I wanted to expand upon your haloproxy application, but instead it is a DLL project. So far I have hooked the recvfrom function using simple IAT address replacement:
Code:
#define IAT_RECVFROM 0x00634454
*((DWORD*)IAT_RECVFROM) = (DWORD)&myrecvfrom;
int __stdcall far myrecvfrom(SOCKET s, char *buf, int len, int flags, sockaddr *from, int *fromlen)
{
int result = recvfrom(s, buf, len, flags, from, fromlen);
sockaddr_in *peer = (sockaddr_in*)from;
DEBUG("Address: %s:%i", inet_ntoa(peer->sin_addr), peer->sin_port);
show_dump((unsigned char*)buf, len);
return result;
}
I am doing this so I don't have mess with all the winsock code, I have not yet learned the API well enough. That and I don't have to manually put in IP addresses. DEBUG() just formats data and prints it to a file. Thank you for show_dump, it's very very nice but I modified it to print to my file.
My goal is to interface between client and server to decrypt and analyze packets for your Halo/gamespy expoits. I know this stuff has been patched in Halo 1.08, but Halo Trial version still has a big community and there is no patches, so why not make a decent one for it. I am great at reversing data structures and functions in assembler, but when it comes to packet exploits, I have no idea what to look for when patching a binary executable. I am good at hooking and analyzing, so this is the route I am taking.
One thing I don't understand is the first 7 bytes of Halo packets and your use of it in haloproxy. You have it defined like this:
Code:
typedef struct {
u16 sign;
u8 type;
u16 gs1;
u16 gs2;
} gh_t;
What do these struct members represent? What do the different types mean? What's the difference between the signs, 0xFEFE and 0xFEFD? If you can go in detail about this little stuff, it would help a lot!
I captured a bunch of packets in a Halo Trial server, but not all of the packets began with the gh_t struct, meaning there was no FEFE or FEFD at the beginning. Most of them did though, only some didn't. I will get to the decrypting part later today, I just wanted to figure this out first.
