Solved

Replacing WS2_32.DLL

Posted on 2003-11-26
16
7,890 Views
Last Modified: 2013-12-03
I am trying to replace WS2_32.DLL to create a small firewall and logging system.
I 've made a tool which reads a dll and generates CPP,and DEF files that have stubs for the functions inside with
their ordinals.
For WS2_32.DLL , this looks as follows:


#include <stdio.h>
#include <windows.h>
//-------------------

HINSTANCE hDLL = 0;

int _stdcall (*_L_accept)();
int _stdcall (*_L_bind)();
....

extern "C" void _stdcall __declspec(naked) _I_accept()
      {
      asm {jmp _L_accept;}
      }

extern "C" void _stdcall __declspec(naked) _I_bind()
      {
      asm {jmp _L_bind;}
      }

....

And the DEF file is:

EXPORTS

accept=_I_accept @1
bind=_I_bind @2
...

The Entry routine in the CPP file looks like this:

BOOL WINAPI DllEntryPoint(HINSTANCE hI,DWORD fwd,LPVOID)
      {
      if (fwd == DLL_PROCESS_ATTACH)
            {
            hDLL = LoadLibrary("ws2_31.dll"); // This ws2_31.dll is the original ws2_32.dll
            if (!hDLL)
                  return FALSE;

            _L_accept = GetProcAddress(hDLL,"accept");
            _L_bind = GetProcAddress(hDLL,"bind");
            ....
            return TRUE;
            }
      if (fwd == DLL_PROCESS_DETACH)
            FreeLibrary(hDLL);

      return TRUE;
      }


And I link this CPP with my own assembly stub:

// -----
.386
locals
jumps
.model flat,stdcall
L equ <LARGE>

.code

extrn DllEntryPoint:PROC
ADllEntryPoint PROC hInstance:DWORD, fdwReason:DWORD, resvd:DWORD

PUSH L resvd
PUSH L fdwReason
PUSH L hInstance
CALL DllEntryPoint
RET
EndP

.stack
dd 4096 dup(?)


End ADllEntryPoint            
                        

This procedure works when I use another DLL with an app, however when I copy the generated DLL in C:\windows\system32 (through booting with DOS) , the Windows won't start (XP) , even WINLOGON.EXE crashes when loads it.
Can you see any possible problem and/or suggest a different way of making the trick ?

Thanks
0
Comment
Question by:WxW
  • 6
  • 2
  • 2
  • +4
16 Comments
 
LVL 32

Expert Comment

by:jhance
ID: 9823679
This is not the best approach.  You are attempting to write what is called a "SHIM" DLL, replacing the real DLL with one of your own and intercepting calls.  While this can be done, Windows XP works against you since this DLL is one of the "protected" ones in the system.

But to succeed you must implement ALL exports in the original DLL, even the undocumented ones that don't even have names.  Run DUMPBIN /EXPORTS on the original and get your list and start working!!

A better approach is to use one of the interfaces in Windows that Microsoft has provided for doing this.  There are two that are most useful here:

1) If you are interested ONLY in TCPIP traffic, you have the WINSOCK SPI:

http://msdn.microsoft.com/library/default.asp

2) If you are interested in ANY network traffic, you have the NDIS Intermediate API:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/network/hh/network/301int_78mf.asp
0
 
LVL 6

Author Comment

by:WxW
ID: 9824212
The tool I made gets every export from the original DLL and creates a stub that jmps with assembly to the correct entry point. WS2_32.DLL exports 500 items, and most of them are unnamed, only exported by ordinal value. But I still import them with dummy function names.

I found the problem, its because my linker (damn borland !) assings arbitary ordinal numbers , not choosing the ones the DEF file specifies. Rather than change my linker (which requires I would reinstall MS VC 2003 into my 1GB free disk !) , can you suggest me a tool that can change the ordinal numbers in a module so I apply it to the new DLL ?

Thanks a lot.
0
 
LVL 6

Author Comment

by:WxW
ID: 9824217
If i use NDIS , i will have to create a driver...which is something I 've never done !.
0
Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

 
LVL 6

Author Comment

by:WxW
ID: 9824225
Or can you tell me how to change the ordinal value's myself by manipulating the DLL itself?
0
 
LVL 20

Expert Comment

by:Madshi
ID: 9824341
Here you'll find documentation about how PE files look like:

http://msdn.microsoft.com/msdnmag/issues/02/02/PE/default.aspx
http://msdn.microsoft.com/msdnmag/issues/02/03/PE2/default.aspx

Have you already found a solution for the problem with the system file protection? Because if you don't find one, you can forget about the whole idea.
0
 
LVL 8

Expert Comment

by:_corey_
ID: 9830113
Could I find out which version of borland you are using?
0
 
LVL 8

Expert Comment

by:_corey_
ID: 9830139
Also, are you trying to develop something like www.ethereal.com ?  If so, you might be interested in the library they use.
0
 
LVL 6

Author Comment

by:WxW
ID: 9830143
builder 6
0
 
LVL 5

Expert Comment

by:Daij-Djan
ID: 9836986
Replacing a shared lib is not the way to go. What if the user doesnt want your dll-changes anymore
0
 

Expert Comment

by:zrazzaque
ID: 10085939
Did the shim approach work? I would like to do the same to implement something on windows along the lines of tcpdump and at the same time showing the process that is using a particular socket(UDP or TCP). I may also want to sniff around while I am at it, which I assume is no problem. An yeah if you did get it to work eventually which compiler did the trick?

Cheers,
Zeeshan
0
 
LVL 6

Author Comment

by:WxW
ID: 10086169
No it doesn't work altought I managed to make it the way I told you. I am pretty sure that the DLL exports everything that should be exported and jumps to the original dll when processing is finished, and XP complains that the dll is incorrect, for unknown reasons. I am still trying to use a NDIS driver.

However, the trick worked for other DLL's, so you can use it.
If you find a way to do it with WS2_32.DLL, or if you find an already working solution, please tell us.
0
 

Expert Comment

by:zrazzaque
ID: 10093538
Right.

Can I have the stub file and the DEF file, or better still can you tell me how to generate those for a DLL?

I gather that you only tried it for XP, am I right? Did you use VC eventually?

Zee
0
 
LVL 6

Author Comment

by:WxW
ID: 10098005
I used a program I made, called 'wrappit' . This program reads the exports (generated by depends.exe) and creates 3 files. The CPP file, which contains functions with the _I_ prefix which jump to the original functions.
The ASM file, which does the same if you want to use assembly, and
the DEF file, which specifies the same ordinals.

And finally, I link the compiled object file, with my .ASM object shown above. That prohibits you to use C++ runtime functions as you would have to link against your compiler's libraries, but I only needed Win32 API.

If you want the source code of 'wrappit', I would be glad to share, send me e-mail at m@turboirc.com
Michael.
0
 
LVL 1

Accepted Solution

by:
Computer101 earned 0 total points
ID: 10883581
PAQed, with points refunded (250)

Computer101
E-E Admin
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article shows how to make a Windows 7 gadget that extends its U/I with a flyout panel -- a window that pops out next to the gadget.  The example gadget shows several additional techniques:  How to automatically resize a gadget or flyout panel t…
For a while now I'v been searching for a circular progress control, much like the one you get when first starting your Silverlight application. I found a couple that were written in WPF and there were a few written in Silverlight, but all appeared o…
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

808 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question