hook: in-process RE instrumentation + LSX redirect + capture tooling
Hook-side tooling for the LSX/Blaze reverse-engineering effort: - probe.rs (new, `probe` feature): passive logging detours on FIFA's online-flow functions via the unhook/rehook pattern (no trampoline/relocation, works on RIP-relative prologues). Deferred install waits for anadius64.dll to load, then logs enter/return for GoOnline + GetInternetConnectedState (anadius) and the OnlineStatusEvent/Login deserializers (FIFA23.exe). Revealed that our pushed LSX events reach FIFA and parse OK, while GoOnline never fires — localizing the online gate to FIFA's game-side event consumer. - connect_hook.rs: redirect FIFA's LSX connect :3216 → :3217 so it lands on the native openfut-bridge LSX server (slips past anadius's in-process :3216 intercept); gated off under the `capture_baseline` feature. - recv_hook.rs: boundary-safe trampolines + LSX peer filtering for the capture_baseline path (log anadius's real LSX frames when the redirect is off). Build the instrumented DLL with `--features probe` (or `--features capture_baseline` for the anadius-baseline capture). Both features are off by default. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
funman300
@@ -22,32 +22,41 @@ unsafe fn make_trampoline(orig: *mut u8, name: &str) -> Option<usize> {
|
||||
use windows_sys::Win32::System::Memory::{
|
||||
VirtualAlloc, MEM_COMMIT, MEM_RESERVE, PAGE_EXECUTE_READWRITE,
|
||||
};
|
||||
// Log prologue so we can diagnose if trampolines misbehave
|
||||
let bytes: [u8; 14] = core::array::from_fn(|i| *orig.add(i));
|
||||
let hex: String = bytes.iter().map(|b| format!("{b:02x} ")).collect();
|
||||
// Read enough prologue to walk instruction boundaries.
|
||||
let probe: [u8; 24] = core::array::from_fn(|i| *orig.add(i));
|
||||
let hex: String = probe[..14].iter().map(|b| format!("{b:02x} ")).collect();
|
||||
crate::write_log(&format!("recv_hook: {name} prologue {hex}\n"));
|
||||
|
||||
// Walk instruction boundaries to find relative branches.
|
||||
// Byte-by-byte scanning mis-identifies immediate operands (e.g. `sub rsp, 0x70`)
|
||||
// as jump opcodes, so we must parse properly.
|
||||
if has_rip_relative_branch(&bytes) {
|
||||
crate::write_log(&format!("recv_hook: {name} has relative branch in prologue, skipping trampoline\n"));
|
||||
return None;
|
||||
// Copy WHOLE instructions until we've covered >= 14 bytes (the size of the JMP
|
||||
// patch), so the trampoline never splits an instruction. Copying a fixed 14
|
||||
// bytes lands mid-instruction on these prologues and crashes on execution.
