📡 KafraPacketSeeker

A high-performance, low-level inline API hooking DLL engineered to intercept, log, and structurally reconstruct Winsock (ws2_32.dll) network telemetry via dynamic runtime heuristics.

---

KafraPacketSeeker is a non-invasive, zero-dependency diagnostic utility tailored for protocol researchers, security analysts, and emulation developers working within the Ragnarok Online ecosystem. Unlike traditional packet sniffers that require complex driver installations (e.g., WinPcap/NPcap), this tool attaches directly inside the target process memory space. It hooks the standard send and recv symbols to intercept data streams pre-encryption.

---

🔬 Core Engine Architecture

🛡️ 1. Dynamic Hotpatch & Hooking Subsystem

The engine contains an advanced proxy pipeline (InstallProxyFunction) designed to detect and adapt to various compiler-generated code patterns in the Windows API ecosystem, handling three distinct cases:

[Standard Hotpatch Signature]          [Active Runtime Hook Substitution]
p[-5]  90 90 90 90 90 (NOPs)   ───►    p[-5]  E9 XX XX XX XX (JMP MyProxy)
p[0]   8B FF          (MOV EDI,EDI)    p[0]   EB F9          (JMP short back)

• Standard 5-NOP Hotpatching: Replaces the initial 2-byte placeholder MOV EDI, EDI (0x8BFF) with a short relative jump backward (0xEBF9), where a long relative jump (0xE9) is safely mounted in memory, mitigating thread-safety race conditions.
• Pre-Hooked/Dirty Function Interception: Detects if an auxiliary external overlay (e.g., Anti-Cheat or localized modifications like iRO custom layers) has already written to the target location, dynamically calculation-shifting the offsets to hook securely without triggering process instability.

🧠 2. Statistical Structural Predictor Engine

Rather than merely dumping raw hex streams, dllmain.cpp incorporates an on-the-fly heuristic parser that maintains state inside an active hash table map (std::unordered_map<unsigned short, PacketAnalysis>).

Every 10 samples of a unique tokenized identifier, the engine evaluates payload deltas to output syntactically valid, copy-paste ready C++ code layouts:

• Dynamic Size Determination: Tracks data-length bounds ($O(1)$ updates) to mark structural boundaries as static or variable length.
• Type-Hint Guessing Inference: Runs linear validations over variable stream sections to detect variable data types:
  • Null-terminated string verification using ASCII visual range masks (0x20 to 0x7E).
  • Big-endian/Little-endian value boundaries checking for uint8_t and uint16_t layout configurations.

---

📊 Structural Prediction Output Example

When the buffer evaluator isolates an active payload stream, it echoes structured abstractions directly into the allocated developer console:

=== STRUCT SUGGESTION TO 0x0072 ===
Sended: 10 | len: variable (31-64 bytes)
struct PACKET_0x0072 {
    uint16 packetType;    // 0x0072
    uint16 packetLength;  // Dynamic Length Field Identified
    uint16 va_1;          // offset 4 [variable]
    uint8  va_2;          // offset 6
    char[24] va_3;        // offset 7 [string]
} __attribute__((packed));
=====================================

---

⚙️ Compilation & Macro Matrix Configuration

Fine-tune compiling behavior via adjustments in config.h:

Preprocessor Directive	Engine Operational Scope
#define HOOK_SEND	Intercepts exclusively outgoing client transmission requests.
#define HOOK_RECEIVED	Intercepts exclusively incoming network server responses.
#define HOOK_BOTH	Activates concurrent dual-direction packet surveillance loops.
#define USE_CONSOLE_LOG	Spawns a high-visibility Win32 console instance (AllocConsole) at entry point.

---

🚀 Compilation & Deployment Workflow

Prerequisites

• Microsoft Visual Studio 2019 / 2022 (C++17 Compiler Suite)
• Windows SDK (Targeting Win32 / x86 architecture)

Injection Execution Setup

1. Compile the solution under Release | Win32 mode to produce KafraPacketSeeker.dll.
2. Use any standard usermode injection library (e.g., Warp, Nemo, custom loaders).
3. Alternatively, leverage automatic .asi loading hooks by renaming the binary target to KafraPacketSeeker.asi and configuring your directory root launcher environment.

Sample configuration structure using Warp Loader Architecture

Enable Patch: Load Custom DLL Edit DLLSpec.yml to:

  Name: KafraPacketSeeker.dll
  Funcs:
    - Name: "WinsockHook"

---

⚠️ Compliance & Reverse-Engineering Rules

This software is an open-source security tool provided to the research community under the Unlicense framework. It is strictly developed for sandbox analytics, protocol reconstruction, security logging validation, and local network diagnostics. Do not distribute modified binaries intended for production servers or deployment environments protected by commercial anti-cheat solutions.