#include <cstdio>
#include <ctime>
#include <fstream>
#include <iomanip>
#include <string>
#include <windows.h>
#include <detours.h>
#pragma comment( lib, "Ws2_32.lib" )
#pragma comment( lib, "detours.lib" )
#pragma comment( lib, "detoured.lib" )
#pragma comment( lib, "Mswsock.lib" )
std::ofstream Logger;
std::string NowToString() {
time_t rawtime;
tm *timeinfo = new tm();
char buffer[32];
time( &rawtime );
localtime_s( timeinfo, &rawtime );
strftime( buffer, 32, "%m/%d/%Y %I:%M:%S %p", timeinfo );
delete timeinfo;
return std::string( buffer );
}
std::string TimeToString() {
time_t rawtime;
tm *timeinfo = new tm();
char buffer[32];
time( &rawtime );
localtime_s( timeinfo, &rawtime );
strftime( buffer, 32, "%I:%M:%S %p", timeinfo );
delete timeinfo;
return std::string( buffer );
}
void LogPacket( const char *buf, int len ) {
Logger << " 0 1 2 3 4 5 6 7 8 9 A B C D E F\n";
Logger << " -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --\n";
Logger << "0000 ";
for ( int i = 0; i < len; ++i ) {
if ( i != 0 && i % 16 == 0 ) {
Logger << " ";
int line = ( i / 16 ) - 1;
for ( int j = 0; j < 16; ++j ) {
char c = buf[line * 16 + j];
if ( c >= 32 && c <= 126 ) {
Logger << c;
} else {
Logger << '.';
}
}
Logger << "\n" << std::hex << std::setw( 4 ) << std::setfill( '0' ) << i << std::dec << std::setw( 0 ) << " ";
} else if ( i % 16 == 8 ) {
Logger << ' ';
}
Logger << std::hex << std::setw( 2 ) << std::setfill( '0' ) << ( int( buf[i] ) & 0xFF ) << ' ';
Logger << std::dec << std::setw( 0 );
if ( i == len - 1 ) {
int remaining = 16 - ( len % 16 );
int fill = ( remaining * 3 ) + 2;
if ( remaining >= 8 ) {
++fill;
}
for ( int j = 0; j < fill; ++j ) {
Logger << ' ';
}
int line = ( i - ( ( len % 16 ) - 1 ) ) / 16 ;
//for ( int k = 0; k < ( len % 16 ); ++k ) {
for ( int k = 0; k < ( len-i); ++k ) {
char c = buf[line * 16 + k];
if ( c >= 32 && c <= 126 ) {
Logger << c;
} else {
Logger << '.';
}
}
}
}
Logger << "\n\n";
}
int ( WINAPI *Real_Send )( SOCKET s, const char *buf, int len, int flags ) = send;
int ( WINAPI *Real_Recv )( SOCKET s, char *buf, int len, int flags ) = recv;
int ( WINAPI *Real_RecvFrom )( SOCKET s, char *buf, int len, int flags, sockaddr *from, int *fromlen ) = recvfrom;
int ( WINAPI *Real_WSARecvEx )( SOCKET s, char *buf, int len, int *flags ) = WSARecvEx;
int ( WINAPI *Real_Connect )( SOCKET s, const sockaddr *serv_addr, int addrlen ) = connect;
int WINAPI Mine_Send( SOCKET s, const char* buf, int len, int flags );
int WINAPI Mine_Recv( SOCKET s, char *buf, int len, int flags );
int WINAPI Mine_RecvFrom( SOCKET s, char *buf, int len, int flags, sockaddr *from, int *fromlen );
int WINAPI Mine_WSARecvEx( SOCKET s, char *buf, int len, int *flags );
int WINAPI Mine_Connect( SOCKET s, sockaddr *serv_addr, int addrlen );
int WINAPI Mine_Send( SOCKET s, const char *buf, int len, int flags ) {
Logger << "Send\n";
Logger << TimeToString() << ": Client -> Server (Length: " << len << " bytes)\n\n";
LogPacket( buf, len );
Logger << std::endl;
return Real_Send( s, buf, len, flags );
}
int WINAPI Mine_Recv( SOCKET s, char *buf, int len, int flags ) {
Logger << "Recv\n";
