| View previous topic :: View next topic |
| Author |
Message |
Grinning Fool
Joined: 12 Feb 2005
Posts: 264
|
 Posted: Thu Jan 17, 2008 6:08 Post subject: |
 |
|
::headdesk::
Alright, I've been every route I can think of with this. The build works perfectly under Windows, but under WINE... the hook doesn't hook. The DLL never gets injected.
I've checked filenames, wine settings, ini settings, and just about anything else that comes to mind, up to and including making the changes manually and building my own copy. Does anyone have any suggestions for what I could be missing? The only thing that strikes me is that I"m running a later version of wine than previously tested, 9.52
Results were confirmed by adding a quick little module dump to the code:
| WinXP wrote: |
Modules Loaded:
o N:\nwn2server.exe
o C:\WINDOWS\system32\ntdll.dll
o C:\WINDOWS\system32\kernel32.dll
o N:\Detoured.dll
o C:\WINDOWS\system32\USER32.dll
o C:\WINDOWS\system32\GDI32.dll
o C:\WINDOWS\system32\SHELL32.dll
o C:\WINDOWS\system32\ADVAPI32.dll
o C:\WINDOWS\system32\RPCRT4.dll
o C:\WINDOWS\system32\Secur32.dll
o C:\WINDOWS\system32\msvcrt.dll
o C:\WINDOWS\system32\SHLWAPI.dll
o C:\WINDOWS\system32\ole32.dll
o C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
o N:\NWNX4_hook.dll
o C:\WINDOWS\system32\WS2_32.dll
o C:\WINDOWS\system32\WS2HELP.dll
o C:\WINDOWS\system32\WINMM.dll
o C:\WINDOWS\system32\dbghelp.dll
o C:\WINDOWS\system32\VERSION.dll
o N:\NWN2_MemoryMgr_amdxp.dll
o C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCP80.dll
o N:\granny2.dll
o N:\d3dx9_30.dll
o C:\WINDOWS\system32\d3d9.dll
o C:\WINDOWS\system32\d3d8thk.dll
o N:\mss32.dll
o C:\WINDOWS\system32\OLEAUT32.dll
o C:\WINDOWS\system32\IMM32.DLL
o C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
o C:\WINDOWS\system32\comctl32.dll
o C:\WINDOWS\system32\MSCTF.dll
o C:\WINDOWS\system32\msctfime.ime
o C:\WINDOWS\system32\DNSAPI.dll
o C:\WINDOWS\system32\rasadhlp.dll
o C:\WINDOWS\system32\mswsock.dll
o C:\WINDOWS\system32\hnetcfg.dll
o C:\WINDOWS\System32\wshtcpip.dll
o C:\WINDOWS\System32\winrnr.dll
o C:\WINDOWS\system32\WLDAP32.dll
o C:\Program Files\Juniper Networks\Secure Application Manager\samnsp.dll
o C:\WINDOWS\system32\DSOUND.DLL
o C:\WINDOWS\system32\WINTRUST.dll
o C:\WINDOWS\system32\CRYPT32.dll
o C:\WINDOWS\system32\MSASN1.dll
o C:\WINDOWS\system32\IMAGEHLP.dll
o C:\WINDOWS\system32\wdmaud.drv
o C:\WINDOWS\system32\msacm32.drv
o C:\WINDOWS\system32\MSACM32.dll
o C:\WINDOWS\system32\midimap.dll
o C:\WINDOWS\system32\KsUser.dll
o N:\xp_util.dll
o N:\pircbotcpp-mt.dll
o N:\xp_hashtable.dll
o N:\xp_time.dll
o N:\xp_mysql.dll
o C:\WINDOWS\system32\WSOCK32.dll
|
| WINE wrote: |
Modules Loaded:
o Z:\home\nwserver\nwn2server.exe
o c:\windows\system32\ntdll.dll
o c:\windows\system32\KERNEL32.dll
o c:\windows\system32\ws2_32.dll
o c:\windows\system32\iphlpapi.dll
o c:\windows\system32\advapi32.dll
o c:\windows\system32\winmm.dll
o c:\windows\system32\user32.dll
o c:\windows\system32\gdi32.dll
o c:\windows\system32\dbghelp.dll
o c:\windows\system32\psapi.dll
o c:\windows\system32\ole32.dll
o c:\windows\system32\rpcrt4.dll
o Z:\home\nwserver\NWN2_MemoryMgr_amdxp.dll
o C:\windows\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCP80.dll
o C:\windows\winsxs\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
o c:\windows\system32\msvcrt.dll
o Z:\home\nwserver\granny2.dll
o c:\windows\system32\shlwapi.dll
o c:\windows\system32\version.dll
o c:\windows\system32\lz32.dll
o Z:\home\nwserver\d3dx9_30.dll
o c:\windows\system32\d3d9.dll
o c:\windows\system32\wined3d.dll
o Z:\home\nwserver\mss32.dll
o c:\windows\system32\shell32.dll
o c:\windows\system32\comctl32.dll
o c:\windows\system32\oleaut32.dll
|
_________________
Khalidine, a NWN2 persistent world
Looking for volunteers. |
|
| Back to top |
|
 |
xeopherith
Joined: 14 Dec 2007
Posts: 8
|
| Posted: Thu Jan 17, 2008 15:21 Post subject: |
|
|
If you compiled it yourself you may just want to use these already compiled files: http://nwvault.ign.com/View.php?view=NWN2Other.Detail&id=163
They are supposedly confirmed working with wine. I know it works for me on win2003 64bit.
