{"id":717,"date":"2012-10-27T16:08:47","date_gmt":"2012-10-27T08:08:47","guid":{"rendered":"http:\/\/newbiecoder.0ginr.com\/blog\/?p=717"},"modified":"2012-10-28T12:28:23","modified_gmt":"2012-10-28T04:28:23","slug":"%e9%ad%94%e5%85%bd%e4%ba%89%e9%9c%b8-3-%e8%b8%a2%e4%ba%ba%e5%86%85%e6%8c%82","status":"publish","type":"post","link":"https:\/\/newbiecoder.0ginr.com\/blog\/?p=717","title":{"rendered":"\u9b54\u517d\u4e89\u9738 3 \u8e22\u4eba\u5185\u6302"},"content":{"rendered":"

\u8bdd\u8bf4 war3 \u4f1a\u81ea\u52a8\u628a war3.exe \u6240\u5728\u76ee\u5f55\u4e0b\u7684 .mix \u6587\u4ef6\u4f5c\u4e3a DLL \u52a0\u8f7d~~<\/p>\n

\u6240\u4ee5\u7f16\u8bd1\u6210 DLL \u6539\u6210 xxx.mix \u653e\u5728 war3.exe \u7684\u76ee\u5f55\u91cc\u9762\u5c31\u597d\u4e86~~<\/p>\n

Update at 0:23 2012\/10\/28: \u6211\u5ffd\u7136\u53d1\u73b0\u6211\u51e0\u4e4e\u628a\u6240\u6709\u7684\u9519\u8bef\u5904\u7406\u90fd\u5ffd\u7565\u6389\u4e86\u3002\u5927\u6982\u662f\u592a\u4e45\u6ca1\u5199\u4ee3\u7801\u4e86\u3002<\/p>\n

\/\/
\n\/\/ \u9ed8\u8ba4\u8c03\u7528\u7ea6\u5b9a\uff1a__stdcall
\n\/\/
\n\/\/ WAR3 \u6570\u636e\u5305\u683c\u5f0f\u6765\u6e90\u4e8e W3GStreamer\u3002
\n\/\/<\/p>\n

#include
\n#include <\/p>\n

#define ORDINAL_SEND (0x00000013)<\/p>\n

#define ENTRY_NOT_FOUND (-1)<\/p>\n

#define PACKET_SIGNATURE (0xF7)
\n#define PACKET_CHAT (0x0F)<\/p>\n

#define PACKET_CHAT_FLAG_IN_PREPARE_SCREEN (0x10)
\n#define PACKET_CHAT_FLAG_IN_GAME (0x20)<\/p>\n

#define COMMAND_KICK \"\/kick\"<\/p>\n

#define Add2Ptr(Pointer, Increment, ResultType) (reinterpret_cast((ULONG_PTR)(Pointer) + (Increment)))
\n#define PtrOffset(Pointer2, Pointer1) ((reinterpret_cast(Pointer2) - reinterpret_cast(Pointer1)))<\/p>\n

typedef DWORD (SEND) (
\n\t__in SOCKET Socket,
\n\t__in_bcount(BufferSize) PVOID Buffer,
\n\t__in DWORD BufferSize,
\n\t__in DWORD Flags
\n\t);<\/p>\n

typedef SEND *PSEND;<\/p>\n

typedef __declspec(align(1)) struct _GAME_PACKET {
\n\tBYTE Signature;
\n\tBYTE Operation;
\n\tWORD PacketSize;<\/p>\n

\tunion {
\n\t\tstruct {
\n\t\t\tBYTE TargetCount;<\/p>\n

\t\t\t\/\/
\n\t\t\t\/\/ \u63a5\u4e0b\u6765\u662f\u76ee\u6807 ID\u3002
\n\t\t\t\/\/
\n\t\t\t\/\/ BYTE Id[TargetCount];
\n\t\t\t\/\/<\/p>\n

\t\t\tBYTE SelfId;
\n\t\t\tBYTE Flags;<\/p>\n

\t\t\t\/\/
\n\t\t\t\/\/ \u5982\u679c Flags \u662f PACKET_CHAT_FLAG_IN_GAME\uff0c\u90a3\u4e48\u63a5\u4e0b\u6765\u4f1a\u6709 Target\u3002
\n\t\t\t\/\/
\n\t\t\t\/\/ DWORD Target;
\n\t\t\t\/\/<\/p>\n

\t\t\tCHAR Message[1];
\n\t\t} Chat;
\n\t};
\n} GAME_PACKET, *PGAME_PACKET;<\/p>\n

PSEND OldSend;<\/p>\n

\/\/
\n\/\/ \u5b9a\u4f4d\u6620\u50cf\u6570\u636e\u76ee\u5f55\u3002
\n\/\/<\/p>\n

PVOID LocateImageDataDirectory(
\n\t__in PVOID ImageBase,
\n\t__in ULONG DataDirectory
\n\t)
\n{
\n\tPIMAGE_DOS_HEADER DosHeader;
\n\tPIMAGE_NT_HEADERS NtHeaders;<\/p>\n

