[Сеть, интернет] Аналог WPE PRO на Autoit

#include "Hooking.au3"
;===================>Global Variables
Global $hHook, $hProc
Global $pString[2] = [0, 0] ;the first element holds the address and the second the length, so its easier to call the _DelString() Function
Global $sProcessName = "Client.exe" ;our target process
Global $param1 = 0;
Global $soketClient = 0;
Global $sizePacket = 0;
Global $MSG_OOB = 0;
Global $modif = 0
Global $param;
;===========>
SetPrivilege("SeDebugPrivilege", 1) ;too trivial
$lpMsgBoxA = _WinAPI_GetProcAddress(_WinAPI_GetModuleHandle("Ws2_32.dll"), "send") ;we are reading the address of MessageBoxA in the RAM
$callback = DllCallbackRegister("myHookFunc", "none", "dword") ;we are registering the callback function
If @error Then
	MsgBox(16, "ERROR", "Couldn't initialize Callback")
	Exit
EndIf
$ptr = DllCallbackGetPtr($callback)
_VirtualProtect(Number($ptr), 94) ;we have to unprotect the Callbackfunction
$hProc = _OpenProcess($sProcessName) ;we have to open the process
$hHook = _SetHook(number($lpMsgBoxA), 5, Number($ptr), "int;int;int;int", $hProc) ;we are going to hook the MessageBoxA-Function
;Do
;	Sleep(1000)
;until NOT ProcessExists($sProcessName) ;waiting

; Ждем инициализацию сокета. Как только от клиента пришел пакет, завершаем цикл.
While Number($soketClient)<1
	Sleep(1000)
	Consolewrite("Проход " & @crlf)
WEnd

;попытка отправить пакет на открытый сокет. Ошибка.
;$paket = 'B9 A9 CB E1 50 5A BD B9 0C 00 00 00 00 00 00 00'
;_TCPSend($soketClient, $paket, $MSG_OOB)

; Вызываем функцию отправки.
; $param - глобальная переменная. Значение заностися при первом перехвате пакета от игры
; $modif - флаг, указывающий на то, что текущий пакет отправлен от Autoit, а не от клиента игры.

;$modif = 1
myHookFunc($param)

_UninstallHook($hHook, $hProc)

Func myHookFunc($iParam) ;=>our HookFunction
	If $pString[0] <> 0 Then _DelString($pString[0], $pString[1], $hProc) ;free the old string
	_GetParameter($iParam, $hHook, $hProc) ;get the parameter from the stack
	ConsoleWrite("================NEW PAKET WILL BE SENDED==========" & @crlf)
	For $i = 1 To 5
		ConsoleWrite($i & ". Argument is " & Number(DllStructgetdata($hHook[5], $i)) & @crlf)
	next
	Consolewrite("iParam: " & $iParam &@crlf)
	;==============>String auslesen
;	$myString = _ReadString(DllStructgetdata($hHook[5], 3), $hproc)
	$param = $iParam
	If $modif>0 Then
;		DllStructSetData($hHook[5], 1, $param1)
;		DllStructSetData($hHook[5], 2, 1188)
		DllStructSetData($hHook[5], 3, 335807180)
		DllStructSetData($hHook[5], 4, 16)
		Consolewrite("Модификация..." & @crlf)
;		DllStructSetData($hHook[5], 5, 0)
		$modif = 0
	EndIf
	$param1 = DllStructgetdata($hHook[5], 1)
	$soketClient = DllStructgetdata($hHook[5], 2)
	$sizePacket = DllStructgetdata($hHook[5], 4)
	$MSG_OOB = DllStructgetdata($hHook[5], 5)
	$myString = String(DllStructgetdata($hHook[5], 3))
	Consolewrite("Gesendet wird: " & $myString &@crlf)

	;===================>
	_SetParameter($iParam, $hHook, $hProc) ;and write it ;)
	return ;works much better with return
EndFunc

Func _TCPSend($Sock, $sData, $iFlag)
    Local $DataBuffer = DllStructCreate("char[" & StringLen($sData)+2 & "]")
    DllStructSetData($DataBuffer, 1, $sData)

    $Ret = DllCall("Ws2_32.dll", "int", "send", "ptr", $Sock, "ptr", DllStructGetPtr($DataBuffer), "int", DllStructGetSize($DataBuffer)-1, "int", $iFlag)
    If $Ret[0] = -1 Then Exit MsgBox(16,"Error",_WinAPI_GetLastErrorMessage())
EndFunc

