private static void ServerInstance_FunctionPointerEvent(int clientID, uint address, FunctionType functionType)
{
int clientIndex = GetClient(clientID);
ClientInfo ci;
if (ClientInfoCollection.GetClient(clientIndex, out ci))
{
switch (functionType)
{
case FunctionType.Receive:
ci.RecvFunctionPointer = (IntPtr)address;
ClientHook.InstallRecvHook(ci);
#if DEBUG
Log.LogMessage(clientID, "Recv function pointer = 0x" + address.ToString("X"));
#endif
break;
case FunctionType.Send:
ci.SendFunctionPointer = (IntPtr)address;
ClientHook.InstallSendHook(ci);
#if DEBUG
Log.LogMessage(clientID, "Send function pointer = 0x" + address.ToString("X"));
#endif
break;
}
}
}
public static void PrepareClientSendCave(ClientInfo ci)
{
byte[] cave = new byte[] {
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0x00, 0x00, 0x66, 0xA1, 0xFF, 0xFF, 0xFF, 0xFF,
0x66, 0x83, 0xF8, 0x00, 0x75, 0x06, 0x90, 0x90,
0x90, 0x90, 0x90, 0xC3, 0x66, 0x33, 0xC0, 0x66,
0xA3, 0xFF, 0xFF, 0xFF, 0xFF, 0x51, 0x52, 0x53,
0x54, 0x55, 0x56, 0x57, 0x8B, 0x2D, 0xFF, 0xFF,
0xFF, 0xFF, 0x8B, 0x3D, 0xFF, 0xFF, 0xFF, 0xFF,
0x55, 0x8B, 0x0D, 0xFF, 0xFF, 0xFF, 0xFF, 0x8B,
0xF1, 0xE8, 0xFF, 0xFF, 0xFF, 0xFF, 0x5F, 0x5E,
0x5D, 0x5C, 0x5B, 0x5A, 0x59, 0xC3
};
int caveAddress = ci.ClientSendCaveAddress.ToInt32();
byte[] bufferDword = BitConverter.GetBytes(caveAddress);
byte[] lenDword = BitConverter.GetBytes(caveAddress + 4);
byte[] startWord = BitConverter.GetBytes(caveAddress + 8);
byte[] packetRecvCALL = ClientHook.CreateCALL((IntPtr)(caveAddress + 65), ci.RecvHookAddress, CallType.CALL);
byte[] pathFindCaveCALL = ClientHook.CreateCALL(caveAddress + 22, ci.PathFindCaveAddress.ToInt32() + 8, CallType.CALL);
byte[] data = BitConverter.GetBytes(ci.ClientPacketData);
Buffer.BlockCopy(startWord, 0, cave, 12, 4);
Buffer.BlockCopy(pathFindCaveCALL, 0, cave, 22, 5);
Buffer.BlockCopy(startWord, 0, cave, 33, 4);
Buffer.BlockCopy(bufferDword, 0, cave, 46, 4);
Buffer.BlockCopy(lenDword, 0, cave, 52, 4);
Buffer.BlockCopy(data, 0, cave, 59, 4);
Buffer.BlockCopy(packetRecvCALL, 0, cave, 65, 5);
Memory.Write(ci.Handle, ci.ClientSendCaveAddress, cave, true);
}
public static void PrepareServerSendCave(ClientInfo ci)
{
byte[] cave = new byte[] {
0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x66, 0xA1,
0xFF, 0xFF, 0xFF, 0xFF, 0x66, 0x83, 0xF8, 0x00,
0x75, 0x06, 0xE8, 0xFF, 0xFF, 0xFF, 0xFF, 0xC3,
0x66, 0x33, 0xC0, 0x66, 0xA3, 0xFF, 0xFF, 0xFF,
0xFF, 0x53, 0x54, 0x55, 0x56, 0x57, 0xA1, 0xFF,
0xFF, 0xFF, 0xFF, 0x50, 0x8B, 0x0D, 0xFF, 0xFF,
0xFF, 0xFF, 0x8B, 0xD9, 0xE8, 0xFF, 0xFF, 0xFF,
0xFF, 0x5F, 0x5E, 0x5D, 0x5C, 0x5B, 0xC3
};
int caveAddress = ci.ServerSendCaveAddress.ToInt32();
byte[] bufferDword = BitConverter.GetBytes(caveAddress);
byte[] startWord = BitConverter.GetBytes(caveAddress + 4);
byte[] packetSendCALL = ClientHook.CreateCALL((IntPtr)(caveAddress + 52), (IntPtr)ci.ServerPacketSendFunction, CallType.CALL);
byte[] clientSendCaveCall = ClientHook.CreateCALL((IntPtr)(caveAddress + 18), (IntPtr)(ci.ClientSendCaveAddress.ToInt32() + 10), CallType.CALL);
byte[] data = BitConverter.GetBytes(ci.ClientPacketData);
Buffer.BlockCopy(startWord, 0, cave, 8, 4);
Buffer.BlockCopy(startWord, 0, cave, 29, 4);
