Creating network proxy

I've decided not to touch memory of games at all and go pure packet manipulation way. I've already coded a sniffer that can catch, decode, analyze, craft and deliver packets. The last thing that is left to do is to be able to edit packets before they reach game client or game server. This is where it's hard for me to grasp the concept.

I want to code a middleman between client and server that would receive all traffic between them and process it depending on which filters I set. How do I make it so my proxy monitors if there are new connections being made (preferably only on specific ports) and redirects them to itself? What socket functions should I use? I want to use only standart libraries if possible.

Basicly I want this shceme: client --> proxy --> server, and vise versa: client <-- proxy <-- server.

yyou can use winsock to make a proxy server and also you could use dialogboxes to handle options set and encryption stufff,il try find you a working proxy example when i have time

Easiest way is to hook Windows Socket functions.

Depending on the communication type ( TCP or UDP ) and the socket library the game uses ( WSA vs native socket functions ), you'll need to hook one or more of the following;

Send:
connect
send
sendto
WSASend
WSASendTo

Receive:
recv
recvfrom
WSARecv
WSARecvFrom

Makes me wonder how he "coded a sniffer that can catch, decode, analyze, craft and deliver packets." without already doing exactly that : p

Originally Posted by Anddos

you can use winsock to make a proxy server and also you could use dialogboxes to handle options set and encryption stufff,il try find you a working proxy example when i have time

Thanks, looking forward to it.

Originally Posted by Hitokiri~

Easiest way is to hook Windows Socket functions.

Depending on the communication type ( TCP or UDP ) and the socket library the game uses ( WSA vs native socket functions ), you'll need to hook one or more of the following;

Send:
connect
send
sendto
WSASend
WSASendTo

Receive:
recv
recvfrom
WSARecv
WSARecvFrom

That sure would be a way, but I'm hoping to find a solution that doesn't require messing with memory of game process.

Originally Posted by abuckau907

Makes me wonder how he "coded a sniffer that can catch, decode, analyze, craft and deliver packets." without already doing exactly that : p

Raw sockets. I can read packets, I can make new ones, but I can't make any changes to packets between game and servers. So basicly I can do stuff like read player positions, make some requests to server, but something like blocking server from sending me damage updates I can't do. For that I need a middleware.

Originally Posted by PacketGuy

Raw sockets. I can read packets, ....

How are you using 'raw sockets' to sniff? Would you mind posting code (maybe in a [ s p o i l e r ] tags)? Are you saying you sniffed the game's traffic, or created your own connection to the server? The later is not "coded a sniffer that can catch,decode,analyze...packets".

Anyone can sniff game packets... Clearly just download windows network analyzer...
To send packets yourself, u actually need to code one yourself, because as far as I've searched last night I couldn't find any sniffer that could send packets but only receive.

You forgot to *fly away* Cptn. Obvious

Originally Posted by abuckau907

How are you using 'raw sockets' to sniff? Would you mind posting code (maybe in a [ s p o i l e r ] tags)? Are you saying you sniffed the game's traffic, or created your own connection to the server? The later is not "coded a sniffer that can catch,decode,analyze...packets".

Well he might have meant he used some driver such as WinPCAP.
Hypothetically, you can use it to intercept outgoing and incoming messages for games, edit them etc before passing them to userland.

For Quake, every packet has an ID of -1 in the header so it's quite easy to identify messages. But since drivers tend to capture all packets indistinguishably, I have no clue how he's identifying which comes from the server ( apart from reading the source address ).

exactly you just set winsock to listen in raw mode on the network adapter, that is very simple todo and if he was to hook the winsock functions you are likely to get a ban for dll injection, i am looking for that proxy source now

https://www.virustotal.com/en/file/d...is/1423255536/

Proxy_mpgh.net.rar2 KB · 42 downloads Clean

Download & Thanks

Originally Posted by Anddos

exactly you just set winsock to listen in raw mode on the network adapter, that is very simple todo and if he was to hook the winsock functions you are likely to get a ban for dll injection, i am looking for that proxy source now

https://www.virustotal.com/en/file/d...is/1423255536/

Approved .

Originally Posted by Anddos

exactly you just set winsock to listen in raw mode on the network adapter, that is very simple todo and if he was to hook the winsock functions you are likely to get a ban for dll injection, i am looking for that proxy source now

That's very interesting, I thought I could use that only for sniffing, but if it's also possible to redirect traffic that way that's great. Gonna take a look at this example as soon as it's approved.

Originally Posted by Hitokiri~

Well he might have meant he used some driver such as WinPCAP.
Hypothetically, you can use it to intercept outgoing and incoming messages for games, edit them etc before passing them to userland.

For Quake, every packet has an ID of -1 in the header so it's quite easy to identify messages. But since drivers tend to capture all packets indistinguishably, I have no clue how he's identifying which comes from the server ( apart from reading the source address ).

That's going a bit off-topic, but indeed that roughly sums up what I do, except I can only read traffic but not modify it yet. That is also true that I have to listen to every single packet, but it's not hard to put a filter after decoding packet headers.

I had a look at this code, it's not using raw winsock but rather socks4. I suppose this might be what I'm looking for, although it's either not for Windows or missing a few headers necause code is incomplete. Thanks anyway, I guess this should at least give me an idea of general direction to move towards.

oh i thought you already had code to listen in raw mode with winsock?

Yeah, but I can only set it up to display packet contents so far. How do I set it up to actually redirect traffic?

My setup is basicly this:
1) use socket() to create raw socket;
2) use bind() to bind it to my ip;
3) use ioctlsocket() to let my socket grab everything;
4) create a loop with recv() inside.

I suppose if I use send() after recv() I'll simply send a copy of packet but not redirect traffic, so I'm confused how to do that with my current setup.

Creating network proxy

Post a Reply

Similar Threads

Tags for this Thread