\tDosHeader = reinterpret_cast(ImageBase);
\n\tNtHeaders = Add2Ptr(ImageBase, DosHeader->e_lfanew, PIMAGE_NT_HEADERS);<\/p>\n

\t\/\/
\n\t\/\/ \u4ece\u6587\u4ef6\u5934\u4e2d\u5b9a\u4f4d\u6570\u636e\u76ee\u5f55\u3002
\n\t\/\/<\/p>\n

\treturn Add2Ptr(ImageBase, NtHeaders->OptionalHeader.DataDirectory[DataDirectory].VirtualAddress, PVOID);
\n}<\/p>\n

\/\/
\n\/\/ \u6839\u636e DLL \u6587\u4ef6\u540d\u5b9a\u4f4d\u5bfc\u5165\u63cf\u8ff0\u7b26\u3002
\n\/\/<\/p>\n

PIMAGE_IMPORT_DESCRIPTOR LocateImportDescriptor(
\n\t__in PVOID ImageBase,
\n\t__in PSTR DllName
\n\t)
\n{
\n\tPIMAGE_IMPORT_DESCRIPTOR ImportDescriptor;<\/p>\n

\t\/\/
\n\t\/\/ \u5b9a\u4f4d\u5bfc\u5165\u63cf\u8ff0\u7b26\u3002
\n\t\/\/<\/p>\n

\tImportDescriptor = reinterpret_cast(LocateImageDataDirectory(ImageBase,
\n\t\tIMAGE_DIRECTORY_ENTRY_IMPORT));<\/p>\n

\twhile (ImportDescriptor->Name) {
\n\t\tPSTR ImportedDllName;<\/p>\n

\t\t\/\/
\n\t\t\/\/ \u6bd4\u8f83 DLL \u6587\u4ef6\u540d\u3002
\n\t\t\/\/<\/p>\n

\t\tImportedDllName = Add2Ptr(ImageBase, ImportDescriptor->Name, PSTR);<\/p>\n

\t\tif (!_strcmpi(DllName, ImportedDllName)) {
\n\t\t\treturn ImportDescriptor;
\n\t\t}<\/p>\n

\t\tImportDescriptor++;
\n\t}<\/p>\n

\treturn NULL;
\n}<\/p>\n

\/\/
\n\/\/ \u5b9a\u4f4d\u5bfc\u5165\u67e5\u627e\u8868\u3002
\n\/\/<\/p>\n

PULONG_PTR LocateImportEntries(
\n\t__in PVOID ImageBase,
\n\t__in PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor,
\n\t__in BOOL LocateOriginalEntries
\n\t)
\n{
\n\tif (LocateOriginalEntries) {
\n\t\treturn Add2Ptr(ImageBase, ImportDescriptor->OriginalFirstThunk, PULONG_PTR);
\n\t} else {
\n\t\treturn Add2Ptr(ImageBase, ImportDescriptor->FirstThunk, PULONG_PTR);
\n\t}
\n}<\/p>\n

\/\/
\n\/\/ \u6bd4\u8f83\u5bfc\u5165\u67e5\u627e\u8868\u4e2d\u7684\u8868\u9879\u3002
\n\/\/
\n\/\/ \u8fd9\u4e2a\u51fd\u6570\u53ef\u4ee5\u6b63\u786e\u5904\u7406\u6309\u7167\u5e8f\u53f7\u5bfc\u5165\u7684\u8868\u9879\u3002
\n\/\/<\/p>\n

BOOL CompareImportEntry(
\n\t__in PVOID ImageBase,
\n\t__in ULONG_PTR ImportedEntry,
\n\t__in PSTR EntryToLookup
\n\t)
\n{
\n\tif (IMAGE_SNAP_BY_ORDINAL(ImportedEntry) !=
\n\t\tIMAGE_SNAP_BY_ORDINAL(reinterpret_cast(EntryToLookup))) {
\n\t\treturn FALSE;
\n\t}<\/p>\n

\tif (IMAGE_SNAP_BY_ORDINAL(ImportedEntry)) {<\/p>\n

\t\t\/\/
\n\t\t\/\/ ImportedEntry \u662f\u4e00\u4e2a\u51fd\u6570\u7684\u5e8f\u53f7\u3002\u4e5f\u610f\u5473\u7740 EntryToLookup \u4e5f\u662f\u4e00\u4e2a\u5e8f\u53f7\u3002
\n\t\t\/\/<\/p>\n

\t\treturn IMAGE_ORDINAL(ImportedEntry) == IMAGE_ORDINAL(reinterpret_cast(EntryToLookup));
\n\t} else {<\/p>\n

