[VB6] Memory hooking to view packets?

[Fr0z3N]

Not sure what to call it, but what I wanna do is hook into the d2 memory (if I'm even correct here) and view the incoming packets IE. too see if you get hostiled or to see if someones dies etc.  I have no idea where to start so help would be nice. 

[topaz]

Ethereal

[Fr0z3N]

I wanna do it IN my program.

[Joe[x86]]

Reference WinPcap.

EDIT -
Alright, I'll admit, that was way to vague.

WinPcap stands for Windows packet capture library, and it's what's in the background of Ethereal. I've never used it before (as a developer, as an actual user I have, of course), but I asume it'd work something like the Winsock API's, where it fires a callback routine when an event happens. You seem to have gotten those to work fine, so I don't think you'll have much trouble getting WinPcap to work.

A little reminder, though: WinPcap returns the entire packet, not the TCP body. First, you'll need to check if it's even TCP, then see if it's being recieved, then see if the checksum is correct (not required), then see if it's on port 6112. The TCP header is 0x36 bytes long.

[MyndFyre]

Reference WinPcap.

http://www.winpcap.org/misc/faq.htm#Q-9

Q-9: Can I use WinPcap with Visual Basic?

A: We don't support Visual Basic and we are not able to provide help on this subject because we don't know enough about it. BeeSync has developed an ActiveX control that integrates winpcap packet capture functionality with Visual Basic or any other programming environment supporting Microsoft ActiveX technology. You can find it at http://www.beesync.com/products.html.

[Fr0z3N]

So thats a yes or no with that? If no, any other ideas?

[Joe[x86]]

That's a "yes but we won't tell you how".

[Joe[x86]]

Joe + 45 minutes of boredom + IDE = This

[UserLoser]

Joe + 45 minutes of boredom + IDE = This

Code Select Expand


'---------------------------------------------------------------------------------------
' Procedure : RemoveVoid
' Author    : Joe[e2]
' Purpose   : Remove a VOID, of specified length.
'---------------------------------------------------------------------------------------

Public Function RemoveVoid(Length As Integer)
    Buffer = Mid(Buffer, Length + 1)
    RemoveVoid = Mid(Buffer, 1, Length)
End Function


That's funny.

[UserLoser]

Just the term and function name - "Remove a void"

[Fr0z3N]

Joe + 45 minutes of boredom + IDE = This

After much work trying to get that to work, I have come to one thing I cannot seem to figure out.

Code Select Expand


Private Sub objPacketX_OnPacket(ByVal pPacket As PacketXLibCtl.IPktXPacket)
    If pPacket.Protocol = PktXProtocolTypeTCP Then
        If pPacket.SourcePort = 6112 Then
            Call modProtocol.Parse_Server(pPacket.Data)
        End If
        If pPacket.DestPort = 6112 Then
            Call modProtocol.Parse_Client(pPacket.Data)
        End If
    End If


Both these lines are being highlighted with Type Mismatch

Code Select Expand


            Call modProtocol.Parse_Server(pPacket.Data)

            Call modProtocol.Parse_Client(pPacket.Data)


When I switch them to .DataArray all I am seeing is Sent 0x3F, Received 0x3F over and over. But for some reason they are not working with just .Data

[LivedKrad]

Joe + 45 minutes of boredom + IDE = This

After much work trying to get that to work, I have come to one thing I cannot seem to figure out.

Code Select Expand


Private Sub objPacketX_OnPacket(ByVal pPacket As PacketXLibCtl.IPktXPacket)
    If pPacket.Protocol = PktXProtocolTypeTCP Then
        If pPacket.SourcePort = 6112 Then
            Call modProtocol.Parse_Server(pPacket.Data)
        End If
        If pPacket.DestPort = 6112 Then
            Call modProtocol.Parse_Client(pPacket.Data)
        End If
    End If


Both these lines are being highlighted with Type Mismatch

Code Select Expand


            Call modProtocol.Parse_Server(pPacket.Data)

            Call modProtocol.Parse_Client(pPacket.Data)


When I switch them to .DataArray all I am seeing is Sent 0x3F, Received 0x3F over and over. But for some reason they are not working with just .Data

.DataArray is a byte array containing each byte in the message. So if Joe's function is supposed to read some sort of Variant data (which .Data is) then passing an array won't do any good as I think it will only read the first byte. (Not sure, did not download the source).