C++ Hooking ws2_32.dll send recv

07/27/2017 06:37 Speaker1337#1

Hi guys,

I am trying to learn hooking and want to hook only an .exe's send/recv function.

I'm building the project as a .dll and then injecting it to the .exe

Now my problem is I am stuck.

I am able to successfully find the address for recv function, next I would like to see the packets that's being received..

A little guide pls on what to do next..
This is my .cpp

Code:

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include "dll.h"

#include <Winsock.h>
#pragma warning(disable:4996)
#pragma comment (lib,"ws2_32.lib")

typedef int(*WINAPI oldsend)(SOCKET s, const char* buf, int len, int flags);



void Proc_Attach()
{
	DWORD dwProtect;
	HINSTANCE hLib = LoadLibrary(L"WS2_32.dll");
	DWORD OldFuncAddr = (DWORD)GetProcAddress(hLib, "recv");
	WCHAR szTest[100]; // WCHAR is the same as wchar_t
					  // swprintf_s is the same as sprintf_s for wide characters
	swprintf_s(szTest, 100, L"%d", OldFuncAddr); // use L"" prefix for wide chars
	MessageBox(0, szTest, L"A", MB_ICONINFORMATION);
	//MessageBox(0, L" Process Attached!\n", L"Hi", MB_ICONINFORMATION);
}



BOOL APIENTRY DllMain(HINSTANCE hInst     /* Library instance handle. */,
	DWORD reason        /* Reason this function is being called. */,
	LPVOID reserved     /* Not used. */)
{
	switch (reason)
	{
	case DLL_PROCESS_ATTACH:
		
		Proc_Attach();
		
		break;

	case DLL_PROCESS_DETACH:
	
		break;

	case DLL_THREAD_ATTACH:
	
		break;

	case DLL_THREAD_DETACH:
		
		break;
	}

	
	return TRUE;
}

header file

Code:

#pragma once
#ifndef _DLL_H_
#define _DLL_H_

#if BUILDING_DLL
# define DLLIMPORT __declspec (dllexport)
#else /* Not BUILDING_DLL */
# define DLLIMPORT __declspec (dllimport)
#endif /* Not BUILDING_DLL */


DLLIMPORT void Proc_Attach(void);



#endif /* _DLL_H_ */

07/27/2017 11:38 BladeTiger12#2

Wow^^ You've done so much already.
I never could do that...
You didn't even firgure out, how to hook?
I think you should really google a bit.
It's not that difficult to find a hook function.
And when you hooked it, it is very easy to get the packet out of the buffer.

(Look under: C++ how to detour)

07/27/2017 11:41 XnovaFR#3

What about [Only registered and activated users can see links. Click Here To Register...] ?

09/05/2017 03:30 Ustonovic#4

Why do you load the winsock library when your target needs it anyway?

09/10/2017 07:55 atom0s#5

Quote:

Originally Posted by Ustonovic

Why do you load the winsock library when your target needs it anyway?

If the target late-loads the library and your DLL is injected before the target has loaded it, it won't be present. Using LoadLibrary on something that is already loaded will just return the current module handle. It is no different than calling GetModuleHandle at that point.

10/07/2017 23:29 maxi39#6

u can do an easy IAT Hook.
1. write a function which has the same signature, analyzes the buffer and calls the orginal function at return.
2. overwrite the orignal adress of recv in iat table with ur new function adress
3. sucess