[meTaLiCroSS]

By hooking SV_ConnectClient you can parse some player data like name and more from his userinfo.

But I can't find a way of hooking something that let us know which is the IP address from the recently connected user.

Tryed hooking NET_IsLocalAddress inside SV_ConnectClient but the first param it's equal to 1 or 3 (meaning 1=localhost and 3=otherwise).

Another way could be hooking NET_AdrToString but the bad is that I can't create a correct signature of bytes from it

From swds.dll (updated cs) seeking a lot of functions, sub_1D57190 = NET_AdrToString, bad thing is:

1. I don't know his params
2. It's like the same as NET_BaseAdrToString, could affect the sig of bytes

This is just for adding some restriction for botnet detection, and yeah, it's possible, if another case, i won't be asking for a signature of an updated cs version so keep away that kind of comments.

[Arkshine]

From NET_IsLocalAddres, you should be able to get IP. The arg passed is a netadr_s structure. At index 0, it's the type set, then after it's the IP.


struct netadr_s
{
netadrtype_t type;
unsigned __int8 ip[4];
unsigned __int8 ipx[10];
unsigned __int16 port;
};

[Neeeeeeeeeel.-]

Originally Posted by Arkshine From NET_IsLocalAddres, you should be able to get IP. The arg passed is a netadr_s structure. At index 0, it's the type set, then after it's the IP. struct netadr_s { netadrtype_t type; unsigned __int8 ip[4]; unsigned __int8 ipx[10]; unsigned __int16 port; };

Would this work? I can't test right now.

PHP Code:

public OnNET_IsLocalAddress_Post(ptr)
{
        new szClientAddr[32];
        new arg[8];
        read_argc(0, arg, charsmax(arg));
        new iAddressPtr = arg[1];
        formatex(szClientAddr, charsmax(szClientAddr), "%d.%d.%d.%d", ((iAddressPtr>>0) & 255), ((iAddressPtr>>8) & 255), ((iAddressPtr>>16) & 255), ((iAddressPtr>>24) & 255))
        server_print("Client IP: %s", szClientAddr);
        Unregister_NET_IsLocalAddress()
} 


I only see this in a decompiled engine

PHP Code:

bool __cdecl NET_IsLocalAddress(int a1)
{
  return a1 == 1;
} 


How did you know which args are passed to the function?

[Arkshine]

If you're using Orpheu, you will need to create a memory file containing structure offset, and using OrpheuMemoryGetAtAdress( ptr, ... etc to read the value.

With Okapi, it's more simple, probably just need okapi_get_ptr_array.

[Neeeeeeeeeel.-]

Here is the full plugin:

PHP Code:

#include <amxmodx>
#include <orpheu>
#include <orpheu_memory>
 
new OrpheuHook:g_hHook_NET_IsLocalAddress
new OrpheuFunction:g_hFunc_NET_IsLocalAddress
new OrpheuFunction:g_hFunc_NET_AdrToString
 
public plugin_init()
{
        OrpheuRegisterHook(OrpheuGetFunction("SV_ConnectClient"), "OnSV_ConnectClient");
        OrpheuRegisterHook(OrpheuGetFunction("SV_ConnectClient"), "OnSV_ConnectClient_Post", OrpheuHookPost);
       
        g_hFunc_NET_AdrToString = OrpheuGetFunction("NET_AdrToString");
        g_hFunc_NET_IsLocalAddress = OrpheuGetFunction("NET_IsLocalAddress");
}
 
public OnSV_ConnectClient(){
    g_hHook_NET_IsLocalAddress = OrpheuRegisterHook(g_hFunc_NET_IsLocalAddress, "OnNET_IsLocalAddress_Post", OrpheuHookPost);
}
 
public OnNET_IsLocalAddress_Post(ptr)
{
    new szClientAddr[32];
    new arg[8];
    read_argc(0, arg, charsmax(arg));
    // this was first meTaLiCroSS try but it crashs
    //new iAddressPtr = OrpheuMemoryGetAtAdress(ptr+8, "int");
    
