[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

intercepting winsock

Posted on 1998-01-29
8
Medium Priority
?
477 Views
Last Modified: 2013-12-03
I need to do something as Socket Spy 32.
I want my program to start an application and
then intercept all winsock calls.
How can I do that?

0
Comment
Question by:jct052097
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
  • +1
8 Comments
 
LVL 2

Expert Comment

by:anichini
ID: 1410608
Matt Pietrek did something similar in Microsoft System's Journal Volume 12 Number 9 (September 1997), where he wrote something that could spy the wininet.dll. Check out the Under the Hood article. Perhaps the techniques he uses there are applicable to winsock.

0
 
LVL 4

Expert Comment

by:tflai
ID: 1410609
You can write a Winsock Helper kernel-mode driver that will act as an intermediate driver between Winsock and MSTCP protocol driver.  There is an example in the NT's DDK.  Why do you want to go through all that trouble and actually intercept all Winsock calls.  If you just want to monitor Winsock calls, probably anichini's proposed approach would do.
0
 
LVL 1

Author Comment

by:jct052097
ID: 1410610
MSCTCP protocol?
where I can find NT's DDK? it's free?
what's anichini proposed approach? where I can find it?

do you know wether Socket Spy 32 uses a Winsock Helper kernel-mode driver?

0
Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

 
LVL 1

Author Comment

by:jct052097
ID: 1410611
MSCTCP protocol?
where I can find NT's DDK? it's free?

where I can find the Microsoft System's Journal?

do you know wether Socket Spy 32 uses a Winsock Helper kernel-mode driver?

0
 
LVL 4

Expert Comment

by:tflai
ID: 1410612
MSTCP protocol driver - Microsoft TCP/IP Protocol driver.
NTDDK - Device Driver Kit, get it by subscripting to MSDN.
Microsoft System's Journal - MSJ, on-shelf magazine.
I've looked at Socket Spy 32, it looks like that it uses API spy technique rather than using kernel-mode driver.  It can only monitor IP traffic of applications that were launched from within the program.  A kernel-mode intermediate driver would be able to monitor/intercept any IP traffic.
0
 
LVL 1

Author Comment

by:jct052097
ID: 1410613
Not really.
Socket Spy 32 receives the winsock data, look for
a pattern, change for another and then send
the modifed data to the application.

I am just like in the beginning.
I don't know how to monitor and if possible intercept winsock
data for a single application.
Where I can find the microsoft system journal?


0
 
LVL 2

Accepted Solution

by:
AlFa earned 100 total points
ID: 1410614
Get the code of TCPDUMP command of freeBSD (it's unix but sockets have the same philosophy) and do something with it.
You can also get a win tcpdump in a hacker site (do not repeat it!)
0
 
LVL 2

Expert Comment

by:AlFa
ID: 1410615
Sorry I 've just sent a comment. what did my mouse has done!..
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

zlib is a free compression library (a DLL) on which the popular gzip utility is built.  In this article, we'll see how to use the zlib functions to compress and decompress data in memory; that is, without needing to use a temporary file.  We'll be c…
This article surveys and compares options for encoding and decoding base64 data.  It includes source code in C++ as well as examples of how to use standard Windows API functions for these tasks. We'll look at the algorithms — how encoding and decodi…
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
Have you created a query with information for a calendar? ... and then, abra-cadabra, the calendar is done?! I am going to show you how to make that happen. Visualize your data!  ... really see it To use the code to create a calendar from a q…

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question