Buffer.BlockCopy(bufferDword, 0, cave, 39, 4);
Buffer.BlockCopy(data, 0, cave, 46, 4);
Buffer.BlockCopy(packetSendCALL, 0, cave, 52, 5);
Buffer.BlockCopy(clientSendCaveCall, 0, cave, 18, 5);
Memory.Write(ci.Handle, ci.ServerSendCaveAddress, cave, true);
}
public override void OnActionExecuting(ActionExecutingContext filterContext)
{
#region 认证
bool isAnoy = filterContext.ActionDescriptor.IsDefined(typeof(AllowAnonymousAttribute), true) ||
filterContext.ActionDescriptor.ControllerDescriptor.IsDefined(typeof(AllowAnonymousAttribute), true);
var ClientHook = new ClientHook <Website.Controllers.ManageClientDataModel>();
var ManageClientDataModel = ClientHook.GetModel();
if (!isAnoy && ManageClientDataModel != null)
{
if (filterContext.HttpContext.Request.IsAjaxRequest())
{
var result = new AjaxResult()
{
IsSuccess = false,
Message = "请重新登录",
};
filterContext.Result = new JsonResult
{
Data = result,
JsonRequestBehavior = JsonRequestBehavior.AllowGet,
ContentType = "text/html"
};
}
else
{
new ActionResult()
{
}
}
}
#endregion
#region 授权
string Controller = filterContext.Controller.ControllerContext.Controller.ToString();
string ActionName = filterContext.ActionDescriptor.ActionName;
filterContext.Controller.ViewBag.ActionName = Controller;
filterContext.Controller.ViewBag.ControllerName = ActionName;
#endregion
#region 初始化配置
#endregion
}
public static void PreparePrimaryCave(ClientInfo ci)
{
ci.PrimaryCave = new byte[] {
0x00, 0x00, 0xE8, 0xFF, 0xFF, 0xFF, 0xFF, 0x68,
0xFF, 0xFF, 0xFF, 0xFF, 0x66, 0xA1, 0xFF, 0xFF,
0xFF, 0xFF, 0x66, 0x83, 0xF8, 0x00, 0x75, 0x01,
0xC3, 0x66, 0x31, 0xC0, 0x66, 0xA3, 0xFF, 0xFF,
0xFF, 0xFF, 0x68, 0x00, 0x00, 0x00, 0x00, 0x68,
0xFF, 0xFF, 0xFF, 0xFF, 0x68, 0xFF, 0xFF, 0xFF,
0xFF, 0x68, 0xFF, 0xFF, 0xFF, 0xFF, 0xC3, 0x83,
0xC4, 0x08, 0xC3, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00,
0x19, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
0x00, 0x00, 0xFF, 0x00, 0x00, 0x00, 0xFF, 0x00,
0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};
ci.PrimaryCave[0] = 0;
int startWordAddress = ci.CaveAddress.ToInt32();
byte[] hookBytes = ClientHook.CreateCALL(ci.HookAddress, (IntPtr)(startWordAddress + func1offset), CallType.CALL);
byte[] origDest = BitConverter.GetBytes(ci.OriginalDest);
byte[] serverSendCaveCall = ClientHook.CreateCALL(startWordAddress + func1offset, ci.ServerSendCaveAddress.ToInt32() + 6, CallType.CALL);
byte[] startAddress = BitConverter.GetBytes(startWordAddress);
byte[] data1Address = BitConverter.GetBytes(startWordAddress + data1offset);
byte[] returnAddress = BitConverter.GetBytes(ci.ReturnAddress);
byte[] addressForFunc2 = BitConverter.GetBytes(startWordAddress + func2offset + 21);
Buffer.BlockCopy(serverSendCaveCall, 0, ci.PrimaryCave, 2, 5);
Buffer.BlockCopy(origDest, 0, ci.PrimaryCave, 8, 4);
Buffer.BlockCopy(startAddress, 0, ci.PrimaryCave, 14, 4);
Buffer.BlockCopy(startAddress, 0, ci.PrimaryCave, 30, 4);
Buffer.BlockCopy(data1Address, 0, ci.PrimaryCave, 40, 4);
Buffer.BlockCopy(addressForFunc2, 0, ci.PrimaryCave, 45, 4);
Buffer.BlockCopy(returnAddress, 0, ci.PrimaryCave, 50, 4);
Memory.Write(ci.Handle, ci.CaveAddress, ci.PrimaryCave, true);
Memory.Write(ci.Handle, ci.HookAddress, hookBytes, true);