    // this is what you meant?
    new iAddressPtr = OrpheuMemoryGetAtAdress(arg[1], "int");
    formatex(szClientAddr, charsmax(szClientAddr), "%d.%d.%d.%d", ((iAddressPtr>>0) & 255), ((iAddressPtr>>8) & 255), ((iAddressPtr>>16) & 255), ((iAddressPtr>>24) & 255))
    server_print("Client IP: %s", szClientAddr);
    Unregister_NET_IsLocalAddress()
}
 
public OnSV_ConnectClient_Post()
{
    if(g_hHook_NET_IsLocalAddress) // no corto la funcion antes, lo corto en el primer chequeo
        Unregister_NET_IsLocalAddress()
}
 
Unregister_NET_IsLocalAddress()
{
    OrpheuUnregisterHook(g_hHook_NET_IsLocalAddress);
    g_hHook_NET_IsLocalAddress = OrpheuHook:0
} 


Edit: After re-reading your post. I think you meat I have to make a signature for netadr_s structure. Am I right?

[meTaLiCroSS]

Originally Posted by Arkshine With Okapi, it's more simple, probably just need okapi_get_ptr_array.

Another reason for using Okapi, thanks again Arkshine, gonna test now

[Arkshine]

@Neeeeeeeeeel.- : no, you have just to make config representing the structure.

Probably something like :

    {
        "name"        : "netadr_ip",
        "type"        : "int",
        "memoryType"  : "data",
        "identifiers" : 
        [
            {
                "os"    : "windows",
                "mod"   : "cstrike",
                "value" : 4
            },
            {
                "os"    : "linux",
                "mod"   : "cstrike",
                "value" : 4
            }
        ]
    }

Then new ip[4]; OrpheuMemoryGetAtAddress( ptr, "netadr_ip", ip , etc. Don't remember the syntax.

Or possible to do : OrpheuMemoryGetAtAddress( ptr + 4, "int", ip, etc. Like you can see with Infinite Round, etc.

Sorry to be vague, tell me if you don't understand. You can try Okapi too.


@meTaLiCroSS: Okapi has some interesting natives. It will be probably more easy to use, at least different, but the sad part is that hardcoding all in a plugin is really a bad thing. Though it should be more solid than Orpheu. Well, it won't hurt to try I guess.

[meTaLiCroSS]

Using okapi_get_ptr_array crashes, and I think it's because "ptr" parameter is equal to 3

Can be maybe the signature?

PHP Code:

#define SKIPBIT 0xDEF
// ...
new iBytes_NET_IsLocalAddress[] = {0x55,0x8B,0xEC,0x8B,0x4D,SKIPBIT,0x33,0xC0,0x83,0xF9,SKIPBIT,0x0F,0x94,0xC0,0x5D,0xC3} 


PHP Code:

public OnNET_IsLocalAddress_Post(ptr)
{
    server_print("Called!, ptr=%d, ret=%d", ptr, okapi_get_orig_return())

    new iNetAddrData[4]
    okapi_get_ptr_array(ptr, iNetAddrData, sizeof iNetAddrData)
} 


It's hooked correctly, no error given with this one and SV_ConnectClient

[Arkshine]

How do you hook the function ?

[meTaLiCroSS]

Originally Posted by Arkshine How do you hook the function ?

PHP Code:

    new iBytes_NET_IsLocalAddress[] = {0x55,0x8B,0xEC,0x8B,0x4D,SKIPBIT,0x33,0xC0,0x83,0xF9,SKIPBIT,0x0F,0x94,0xC0,0x5D,0xC3}
    new iSig_NET_IsLocalAddress = okapi_engine_find_sig_at(iEngineBasePtr, iBytes_NET_IsLocalAddress, sizeof iBytes_NET_IsLocalAddress)
    g_hFunc_NET_IsLocalAddress = okapi_build_function(iSig_NET_IsLocalAddress, arg_int /*ret*/, arg_int /*arg1*/) 


PHP Code:

public OnSV_ConnectClient()
{
    g_hHook_NET_IsLocalAddress = okapi_add_hook(g_hFunc_NET_IsLocalAddress, "OnNET_IsLocalAddress_Post", true)
} 


The callback is called correctly, it just crashes with okapi_get_ptr_array