Xtrap hooks routines that are used for such purposes(ntwpm,ntop,nttp).The only possible way that I know for redirecting something that uses xtrap(in user mode!!),is to create the process suspended,hook Connect(WS2_32.dll) and then let xtrap go.But you cannot write anything after the routines are hooked by xtrap unless they are unhooked.
Even unhooked,xtrap makes crc checks.
It's not easy to bypass protections written by talented people.Requires skills to write drivers.
|