Hook HttpWebRequest

09/27/2013 01:17 qkuh#1
Hello Community.
How to hook for instance HttpWebRequest functions? Hooking C++ functions is quite easy but hooking .NET Framework functions does not work for me. The dll's cannot be injected. Do you have any solutions for my problem? I want to inject a native dll into a managed process.

Greetings,

qkuh
09/27/2013 02:18 Jeoni#2
Well, it's just theory, as I never get in touch with hooking managed function. And I guess you can't hook managed code with a native module.
But the managed code is just a layer over the native code. The .net runtime (CLR) has to JIT-compile or interpret the .net bytecode to execute it. So whenever an managed application sends out a HttpWebRequest there have to be a native packet sent by a native socket (most likely over the native winapi). So your native dll could hook these functions (which is quite easy, just like you said) and log / analyse them.
Of course you can play around a bit and see if a winapi call to send a packet always comes from the same location (mscoree.dll maybe, I don't know) so you would know which .net function equivalent it is or if one HttpWebRequest instance always has the same socket. Maybe these things could be usefull for you.
I hope that I was able to help you at least a bit ;)
Jeoni
09/27/2013 02:35 qkuh#3
Yea, HttpWebRequest uses WSAConnect but how should I hook it? Because it's inside the ws2_32.dll which is loaded by the .net application.
09/27/2013 09:22 dready#4
There are some ways todo it, jeonis approach is working normaly. Could you give us a bit more information about what you want to do ?

Iam a bit suprised btw, detouring ws2_32.dll functions should work :o
09/28/2013 14:34 dasschild#5
[Only registered and activated users can see links. Click Here To Register...]
09/28/2013 15:30 qkuh#6
Quote:
Originally Posted by dasschild View Post
[Only registered and activated users can see links. Click Here To Register...]
That does not help me. I do not have access to the sourcecode. Thanks anyway.
09/28/2013 16:10 tolio#7
code in fremden .net code zu injecten sollte ja wohl kein problem sein. also wirste wohl auch das oben nutzen können

sonst wie schon gesagt einfach winsock hooken