\t\t\/\/
\n\t\t\/\/ \u6bd4\u8f83\u5b57\u7b26\u4e32\u3002
\n\t\t\/\/<\/p>\n

\t\treturn !strcmp(Add2Ptr(ImageBase, ImportedEntry, PSTR), EntryToLookup);
\n\t}
\n}<\/p>\n

\/\/
\n\/\/ \u67e5\u627e\u5bfc\u5165\u67e5\u627e\u8868\u8868\u9879\u3002
\n\/\/
\n\/\/ \u5982\u679c ProcName \u662f\u4e00\u4e2a\u5e8f\u53f7\uff0c\u90a3\u4e48\u5b83\u7684\u6700\u9ad8\u4f4d\u9700\u8981\u88ab\u8bbe\u4e3a 1\u3002
\n\/\/<\/p>\n

DWORD LookupImportEntryIndex(
\n\t__in PVOID ImageBase,
\n\t__in PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor,
\n\t__in PSTR ProcName
\n\t)
\n{
\n\tDWORD Index;
\n\tPULONG_PTR Entries;<\/p>\n

\tIndex = 0;<\/p>\n

\t\/\/
\n\t\/\/ \u5b9a\u4f4d\u5bfc\u5165\u67e5\u627e\u8868\u3002
\n\t\/\/<\/p>\n

\tEntries = LocateImportEntries(ImageBase, ImportDescriptor, TRUE);<\/p>\n

\t\/\/
\n\t\/\/ \u904d\u5386\u5bfc\u5165\u67e5\u627e\u8868\u3002
\n\t\/\/<\/p>\n

\twhile (ULONG_PTR Offset = Entries[Index]) {<\/p>\n

\t\t\/\/
\n\t\t\/\/ \u6bd4\u8f83\u51fd\u6570\u540d \/ \u5e8f\u53f7\u3002
\n\t\t\/\/<\/p>\n

\t\tif (CompareImportEntry(ImageBase, Offset, ProcName)) {
\n\t\t\treturn Index;
\n\t\t}<\/p>\n

\t\tIndex++;
\n\t}<\/p>\n

\treturn ENTRY_NOT_FOUND;
\n}<\/p>\n

\/\/
\n\/\/ IAT HOOK\u3002
\n\/\/<\/p>\n

PVOID InterceptImportedProc(
\n\t__in PTSTR TargetName,
\n\t__in PSTR DllName,
\n\t__in PSTR ProcName,
\n\t__in PVOID HookProc
\n\t)
\n{
\n\tPIMAGE_IMPORT_DESCRIPTOR ImportDescriptor;
\n\tDWORD ImportEntryIndex;
\n\tPULONG_PTR Entries;
\n\tPVOID TargetBase;<\/p>\n

\t\/\/
\n\t\/\/ \u5b9a\u4f4d\u8981 HOOK \u7684\u6a21\u5757\u3002
\n\t\/\/<\/p>\n

\tTargetBase = reinterpret_cast(GetModuleHandle(TargetName));<\/p>\n

\t\/\/
\n\t\/\/ \u5b9a\u4f4d\u5bfc\u5165\u63cf\u8ff0\u7b26\u3002
\n\t\/\/<\/p>\n

\tImportDescriptor = LocateImportDescriptor(TargetBase, DllName);<\/p>\n

\t\/\/
\n\t\/\/ \u67e5\u627e\u5bfc\u5165\u7684\u51fd\u6570\u7684\u7d22\u5f15\u3002
\n\t\/\/<\/p>\n

\tImportEntryIndex = LookupImportEntryIndex(TargetBase, ImportDescriptor, ProcName);<\/p>\n

\t\/\/
\n\t\/\/ \u5b9a\u4f4d\u5bfc\u5165\u51fd\u6570\u7684\u5730\u5740\u8868\u3002
\n\t\/\/<\/p>\n

\tEntries = LocateImportEntries(TargetBase, ImportDescriptor, FALSE);<\/p>\n

\t\/\/
\n\t\/\/ \u8bfb\u53d6\u5f53\u524d\u5730\u5740\u5e76\u66ff\u6362\u3002
\n\t\/\/<\/p>\n

\treturn reinterpret_cast(InterlockedExchange(reinterpret_cast(&Entries[ImportEntryIndex]),
\n\t\treinterpret_cast(HookProc)));
\n}<\/p>\n

\/\/
\n\/\/ WSASend \u7684\u8fc7\u6ee4\u51fd\u6570\u3002
\n\/\/<\/p>\n

DWORD NewSend(
\n\t__in SOCKET Socket,
\n\t__in_bcount(BufferSize) PVOID Buffer,
\n\t__in DWORD BufferSize,
\n\t__in DWORD Flags
\n )
\n{
\n\tPGAME_PACKET GamePacket, NewGamePacket;<\/p>\n

