Solved

Replacing WS2_32.DLL

Posted on 2003-11-26
16
7,877 Views
Last Modified: 2013-12-03
I am trying to replace WS2_32.DLL to create a small firewall and logging system.
I 've made a tool which reads a dll and generates CPP,and DEF files that have stubs for the functions inside with
their ordinals.
For WS2_32.DLL , this looks as follows:


#include <stdio.h>
#include <windows.h>
//-------------------

HINSTANCE hDLL = 0;

int _stdcall (*_L_accept)();
int _stdcall (*_L_bind)();
....

extern "C" void _stdcall __declspec(naked) _I_accept()
      {
      asm {jmp _L_accept;}
      }

extern "C" void _stdcall __declspec(naked) _I_bind()
      {
      asm {jmp _L_bind;}
      }

....

And the DEF file is:

EXPORTS

accept=_I_accept @1
bind=_I_bind @2
...

The Entry routine in the CPP file looks like this:

BOOL WINAPI DllEntryPoint(HINSTANCE hI,DWORD fwd,LPVOID)
      {
      if (fwd == DLL_PROCESS_ATTACH)
            {
            hDLL = LoadLibrary("ws2_31.dll"); // This ws2_31.dll is the original ws2_32.dll
            if (!hDLL)
                  return FALSE;

            _L_accept = GetProcAddress(hDLL,"accept");
            _L_bind = GetProcAddress(hDLL,"bind");
            ....
            return TRUE;
            }
      if (fwd == DLL_PROCESS_DETACH)
            FreeLibrary(hDLL);

      return TRUE;
      }


And I link this CPP with my own assembly stub:

// -----
.386
locals
jumps
.model flat,stdcall
L equ <LARGE>

.code

extrn DllEntryPoint:PROC
ADllEntryPoint PROC hInstance:DWORD, fdwReason:DWORD, resvd:DWORD

PUSH L resvd
PUSH L fdwReason
PUSH L hInstance
CALL DllEntryPoint
RET
EndP

.stack
dd 4096 dup(?)


End ADllEntryPoint            
                        

This procedure works when I use another DLL with an app, however when I copy the generated DLL in C:\windows\system32 (through booting with DOS) , the Windows won't start (XP) , even WINLOGON.EXE crashes when loads it.
Can you see any possible problem and/or suggest a different way of making the trick ?

Thanks
0
Comment
Question by:WxW
  • 6
  • 2
  • 2
  • +4
16 Comments
 
LVL 32

Expert Comment

by:jhance
ID: 9823679
This is not the best approach.  You are attempting to write what is called a "SHIM" DLL, replacing the real DLL with one of your own and intercepting calls.  While this can be done, Windows XP works against you since this DLL is one of the "protected" ones in the system.

But to succeed you must implement ALL exports in the original DLL, even the undocumented ones that don't even have names.  Run DUMPBIN /EXPORTS on the original and get your list and start working!!

A better approach is to use one of the interfaces in Windows that Microsoft has provided for doing this.  There are two that are most useful here:

1) If you are interested ONLY in TCPIP traffic, you have the WINSOCK SPI:

http://msdn.microsoft.com/library/default.asp

2) If you are interested in ANY network traffic, you have the NDIS Intermediate API:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/network/hh/network/301int_78mf.asp
0
 
LVL 6

Author Comment

by:WxW
ID: 9824212
The tool I made gets every export from the original DLL and creates a stub that jmps with assembly to the correct entry point. WS2_32.DLL exports 500 items, and most of them are unnamed, only exported by ordinal value. But I still import them with dummy function names.

I found the problem, its because my linker (damn borland !) assings arbitary ordinal numbers , not choosing the ones the DEF file specifies. Rather than change my linker (which requires I would reinstall MS VC 2003 into my 1GB free disk !) , can you suggest me a tool that can change the ordinal numbers in a module so I apply it to the new DLL ?

Thanks a lot.
0
 
LVL 6

Author Comment

by:WxW
ID: 9824217
If i use NDIS , i will have to create a driver...which is something I 've never done !.
0
 
LVL 6

Author Comment

by:WxW
ID: 9824225
Or can you tell me how to change the ordinal value's myself by manipulating the DLL itself?
0
 
LVL 20

Expert Comment

by:Madshi
ID: 9824341
Here you'll find documentation about how PE files look like:

http://msdn.microsoft.com/msdnmag/issues/02/02/PE/default.aspx
http://msdn.microsoft.com/msdnmag/issues/02/03/PE2/default.aspx

Have you already found a solution for the problem with the system file protection? Because if you don't find one, you can forget about the whole idea.
0
 
LVL 8

Expert Comment

by:_corey_
ID: 9830113
Could I find out which version of borland you are using?
0
 
LVL 8

Expert Comment

by:_corey_
ID: 9830139
Also, are you trying to develop something like www.ethereal.com ?  If so, you might be interested in the library they use.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 6

Author Comment

by:WxW
ID: 9830143
builder 6
0
 
LVL 5

Expert Comment

by:Daij-Djan
ID: 9836986
Replacing a shared lib is not the way to go. What if the user doesnt want your dll-changes anymore
0
 

Expert Comment

by:zrazzaque
ID: 10085939
Did the shim approach work? I would like to do the same to implement something on windows along the lines of tcpdump and at the same time showing the process that is using a particular socket(UDP or TCP). I may also want to sniff around while I am at it, which I assume is no problem. An yeah if you did get it to work eventually which compiler did the trick?

Cheers,
Zeeshan
0
 
LVL 6

Author Comment

by:WxW
ID: 10086169
No it doesn't work altought I managed to make it the way I told you. I am pretty sure that the DLL exports everything that should be exported and jumps to the original dll when processing is finished, and XP complains that the dll is incorrect, for unknown reasons. I am still trying to use a NDIS driver.

However, the trick worked for other DLL's, so you can use it.
If you find a way to do it with WS2_32.DLL, or if you find an already working solution, please tell us.
0
 

Expert Comment

by:zrazzaque
ID: 10093538
Right.

Can I have the stub file and the DEF file, or better still can you tell me how to generate those for a DLL?

I gather that you only tried it for XP, am I right? Did you use VC eventually?

Zee
0
 
LVL 6

Author Comment

by:WxW
ID: 10098005
I used a program I made, called 'wrappit' . This program reads the exports (generated by depends.exe) and creates 3 files. The CPP file, which contains functions with the _I_ prefix which jump to the original functions.
The ASM file, which does the same if you want to use assembly, and
the DEF file, which specifies the same ordinals.

And finally, I link the compiled object file, with my .ASM object shown above. That prohibits you to use C++ runtime functions as you would have to link against your compiler's libraries, but I only needed Win32 API.

If you want the source code of 'wrappit', I would be glad to share, send me e-mail at m@turboirc.com
Michael.
0
 
LVL 1

Accepted Solution

by:
Computer101 earned 0 total points
ID: 10883581
PAQed, with points refunded (250)

Computer101
E-E Admin
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

As more and more people are shifting to the latest .Net frameworks, the windows presentation framework is gaining importance by the day. Many people are now turning to WPF controls to provide a rich user experience. I have been using WPF controls fo…
After several hours of googling I could not gather any information on this topic. There are several ways of controlling the USB port connected to any storage device. The best example of that is by changing the registry value of "HKEY_LOCAL_MACHINE\S…
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now