|
||||
let mut copy_len = 0usize;
|
||||
while copy_len < 14 {
|
||||
let (len, branch) = decode_instr_len(&probe[copy_len..]);
|
||||
if len == 0 || branch {
|
||||
crate::write_log(&format!(
|
||||
"recv_hook: {name} unrelocatable prologue (len={len} branch={branch}), skipping\n"
|
||||
));
|
||||
return None;
|
||||
}
|
||||
copy_len += len;
|
||||
}
|
||||
|
||||
let mem = VirtualAlloc(
|
||||
core::ptr::null_mut(), 32,
|
||||
core::ptr::null_mut(), 64,
|
||||
MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE,
|
||||
);
|
||||
if mem.is_null() { crate::write_log("recv_hook: VirtualAlloc failed\n"); return None; }
|
||||
|
||||
let t = mem as *mut u8;
|
||||
core::ptr::copy_nonoverlapping(orig, t, 14);
|
||||
// JMP [RIP+0] → orig+14
|
||||
let cont = (orig as u64) + 14;
|
||||
t.add(14).write(0xFF); t.add(15).write(0x25);
|
||||
(t.add(16) as *mut u32).write(0);
|
||||
(t.add(20) as *mut u64).write(cont);
|
||||
core::ptr::copy_nonoverlapping(orig, t, copy_len);
|
||||
// JMP [RIP+0] → orig+copy_len (resume at the next whole instruction)
|
||||
let cont = (orig as u64) + copy_len as u64;
|
||||
t.add(copy_len).write(0xFF);
|
||||
t.add(copy_len + 1).write(0x25);
|
||||
(t.add(copy_len + 2) as *mut u32).write(0);
|
||||
(t.add(copy_len + 6) as *mut u64).write(cont);
|
||||
crate::write_log(&format!("recv_hook: {name} trampoline copy_len={copy_len}\n"));
|
||||
Some(t as usize)
|
||||
}
|
||||
|
||||
@@ -151,46 +160,78 @@ unsafe fn get_fn(dll: &[u8], sym: &[u8]) -> Option<*mut u8> {
|
||||
|
||||
static RECV_TRAMPOLINE: AtomicUsize = AtomicUsize::new(0);
|
||||
|
||||
pub unsafe extern "system" fn hooked_recv(s: usize, buf: *mut u8, len: i32, flags: i32) -> i32 {
|
||||
if crate::lsx::is_lsx(s) {
|
||||
return crate::lsx::on_recv(s, buf, len);
|
||||
}
|
||||
let t = RECV_TRAMPOLINE.load(Ordering::Relaxed);
|
||||
if t == 0 { return -1; }
|
||||
let f: unsafe extern "system" fn(usize, *mut u8, i32, i32) -> i32 = core::mem::transmute(t);
|
||||
f(s, buf, len, flags)
|
||||
/// True if socket `s` is connected to the EA App LSX port (127.0.0.1:3216).
|
||||
/// Used in capture mode to tap only the LSX conversation.
|
||||
unsafe fn peer_is_lsx(s: usize) -> bool {
|
||||
use windows_sys::Win32::Networking::WinSock::getpeername;
|
||||
let mut sa = [0u8; 16];
|
||||
let mut sl: i32 = 16;
|
||||
if getpeername(s, sa.as_mut_ptr() as *mut _, &mut sl) != 0 { return false; }
|
||||
// sockaddr_in: sa_family (2 bytes) then sin_port (2 bytes, network order).
|
||||
u16::from_be_bytes([sa[2], sa[3]]) == 3216
|
||||
}
|
||||
|
||||
// IAT-hook approach (no inline trampoline — FIFA's `recv`/`send` prologues have
|
||||
// instructions that straddle the 14-byte patch boundary, so an inline trampoline
|
||||
// corrupts them and crashes. IAT hooking only swaps import-table pointers and
|
||||
// never touches the function body). The real fns are resolved in lib.rs and set
|
||||
// here; our hooks call them directly.
|
||||
static REAL_RECV: AtomicUsize = AtomicUsize::new(0);
|
||||
static REAL_SEND: AtomicUsize = AtomicUsize::new(0);
|
||||
|
||||
pub fn set_real_recv(f: unsafe extern "system" fn(usize, *mut u8, i32, i32) -> i32) {
|
||||
REAL_RECV.store(f as usize, Ordering::Relaxed);
|
||||
}
|
||||
pub fn set_real_send(f: unsafe extern "system" fn(usize, *const u8, i32, i32) -> i32) {
|
||||
REAL_SEND.store(f as usize, Ordering::Relaxed);
|
||||
}
|
||||
|
||||
/// Inline-hook ws2_32!recv: build a boundary-safe trampoline (the "real" fn our
|
||||
/// hook calls) and overwrite the entry with a JMP to `hooked_recv`. Inline hooks
|
||||
/// catch calls from every module and dynamically-resolved calls, unlike IAT.
