Esempio n. 1
0
        public ReceiveHook()
        {
            var address = Helper.GetReceiveHookOffet();

            if (address == 0)
            {
                Console.WriteLine("Can't find Receive address!");
            }
            else
            {
                if (Environment.Is64BitProcess)
                {
                    instructionLength = 12;

                    originalInstruction = new byte[instructionLength];
                    hookInstruction     = new byte[instructionLength];

                    hookInstruction[0]  = 0x48;
                    hookInstruction[1]  = 0xB8;
                    hookInstruction[10] = 0xFF;
                    hookInstruction[11] = 0xE0;
                }
                else
                {
                    instructionLength = 5;

                    originalInstruction = new byte[instructionLength];
                    hookInstruction     = new byte[instructionLength];

                    hookInstruction[0] = 0xE9;
                }

                Console.Write("Initialize Receive hook at 0x{0:X8}... ", address);

                // Assign function pointers
                originalDelegate = Marshal.GetDelegateForFunctionPointer(new IntPtr(address + Memory.BaseAddress), typeof(ClientReceiveDummy)) as ClientReceiveDummy;
                originalFunction = Marshal.GetFunctionPointerForDelegate(originalDelegate);
                hookFunction     = Marshal.GetFunctionPointerForDelegate(hookDelegate);

                // Store original & hook instructions
                Buffer.BlockCopy(Memory.Read(originalFunction, instructionLength), 0, originalInstruction, 0, instructionLength);

                if (Environment.Is64BitProcess)
                {
                    Buffer.BlockCopy(BitConverter.GetBytes(hookFunction.ToInt64()), 0, hookInstruction, 2, 8);
                }
                else
                {
                    var hookOffset = hookFunction.ToInt64() - (originalFunction.ToInt64() + instructionLength);

                    Buffer.BlockCopy(BitConverter.GetBytes((uint)hookOffset), 0, hookInstruction, 1, 4);
                }

                Memory.Write(originalFunction, hookInstruction);

                Console.WriteLine("Receive hook successfully initialized!");
            }
        }
Esempio n. 2
0
        public ReceiveHook()
        {
            long address;

            if (Environment.Is64BitProcess)
            {
                instructionLength = 12;

                originalInstruction = new byte[instructionLength];
                hookInstruction = new byte[instructionLength];

                address = Globals.ReceiveAddresses[1];

                hookInstruction[0] = 0x48;
                hookInstruction[1] = 0xB8;
                hookInstruction[10] = 0xFF;
                hookInstruction[11] = 0xE0;
            }
            else
            {
                instructionLength = 5;

                originalInstruction = new byte[instructionLength];
                hookInstruction = new byte[instructionLength];

                address = Globals.ReceiveAddresses[0];

                hookInstruction[0] = 0xE9;
            }

            originalDelegate = Marshal.GetDelegateForFunctionPointer(new IntPtr(address + Memory.BaseAddress), typeof(ClientReceiveDummy)) as ClientReceiveDummy;

            Console.WriteLine("Initialize Receive hook...");

            // Assign function pointers
            originalFunction = Marshal.GetFunctionPointerForDelegate(originalDelegate);
            hookFunction = Marshal.GetFunctionPointerForDelegate(hookDelegate);

            // Store original & hook instructions
            Buffer.BlockCopy(Memory.Read(originalFunction, instructionLength), 0, originalInstruction, 0, instructionLength);

            if (Environment.Is64BitProcess)
                Buffer.BlockCopy(BitConverter.GetBytes(hookFunction.ToInt64()), 0, hookInstruction, 2, 8);
            else
            {
                var hookOffset = hookFunction.ToInt64() - (originalFunction.ToInt64() + instructionLength);

                Buffer.BlockCopy(BitConverter.GetBytes((uint)hookOffset), 0, hookInstruction, 1, 4);
            }

            Memory.Write(originalFunction, hookInstruction);

            Console.WriteLine("Receive hook successfully initialized");
        }