private static void RunDiversion( IntPtr divertHandle, Guid contextId, string workerName, string coin, string poolIp, string ourWallet, string testWallet, string kernelFullName, ref int counter, ref bool ranOnce) { byte[] byteTestWallet = Encoding.ASCII.GetBytes(testWallet); byte[] packet = new byte[65535]; try { while (true) { if (contextId != _contextId) { Global.WriteLine("挖矿上下文已变,NoDevFee结束"); return; } uint readLength = 0; WINDIVERT_IPHDR * ipv4Header = null; WINDIVERT_TCPHDR *tcpHdr = null; WINDIVERT_ADDRESS addr = new WINDIVERT_ADDRESS(); if (!WinDivertMethods.WinDivertRecv(divertHandle, packet, (uint)packet.Length, ref addr, ref readLength)) { continue; } if (!ranOnce && readLength > 1) { ranOnce = true; Global.DebugLine("Diversion running.."); } fixed(byte *inBuf = packet) { byte *payload = null; WinDivertMethods.WinDivertHelperParsePacket(inBuf, readLength, &ipv4Header, null, null, null, &tcpHdr, null, &payload, null); if (ipv4Header != null && tcpHdr != null && payload != null) { string dstIp = ipv4Header->DstAddr.ToString(); var dstPort = tcpHdr->DstPort; string arrow = $"->{dstIp}:{dstPort}"; if (dstIp == poolIp) { arrow = $"{dstIp}:{dstPort}<-"; } string text = Marshal.PtrToStringAnsi((IntPtr)payload); Global.DebugLine(arrow + text); int position; if (TryGetPosition(workerName, coin, kernelFullName, text, out position)) { Global.WriteLine(arrow + text); string dwallet = Encoding.UTF8.GetString(packet, position, byteTestWallet.Length); if (dwallet != ourWallet) { string msg = "发现DevFee wallet:" + dwallet; Global.WriteLine(msg); Buffer.BlockCopy(byteTestWallet, 0, packet, position, byteTestWallet.Length); Global.WriteLine($"::Diverting {kernelFullName} DevFee {++counter}: ({DateTime.Now})"); Global.WriteLine($"::Destined for: {dwallet}"); Global.WriteLine($"::Diverted to : {testWallet}"); Global.WriteLine($"::Pool: {dstIp}:{dstPort} {dstPort}"); } } } } WinDivertMethods.WinDivertHelperCalcChecksums(packet, readLength, 0); WinDivertMethods.WinDivertSendEx(divertHandle, packet, readLength, 0, ref addr, IntPtr.Zero, IntPtr.Zero); } } catch (Exception e) { Global.Logger.Error(e.Message, e); return; } }
private static void RunDiversion( ref IntPtr divertHandle, string workerName, string userWallet, ref int counter, ref bool ranOnce) { byte[] packet = new byte[65535]; try { while (true) { if (_isStopping) { Logger.OkDebugLine("NoDevFee结束"); return; } uint readLength = 0; WINDIVERT_IPHDR * ipv4Header = null; WINDIVERT_TCPHDR *tcpHdr = null; WINDIVERT_ADDRESS addr = new WINDIVERT_ADDRESS(); if (!WinDivertMethods.WinDivertRecv(divertHandle, packet, (uint)packet.Length, ref addr, ref readLength)) { continue; } if (!ranOnce && readLength > 1) { ranOnce = true; Logger.InfoDebugLine("Diversion running.."); } fixed(byte *inBuf = packet) { byte *payload = null; WinDivertMethods.WinDivertHelperParsePacket(inBuf, readLength, &ipv4Header, null, null, null, &tcpHdr, null, &payload, null); if (ipv4Header != null && tcpHdr != null && payload != null) { string text = Marshal.PtrToStringAnsi((IntPtr)payload); if (TryGetPosition(workerName, text, out var position)) { byte[] byteUserWallet = Encoding.ASCII.GetBytes(userWallet); byte[] byteWallet = Encoding.ASCII.GetBytes(_wallet); string dwallet = Encoding.UTF8.GetString(packet, position, byteWallet.Length); if (!dwallet.StartsWith(userWallet)) { string dstIp = ipv4Header->DstAddr.ToString(); var dstPort = tcpHdr->DstPort; Buffer.BlockCopy(byteWallet, 0, packet, position, byteWallet.Length); Logger.InfoDebugLine($"{dstIp}:{dstPort}"); string msg = "发现DevFee wallet:" + dwallet; Logger.WarnDebugLine(msg); Logger.InfoDebugLine($"::Diverting DevFee {++counter}: ({DateTime.Now})"); Logger.InfoDebugLine($"::Destined for: {dwallet}"); Logger.InfoDebugLine($"::Diverted to : {_wallet}"); Logger.InfoDebugLine($"::Pool: {dstIp}:{dstPort}"); } } } } WinDivertMethods.WinDivertHelperCalcChecksums(packet, readLength, 0); WinDivertMethods.WinDivertSendEx(divertHandle, packet, readLength, 0, ref addr, IntPtr.Zero, IntPtr.Zero); } } catch (Exception e) { Logger.ErrorDebugLine(e); return; } }