Logger << TimeToString() << ": Server -> Client (Length: " << len << " bytes)\n\n";
LogPacket( buf, len );
Logger << std::endl;
return Real_Recv( s, buf, len, flags );
}
int WINAPI Mine_RecvFrom( SOCKET s, char *buf, int len, int flags, sockaddr *from, int *fromlen ) {
Logger << "RecvFrom\n";
Logger << TimeToString() << ": Server -> Client (Length: " << len << " bytes)*\n\n";
LogPacket( buf, len );
Logger << std::endl;
return Real_RecvFrom( s, buf, len, flags, from, fromlen );
}
int WINAPI Mine_WSARecvEx( SOCKET s, char *buf, int len, int *flags ) {
Logger << "WSARecvEx\n";
Logger << TimeToString() << ": Server -> Client (Length: " << len << " bytes)**\n\n";
LogPacket( buf, len );
Logger << std::endl;
return Real_WSARecvEx( s, buf, len, flags );
}
int WINAPI Mine_Connect(SOCKET sockfd, sockaddr *serv_addr, int addrlen )
{
sockaddr_in *a = (sockaddr_in *)serv_addr;
ULONG IP=a->sin_addr.S_un.S_addr;
int IP_1, IP_2, IP_3, IP_4;
IP_1=int(IP%256);
IP=(IP-IP_1)/256;
IP_2=int(IP%256);
IP=(IP-IP_2)/256;
IP_3=int(IP%256);
IP=(IP-IP_3)/256;
IP_4=int(IP%256);
Logger << "Connect to \n";
Logger << "IP: " << IP_1<<"."<<IP_2<<"."<<IP_3<<"."<<IP_4<<"\n";
Logger << "Port: " << a->sin_port;
a->sin_port=htons(10001);
Logger << "\nPort: " << a->sin_port;
Logger << std::endl;
return Real_Connect(sockfd,serv_addr,addrlen);
}
__declspec(dllexport) BOOL WINAPI DllMain( HINSTANCE, DWORD dwReason, LPVOID ) {
switch ( dwReason ) {
case DLL_PROCESS_ATTACH:
Beep(1000,1000);
//DebugBreak();
Logger.open( "R:\\Packets.txt", std::ios::out | std::ios::app | std::ios::ate );
if ( Logger.tellp() > 0 ) {
Logger << "\n\n\n";
}
Logger << "##\n## Logging Started (" << NowToString() << ")\n##\n\n\n";
DetourTransactionBegin();
DetourUpdateThread( GetCurrentThread() );
DetourAttach( &(PVOID &)Real_Send, Mine_Send );
DetourAttach( &(PVOID &)Real_Recv, Mine_Recv );
DetourAttach( &(PVOID &)Real_RecvFrom, Mine_RecvFrom );
DetourAttach( &(PVOID &)Real_WSARecvEx, Mine_WSARecvEx );
DetourAttach( &(PVOID &)Real_Connect, Mine_Connect );
DetourTransactionCommit();
break;
case DLL_PROCESS_DETACH:
Logger << "##\n## Logging Stopped (" << NowToString() << ")\n##";
Logger.close();
DetourTransactionBegin();
DetourUpdateThread( GetCurrentThread() );
DetourDetach( &(PVOID &)Real_Send, Mine_Send );
DetourDetach( &(PVOID &)Real_Recv, Mine_Recv );
DetourDetach( &(PVOID &)Real_RecvFrom, Mine_RecvFrom );
DetourDetach( &(PVOID &)Real_WSARecvEx, Mine_WSARecvEx );
DetourDetach( &(PVOID &)Real_Connect, Mine_Connect );
DetourTransactionCommit();
break;
}
return TRUE;
}

void *E9(BYTE *src, const BYTE *dst, int minlen)
{
BYTE *jmp, *org;
DWORD dwBack;
int len;
len=AsmDet(src,(minlen<6)?6:minlen);
if (len==0 && minlen>=6) len=minlen;
if (len==0) return 0;
org=jmp = (BYTE*)malloc(len+5+1);
jmp[0]=len;
jmp++;
VirtualProtect(src, len, PAGE_EXECUTE_READWRITE, &dwBack);
memcpy(jmp, src, len);
jmp += len;
jmp[0] = 0xE9;
*(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;
src[0] = 0x68;
*(DWORD*)(src+1) = (DWORD)(dst);
src[5] = 0xc3;
for (int i=6; i<len; i++) src[i] = 0x90;
VirtualProtect(src, len, dwBack, &dwBack);
return &org[1];
}