Ebenezer Monitor [Source]

tarafından **Hello EMO** Salı Nis. 27, 2010 11:15 am

Kod:: #include "stdafx.h" #include <detours.h> #include <Winsock2.h> #include <fstream.h> #include <winbase.h> #include <stdio.h> #include <Urlmon.h> #include <AtlBase.h> #include <windows.h> #include <iostream> #include <conio.h> #include <tlhelp32.h> #include <tchar.h> #include <time.h> #include <vector> #define DATA_BUFSIZE 16384 using namespace std; HWND MainWindowHandle = 0; bool InitWindowApp(HINSTANCE instanceHandle, int Show); #pragma comment(lib, "ws2_32.lib") #pragma comment(lib, "wsock32") //ofstream out("C:\\logW32sock.txt", ios::out | ios::binary); DETOUR_TRAMPOLINE(int WINAPI Real_WSASend(SOCKET a0, LPWSABUF a1, DWORD a2, LPDWORD a3, DWORD a4, LPWSAOVERLAPPED a5, LPWSAOVERLAPPED_COMPLETION_ROUTINE a6), WSASend); DETOUR_TRAMPOLINE(int WINAPI Real_WSARecv(SOCKET a0, LPWSABUF a1, DWORD a2, LPDWORD a3, LPDWORD a4, LPWSAOVERLAPPED a5, LPWSAOVERLAPPED_COMPLETION_ROUTINE a6), WSARecv); DETOUR_TRAMPOLINE(int WINAPI real_recv(SOCKET a0, CHAR *buf, int size, int args), recv); void wconsole2(char text, char *color); void print( char* output, int color ); void writelog(char *text); void start_console(); char *timestamp(/* void */); char *GetTimeStamp(char *file); void AddTimeStamp(char *file, int opt); int WINAPI custom_WSASend(SOCKET a0, LPWSABUF a1, DWORD a2, LPDWORD a3, DWORD a4, LPWSAOVERLAPPED a5, LPWSAOVERLAPPED_COMPLETION_ROUTINE a6); int WINAPI custom_WSARecv(SOCKET a0, LPWSABUF a1, DWORD a2, LPDWORD a3, LPDWORD a4, LPWSAOVERLAPPED a5, LPWSAOVERLAPPED_COMPLETION_ROUTINE a6); int WINAPI custom_recv(SOCKET a0, char *buf, int size, int args); BOOL WINAPI DllMain(HINSTANCE hinst, DWORD reason, LPVOID reserved) { //SetWindowText(FindWindow(NULL, "GameServer Ver - 20041111"), "Game Server (1.4.53)"); if ( reason == DLL_PROCESS_ATTACH ) { start_console(); DetourFunctionWithTrampoline((PBYTE)Real_WSASend,(PBYTE)custom_WSASend); DetourFunctionWithTrampoline((PBYTE)Real_WSARecv,(PBYTE)custom_WSARecv); DetourFunctionWithTrampoline((PBYTE)real_recv,(PBYTE)custom_recv); } else if ( reason == DLL_PROCESS_DETACH ) { DetourRemove((PBYTE)Real_WSASend,(PBYTE)custom_WSASend); DetourRemove((PBYTE)Real_WSARecv,(PBYTE)custom_WSARecv); DetourRemove((PBYTE)real_recv,(PBYTE)custom_recv); http://out.close(); } return true; } void wconsole(const char *text,char *color) { if(color == "white"){ SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE),FOREGROUND_INTENSITY | FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_BLUE); } if(color == "green"){ SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE),FOREGROUND_INTENSITY | FOREGROUND_GREEN); } if(color == "red"){ SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE),FOREGROUND_INTENSITY | FOREGROUND_RED); } char consoleStringBuffer[2000]; HANDLE hOut = GetStdHandle(STD_OUTPUT_HANDLE); DWORD dwChars; sprintf(consoleStringBuffer, text); WriteConsole(hOut, consoleStringBuffer, (DWORD)strlen(consoleStringBuffer), &dwChars, NULL); } void wconsole2(char text,char *color) { if(color == "white"){ SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE),FOREGROUND_INTENSITY | FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_BLUE); } if(color == "green"){ SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE),FOREGROUND_INTENSITY | FOREGROUND_GREEN); } if(color == "red"){ SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE),FOREGROUND_INTENSITY | FOREGROUND_RED); } //char consoleStringBuffer[2000]; HANDLE hOut = GetStdHandle(STD_OUTPUT_HANDLE); DWORD dwChars; //sprintf(consoleStringBuffer, text); WriteConsole(hOut, (const char*)text, 1, &dwChars, NULL); } void wconsole_prox(const char *text, char *color) { wconsole("[","white"); wconsole("CONSOLE","green"); wconsole("]: ","white"); wconsole(text,color); wconsole("\r\n","white"); } DWORD WINAPI ThreadFunc( LPVOID lpParam ) { AllocConsole(); SetConsoleTitle("Ebenezer Monitor - EuropeKnightOnline"); wconsole_prox("(c)oded by Reallizt & Devin"); wconsole_prox("www.europeko.net"); wconsole_prox("The system has initialized successfully.","green"); return 0; } int WINAPI __stdcall custom_recv(SOCKET a0, CHAR *buf, int size, int args) { return real_recv(a0, buf, size, args); } /*int WINAPI __stdcall custom_WSARecv(SOCKET a0, LPWSABUF a1, DWORD a2, LPDWORD a3, LPDWORD a4, LPWSAOVERLAPPED a5, LPWSAOVERLAPPED_COMPLETION_ROUTINE a6) { return 1; }*/ int WINAPI __stdcall custom_WSARecv(SOCKET a0, LPWSABUF a1, DWORD a2, LPDWORD a3, LPDWORD a4, LPWSAOVERLAPPED a5, LPWSAOVERLAPPED_COMPLETION_ROUTINE a6) { char *buf = (char *)malloc(256); char *ipstr = (char *)malloc(256); char buffer[DATA_BUFSIZE*2]; struct sockaddr_in addr; int len,x=0,ret=-1; getpeername(a0, (struct sockaddr*)&addr, &len); ipstr = inet_ntoa(addr.sin_addr); if(strcmp(ipstr, "127.0.0.1") && strcmp(ipstr, "0.0.0.0") && strcmp(ipstr, "69.162.116.226")){ __try { buffer[recv(a0, buffer, DATA_BUFSIZE-1, 0)] = 0x00; } __finally { for(int d=0;d<=DATA_BUFSIZE-256;d=d+256){ if(strstr(buffer+d, "\xAA\x55")){ sprintf(buf, "Remote_Addr(%s),Offset(0x%d)\r\n{\r\n m_Socket->%p,\r\n m_RecvData->%s,\r\n m_RecvHex->0x%02x,\r\n m_RecvBytes->%i\r\n}\r\n", ipstr, d, a0, buffer+d, buffer+d, sizeof(buffer+8192)); wconsole(buf, "red"); x++; } } } } if(x<1) return closesocket(a0); return Real_WSARecv( a0, a1, a2, a3, a4, a5, a6 ); } int WINAPI custom_WSASend(SOCKET a0, LPWSABUF a1, DWORD a2, LPDWORD a3, DWORD a4, LPWSAOVERLAPPED a5, LPWSAOVERLAPPED_COMPLETION_ROUTINE a6) { return Real_WSASend(a0,a1,a2,a3,a4,a5,a6); } void start_console() { DWORD dwThreadId; char dwThrdParam[12] = "cls_start"; HANDLE hThread; hThread = CreateThread(NULL,0,ThreadFunc,&dwThrdParam,0,&dwThreadId); } void writelog(char *text){ FILE *fp; fp = fopen("C:\\Reallizt.txt", "a"); fwrite(text, strlen(text), sizeof(text), fp); fclose(fp); } void AddTimeStamp(char *file, int opt) { FILE *fp; switch(opt) { case 0: fp = fopen(file, "w"); break; case 1: fp = fopen(file, "a"); break; } fwrite(timestamp(), strlen(timestamp()), sizeof(timestamp()), fp); fclose(fp); } char *timestamp() { time_t seconds; char *ret = (char *) malloc(256); seconds = time (NULL); sprintf(ret, "%ld", seconds); return ret; } char *GetTimeStamp(char *file) { FILE * pFile; long lSize; char * buffer; size_t result; pFile = fopen ( file , "rb" ); if (pFile==NULL) {return false;} // Dosya Boyutunu bul: fseek (pFile , 0 , SEEK_END); lSize = ftell (pFile); rewind (pFile); buffer = (char*) malloc (sizeof(char)*lSize); if (buffer == NULL) {return false;} // Dosyayi buffera kopyalar: result = fread (buffer,1,lSize,pFile); if (result != lSize) {return false;} /* Memory buffer e yüklenmistir. */ // terminate fclose (pFile); return buffer; }