Menu
What's new
RunUO Community

This is a sample guest message. Register a free account today to become a member! Once signed in, you'll be able to participate on this site by adding your own topics and posts, as well as connect with other members through your own private inbox!

SpyUO - a C# UO packet hooker

M

MuadDib

Wanderer
Thanks mate. Forwarded it to tomi. He's looking at different ways to try auto pull the keys for most clients auto. So should be helpful to him.

You wouldn't happen to have a working source of SpyUO would you? I was going to update packet names, and some other features to post on here, but the ones I find are either too outdated or don't work (and I really don't want to have to re-add everything for newest client support just for some features, naming, and such)
 
T

twisterdark

Wanderer
I've a serious problem, my SpyUO (i tried every one version 1.0, 1.1, 1.2, 1.9, 2.0) crash everytime i try to save/load things.

At start i thought it was an "extract book" problem, so i tried to save a log file....same problem, SpyUO go freeze and when i close it crashes (App Hang B1).

I tried to save/load without attaching to client too...same problem.
I tried only to start Spyuo and try to save filter preferences....same problem.

At the end, everytime SpyUO have to show me the directories list it crashes, so i cannot save any log i obtain. What have I to do?

(I'm on Windows 7 and i tried every compatibility mode)

Thanks...
 
osd_daedalus

osd_daedalus

Knight
lukin69;807063 said:
Anyone have another link to download the app? the zip file says its corrupted.
Click to expand...

it's because RunUO forums network handles really bad archives. You should use a download manager like Orbit to download properly archives in these forums. (won't work with Firefox, you have to use IE)
 
D

daat

Wanderer
So the new client is out and this is about as far as I have gotten with the new key.

#7.0 Series
4AA52CC4: "7.0.0.0 2D"

Haha.. Yeah not much there. It seems none of the older search functions that were built work. So I'm guessing its back to hand work. I was curious if someone could lay this out a little better for me. I have the client open in Olly and I'm search for the latest address available then moving on from there, but what command signature am I looking for?
 
X

xenoglyph

Sorceror
my signatures are still working for 7.0.0.0, i posted them a couple pages back i think

i don't remember exactly where spyuo likes to hook at, but it should be close to the addresses i use, here are mine:

recv = 0x47DA10

send = 0x4607D8

not tested with spyuo as i don't use it, oh and same registers as the other 2d clients

xenoglyph;794497 said:
Here's a couple signatures I'm using to find recv function in 2D ML clients:

53 56 57 8B F9 8B 0D = start of function for older clients
8B 38 8B E9 BE (-18 bytes) = start for newer clients

and here are sigs for send function:

8D 8B 94 00 00 00 (+11 bytes) = target for older clients
0F B7 D8 0F B6 06 83 C4 04 (+9) = target for newer clients

each client should only have one instance of either of those signatures. I'll revise it if necessary.
Click to expand...

to calculate relative address, get base address of exe, find offset of signature, add the two together. or you can just cheat and assume 0x400000 base address.
 
psz

psz

Administrator
7.0.0.2 settings:

Code: 
4AB010A7: "7.0.0.2 2D"       460A22 5 2 47DC56 7 6

Note: I've had some .Net exceptions thrown since going to the 7 series. This may be due to the packet changes in the 7 series.
 
S

Stuby

Sorceror
Are the most recent sources available anywhere? I've read the pages through and found a dozen or so various links and of course can base "recent" off of the last posted, but I was curious if we'd always have to do this or if there was a dedicated site or source repository for the project.
 
S

Stuby

Sorceror
Thanks for the verification on the latest code.

MalGanis, I've found a correction for Vista. This code
Code: 
private void SpyPacket( uint threadId, bool send )
		{
			IntPtr hThread = NativeMethods.OpenThread( NativeMethods.DesiredAccessThread.THREAD_GET_CONTEXT | NativeMethods.DesiredAccessThread.THREAD_SET_CONTEXT, false, threadId );
...
}
should be this
Code: 
private void SpyPacket( uint threadId, bool send )
		{
			IntPtr hThread = NativeMethods.OpenThread( NativeMethods.DesiredAccessThread.THREAD_GET_CONTEXT | NativeMethods.DesiredAccessThread.THREAD_SET_CONTEXT | NativeMethods.DesiredAccessThread.THREAD_QUERY_INFORMATION, false, threadId );
...
}

So far that's all I've had to change to get it working on Vista. I've not ran across it yet, but I imagine all file openings will need a FileAccess.Read permission in case the file is already in use. I'll let you know if I have to change anything else.
 
A

Arcer

Sorceror
hi

i'm lookig for documentation-tutorial or guide to use SpyuoLib.dll 's function...someone can help me?

specially for capturing and analyzing packet

thanks
 
F

Fenyx

Wanderer
MalGanis;806202 said:
First number is time date stamp of the client, you can get it using UOCH.

Basically i open client.exe with OllyDbg and i go to address of send (third number of previous version). Then i search for the sequence of commands (see image Send.jpg). If i find it thats teh new send address. Same with recieve address.
Click to expand...


I've tried to follow these instructions. Best I can get is this using OllyDbg;

: "7.0.0.4 2D" 460A21 5 2 47DC75 7 6

But it is pure guess work... I can't get UOCH working so I can't get the time stamp. Downloading MalGanis' links fail (tried it with Orbit too). I manage to track down the tool though and I still can't figure out what to do to get the timestamp.

Any help would be great. Thanks.
 
You must log in or register to reply here.
Top