9.网络游戏逆向分析与漏洞攻防-游戏网络架构逆向分析-接管游戏连接服务器的操作

#include "pch.h"
#include "GameProc.h"
#include "extern_all.h"// typedef bool(GameWinSock::* U)(char*, unsigned);bool _OnConnect(HOOKREFS2) {/*根据虚函数表做HOOK的操作截取 ecx 获取 winsock 的值(指针)*/unsigned* vtable = (unsigned*)_EDX;//WinSock = (GameWinSock *)_ECX;/*联合体的特点是共用一个内存由于 GameWinSock::OnConnect 的 OnConnect函数是 GameWinSock类的成员函数直接 vtable[0x34 / 4] = (unsigned)&GameWinSock::OnConnect; 这样写语法不通过所以使用联合体，让语法通过*/union {unsigned value;bool(GameWinSock::* _proc)(char*, unsigned);} vproc;/*vproc._proc = &GameWinSock::OnConnect;  这一句是把我们自己写的调用connect函数的地址的出来*/ vproc._proc = &GameWinSock::OnConnect; /*InitClassProc函数里做的是给指针赋值的操作InitClassProc(&GameWinSock::_OnConnect, vtable[0x34/4]);这一句的意思是把GameWinSock类里的_OnConnect变量的值赋值成vtable[0x34/4]，这个 vtable[0x34/4] 是虚表里的函数vtable[0x34/4]是游戏中调用connect函数的函数地址，经过之前的分析调用connect是先调用了虚表中的一个函数，然后从这个函数中调用了connect函数*/InitClassProc(&GameWinSock::_OnConnect, vtable[0x34/4]);CString str;str.Format(L"===vtable：%X", vtable[0x34 / 4]);AfxMessageBox(str);DWORD oldPro,backProc;VirtualProtect(vtable, 0x100, PAGE_EXECUTE_READWRITE, &oldPro);vtable[0x34 / 4] = vproc.value;VirtualProtect(vtable, 0x100, oldPro, &backProc);return true;
}GameProc::GameProc()
{hooker = new htd::hook::htdHook2();Init();InitInterface();
}void GameProc::LoadBase()
{LoadLibraryA("fxnet2.dll");
}void GameProc::Init()
{
}void GameProc::InitInterface()
{LoadBase();MessageBoxA(0, "1", "1", MB_OK);hooker->SetHook((LPVOID)0x10617046, 0x1, _OnConnect, 0, true);
}

#pragma once
class GameWinSock
{typedef bool(GameWinSock::* PROC)(char*, unsigned);
public:static PROC _OnConnect;bool OnConnect(char* ip, unsigned port);
};

#include "pch.h"
#include "GameWinSock.h"
#include "extern_all.h"GameWinSock::PROC GameWinSock::_OnConnect{};
// 这个函数拦截了游戏的连接
bool GameWinSock::OnConnect(char* ip, unsigned port)
{// this是ecx，HOOK的点已经有ecx了WinSock = this;MessageBoxA(0, ip, ip, MB_OK);bool b = (this->*_OnConnect)(ip, port);// 下方注释的代码时为了防止多次注入，导致虚函数地址不恢复问题导致死循环，通过一次性HOOK也能解决/*unsigned* vtable = (unsigned*)this;vtable = (unsigned*)vtable[0];union {unsigned value;bool(GameWinSock::* _proc)(char*, unsigned);} vproc;vproc._proc = _OnConnect;DWORD oldPro, backProc;VirtualProtect(vtable, 0x100, PAGE_EXECUTE_READWRITE, &oldPro);vtable[0x34 / 4] = vproc.value;VirtualProtect(vtable, 0x100, oldPro, &backProc);*/return b;
}

// htdMfcDll.cpp: 定义 DLL 的初始化例程。这是一个MFC的dll
//#include "pch.h"
#include "framework.h"
#include "htdMfcDll.h"
#include "extern_all.h"#ifdef _DEBUG
#define new DEBUG_NEW
#endif// 注释掉下方宏，以入口点注入的方式注入
// #define WNDHOOK
#ifdef WNDHOOK
typedef struct htdDll
{HHOOK     keyHook;unsigned  KbdProc;unsigned  SetDll;}*PHtdDll;
void htdSetDll(htdDll hDll);
htdDll mDll;
#endifBEGIN_MESSAGE_MAP(ChtdMfcDllApp, CWinApp)
END_MESSAGE_MAP()// ChtdMfcDllApp 构造ChtdMfcDllApp::ChtdMfcDllApp()
{}ChtdMfcDllApp theApp;
ChtdMfcDllApp* PtheApp;HHOOK keyHook;
LRESULT CALLBACK KeyCallBack(int nCode, WPARAM w, LPARAM l);BOOL ChtdMfcDllApp::InitInstance()
{CWinApp::InitInstance();PtheApp = this;
#ifdef WNDHOOKmDll.KbdProc = (DWORD)(KeyCallBack);mDll.SetDll = 0;
#elsekeyHook = SetWindowsHook(WH_KEYBOARD, KeyCallBack);// 代码一开始，在这注册一个键盘事件的钩子
#endifPGameProc = new GameProc();return TRUE;
}// 钩子处理事件
LRESULT CALLBACK KeyCallBack(int nCode, WPARAM w, LPARAM l)
{if (nCode == 0){if ((l & (1 << 31)) == 0){switch (w){case VK_HOME:if (PtheApp->wndMain == NULL){PtheApp->wndMain = new CUI();PtheApp->wndMain->Create(IDD_MAIN);}PtheApp->wndMain->ShowWindow(TRUE);break;}}}return CallNextHookEx(keyHook, nCode, w, l);
}
#ifdef WNDHOOK
void htdInit(htdDll* hDll)
{hDll->KbdProc = mDll.KbdProc;hDll->keyHook = mDll.keyHook;hDll->SetDll = mDll.SetDll;
}void htdSetDll(htdDll hDll)
{mDll = hDll;
}
#else
void htdInit()
{
}
#endif

/*此文件是用来存放全局变量、全局函数（通用函数）
*/
#pragma once
#include "GameWinSock.h"
#include "GameProc.h"extern 	GameWinSock* WinSock;
extern GameProc* PGameProc;
extern void InitClassProc(LPVOID proc_addr, unsigned value);

/*此文件是用来存放全局变量、全局函数（通用函数）
*/
#include "pch.h"
#include "extern_all.h"
GameWinSock* WinSock = nullptr;
GameProc* PGameProc = nullptr;void InitClassProc(LPVOID proc_addr, unsigned value)
{unsigned* writer = (unsigned*)proc_addr;writer[0] = value;
}