ci.PrimaryCave[0] = 1;
}
public static void PreparePathfindCave(ClientInfo ci)
{
byte[] cave;
int caveAddress = ci.PathFindCaveAddress.ToInt32();
byte[] startWord = BitConverter.GetBytes(caveAddress + 6);
byte[] EAXDword = BitConverter.GetBytes(caveAddress - 0x24);
byte[] gumpFunction;
byte[] RETNDword;
byte[] pathFindJMP;
switch (ci.PathFindType)
{
case 0:
cave = new byte[] {
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00,
0x66, 0xA1, 0xFF, 0xFF, 0xFF, 0xFF, 0x66, 0x83,
0xF8, 0x00, 0x75, 0x06, 0x90, 0x90, 0x90, 0x90,
0x90, 0xC3, 0x66, 0x33, 0xC0, 0x66, 0xA3, 0xFF,
0xFF, 0xFF, 0xFF, 0x6A, 0x00, 0x6A, 0x00, 0x68,
0xFF, 0xFF, 0xFF, 0xFF, 0x51, 0x53, 0x55, 0x56,
0x57, 0xB8, 0xFF, 0xFF, 0xFF, 0xFF, 0xE9, 0xFF,
0xFF, 0xFF, 0xFF, 0xC3
};
gumpFunction = ClientHook.CreateCALL(caveAddress + 20, ci.GumpFunctionCaveAddress.ToInt32() + 10, CallType.CALL);
pathFindJMP = ClientHook.CreateCALL(caveAddress + 54, ci.PathFindFunction, CallType.JMP);
RETNDword = BitConverter.GetBytes(caveAddress + cave.Length - 1);
Buffer.BlockCopy(startWord, 0, cave, 10, 4);
Buffer.BlockCopy(startWord, 0, cave, 31, 4);
Buffer.BlockCopy(gumpFunction, 0, cave, 20, 5);
Buffer.BlockCopy(RETNDword, 0, cave, 40, 4);
Buffer.BlockCopy(EAXDword, 0, cave, 50, 4);
Buffer.BlockCopy(pathFindJMP, 0, cave, 54, 5);
Memory.Write(ci.Handle, ci.PathFindCaveAddress, cave, true);
break;
case 1:
/* 004008D1 FFFF ??? ; X
* 004008D3 FFFF ??? ; Y
* 004008D5 FFFF ??? ; Z
* 004008D7 0000 ADD BYTE PTR DS:[EAX],AL ; nonzero = execute
* 004008D9 66:A1 D7084000 MOV AX,WORD PTR DS:[4008D7]
* 004008DF 66:83F8 00 CMP AX,0
* 004008E3 75 06 JNZ SHORT client.004008EB
* 004008E5 90 NOP ; reserved for future
* 004008E6 90 NOP ; reserved for future
* 004008E7 90 NOP ; reserved for future
* 004008E8 90 NOP ; reserved for future
* 004008E9 90 NOP ; reserved for future
* 004008EA C3 RETN
* 004008EB 66:33C0 XOR AX,AX
* 004008EE 66:A3 D7084000 MOV WORD PTR DS:[4008D7],AX
* 004008F4 6A 00 PUSH 0
* 004008F6 6A 00 PUSH 0
* 004008F8 68 08094000 PUSH client.00400908 ; RETN from pathfind
* 004008FD 51 PUSH ECX
* 004008FE B8 AD084000 MOV EAX,client.004008AD ; EAX + 0x24 = X word
* 00400903 -E9 51980900 JMP client.0049A159
* 00400908 C3 RETN */
cave = new byte[] {
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00,
0x66, 0xA1, 0xFF, 0xFF, 0xFF, 0xFF, 0x66, 0x83,
0xF8, 0x00, 0x75, 0x06, 0x90, 0x90, 0x90, 0x90,
0x90, 0xC3, 0x66, 0x33, 0xC0, 0x66, 0xA3, 0xFF,
0xFF, 0xFF, 0xFF, 0x6A, 0x00, 0x6A, 0x00, 0x68,
0xFF, 0xFF, 0xFF, 0xFF, 0x51, 0xB8, 0xFF, 0xFF,
0xFF, 0xFF, 0xE9, 0xFF, 0xFF, 0xFF, 0xFF, 0xC3
};
gumpFunction = ClientHook.CreateCALL(caveAddress + 20, ci.GumpFunctionCaveAddress.ToInt32() + 10, CallType.CALL);
pathFindJMP = ClientHook.CreateCALL(caveAddress + 50, ci.PathFindFunction, CallType.JMP);
RETNDword = BitConverter.GetBytes(caveAddress + cave.Length - 1);
Buffer.BlockCopy(startWord, 0, cave, 10, 4);
Buffer.BlockCopy(startWord, 0, cave, 31, 4);
Buffer.BlockCopy(RETNDword, 0, cave, 40, 4);
Buffer.BlockCopy(EAXDword, 0, cave, 46, 4);
Buffer.BlockCopy(pathFindJMP, 0, cave, 50, 5);
Buffer.BlockCopy(gumpFunction, 0, cave, 20, 5);
Memory.Write(ci.Handle, ci.PathFindCaveAddress, cave, true);
break;
}
}