\tGamePacket = reinterpret_cast(Buffer);<\/p>\n

\t\/\/
\n\t\/\/ \u68c0\u6d4b\u662f\u5426\u4e3a\u53d1\u9001\u6d88\u606f\u7684\u5305\u3002
\n\t\/\/<\/p>\n

\tif (GamePacket->Signature == PACKET_SIGNATURE && GamePacket->Operation == PACKET_CHAT) {
\n\t\tPSTR MessageBuffer;<\/p>\n

\t\t\/\/
\n\t\t\/\/ \u6807\u5fd7\u4f4d\u4e4b\u524d\u6709 TargetCount \u4e2a ID\uff0c\u6bcf\u4e2a ID \u5360\u7528\u4e00\u4e2a BYTE \u7684\u5927\u5c0f\u3002
\n\t\t\/\/<\/p>\n

\t\tNewGamePacket = Add2Ptr(GamePacket, GamePacket->Chat.TargetCount * sizeof(BYTE), PGAME_PACKET);<\/p>\n

\t\tif (NewGamePacket->Chat.Flags == PACKET_CHAT_FLAG_IN_GAME) {<\/p>\n

\t\t\t\/\/
\n\t\t\t\/\/ \u5982\u679c Flags == PACKET_CHAT_FLAG_IN_GAME\uff0c\u90a3\u4e48\u5728\u6d88\u606f\u6b63\u6587\u4e4b\u524d\u8fd8\u6709\u4e00\u4e2a Target\uff0c\u5360\u7528\u4e00\u4e2a DWORD\u3002
\n\t\t\t\/\/<\/p>\n

\t\t\tNewGamePacket = Add2Ptr(NewGamePacket, sizeof(DWORD), PGAME_PACKET);
\n\t\t}<\/p>\n

\t\tMessageBuffer = NewGamePacket->Chat.Message;<\/p>\n

\t\t\/\/
\n\t\t\/\/ \u6bd4\u8f83\u547d\u4ee4\u3002\uff08MessageBuffer \u662f\u4ee5 0 \u7ed3\u5c3e\u7684\u3002\uff09
\n\t\t\/\/<\/p>\n

\t\tif (!strcmp(MessageBuffer, COMMAND_KICK)) {<\/p>\n

\t\t\t\/\/
\n\t\t\t\/\/ \u8fd4\u56de\u9519\u8bef\u3002\u6e38\u620f\u4f1a\u81ea\u52a8\u65ad\u5f00\u8fde\u63a5\u3002
\n\t\t\t\/\/<\/p>\n

\t\t\treturn SOCKET_ERROR;
\n\t\t}
\n\t}<\/p>\n

\treturn OldSend(Socket, Buffer, BufferSize, Flags);
\n}<\/p>\n

\/\/
\n\/\/ DLL \u5165\u53e3\u70b9\u3002
\n\/\/<\/p>\n

BOOL DllMain(
\n\t__in HINSTANCE DllBase,
\n\t__in DWORD Reason,
\n\t__reserved PVOID Reserved
\n\t)
\n{
\n\tif (Reason == DLL_PROCESS_ATTACH) {<\/p>\n

\t\t\/\/
\n\t\t\/\/ HOOK\u3002
\n\t\t\/\/<\/p>\n

\t\tOldSend = reinterpret_cast(InterceptImportedProc(TEXT(\"war3.exe\"), \"wsock32.dll\",
\n\t\t\treinterpret_cast(ORDINAL_SEND | IMAGE_ORDINAL_FLAG), reinterpret_cast(NewSend)));<\/p>\n

\t} else if (Reason == DLL_PROCESS_DETACH) {<\/p>\n

\t\t\/\/
\n\t\t\/\/ UNHOOK\u3002
\n\t\t\/\/<\/p>\n

\t\tInterceptImportedProc(TEXT(\"war3.exe\"), \"wsock32.dll\",
\n\t\t\treinterpret_cast(ORDINAL_SEND | IMAGE_ORDINAL_FLAG), reinterpret_cast(OldSend));
\n\t}<\/p>\n

\treturn TRUE;
\n}
\n<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"

\u8bdd\u8bf4 war3 \u4f1a\u81ea\u52a8\u628a war3.exe \u6240\u5728\u76ee\u5f55\u4e0b\u7684 .mix \u6587\u4ef6\u4f5c\u4e3a DLL \u52a0\u8f7d~~ \u6240\u4ee5\u7f16\u8bd1\u6210 D […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-717","post","type-post","status-publish","format-standard","hentry","category-1"],"_links":{"self":[{"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/717","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=717"}],"version-history":[{"count":6,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/717\/revisions"}],"predecessor-version":[{"id":724,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/717\/revisions\/724"}],"wp:attachment":[{"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=717"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=717"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=717"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}