If you want to try sending me your files I can try running them to see if they work on my system. I also have ubuntu loaded with wine and its probably 6 months or so old. |
|
| Back to top |
|
|
Grinning Fool
Joined: 12 Feb 2005
Posts: 264
|
| Posted: Thu Jan 17, 2008 22:47 Post subject: |
|
|
That's actually the first thing I tried. Below is a to a zip with my files; if they also work, I guess that'll make it safe to assume it's related to the WINE version. I have gotten the same (lack of) results even with no plugins present, so the zip file contains only the 'core' files. This version includes a 10 second delay (needed to allow all libraries to load) followed by the output of loaded module list.
Thanks for the help 
http://dev.khalidine.com:8001/misc/NWNX_GF.zip
Another thing I've noticed is that when no module is loaded, NWN2server under wine (without nwnx) uses a constant 6% CPU; while after the module is loaded, it's 18-20% constant. The same scenario on Windows is 0-1%, and 1-2% respectively. Have you seen anything similar?
Hmm... the only other thing worth noting is that my binaries are built against the Visual Studio SP1 version of the runtimes; though I have not been able to find any record of issues with it.
Still, I'll try again tonight using non-sp1 runtimes and the compiled version from nwvault. I'd hate to have to revert the SP1 install to use this though...
_________________
Khalidine, a NWN2 persistent world
Looking for volunteers.
Last edited by Grinning Fool on Fri Jan 18, 2008 5:47; edited 1 time in total |
|
| Back to top |
|
|
cadderly
Joined: 05 Dec 2007
Posts: 8
|
| Posted: Thu Jan 17, 2008 22:55 Post subject: |
|
|
| Grinning Fool wrote: |
Another thing I've noticed is that when no module is loaded, NWN2server under wine (without nwnx) uses a constant 6% CPU; while after the module is loaded, it's 18-20% constant. The same scenario on Windows is 0-1%, and 1-2% respectively. Have you seen anything similar?
|
On my Laptop 2,3 - 4 % with a 1 area test module on Ubuntu 7 |
|
| Back to top |
|
|
Grinning Fool
Joined: 12 Feb 2005
Posts: 264
|
| Posted: Sat Jan 19, 2008 5:17 Post subject: |
|
|
Alright, so...
- confirmed that it wasn't SP1, b/c the downloadable binaries on nwvault are also sp1
- ran a completely new install, "plain vanilla", including removing the ".wine" directory and recreating it.
- Used the downloadable version of the exe/dll files.
Still, the same results. Everything appears to run fine but the hook dll neve gets attached to the nwn2server process ,under WINE only.
I'm out of ideas, unfortunately. xeopherith, did you have any luck with the binaries I linked to in yesterday's post?
_________________
Khalidine, a NWN2 persistent world
Looking for volunteers. |
|
| Back to top |
|
|
Urlord
Joined: 17 Nov 2006
Posts: 122
|
| Posted: Wed Feb 20, 2008 2:34 Post subject: |
|
|
I am trying to install NWN2Server and NWNX4 on a Windows Vista x64 box. Do you have any suggestions?
_________________
Jim (aka, Urlord)
Visit the Persistent World of Nymri |
|
| Back to top |
|
|
Papillon
x-man
Joined: 28 Dec 2004
Posts: 1060
Location: Germany
|
| Posted: Fri Feb 22, 2008 9:45 Post subject: |
|
|
How many people had success with the Detours hooking method on windows (32 and 64 bit), and how many did not ?
I would like to find out whether Detours is ready for becoming the official hooking method.
_________________
Papillon |
|
| Back to top |
|
|
chaoslink
Joined: 23 Aug 2006
Posts: 37
|
| Posted: Fri Feb 22, 2008 20:06 Post subject: |
|
|
I'm using code I pulled from detours to hook a few functions very successfully under Linux.
