Http://blog.163.com/etomahawk.popo/blog/static/919644820081131115223397/
Original post addressThe gaming platform always gives you a mysterious feeling without understanding it. However, when your understanding of socket reaches a certain level, you will no longer feel mysterious.
This technology is summarized in one sentence: Virtual LAN (VLAN ). To implement this platform, we mainly use the client. There are many methods for the client. As far as I know, we can use three methods:
1. Replace Windows Socket DLL. Then, do whatever you want.
2. process injection and hook Winsock function call.
3. Virtual NIC Driver.
In fact, the first two technologies are also used by many Trojans. The so-called technology is a double-edged sword, depending on where you want to use it. Now I know about the combat platform, using the last two methods. Most of them are 2nd-after all, drivers cannot be installed and used under some user permissions.
Haofang, QQ battle platform, VS, etc., basically all adopt the second method. The third method has seen one. The effect is acceptable.
The following describes the platform structure I wrote during my research:
The entire platform consists of two parts: the server and the client.
Communication Method: UDP communication is adopted.
Zero, basic knowledge:
If you are interested in developing a similar platform, I suggest you first understand the following:
A. A simple understanding of Windows protocol stack.
B. Winsock communication.
C. Hook Technology.
D. Data exchange and communication between threads and processes.
E. synchronization between threads.
F. Thread injection.
E. Other Basic Windows development knowledge will not be listed one by one.
These are all basic skills. The basic skills determine the step you can take.
I. Server:
The server is logically divided into two parts:
A. User server: virtual IP Address Allocation, user management, Message notification, etc.
B. Forwarding server: Perform necessary data forwarding (P2P communication is not allowed)
Ii. Client:
The client also contains two parts,
A. Client EXE: Responsible for process injection and communication with the server.
B. Client dll: replaces and processes socket functions.
Note: Both the server and client have the keepalive function. If the packet is not received within a certain period of time, the user is deemed to have dropped.
3. Main workflow:
Here, we will summarize the connection steps of user login and logout, start and exit the game. A. user login process
+ ------------------------------- +
| Enter the user name and password and log on to the system. |
+ ------------------------------- +
|
+ ----------------------------- +
| Send the login package to the server |
+ ----------------------------- +
|
+ ----------------------------- +
| Process feedback |
+ ------------------------------ +
|
<Login successful> ------------ failed -------------> [Prompt User]
|
+ ------------------------------ +
| Request other online user information |
+ ----------------------------- +
Process of user login information Client
+ -------------------- +
| Received User Login package |
+ -------------------- +
|
<Data parsing> ----------------> [discard invalid data packets]
|
<Verify user login information> ----------- failure-failure ------- +
|
|
+ ---------------------------- + ----------------------------------- +
| Assign a virtual IP address | returns logon Failure Information to the client. |
+ ---------------------------- ++ --------------------------------- +
|
+ -------------------------------------- +
| Add a user to the online user list |
+ -------------------------------------- +
| Returns the user's login success and server information |
| To the client | (* contains the forwarding Server Information)
+ -------------------------------------- +
|
+ ------------------------------ +
| Broadcast information to all login users |
+ ----------------------------- +
User login information server processing process (handled by the user server)
B. User logout process
+ -------------------- +
| Receive the user exit package |
+ -------------------- +
|
<Data parsing> ----------------> [discard invalid data packets]
|
+ ---------------------- +
<Search to turn user information> ------------> not found, not processed
+ --------------------- +
|
+ ---------------------------------------- +
| Deletes a user from the online user list |
+ --------------------------------------- +
|
+ ------------------------------------ +
| Reclaim a virtual IP address from another user |
+ ----------------------------------- +
|
+ ------------------------------------------- +
| Broadcast user logout information to all online users |
+ ------------------------------------------- +
Server Processing
<Determine whether the user is in the game> ----------- Yes ----------> prompt the user
|
No
|
+ ----------------------------- +
| Send a logout package to the server |
+ ----------------------------- +
|
+ ------------------------- +
| Exit |
+ ------------------------- +
Client Processing
C. Game Startup Process
+ -------------------------- +
| Creates a memory share. |
| (Createfilemapping) |
| Write the current game Configuration |
| (Including online user information and |
| Forwarding Server Information) |
+ -------------------------- +
|
+ ----------------------------- +
| Start the game based on user selection |
| (CreateProcess call) |
+ ---------------------------- +
|
<Start successful or not> ------------ no ----------> [Prompt User Failure Information]
|
+ ----------------------------- +
| Inject game DLL into the game |
+ ---------------------------- +
|
+ -------------------------------- +
| Reads game configuration information |
+ ------------------------------- +
|
+ ----------------------------- +
| Connect to the forwarding server |
+ ----------------------------- +
|
+ -------------------------------------- +
| Game DLL hook all network functions |
| (Using the inline Hook method) |
+ ------------------------------------- +
|
+ ---------------------------------- +
| OK, now game start OK! |
+ ---------------------------------- + D. Game Exit Process
+ ---------------------------------------------- +
| Game DLL releases all hook functions |
+ --------------------------------------------- +
|
+ ----------------------------------- +
| Disable memory shared files |
+ ----------------------------------- +
|
+ -------------------------------------- +
| Send and exit the package to the forwarding server |
+ -------------------------------------- +
4. Game DLL working process:
I am afraid this part is the most important part of the entire platform operation process. Therefore, I will explain the structure of this part separately.
