Maggotboy's Super Stealth Sniffer V2 (code)

[MisterSpock]

I have compiled this code (v2), and various homebrew variants of it on VC6 and VS.Net and they work flawlessly. The only nut I've been unable to crack is the LCC-Win32 compiler issue. It crashes with a C00000005 exception every time it picks up the global hook (keypress) and attempts to launch the relocated code.

[Ataal]

FYI, I am running version 6.0 on a WinXP home machine and I cannot even get the crash to happen on purpose. /shrug

[cmore]

Originally posted by maggotboy
cmore -- make sure the eqsniffer2.cpp file is the only .c or .cpp file in the project. The linker is telling you more than one DllMain is declared somewhere, which means you probably forgot to take out the additional files VS.NET created for your DLL project.

Maggotboy

Thanks for answering. Yes, I removed the default .cpp it created for my project: <ProjectName>.cpp and it builds and creates the .dll successfully now.

Thanks again.

[steve]

Successfully compiled with VC6.

Ran the hook, no error, assuming it's working.

Run ShowEQ, input port that the hook is sending to.

Now, half the time I zone, SEQ segfaults. The other half, it doesn't do anything.

I'm using the latest libEQ.a, and am patched up to the CVS current. The only questionable thing I changed was:

#define INJECT_OFFSET 0x04
to
#define INJECT_OFFSET 0x08

I think this is where I goofed. Does it have to be in hex?

EDIT: Changed it back to the default, and SEQ still SEGFAULTS every time I zone. Any ideas?

[steve]

Using 2.05 of the code. I editted out my cpuspeed. Below is the output of DBMON.EXE:

2712: Ignoring process attach request for C:\EQW\EQW.EXE
2532: time()-cpuSpeed:XXXXXXXX
2532: TimeGetTime-cpuSpeed: XXXXXXX
2532: Found EQ Process!
2532: Injecting code length 33792 ...
2532: Code allocated at 0x02520000
2532: Setting hook procedure...
2532: Opening global event "13A3.tmp"

SEQ still segfaults.

Additionally, is this supposed to be spammed every second? It is, for some odd reason.

D:\Documents and Settings\steve\Desktop>dbmon.exe
1780: SymMsg: LoadLibraryASymMsg: psapi.dllSymMsg: PSAPI.DLLSymMsg: C:\WINDOWS\S
ystem32\psapi.dllSymMsg: LoadLibraryA done.SymMsg: LoadLibraryASymMsg: psapi.dll
SymMsg: PSAPI.DLLSymMsg: C:\WINDOWS\System32\psapi.dllSymMsg: LoadLibraryA done.
SymMsg: LoadLibraryASymMsg: psapi.dllSymMsg: PSAPI.DLLSymMsg: C:\WINDOWS\System3
2\psapi.dllSymMsg: LoadLibraryA done. etc...

[wrk2hard]

I have it working great on Win98se.
Compiled using .net (once I pulled my head out and followed the instructions closer).
Had some problems with SEQ still not working so I renamed the seq directory and reinstalled everything. No problems since then.

Great work to Maggotboy and everyone else who has contributed here.

Thanks!

[TrackingWarrior]

Installed and compiled using win2k, with vc++ 6, works awesome, instant decodes, seq is better then before =D

thanks maggotboy, u pwn!

[ml2517]

WinXP Home SP1 & VC++ 6 SP5. Followed the instructions verbatim and it works like a charm. =)

[The Mad Poet]

Ok I've tried to get this going under a Borland compiler but it gets stuck on ONE of the assemly lines..

call $ + 5 ...

Anyone familiar enough with the differences between TASAM and MASAM to know what to change?

I'm a assembly newb =(

[MisterSpock]

Try this:

__asm
{
call next
next: pop pvmem
}

[sauron]

Steve,

My only suggestion is to do the following:

(1) Completely delete your ShowEQ code directory.

(2) Do a complete search for all occurrences of "libEQ.a"

(3) Re-verify MD5sum of libEQ.a

(4) Pull down complete CVS and re-compile.

I say this because it sounds like a problem with SEQ/libeq.a, not the sniffer. With the new libeq.a and SEQ, there is much better handling of invalid keys, so it shouldn't be crashing.

BTW, 2.05 is working 100% for me. Great job Maggotboy! This code is just fantastic!

P.S. I'm using Redhat 7.2, Visual Studio 6 C++, and EQW. I use a batch file to "start Rundll [etc]" and then it will "start EQW".

[steve]

Thanks sauron. ShowEQ doesn't segfault any longer.

When I zone, I see in ShowEQ:

Decrypting and dispatching with key: 0xXXXXXXXXXXXXXXXX

So it's definately receiving the key. Only, after it gets the key, it does nothing, no spawns appear, the zone still shows as unknown, and EQ time shows unknown. It's getting the key, but isn't doing anything.

Any ideas? I summoned a pet like we used to have to, and no luck. Zoned 7 times, nada.

[rencro]

Yea, try what Sauron just suggested...

[steve]

Erm, I did. That's why I thanked him. It solved my segfaulting problem. SEQ is getting the key, but isn't doing anything with it.

[sauron]

Well, I'm not sure what the problem could be at this point. A couple of times, I've started EQ up and the code appeared to inject okay, but SEQ wouldn't decode. I exited EQ, restarted the sniffer, started EQ, and the next time it worked fine. I think I had told ShowEQ to "Detect next client seen" which might have thrown something off too (just a shot in the dark).

Anyway SEQ is seeing you running around on the map and such, right? Only decoding is the problem now?

One suggestion that comes to mind is to use the "simple" memory sniffer, not the "stealth sniffer". Play with entering this code (from the memory sniffer) manually into SEQ using the menu option. If this works, then perhaps try the "simple" memory sniffer that sends the key via UPD. If you can prove the normal memory sniffer works (or doesn't) then this may lead you to figuring out why the stealth sniffer isn't working.

Good luck!