asked on

Intercept Windows API Calls

I want to intercept an API function call. I am writing a TCP/IP tunneling program and need to intercept all calls to winsock32.dll and then make those calls from with in my program. I do not want to use any 3d party utilities (like SoftICE) or replace the winsock32.dll. So how do I do this programmically? What can I do in C/C++ or ASM to intercept these or any other API calls before windows calls the code in the approiate DLL?
I remember using a program called AutoSOCKS that captured the TCP/IP information and automatically entered necessary proxy information so it appeared that your system was directly connected to the internet. They did not replace the winsock32.dll file to do this either.
If needed, I will add more points to the question.

duneram

Yes this is possible, but you are going to have to put your replacement API's in a DLL and then inject that DLL into any application that uses those apis. Do you know which application uses the API's that you want to hook?

The reason I ask this is when a 32 bit program starts up, there is a giant table of imported api's that gets resolved. Up successful loading of the table, you will have a function address for each api. The trick is to have your DLL install itself in the target application, then replace the api function address in the table with the address of your replacement api (do this for each of them). Then in your function you need to make (if you want to perform the real api function) the api call the original function address that you replaced.

Its kinda like this:
(example these addresses are arbritary (not real))

API Jump table
SetForegroundWindow 0x000f0100
.

Your dll gets mapped into the target process. You want to hook the SFW api so you locate the function address in the table and replace it with the address of your function

MySetForegroundWindow starts at 0x07000300 (in this example)

API Jump table
SetForegroundWindow 0x07000300 (my address)

Now whenever the SFW api is called in that app, it will reference the jump table and call yours (in your dll). You need to make sure you eventually invoke the original address of 0x000f0100 so that the original SFW is called.

I will post an answer in code in a few moments.

duneram

I've done this before and have my own homemade CD's with the code somewhere to do it. I haven't found the CD yet, but I'll keep looking. (i have hundreds of homemade cd's....)

chensu

http://users.neca.com/vmis/wspy.htm

lordx

ASKER

The winsock spy program is good but it requires me to replace the winsock32.dll. This is something I did not want to do. Duneram's idea is what I am looking for.

Madshi

Duneram's idea seems to be good, but (even if it really works :-) you would have do manipulate all applications you want to hook.
On "www.sysinternals.com" there is a sample named "regMonitor" (for Win95 and WinNT). This sample hooks system wide (!) all calls for registry. Perhaps you could hook winsock calls in the same way. (I'm not sure, it's only an idea.)
But then you would have to write drivers! :-(

duneram

I've done the api hook thing and when I get home I'll take a look again for my source

lordx

ASKER

Adjusted points to 750

ASKER CERTIFIED SOLUTION