Solved

How to hook WS2_32.recv systemwide under Windows XP?

Posted on 2004-04-17
7
1,157 Views
Last Modified: 2010-04-05
I'm using MadShi's CodeHook and following WinSock-hook works fine in Win 98, but in Windows XP the hook for the WS2_32.recv function is never called. send, connect and closesocket are still working as intended.

HookAPI('ws2_32.dll', 'recv', @recvCallback, @recvNext);

Some working example code would be great. I guess not SUCH a big deal, but I gave it up to search the web so 500 points, because I need a solution soon :).

Greetings,
Michael
0
Comment
Question by:MrCalab666
  • 4
  • 3
7 Comments
 
LVL 20

Expert Comment

by:Madshi
ID: 10852342
What does HookAPI return? True or false?
0
 

Author Comment

by:MrCalab666
ID: 10853693
Log-File:
send succesfuly hooked
recv succesfuly hooked
recvfrom succesfuly hooked
connect succesfuly hooked
closesocket succesfuly hooked

All hooked. "recvfrom" is even called, but "recv" never and the code works perfectly for Win9x and WinME. If you search google for problems+hooking+recv+XP you'll also find a couple of results with the same problem. Don't know what's so especial on this function. As said, send, recvfrom, connect and closesocket work fine, but my recv is never called. I also don't have any firewall installed or what ever, simple XP install and it doesn't work on friend's computers as well... only on 9x.... why ever. I also tried renewing the hook as written in your documentation... no effect.

Greetings,
Michael
0
 
LVL 20

Expert Comment

by:Madshi
ID: 10853763
Are you sure that the API is called? Maybe the hook doesn't fire, because nobody calls that API?
0
Gigs: Get Your Project Delivered by an Expert

Select from freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely and get projects done right.

 

Author Comment

by:MrCalab666
ID: 10853938
Did a lot of testing now.... seems that many programs which have been calling "recv" in Win9x, don't call it anymore in Windows XP... I guess they're not using WinSock directly, but some sort of driver which uses WinSock in Win9x, but not in XP anymore. I tried a bunch of programs and the only one still using recv was TeamSpeak... what the heck are they using as alternate? Well, for games DirectPlay possibly... but normal applications? I need to find a way to hook in at a lower level I guess, so that I am able to filter all TCP/IP packages, doesn't matter which API they're using, not just the ones using WinSock.... normally thought with hooking WinSock I would hook everything... thought wrong ^^.

Greetings,
Michael
0
 
LVL 20

Expert Comment

by:Madshi
ID: 10853948
Remember, there is wsock32.dll (WinSock 1) and ws2_32.dll (WinSock 2). Also remember, some of the APIs are alternatively available with a "WSA" prefix.
0
 
LVL 20

Accepted Solution

by:
Madshi earned 500 total points
ID: 10853969
I think I know why your hook doesn't work. Lots of programs still link to WinSock 1 (wsock32.dll). E.g. all Delphi programs which are using the WinSock unit link to WinSock 1, if I remember correctly.

Probably in win9x calling WinSock 1's "recv" internally resulted in WinSock 2's "recv" being called. So your hook got all the WinSock 1 calls, too. But now look what WinSock 1 "recv" does internally in XP:

71a31020 public recv:                     ; function entry point
71a31020   push    ebp
71a31021   mov     ebp, esp
71a31023   push    ecx
71a31024   push    ecx
71a31025   mov     eax, [ebp+$10]
71a31028   mov     [ebp-8], eax
71a3102b   mov     eax, [ebp+$c]
71a3102e   mov     [ebp-4], eax
71a31031   mov     eax, [ebp+$14]
71a31034   push    0
71a31036   push    0
71a31038   mov     [ebp+$c], eax
71a3103b   lea     eax, [ebp+$c]
71a3103e   push    eax
71a3103f   lea     eax, [ebp+$10]
71a31042   push    eax
71a31043   push    1
71a31045   lea     eax, [ebp-8]
71a31048   push    eax
71a31049   push    dword ptr [ebp+8]
71a3104c   call    +$16 ($71a31067)       ; WSARecv (WS2_32.dll)
71a3104c
71a31051   cmp     eax, -1
71a31054   jz      loc_71a3106d
71a31054
71a31056   test    byte ptr [ebp+$d], $80
71a3105a   jnz     loc_71a32eb3
71a3105a
71a31060 loc_71a31060:
71a31060   mov     eax, [ebp+$10]
71a31063   leave
71a31064   ret     $10
71a31064
71a31064 ; ---------------------------------------------------------
71a31064
71a3106d loc_71a3106d:
71a3106d   or      [ebp+$10], eax
71a31070   jmp     loc_71a31060
71a31070
71a31070 ; ---------------------------------------------------------
71a31070
71a32eb3 loc_71a32eb3:
71a32eb3   neg     dword ptr [ebp+$10]
71a32eb6   push    $2738
71a32ebb   call    dword ptr [$71a31014]  ; RtlRestoreLastWin32Error (ntdll.dll)
71a32ebb
71a32ec1   jmp     loc_71a31060

P.S: BTW, this is a disassembling created by madDisAsm. You can get such disassemblings yourself by using this code:

uses WinSock, madDisAsm, madRemote, madCodeHook, madExcept;

var s1 : string;
begin
  ParseFunction(FindRealCode(@recv), s1);
  FillClipboard(s1);   // exported by madExcept

Try this code in win9x. Probably you'll see that w2_32.dll's "recv" is being called.
0
 

Author Comment

by:MrCalab666
ID: 10854153
That was the solution, now it's working as intended in XP as well, thanks a bunch :).

Greetings,
Michael

p.s. Am simply "routing" both functions now to my own one and always call WinSock2's recv, works fine:
   b:=HookAPI('ws2_32.dll', 'recv', @recvCallback, @recvNext);
   if(b) then writeln(t,'recv succesfuly hooked') else writeln(t,'recv couldn''t be hooked');
   b:=HookAPI('wsock32.dll', 'recv', @recvCallback, @recvOldNext);
   if(b) then writeln(t,'WinSock1 recv succesfuly hooked') else writeln(t,'WinSock1 recv couldn''t be hooked');
0

Featured Post

Gigs: Get Your Project Delivered by an Expert

Select from freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
build html 5 client that connect to indy Tidtcpserver 3 395
Intraweb download file link ? 1 132
Print Graphic and Text to Epson TM-T88v 12 241
Create a path if not exists 7 76
The uses clause is one of those things that just tends to grow and grow. Most of the time this is in the main form, as it's from this form that all others are called. If you have a big application (including many forms), the uses clause in the in…
Introduction I have seen many questions in this Delphi topic area where queries in threads are needed or suggested. I know bumped into a similar need. This article will address some of the concepts when dealing with a multithreaded delphi database…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…

816 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now