[C++] Hook ws2_32 send/recv

tarafından **Hello EMO** Cuma Ara. 17, 2010 8:15 am

Hello everyone,

I'm back with another little tool.

This time it's a DLL that can be injected to hook ws2_32 send and recv functions.
If you understand the code below you will see how easy it is to place a hook.

For explanation go to #snoxd on Qnet because this is the snippet section, not tutorials.

Quote#include
#include
#include
#include

BYTE SendAddy[6];
BYTE RecvAddy[6];

HRESULT _stdcall mySend(SOCKET s, const char* buf, int len, int flags);
HRESULT _stdcall myRecv(SOCKET s, char* buf, int len, int flags);
DWORD HookFunc(LPCSTR lpModule, LPCSTR lpFuncName, LPVOID lpFunction, unsigned char *lpAddress);
BOOL ReleaseFunc(LPCSTR lpModule, LPCSTR lpFuncName, unsigned char *lpAddress);

DWORD HookFunc(LPCSTR lpModule, LPCSTR lpFuncName, LPVOID lpFunction, unsigned char *lpAddress)
{
DWORD dwAddr = (DWORD)GetProcAddress(GetModuleHandle(lpModule), lpFuncName);
BYTE jump[6] = { 0xe9, 0x00, 0x00, 0x00, 0x00, 0xc3 };

ReadProcessMemory(GetCurrentProcess(), (LPVOID)dwAddr, lpAddress, 6, 0);
DWORD dwOffset = ((DWORD)lpFunction - dwAddr - 5);

memcpy(&jump[1], &dwOffset, 4);
if(WriteProcessMemory(GetCurrentProcess(), (LPVOID)dwAddr, jump, 6, 0))
return dwAddr;
}

BOOL ReleaseFunc(LPCSTR lpModule, LPCSTR lpFuncName, unsigned char *lpAddress)
{
DWORD dwAddr = (DWORD)GetProcAddress(GetModuleHandle(lpModule), lpFuncName);
return WriteProcessMemory(GetCurrentProcess(), (LPVOID)dwAddr, lpAddress, 6, 0);
}

HRESULT _stdcall myRecv(SOCKET s, char* buf, int len, int flags)
{
ReleaseFunc("Ws2_32.dll", "recv", RecvAddy);
HRESULT hResult = recv(s, buf, len, flags);
HookFunc("Ws2_32.dll", "recv", myRecv, RecvAddy);
return hResult;
}

HRESULT _stdcall mySend(SOCKET s, const char* buf, int len, int flags)
{
ReleaseFunc("Ws2_32.dll", "send", SendAddy);
HRESULT hResult = send(s, buf, len, flags);
HookFunc("Ws2_32.dll", "send", mySend, SendAddy);
return hResult;
}

BOOL APIENTRY DllMain(HINSTANCE hDll, DWORD callReason, LPVOID lpReserved) {
switch ( callReason ) {
case DLL_PROCESS_ATTACH:
MessageBox(0, "Attached.", "", MB_OK | MB_SETFOREGROUND);

HookFunc("Ws2_32.dll", "send", mySend, SendAddy);
HookFunc("Ws2_32.dll", "recv", myRecv, RecvAddy);
break;
case DLL_PROCESS_DETACH:
MessageBox(0, "Detached.", "", MB_OK | MB_SETFOREGROUND);
break;
}

return true;
}