How to get recv address?

[belzebub]

I want to play a little bit with packets, tibia winsock, but I lack in finding recv address. Anyone could help me? I wont get address of 10.78 but little help how to find it. I'm new with ollydbg ;/

[klusbert]

open ollydbg and search for:

  PUSH EBP
  MOV EBP,ESP
  PUSH DWORD PTR SS:[EBP+10h]
  PUSH DWORD PTR SS:[EBP+0Ch]
  PUSH DWORD PTR SS:[EBP+8h]
  PUSH DWORD PTR DS:[ECX+4h]

Doubleclick the call and you will see the address.
http://i.imgur.com/i2cGcdl.png

for 10.78 it is 0x757994 (with base 0x400000)

[belzebub]

I am very thankfull!

[belzebub]

When I execute with olly tibia.exe with aslr on how I can find address? Always the base would be another... So, I'm asking if i think in good way, that I will run olly on virtualmachine with windowsxp thats hasnt aslr on? Should it be easier? I got mindfuck btw spent 1h looking into olly searchin for address xD

[belzebub]

I think I found it It's 0x707994 with base 0x400000?

[Lolrapa]

If you have aslr activated in your pc every time windows opens tibia it will have a different starting point in the memory.
To find, save and use addresses with aslr you need to do this:

1) Find the address you want to use ex: My position in X lets put it in 0x800000

2) Find the tibia current base address, you can do it by load tibia in cheat engine-> add address manually -> and write "Tibia.exe" let say the value you get is 0x500000

3) Calculate the relative address position, this is the position of the address form the beggining of tibia's memory to do this just substract the base address to the absolute position: Relative= 0x800000 - 0x500000 = 0x300000

4)(optional) tibia base address when aslr is off is 0x400000 so if you want to get the address to that base address just add the relative position to the base address: position for tibia 0x400000 = 0x300000 + 0x400000 = 0x700000

5)Now in your program you'll have to find a way to get the current base address, for instance, for c# is Process.GetProcessByName("Tibia")[0].MainModule.BaseAddress() once you have tibia current base addess you have to calculte the absolute position of the address you want to read so:
If you done step 4:
My Pos X = 0x700000 - 0x400000 + Tibia Current Base Address
If you didn't done step 4:
My Pos X = 0x300000 + Tibia Current Base Address

This Change of base address (Rebase) has to be done every time tibia reloads.

[ottizy]

Or just disable ASLR for Tibia.

[Lolrapa]

Or just disable ASLR for Tibia.

If want your program to be de distributable you can't ask for the user to disable aslr

[ottizy]

With concern to this:

When I execute with olly tibia.exe with aslr on how I can find address? Always the base would be another... So, I'm asking if i think in good way, that I will run olly on virtualmachine with windowsxp thats hasnt aslr on? Should it be easier? I got mindfuck btw spent 1h looking into olly searchin for address xD

[jo3bingham]

While klusbert's method is fine, there's always the chance that the assembly could change in a future update, and it will no longer work. Here's a "better" method. Load the Tibia client in Ollydbg, right-click > Search for > All intermodular calls. When the window appears, click on "Destination" at the top to sort alphabetically. Scroll down to the 'R's, look for WS2_32.recv, double-click it and it will take you straight to the function call. Do the same for the send address by repeating the above process, but scrolling down to the 'S's and looking for WS2_32.send.