|
||||
pub unsafe fn install_recv_hook() -> bool {
|
||||
let ptr = match get_fn(b"ws2_32.dll\0", b"recv\0") { Some(p) => p, None => return false };
|
||||
match make_trampoline(ptr, "recv") {
|
||||
Some(t) => { RECV_TRAMPOLINE.store(t, Ordering::Relaxed); }
|
||||
None => { crate::write_log("recv_hook: recv trampoline failed, hook skipped\n"); return false; }
|
||||
Some(t) => REAL_RECV.store(t, Ordering::Relaxed),
|
||||
None => return false,
|
||||
}
|
||||
write_jmp(ptr, hooked_recv as u64);
|
||||
true
|
||||
}
|
||||
|
||||
// ─── send ──────────────────────────────────────────────────────────────────────
|
||||
|
||||
static SEND_TRAMPOLINE: AtomicUsize = AtomicUsize::new(0);
|
||||
|
||||
pub unsafe extern "system" fn hooked_send(s: usize, buf: *const u8, len: i32, flags: i32) -> i32 {
|
||||
if crate::lsx::is_lsx(s) {
|
||||
return crate::lsx::on_send(s, buf, len);
|
||||
}
|
||||
let t = SEND_TRAMPOLINE.load(Ordering::Relaxed);
|
||||
if t == 0 { return -1; }
|
||||
let f: unsafe extern "system" fn(usize, *const u8, i32, i32) -> i32 = core::mem::transmute(t);
|
||||
f(s, buf, len, flags)
|
||||
}
|
||||
|
||||
pub unsafe fn install_send_hook() -> bool {
|
||||
let ptr = match get_fn(b"ws2_32.dll\0", b"send\0") { Some(p) => p, None => return false };
|
||||
match make_trampoline(ptr, "send") {
|
||||
Some(t) => { SEND_TRAMPOLINE.store(t, Ordering::Relaxed); }
|
||||
None => { crate::write_log("recv_hook: send trampoline failed, hook skipped\n"); return false; }
|
||||
Some(t) => REAL_SEND.store(t, Ordering::Relaxed),
|
||||
None => return false,
|
||||
}
|
||||
write_jmp(ptr, hooked_send as u64);
|
||||
true
|
||||
}
|
||||
|
||||
pub unsafe extern "system" fn hooked_recv(s: usize, buf: *mut u8, len: i32, flags: i32) -> i32 {
|
||||
let t = REAL_RECV.load(Ordering::Relaxed);
|
||||
if t == 0 { return -1; }
|
||||
let f: unsafe extern "system" fn(usize, *mut u8, i32, i32) -> i32 = core::mem::transmute(t);
|
||||
// Pass through to anadius's real socket, then log what it sent back
|
||||
// (anadius's LSX response — the ground truth we want to diff against).
|
||||
let n = f(s, buf, len, flags);
|
||||
if n > 0 && peer_is_lsx(s) {
|
||||
let data = core::slice::from_raw_parts(buf, n as usize);
|
||||
let text = core::str::from_utf8(data).unwrap_or("(binary)");
|
||||
crate::write_log(&format!("CAP recv<-anadius s={s} n={n}: {}\n", &text[..text.len().min(2400)]));
|
||||
}
|
||||
n
|
||||
}
|
||||
|
||||
pub unsafe extern "system" fn hooked_send(s: usize, buf: *const u8, len: i32, flags: i32) -> i32 {
|
||||
if len > 0 && peer_is_lsx(s) {
|
||||
let data = core::slice::from_raw_parts(buf, len as usize);
|
||||
let text = core::str::from_utf8(data).unwrap_or("(binary)");
|
||||
crate::write_log(&format!("CAP send->anadius s={s} len={len}: {}\n", &text[..text.len().min(2400)]));
|
||||
}
|
||||
let t = REAL_SEND.load(Ordering::Relaxed);
|
||||
if t == 0 { return -1; }
|
||||
let f: unsafe extern "system" fn(usize, *const u8, i32, i32) -> i32 = core::mem::transmute(t);
|
||||
f(s, buf, len, flags)
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user