Here, I divide the processing process into three layers, each of which has different functions: network hook layer, custom protocol stack, and network data transmission layer.
First, hook all upper-layer network function calls and hand them over to the custom protocol stack for processing. After processing is complete, if data needs to be sent, it will be sent to the lower-layer network sending layer.
+ ---------------------------------------------------------- +
|
| Network Function hook layer: replaces network functions. |
| And submitted to the lower layer for processing |
| Here, in fact, for ws2_32.dll |
| Replace the socket function. |
|
+ ----------------------------------------------------------- +
|
| Data Processing Layer: mainly responsible for transferring various upper-Layer Networks |
| Function call. |
| For example, when a game calls the socket function |
| When preparing to create a socket, we will follow its parameters. |
| A socket handle is virtualized internally to it. Actually |
| Windows itself does not know the call process. |
|
+ --------------------------------------------------------- +
|
| Real network transmission layer: At this layer, it is the real number. |
| Packaging and sending of data packets |
|
+ --------------------------------------------------------- +
In fact, the entire client only creates two sockets, one for communication with the server, and the other for communication between the forwarding server and the game created in the game DLL.
What is important here is the middle layer, which is mainly to simulate each function in the SOCKET call. This requires you to understand it yourself. I cannot and cannot describe everything.
In fact, the second layer of processing here can also not use this method, you can use the Protocol replacement method, for example, when the game calls the socket function to create an IPX socket, you can change the parameters to UDP, and then call the real socket function of windows.
5. Major technical difficulties:
A. Simulate windows socket.
This technical point is more than said. We know that Windows has six socket models, and we must simulate most of them (the models to be simulated vary depending on the model used by the game ).
Based on my tracking and testing, let's talk about the socket models and protocol types used by the games I know:
Red Alert: A simple wsaasyncselect model is used. (IPX protocol)
StarCraft: The select model is used. (IPX, UDP protocol, based on user parameters)
Dark black: uses the select model. (Using TCP protocol)
Anti-terrorism elites: Use the select model. (Using TCP and UDP protocols)
Frozen throne: It seems that the iocp socket model is used. This is not very clear. (TCP and UDP protocols are used)
B. Improve the reliability of UDP data communication.
In the entire platform, all communications Use UDP, so this is very important. If TCP communication is used in our game, we can ensure that all data can be received by the other party during simulation.
6. Development Postscript:
Last year, I wrote a battle platform study in English. Now, it's just **! It may be that it is relatively impetuous and I have no idea about anything. A year later, I looked back at the code I wrote. Now, I feel a lot more calm and more mature in technology. I want to talk about Windows development. I am a beginner! Haha!
It is difficult to test and develop the entire platform on my machine. Project. Now, I only pass the test on three games: red alert, Starcraft, and dark. I feel that I am too tired to develop a person. In addition, these things have been debugged step by step through multiple AV errors. I think those years are really hard to look back! I don't want to continue. Wait until you have time and energy.
Many times, in order to be able to debug a function, I don't know how many game reboots I have to go through. Basically, most of the socket functions on msdn have been reviewed by me. I understand the parameters and return values of each function.
To understand the principle of socket implementation in windows, read the source code that is said to be Win2k (if you want to read it, search the Internet and unzip it for about 700 mb ), the socket code is in the/Win2k/private/NET/sockets/Winsock2/wsock32 directory (it is estimated that it is the source code of ws2_32.dll). I have read a lot of content and learned something, also let me know how to write the socket program in the future. Now, when I am tired of writing code, I will read the source code of windows, which is quite interesting. Such as the implementation of Gina and the implementation of commctrl.
There are at least 10 thousands or 20 thousands lines of code already written, basically all of which are typed by a letter in editplus/notepad. If you do not want to share the principles for the moment, share the principles. |
