.         pop esi
  163.         pop ebx
  164.         push eax
  165.         mov eax,esp
  166.         pushad
  167.         push [eax+0x0C]
  168.         push [eax+0x08]
  169.         call ReadData
  170.         popad
  171.         pop eax
  172.         ret 0x0008
  173.     }
  174. }
  175.  
  176. DWORD SentPacket = 0x01F08141;
  177. DWORD SentPacket_Ret = 0x01F08149;
  178.  
  179. void _declspec(naked) SentPacket_Hook(){
  180.     _asm{
  181.         pushad
  182.         call EndHook
  183.         popad
  184.         pushfd
  185.         mov dword ptr [esp],0xAE2D2DEA
  186.         jmp dword ptr [SentPacket_Ret]
  187.     }
  188. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement