Skip to content

Instantly share code, notes, and snippets.

@ivanvza
Created November 6, 2019 16:28
Show Gist options
  • Save ivanvza/d808adbac2261c37dfda01c15ce02a89 to your computer and use it in GitHub Desktop.
Save ivanvza/d808adbac2261c37dfda01c15ce02a89 to your computer and use it in GitHub Desktop.
DLL to capture&save proc send recv via detours
#include <windows.h>
#include <fstream> // Required to output logs to files
#include <iomanip> // Required to display the hex properly
#include "detours.h" // Version 3.0 use for this hook. Be sure to include the library and includes to your project in visual studio
// Detours: https://www.microsoft.com/en-us/research/project/detours/
#pragma comment(lib,"detours.lib") // Need to include this so we can use Detours
#pragma comment(lib,"ws2_32.lib") // Required to hook Send and Recv since they both reside in this library
// All credits to:
// https://guidedhacking.com/threads/packet-logger-hook-send-and-recv-and-dump-the-packets-to-text-files.9455/
extern "C" { // Pointers to the original functions
int (WINAPI *originalSend)(SOCKET s, const char* buf, int len, int flags) = send; // https://msdn.microsoft.com/en-us/library/windows/desktop/ms740149(v=vs.85).aspx
int (WINAPI *originalRecv)(SOCKET s, char* buf, int len, int flags) = recv; // https://msdn.microsoft.com/en-us/library/windows/desktop/ms740121(v=vs.85).aspx
}
HMODULE hModule;
std::ofstream sendLog;
std::ofstream recvLog;
int WINAPI newSend(SOCKET s, char* buf, int len, int flags) // Dumps each buffer to a new line in the "send.txt" file in the games directory
{
sendLog.open("send.txt", std::ios::app); // Opens a handle to the send file
for (int i = 0; i < len; i++) { // For each byte:
sendLog << std::hex << std::setfill('0') << std::setw(2) << (unsigned int)(unsigned char)buf[i] << " "; // Log the hex of the byte with a width of 2 (leading 0 added if necessary) and a space after to separate bytes
}
sendLog << std::endl; // Add a newline to the text file, indicating the end of this request
sendLog.close(); // Close the text file
return originalSend(s, buf, len, flags); // Send the buffer to the original send function
}
int WINAPI newRecv(SOCKET s, char* buf, int len, int flags) // Dumps each buffer to a new line in the "recv.txt" file in the games directory
{
len = originalRecv(s, buf, len, flags); // Send the request with a pointer to the buffer for recv to store the response
recvLog.open("recv.txt", std::ios::app); // Opens a handle to the recv file
for (int i = 0; i < len; i++) { // For each byte in the response:
recvLog << std::hex << std::setfill('0') << std::setw(2) << (unsigned int)buf[i] << " "; // Log the hex of the byte with a width of 2 (leading 0 added if necessary) and a space after to separate bytes
}
recvLog << std::endl; // Add a newline to the text file, indicating the end of this request
recvLog.close(); // Close the text file
return len; // Returns the output from the original recv call
}
void hook() { // Basic detours
DisableThreadLibraryCalls(hModule);
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourAttach(&(PVOID&)originalSend, newSend);
DetourAttach(&(PVOID&)originalRecv, newRecv);
DetourTransactionCommit();
}
BOOL APIENTRY DllMain(HMODULE hModule, DWORD Reason, LPVOID reserved)
{
switch (Reason)
{
case DLL_PROCESS_ATTACH:
CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)hook, NULL, 0, NULL);
break;
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment