Tibia Packet Reader

[Lolrapa]

Hello!

Today I bring you a packet reader to get packets the client send to the server. This is done by hooking send packet function.
It's functional for Tibia 10.78 and can be easily updated to any version. This addresses are in 0x400000 base, so if you have aslr you'll have to do the math.



The zip file contains two folders, the loader and the injected dll. Both are visual studio projects (2013). The loader is a c# project and the dll is a c++ project.
https://github.com/lolrapa/Tibia-Server-Packet-Reader
http://www.4shared.com/rar/qDgKy5Qbce/PacketReader.html

Its my first open source project so dont be harsh on me
Thanks to darkstar for the help in this!

Note: Altough the project works it may make tibia crash form time to time, I'm aware of that and I'm working on it.

I hope this project helps you!!!
Good luck!

[Lolrapa]

Added to github.

https://github.com/lolrapa/Tibia-Server-Packet-Reader

[DarkstaR]

You are replacing the first few bytes of the send function without re-implementing them elsewhere, which ends up skipping part of the function prologue. You should be logging the operations that are there and adding them to the end of your code cave.

Better yet, you should grab Microsoft's Detours library and use that, as it will do everything for you.

[Lolrapa]

I acctualy tried that but I didn't figure how to add asm at the very end of my function if I use __asm{} im myFunction() the compiler will add asm code between my asm code and the ret statment and won't work

I mean:

void __stdcall myFunction()
{
		// This function will be called when tibia calls sendpacket I deliver the packet info to the loader via file mapping

		*(DWORD*)((LPVOID)(&((CHAR*)filePointer)[1])) = *SendStreamLength; //write the data len in 2nd byte (four bytes)
		memcpy((LPVOID)(&((CHAR*)filePointer)[5]), SendStreamData, *SendStreamLength); //write the data buffer in 5th byte (sendStreamLenght bytes)
		*(BYTE*)filePointer = 1; //inticates to the loader there's been an update, loader must set this byte to 0 after reading
                
                __asm
                {
                                //asm code to put back the replace asm
                }
}

[Lolrapa]

Or copy the first 5 bytes form the original function and paste them somewhere at the end of my function
I could reserve space by doing

__asm
{
    nop
    nop
    nop
    nop
    nop
{

[DarkstaR]

you need to use declspec(naked)

[szulak]

you need to use declspec(naked)

Or use attribute:

__attribute__ ((naked)) void myFunction() { }

If you're using GCC.

[DarkstaR]

#ifdef __GNUC__
#define SHOW_ME_YOUR_TITS __attribute__ ((naked))
#elif _MSC_VER
#define SHOW_ME_YOUR_TITS__declspec(naked)
#endif

SHOW_ME_YOUR_TITS void myFunction() {}

[Lolrapa]

#ifdef __GNUC__
#define SHOW_ME_YOUR_TITS __attribute__ ((naked))
#elif _MSC_VER
#define SHOW_ME_YOUR_TITS__declspec(naked)
#endif

SHOW_ME_YOUR_TITS void myFunction() {}

Haha, thanks both! I'll try it when I have some time

[eubrunomiguel]

How to use it?