// dllmain.cpp: определяет точку входа для приложения DLL.
#include <Windows.h>
 
__declspec(dllexport) void dllmain() {}
 
class UNetworkHandler {};
 
#pragma pack(push, 1)
struct NetworkPacket
{
    unsigned char id, _padding1, exid, _padding2;
    unsigned short size, _padding3;
    unsigned char* data;
};
struct ClientPacket
{
    unsigned char id, _padding1, exid, _padding2;
    unsigned short size, _padding3;
    unsigned char* data;
};
#pragma pack(pop)
 
int(__fastcall *UNetworkHandler_AddNetworkQueue)(UNetworkHandler*, int, NetworkPacket*);
typedef void(__cdecl *UNetworkHandler_OutgoingPacket)(unsigned int This, char *Format, ...);
UNetworkHandler_OutgoingPacket true_UNetworkHandler_OutgoingPacket;
 
void ParseClientPacket(ClientPacket* packet)
{
 
}
 
void ParseServerPacket(NetworkPacket* packet)
{
 
}
 
//Клиентские пакеты
int __cdecl UNetworkHandler_OutgoingPacket_hook(unsigned int This, char *Format, ...)
{
    true_UNetworkHandler_OutgoingPacket(This, Format, ...);
    return 0;
}
 
//Серверные пакеты
int __fastcall UNetworkHandler_IncommingPacket_hook(UNetworkHandler* This, int /*edx*/, NetworkPacket* packet)
{
    // Полезная нагрузка перехвата
    char buf[1024];
    wsprintfA(buf, "Server Packet id=0x%x, size=0x%x", packet->id, packet->size);
    OutputDebugStringA(buf);
    ParseServerPacket(packet);
    //-----------------------------------------
    return (*UNetworkHandler_AddNetworkQueue)(This, 0/*чтоугодно*/, packet);
}
 
DWORD WINAPI InitThread(LPVOID)
{
    HMODULE hEngine = LoadLibraryA("Engine.dll");
    (FARPROC&)UNetworkHandler_AddNetworkQueue = GetProcAddress(hEngine, "?AddNetworkQueue@UNetworkHandler@@UAEHPAUNetworkPacket@@@Z");
    void** UNetworkHandler_vftable = (void**)GetProcAddress(hEngine, "??_7UNetworkHandler@@6BUObject@@@");
    void** addr = (void**)(UNetworkHandler_vftable - 0x7); //0x1C for 4 byte
    (FARPROC&)true_UNetworkHandler_OutgoingPacket = FARPROC(addr);
    *addr = (void*)UNetworkHandler_OutgoingPacket_hook;
    void** UNetworkHandler_vftableCheck = UNetworkHandler_vftable;
    while (*UNetworkHandler_vftableCheck != (void*)UNetworkHandler_AddNetworkQueue) ++UNetworkHandler_vftableCheck;
    *UNetworkHandler_vftableCheck = (void*)UNetworkHandler_IncommingPacket_hook;
    return 0;
}
 
BOOL WINAPI DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID)
{
    if (DLL_PROCESS_ATTACH != ul_reason_for_call)
        return 1;
    DisableThreadLibraryCalls(hModule);
 
    CreateThread(0, 0, &InitThread, 0, 0, 0);
    return 1;
}
Code: C++

int __cdecl UNetworkHandler_OutgoingPacket_hook(unsigned int This, char *Format, ...)
{
    true_UNetworkHandler_OutgoingPacket(This, Format, ...);
    return 0;
}
Code: C++

 
DWORD WINAPI InitThread(LPVOID)
{
...
    (FARPROC&)true_UNetworkHandler_OutgoingPacket = FARPROC(addr);
...
}
 
Code: C++

 
DWORD WINAPI InitThread(LPVOID)
{
...
    true_UNetworkHandler_OutgoingPacket = (UNetworkHandler_OutgoingPacket)(*addr);
...
}
 
void __cdecl UNetworkHandler_OutgoingPacket_hook(unsigned int This, const char *Format, ...)
{	
	unsigned char buf[10240];
	int size = 0, len;
	wchar_t *wstr;
 
	va_list args;
	va_start(args, Format);
 
	while (*Format != 0)
	{
		switch (*Format)
		{
		case 'c':
			*(unsigned char*)(buf + size) = va_arg(args, unsigned char);
			size++;
			break;
		case 'h':
			*(unsigned short int*) (buf + size) = va_arg(args, unsigned short int);
			size += 2;
			break;
		case 'd':
			*(unsigned int*)(buf + size) = va_arg(args, unsigned int);
			size += 4;
			break;
		case 'Q':
			*(unsigned __int64*)(buf + size) = va_arg(args, unsigned __int64);
			size += 8;
			break;
		case 'b':
			len = va_arg(args, unsigned int);
			memcpy(buf + size, va_arg(args, void*), len);
			size += len;
			break;
		case 'S':
			wstr = va_arg(args, wchar_t*);
			if (wstr == 0)
			{
				len = 2;
				*(unsigned short int*) (buf + size) = 0;
			}
			else
			{
				len = wcslen(wstr) * 2 + 2;
				memcpy(buf + size, wstr, len);
			}
			size += len;
			break;
		}
		Format++;
	}
 
	va_end(args);
 
	true_UNetworkHandler_OutgoingPacket(This, "b", size, (int)buf);
}
 
Code: C++

		void** UNetworkHandler_AddNetworkQueue = (void**)(hEngine + CalcOffset(0x20554600)); // ?AddNetworkQueue@UNetworkHandler@@UAEHPAUNetworkPacket@@@Z 0x20554600 - helios
		void** UNetworkHandler_vftable = (void**)(hEngine + CalcOffset(0x2072E94C));		 // ??_7UNetworkHandler@@6BUObject@@@ 0x2072E94C - helios 0x72D74C
		void** UNetworkHandler_OutgoingPacket = (void**)(hEngine + CalcOffset(0x2072DF98));  // 0x2072DF98 - helios 0x72CD98
		char buf[1024];
		/*
[29384] UNetworkHandler_AddNetworkQueue Offset=0x20554600
[29384] UNetworkHandler_vftable Offset=0x2072e94c
[29384] UNetworkHandler_OutgoingPacket Offset=0x2072df98
		*/
		wsprintfA(buf, "UNetworkHandler_AddNetworkQueue Offset=0x%x", UNetworkHandler_AddNetworkQueue);
		OutputDebugStringA(buf);
		wsprintfA(buf, "UNetworkHandler_vftable Offset=0x%x", UNetworkHandler_vftable);
		OutputDebugStringA(buf);
		wsprintfA(buf, "UNetworkHandler_OutgoingPacket Offset=0x%x", UNetworkHandler_OutgoingPacket);
		OutputDebugStringA(buf);
		(FARPROC&)true_UNetworkHandler_OutgoingPacket = FARPROC(*UNetworkHandler_OutgoingPacket);
		OutputDebugStringA("true_UNetworkHandler_OutgoingPacket!");
		(FARPROC&)UNetworkHandler_OutgoingPacket = (FARPROC)*UNetworkHandler_OutgoingPacket_hook;
		OutputDebugStringA("UNetworkHandler_OutgoingPacket_hook!");
		void** incomming = (UNetworkHandler_vftable + 0x22);
		(FARPROC&)(incomming) = (FARPROC)*UNetworkHandler_IncommingPacket_hook;
		OutputDebugStringA("UNetworkHandler_IncommingPacket_hook!");
Code: C++

		void** incomming = (UNetworkHandler_vftable + 0x22);
		*incomming = (void*)UNetworkHandler_IncommingPacket_hook;
Code: C++