Author | Message | Time |
---|---|---|
HdxBmx27 | Just some old packet handlers I found in Battle.snp whilst I was looking around. 0x17, Read memory addresses? [code]S->C: (UInt32) Cookie (UInt32) Address (UInt32) Length C->S: (UInt32) Cookie (Void) Memory segment?[/code] [code]int __usercall Recv_SID_0x17<eax>(int PacketDataLength<ecx>, int PacketData<eax>) { unsigned int v2; // edi@3 const void *v3; // esi@3 UINT v4; // ST10_4@3 const void *v5; // ST0C_4@3 int v6; // [sp+4h] [bp-4h]@3 int v7; // [sp+0h] [bp-8h]@4 if ( PacketData ) { if ( (unsigned int)PacketDataLength >= 0xC ) { v3 = *(const void **)(PacketData + 4); v2 = *(_DWORD *)(PacketData + 8); v4 = *(_DWORD *)(PacketData + 8); v5 = *(const void **)(PacketData + 4); v6 = *(_DWORD *)PacketData; PacketData = IsBadReadPtr(v5, v4); if ( !PacketData ) { PacketData = SMemAlloc(v2 + 4, "Starcraft\\Storm\\SNPs\\Battle\\Srv.cpp", 3082, PacketData); v7 = PacketData; if ( PacketData ) { *(_DWORD *)PacketData = v6; memcpy((void *)(PacketData + 4), v3, v2); SendBNCSPacket(v2 + 4, 23, PacketData); PacketData = storm_403(v7, "Starcraft\\Storm\\SNPs\\Battle\\Srv.cpp", 3089, 0); } } } } return PacketData; }[/code]0x20, No clue, didn't poke past the initial handler. [code]void *__usercall Recv_SID_0x20<eax>(int PacketDataLength<ecx>, void *PacketData<eax>) { void *v2; // [sp+Ch] [bp-4h]@4 char *v3; // [sp+0h] [bp-10h]@4 int v4; // [sp+4h] [bp-Ch]@4 signed int v5; // [sp+8h] [bp-8h]@4 if ( PacketData ) { if ( (unsigned int)PacketDataLength >= 1 ) { if ( dword_19044E0C ) { v2 = PacketData; v3 = &GameStaps; v4 = 0; v5 = 4; PacketData = sub_19017810(6, (int)&v3, 16, (int)&v3, (int)&v2); } else { PacketData = (void *)sub_19020610(&GameStaps, (int)&GameStaps, (int)PacketData); } } } return PacketData; } void *__stdcall sub_19017810(int a1, int a2, int a3, int a4, int a5) { void *result; // eax@11 int v6; // ebx@11 unsigned int v7; // edi@11 unsigned int v8; // esi@11 void *v9; // edx@13 int v10; // ecx@13 int v11; // esi@13 int v12; // eax@16 int *v13; // eax@22 unsigned int v14; // eax@11 int v15; // eax@12 int v16; // edx@12 void *v17; // edi@15 char v18; // al@15 unsigned int v19; // ecx@15 char *v20; // esi@16 int v21; // edi@16 int v22; // eax@16 unsigned int v23; // ecx@16 const void *v24; // esi@16 void *v25; // edi@16 char v26; // zf@16 int v27; // eax@23 int v28; // ecx@23 char *v29; // [sp+18h] [bp-4h]@2 char *v30; // [sp+14h] [bp-8h]@5 unsigned int v31; // [sp+10h] [bp-Ch]@11 unsigned int v32; // [sp+Ch] [bp-10h]@11 if ( a4 ) v29 = *(char **)a4; else v29 = 0; if ( a5 ) v30 = *(char **)a5; else v30 = 0; if ( !v29 ) v29 = &GameStaps; if ( !v30 ) v30 = &GameStaps; v7 = strlen(v29); v31 = v7; v14 = strlen(v30); v8 = v14; v32 = v14; result = (void *)SMemAlloc(16, "Starcraft\\Storm\\SNPs\\Battle\\Srv.cpp", 3395, 0); v6 = (int)result; if ( result ) { v15 = a3; v16 = a1; *(_DWORD *)(v6 + 8) = a3; *(_DWORD *)v6 = v16; result = (void *)SMemAlloc(v7 + v8 + v15 + 2, "Starcraft\\Storm\\SNPs\\Battle\\Srv.cpp", 3402, 0); *(_DWORD *)(v6 + 4) = result; if ( result ) { v10 = a3; v9 = (char *)result + a3; a3 += (int)(result + v7 + 1); v11 = a2; if ( a2 ) { if ( v10 ) { v17 = result; v18 = v10; v19 = (unsigned int)v10 >> 2; memcpy(v17, (const void *)a2, 4 * v19); memcpy((char *)v17 + 4 * v19, (const void *)(v11 + 4 * v19), v18 & 3); v7 = v31; } } memcpy(v9, v29, v7 + 1); v20 = v30; v21 = a3; v22 = v32 + 1; v23 = (v32 + 1) >> 2; memcpy((void *)a3, v30, 4 * v23); v24 = &v20[4 * v23]; v25 = (void *)(v21 + 4 * v23); LOBYTE(v23) = v22; v12 = a4; v26 = a4 == 0; memcpy(v25, v24, v23 & 3); if ( !v26 ) { if ( *(_DWORD *)v12 ) *(_DWORD *)(*(_DWORD *)(v6 + 4) - a2 + v12) = v9; } if ( a5 ) { if ( *(_DWORD *)a5 ) *(_DWORD *)(*(_DWORD *)(v6 + 4) - a2 + a5) = a3; } EnterCriticalSection(&unk_19046824); v13 = &dword_19045500; if ( dword_19045500 ) { do { v27 = *v13; v28 = *(_DWORD *)(v27 + 12); v13 = (int *)(v27 + 12); } while ( v28 ); } *v13 = v6; *(_DWORD *)(v6 + 12) = 0; LeaveCriticalSection(&unk_19046824); result = dword_19045610; if ( dword_19045610 ) result = (void *)PostMessageA(dword_19045610, 0x469u, 0, 0); } } return result; } BOOL __stdcall sub_19020610(char *Source, int a2, int a3) { int v3; // eax@1 int v4; // esi@1 EnterCriticalSection(&unk_190466F0); v3 = SMemAlloc(772, "Starcraft\\Storm\\SNPs\\Battle\\Spi.cpp", 1027, 0); v4 = v3; if ( v3 ) { strncpy((char *)v3, Source, 0x80u); strncpy((char *)(v4 + 128), (const char *)a2, 0x80u); strncpy((char *)(v4 + 256), (const char *)a3, 0x200u); *(_BYTE *)(v4 + 127) = 0; *(_BYTE *)(v4 + 255) = 0; *(_BYTE *)(v4 + 767) = 0; sub_19002E30(); } LeaveCriticalSection(&unk_190466F0); return SetEvent(hEvent); } [/code]0x24, Something to do with just echoing cookies back and forth?[code]int __usercall Recv_SID_0x24<eax>(int PacketData<eax>, unsigned int PacketDataLength<ecx>) { int v2; // eax@3 char *v3; // edx@3 char *v4; // eax@5 char *v5; // eax@7 _BYTE *v6; // esi@7 int v7; // eax@9 _BYTE *v8; // ecx@9 int v9; // esi@9 int v10; // ecx@3 char v11; // cl@4 char v12; // cl@6 int v13; // eax@7 char v14; // cl@8 char v15; // dl@10 int v16; // [sp+4h] [bp-204h]@3 int OutPacketData; // [sp+0h] [bp-208h]@3 char v18; // [sp+8h] [bp-200h]@3 _BYTE v19[511]; // [sp+9h] [bp-1FFh]@7 if ( PacketData ) { if ( PacketDataLength >= 9 ) { v10 = *(_DWORD *)PacketData; v16 = *(_DWORD *)(PacketData + 4); v2 = PacketData + 8; OutPacketData = v10; v3 = &v18 - v2; do { v11 = *(_BYTE *)v2; v3[v2] = *(_BYTE *)v2; ++v2; } while ( v11 ); v4 = &v18; do v12 = *v4++; while ( v12 ); v13 = v4 - v19; v6 = &v19[v13]; storm_422("Cookies", &v18, 2, &v19[v13], 256); v5 = &v18; do v14 = *v5++; while ( v14 ); v8 = v6; v7 = v5 - v19; v9 = (int)(v6 + 1); do v15 = *v8++; while ( v15 ); PacketData = SendBNCSPacket((int)(&v8[v7 + 10] - v9), 0x24u, (int)&OutPacketData); } } return PacketData; } [/code]Just a random thing. Also found some cool stuff about SC Leagues, did they ever actually make any public ones? As well as the Warden/Crev handlers :P AND! A like 4 server side exploits to '0wnzorz our b0xzorz' Anyone know any more of what these do? Like I said they all had no time put into them because I was doing other things. | January 29, 2010, 1:58 PM |
Sixen | [quote author=Hdx link=topic=18152.msg184019#msg184019 date=1264773516] Just a random thing. Also found some cool stuff about SC Leagues, did they ever actually make any public ones? As well as the Warden/Crev handlers :P [/quote] I believe the only public League released was the WGTour league. | January 30, 2010, 12:54 AM |
xpeh | So, it is possible to read user CD-Keys with 0x17? | February 4, 2010, 2:12 AM |