Func sendPacket($packet, $packetSize, $PROCESS_ID)
	;Declare local variables
	Local $pRemoteThread, $vBuffer, $loop, $result, $OPcode, $processHandle, $packetAddress
	
	;Open process for given processId
	$processHandle = $PROCESS_INFORMATION[1]
	
	;Allocate memory for the OpCode and retrieve address for this
	$functionAddress = DllCall($KERNEL32, 'int', 'VirtualAllocEx', 'int', $processHandle, 'ptr', 0, 'int', 0x46, 'int', 0x1000, 'int', 0x40)
	
	;Allocate memory for the packet to be sent and retrieve the address for this
	$packetAddress = DllCall($KERNEL32, 'int', 'VirtualAllocEx', 'int', $processHandle, 'ptr', 0, 'int', $packetSize, 'int', 0x1000, 'int', 0x40)
	
	;Construct the OpCode for calling the 'SendPacket' function
	$OPcode &= '60'								;PUSHAD
	$OPcode &= 'B8'&_hex($SENDPACKETADDRESS)	;MOV	 EAX, sendPacketAddress
	$OPcode &= '8B0D'&_hex($REALBASEADDRESS)	;MOV     ECX, DWORD PTR [revBaseAddress]
	$OPcode &= '8B4920'							;MOV     ECX, DWORD PTR [ECX+20]
	$OPcode &= 'BF'&_hex($packetAddress[0])		;MOV     EDI, packetAddress	//src pointer
	$OPcode &= '6A'&_hex($packetSize,2)			;PUSH    packetSize		//size
	$OPcode &= '57'								;PUSH    EDI
	$OPcode &= 'FFD0'							;CALL    EAX
	$OPcode &= '61'								;POPAD
	$OPcode &= 'C3'								;RET		
	
	;Put the OpCode into a struct for later memory writing
	$vBuffer = DllStructCreate('byte[' & StringLen($OPcode) / 2 & ']')
	For $loop = 1 To DllStructGetSize($vBuffer)
		DllStructSetData($vBuffer, 1, Dec(StringMid($OPcode, ($loop - 1) * 2 + 1, 2)), $loop)
	Next
	
	;Write the OpCode to previously allocated memory
	DllCall($KERNEL32, 'int', 'WriteProcessMemory', 'int', $processHandle, 'int', $functionAddress[0], 'int', DllStructGetPtr($vBuffer), 'int', DllStructGetSize($vBuffer), 'int', 0)
		
	;Put the packet into a struct for later memory writing
	$vBuffer = DllStructCreate('byte[' & StringLen($packet) / 2 & ']')
	For $loop = 1 To DllStructGetSize($vBuffer)
		DllStructSetData($vBuffer, 1, Dec(StringMid($packet, ($loop - 1) * 2 + 1, 2)), $loop)
	Next
	
	;Write the packet to previously allocated memory
	DllCall($KERNEL32, 'int', 'WriteProcessMemory', 'int', $processHandle, 'int', $packetAddress[0], 'int', DllStructGetPtr($vBuffer), 'int', DllStructGetSize($vBuffer), 'int', 0)
		
	;Create a remote thread in order to run the OpCode
	$hRemoteThread = DllCall($KERNEL32, 'int', 'CreateRemoteThread', 'int', $processHandle, 'int', 0, 'int', 0, 'int', $functionAddress[0], 'ptr', 0, 'int', 0, 'int', 0)
	
	;Wait for the remote thread to finish
	Do
		$result = DllCall('kernel32.dll', 'int', 'WaitForSingleObject', 'int', $hRemoteThread[0], 'int', 50)
	Until $result[0] <> 258
	
	;Close the handle to the previously created remote thread
	DllCall($KERNEL32, 'int', 'CloseHandle', 'int', $hRemoteThread[0])
	
	;Free the previously allocated memory
	DllCall($KERNEL32, 'ptr', 'VirtualFreeEx', 'hwnd', $processHandle, 'int', $functionAddress[0], 'int', 0, 'int', 0x8000)
	DllCall($KERNEL32, 'ptr', 'VirtualFreeEx', 'hwnd', $processHandle, 'int', $packetAddress[0], 'int', 0, 'int', 0x8000)
	
	;Close the Process
	;memclose($processHandle)
	
	Return True
EndFunc		;==>