For some reason I'm not able to hook SetString under windows properly. The function is detoured correctly, but then when I try to call the trampoline I get an access violation. Looks like the function I hooked depends upon ebx(?) and my function is overwriting it. I don't have a good enough understanding of this yet to tell what exactly is going on.
*edit: this is with NWNX2 and NWN1, so it may not have any bearing on the discussion. |
|
| Back to top |
|
|
Gryphyn
Joined: 20 Jan 2005
Posts: 431
|
| Posted: Sat Feb 23, 2008 0:21 Post subject: |
|
|
A More Complete DLL Injection Solution Using CreateRemoteThread
Have a look at the above link.
(I know it works with windows, you may be able to adapt it for Linux)
No MadChook, no Detours (although it works similarly)
Drew Benton (the author) has a series on 'CodeCaves' (code hooking) on the same site.
Cheers
Gryphyn |
|
| Back to top |
|
|
chaoslink
Joined: 23 Aug 2006
Posts: 37
|
| Posted: Sat Feb 23, 2008 5:28 Post subject: |
|
|
From what I can tell, this is just injecting a DLL, not redirecting an existing function.
Detours actually provides functions to handle starting a process and injecting the DLL as well as hooking the function. |
|
| Back to top |
|
|
Grinning Fool
Joined: 12 Feb 2005
Posts: 264
|
| Posted: Sat Feb 23, 2008 16:21 Post subject: |
|
|
| Papillon wrote: | How many people had success with the Detours hooking method on windows (32 and 64 bit), and how many did not ?
I would like to find out whether Detours is ready for becoming the official hooking method. |
This worked fine for me under Windows. However, I was not able to get it entirely working in xp_chat -- I had to leave the old hook in place for that. After a bunch of messing around, I had it about 90% functional, the the missing 10% was critical(executing the chat event script)
| chaoslink wrote: | From what I can tell, this is just injecting a DLL, not redirecting an existing function.
Detours actually provides functions to handle starting a process and injecting the DLL as well as hooking the function. |
That was my thought as well; there are a number of ways to handle simple injection, but the function redirecting is much simplified with detours; and the linked article above doesn't seem to provide that.
_________________
Khalidine, a NWN2 persistent world
Looking for volunteers. |
|
| Back to top |
|
|
Gryphyn
Joined: 20 Jan 2005
Posts: 431
|
| Posted: Sun Feb 24, 2008 22:59 Post subject: |
|
|
Yes, that's the DLL Injection stuff...
The 'CodeCave' articles are about hooking. From what I've read it's an indepth article of hooking functions (much the way detours does it)
Anyways...
Virusman gave you the clue, and it's now in the main code - 'prototyping' to find/mask your 'entry-point'. eg.
| Code: | int (*pt2NWNXSetFunctionPointer)(int (*pt2Function)(char*, char*, char*, int)) = (int (*)(int (*)(char*, char*, char*, int))) hookAt;
pt2NWNXSetFunctionPointer(&NWNXGetInt); |
now Back on topic...
The Injection stuff is the ONLY reason (currently) for having MadCHook. It's the CreateProcessEx() function, replace this and MadChook is no longer required.
Cheers
Gryphyn
Last edited by Gryphyn on Thu Feb 28, 2008 22:50; edited 1 time in total |
|
| Back to top |
|
|
chaoslink
Joined: 23 Aug 2006
Posts: 37
|
| Posted: Thu Feb 28, 2008 18:42 Post subject: |
|
|
| Gryphyn wrote: |
No MadChook, no Detours (although it works similarly)
|
So we should write code from scratch that Detours has been tested to do already? Sure.... and please, don't patronize me, it's not becoming. |
|
| Back to top |
|
|
Gryphyn
Joined: 20 Jan 2005
Posts: 431
|
| Posted: Thu Feb 28, 2008 23:03 Post subject: |
|
|
| chaoslink wrote: | | Gryphyn wrote: |
No MadChook, no Detours (although it works similarly)
|
So we should write code from scratch that Detours has been tested to do already? Sure.... and please, don't patronize me, it's not becoming. |
No, the code is already written, just a matter of using it...
As I said "The Injection stuff is the ONLY reason (currently) for having MadCHook", remains true, and I'm not denying that detours is tested, and works. All that's being offered is another alternative.
I'm sure this wouldn't even be an issue if Madshi had kept 'free' access.
Cheers
Gryphyn |
|
| Back to top |
|
|
GodBeastX
Joined: 09 Aug 2006
Posts: 65
|
| Posted: Thu Feb 28, 2008 23:12 Post subject: |
|
|
| I thought detours had injection functions? I only work with licensed version here, not the open version. Maybe someone could fill me in. |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
