Maggotboy's Super Stealth Sniffer V2 (code)

[devnul]

h3x did you compile with VC6 or VS.NET? Which OS?

What mem offset did you use? (I used what was there (4) after having initial troubles)

dn

[h3x]

compiled with vc6 under ME using in ME didn't change the mem offset.

and all the compiler settings are as suggested. the first version of this dll 1.3 works great with no errors... it's this new fangled gizmo stuff that the confuzer isn't werking with

[wizard]

anyone get this to compile and work with one of the free compilers out there? mingw etc.

[bonkersbobcat]

Maggotboy -- did you see this question?

(It wasn't really posted on the right thread and it ended up on the end of a page. You have been pretty quick at answering questions, and I haven't seen your comment on this yet.)

http://seq.sourceforge.net/showthrea...pagenumber=120

[gerbil42]

quote:
--------------------------------------------------------------------------------

[Category: Customize
- Enable function-level linking: CHECKED
- Eliminate duplicat string: CHECKED
--------------------------------------------------------------------------------



I was having this problem, you need to download Service Pack 5 for MSVS6. That will allow you to ungrey the boxes

I must be a dumbass or something, because SP5 did not ungrey the boxes for me.

[gezs]

I'll do the sp5 update and then run the debug tools when I get home tonight.. don't have access to any of it from work.. it'll be about 5 hours till I'm home..

[fryfrog]

Originally posted by gerbil42


I must be a dumbass or something, because SP5 did not ungrey the boxes for me.

same here, applying sp5 was the first thing i did after installing my old ass copy of vc++. it didn't make these available, if you right click and choose help it says something about some other option that has to be un/checked to make this one available.

it compiled fine, but i haven't tried it with eq yet.

[fhm]

68k? Wow. Mine is only 27k.

Regards,

CJ

[Fletch]

I just tested from home and V2 is working great. /cheer Maggotboy and everyone who contributed.

[Ataal]

quote:
--------------------------------------------------------------------------------
Originally posted by gerbil42


I must be a dumbass or something, because SP5 did not ungrey the boxes for me.
--------------------------------------------------------------------------------


Brand new install of Visual Studio(c++ comes with it) on winxp, did the SP5 thing, still gray'd out. I'm at work still so I'll try it at home too and see if there's any differences.

[Raelik]

Kudos to maggotboy for his incredibly well-documented code! I got it modified and compiled in under 5 minutes. Granted, I don't know if it actually WORKS yet (compiling qt... good god!), but the code is beautiful!

[h3x]

just to guess what's happening to me cause i can't get a debug properly... it's not run32 isn't shutting down and it's continually loading the code or injecting the code each time windows alloc's memory and it's eating away at the resources causing either eq to crash or just windows all together running dbmon the system complete lock up when it decides to go down.. =\

[Ataal]

Ok, I have a work-around for the gray'd out boxes and sp5 doesn't fix it.

By right clicking on the the boxes, it mentions that you cannot modify this setting if you have selected 'edit and continue' in the debug info drop down list under the general category. Actually, you can't either way, lol. Ok, back to my point here, if you select 'program database' and go back to customize, those boxes will not be gray'd out anymore. So, check the boxes, go back and put the debug info drop down back to 'none'. You will notice that even if you go back to customize, those boxes will now always not be gray'd out.

I haven't compiled it yet by doing this, on my way home now.

[gezs]

Well the good news is I got it all working properly even decodes in seq and everything.. BUT rundll32 is still stuck in memory. When I kill it manually seq continues to recieve the key. I am downloading the debug tools.. damn dial up sucks.. I want my dsl back.. I'll update after I get debug going..

[cheeze69]

Bummer!

I just built 2.04 using XP and VS.NET and EQ craps-out whenever I press a key, for example, to speed past the SOE self-promotion screen.

I added #DEFINE _SNIFFDEBUG to the code and captured the following using dbmon:

1816: Ignoring process attach request for C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
1816: Creating event handle "1A.tmp"
440: time()-cpuSpeed:1391062
440: TimeGetTime-cpuSpeed: 1415350
440: Found EQ Process!
440: Injecting code length 37888 ...
440: Code allocated at 0x02590000
440: Setting hook procedure...
440: Opening global event "1A.tmp"



I followed the directions that maggotboy posted on setting the options for VS.NET, so that's my environment. Here are the compiler flags just in case it's useful:

C/C++ options:
/Od /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "_USRDLL" /D "EQS204_EXPORTS" /D "_MBCS" /D "_WINDLL" /GF /FD /RTC1 /ML /Gy /Fo"Debug/" /Fd"Debug/vc70.pdb" /W3 /nologo /c /TP

Linker options:
/OUT:"Debug/eqs204.dll" /INCREMENTAL /NOLOGO /DLL /DEF:"eqs204.def" /PDB:"Debug/eqs204.pdb" /SUBSYSTEM:WINDOWS /IMPLIB:"Debug/eqs204.lib" /MACHINE:IX86 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib

Resources:
/fo"Debug/eqs204.res"

MIDL:
/nologo /env win32 /tlb "Debug/eqs204.tlb" /h "eqs204_h.h"

Any idea?

Thanks,
Mike