Maggotboy's Super Stealth Sniffer V2 (code)

[dpaschal]

What compiler should
I use to compile this code? I need something that is FREE.

[cryptorad]

I have the same problem as Stormdvil. But .. I started compiling at 2.04 and have always had it. I was/am still checking everything over prior to posting.. but since there is another.. I felt I'd add my voice. I have not found anything out of the norm yet and looks like I followed all instructions correctly.

I have not been compiling since loading this machine and only loaded VSC++6 to for this specific compile, so I don't have what may be normal compiler setups. I only loaded VC6+ for this and followed the setup instructions. The SDK wasn't required I read so it's not in.

I'll provide more info as I find it.


Tks to any looking at it.

[cryptorad]

Storm.. used a different debugger on mine.. it tells me the symbol search path is invalid. Basically.. looks like some missing symbol files. Working on figuring it out right now.

[h3x]

Start up dbmon
load up .dll
start eq

i'm not seeing any debug printouts
is there some setting before comiling to have them to display?

[nok]

Originally posted by h3x
is there some setting before comiling to have them to display?

Make sure you are downloading the newest version (clear your browser cache and check that the version in the source code is 2.05.

Make sure that the next line is not commented out :

#define _SNIFFDEBUG

[h3x]

yes to both got the code for 2.05 and that line is not commented out. does dbmon have to be in the same directory as the dll or is there a setting to have set, i used the recomended vc++ settings that are included with the cpp file yet when i load dbmon and the dll i see no output msg's as been posted

[sequsr1]

Alright guys, I am at a complete loss here. Getting kind of frustrated, so maybe you can figure out what I am doing wrong.

Have downloaded the newest and oldest versions of Maggotboy's code. Have successfully compiled and re-compiled them.

Downloaded the newest libEQ.a.

Downloaded the latest CVS of SEQ, and compiled successfully.

Setup the rundll32 command properly each time and was able to see it hooked into memory.

No matter what I do, I am still getting unknowns in the SEQ window. The weird part is that it seems to be decoding some of it as it is listing Items, but that is it.

Been working on this for a few days now and I am sure there is something I am completely missing. Any ideas?

I am following the instructions to a T, just don't know what could be wrong.

Any help is greatly appreciated.

Thanks.

[nok]

Originally posted by sequsr1
Downloaded the newest libEQ.a.

Are you sure that it replaced the old version? check your md5.

The weird part is that it seems to be decoding some of it as it is listing Items, but that is it.

Items are not encrypted at all, thats why you see those.

Try using port 10000.

Make sure that the IP for your seq box is correct.

Do any of the more basic keygrrab routines work? If so, do any of the other UDP program work?

Any strange debug output in dbmon?

[Ataal]

For those of you 'n00bs', like me out there....I have a suggestion that fixed every single problem that I had.

Let me first start off by giving you a brief history of what I have tried since I first learned about the whole sniffer thing:

I first tried a couple of the other sniffers and realized at that point that I had no clue what I was doing. Feeling completely overwhelmed, I just dealt with the gray dots for a week or two. I became increasingly wanting of the 'skittles'. I've been using seq now for about 8 months and had been through several adaptations and figured I have been through so many others, I can do this, I know I can.

I came to this thread and decided I'd give this one a try. I was able to download MS Visual Studio from Microsoft's site license agreement site from work. I copied the code into it and fired it up, still gray dots. I made sure I had the latest seq version, reran cvs -z3 update, deleted the old libEQ.a and got the latest one, still gray dots. I tried several UDP port numbers ranging from 4444 to 10064. gray dots. /sigh

I was getting these inflation errors in seq....so I did a search(yes I know how that function works now), the first thread about that said something about syncing issues and a complete wipe of seq and re-install fixes it.

Guess what, I GOT SKITTLES NOW!! WOOT!!

So, even though I had the latest version of seq, for some god awful reason, a complete wipe/re-install fixed it.

This is a suggestion to all of you peeps out that there that are just like me, those that feel so overwhelmed by all this.

[sequsr1]

Did the md5sum with the libEQ.a I have and compared it with the one posted in the Annoucements...it is the same.

Did a re-compile with the .dll file and it compiled successfully and is loading successfully.

Still nothing.

At the moment, I am running EQ on a Windows XP box on a hub with the Mandrake 9.0 box.

I did what was suggested above and completely wiped out any trace of SEQ on my linux box.

Downloaded the latest CVS, compiled and installed.

Still getting my name and information picked up on SEQ. But as far as the colored dots go, there is nothing.

How can I go about making sure my linux box is picking up the UDP packets from the EQ box?

I am thinking that may have something to do with it, but I can get Chat in the chat window and spells and such appear there too so I know it is listening.

well, tried the complete re-install of SEQ today.

I am just not sure how to get around the unknowns and get the "skittles"

About ready to give up and just go with the navigation tool for a while as I am at a loss atm.

Any help is appreciated. Thank you.

[maggotboy]

What port are you telling SEQ to listen on?

Maggotboy

[sequsr1]

Port 5555 atm

Tried all kinds of ports.

Also, I am getting this in the SEQ terminal. Have anything to do with it?

EQPacket::dispatchZoneData():CharProfileCode:Not Decoded

If you have any other questions, let me know. Will try to respond promptly.

[link129]

How can I go about making sure my linux box is picking up the UDP packets from the EQ box?

On your SEQ box type:
tcpdump dst port 12666 (use your port number)

You should see something like the following:

tcpdump: listening on eth0
09:33:55.964567 eqbox.1054 > seqbox.12666: udp 8

If you don't the packets aren't getting there.

[sequsr1]

Thanks for the tip Link129.

Changed the port that SEQ is listening to to 12666

Re-ran the .dll file on port 12666:

rundll32 tcplnk.dll,tcplnkih 192.168.1.102 12666 eqgame.exe 0x0078AAD0

Ran tcpdump dst port 12666

tcpdump: listening on eth0

17:49:28.770391 192.168.1.100.1916 > 192.168.1.102.12666: udp 8

192.168.1.100 = EQ box
192.168.1.102 = SEQ box

Seems like the information is getting there, but not being decoded?

[link129]

When you updated you libEQ.a did you update you ld.so.conf? Are you using a softlink to showeq that is a old version? Did you tell showeq to use your port # from the decode menu?

Only things I can think of right now.