Solved

How to hook WS2_32.recv systemwide under Windows XP?

Posted on 2004-04-17
7
1,143 Views
Last Modified: 2010-04-05
I'm using MadShi's CodeHook and following WinSock-hook works fine in Win 98, but in Windows XP the hook for the WS2_32.recv function is never called. send, connect and closesocket are still working as intended.

HookAPI('ws2_32.dll', 'recv', @recvCallback, @recvNext);

Some working example code would be great. I guess not SUCH a big deal, but I gave it up to search the web so 500 points, because I need a solution soon :).

Greetings,
Michael
0
Comment
Question by:MrCalab666
  • 4
  • 3
7 Comments
 
LVL 20

Expert Comment

by:Madshi
ID: 10852342
What does HookAPI return? True or false?
0
 

Author Comment

by:MrCalab666
ID: 10853693
Log-File:
send succesfuly hooked
recv succesfuly hooked
recvfrom succesfuly hooked
connect succesfuly hooked
closesocket succesfuly hooked

All hooked. "recvfrom" is even called, but "recv" never and the code works perfectly for Win9x and WinME. If you search google for problems+hooking+recv+XP you'll also find a couple of results with the same problem. Don't know what's so especial on this function. As said, send, recvfrom, connect and closesocket work fine, but my recv is never called. I also don't have any firewall installed or what ever, simple XP install and it doesn't work on friend's computers as well... only on 9x.... why ever. I also tried renewing the hook as written in your documentation... no effect.

Greetings,
Michael
0
 
LVL 20

Expert Comment

by:Madshi
ID: 10853763
Are you sure that the API is called? Maybe the hook doesn't fire, because nobody calls that API?
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 

Author Comment

by:MrCalab666
ID: 10853938
Did a lot of testing now.... seems that many programs which have been calling "recv" in Win9x, don't call it anymore in Windows XP... I guess they're not using WinSock directly, but some sort of driver which uses WinSock in Win9x, but not in XP anymore. I tried a bunch of programs and the only one still using recv was TeamSpeak... what the heck are they using as alternate? Well, for games DirectPlay possibly... but normal applications? I need to find a way to hook in at a lower level I guess, so that I am able to filter all TCP/IP packages, doesn't matter which API they're using, not just the ones using WinSock.... normally thought with hooking WinSock I would hook everything... thought wrong ^^.

Greetings,
Michael
0
 
LVL 20

Expert Comment

by:Madshi
ID: 10853948
Remember, there is wsock32.dll (WinSock 1) and ws2_32.dll (WinSock 2). Also remember, some of the APIs are alternatively available with a "WSA" prefix.
0
 
LVL 20

Accepted Solution

by:
Madshi earned 500 total points
ID: 10853969
I think I know why your hook doesn't work. Lots of programs still link to WinSock 1 (wsock32.dll). E.g. all Delphi programs which are using the WinSock unit link to WinSock 1, if I remember correctly.

Probably in win9x calling WinSock 1's "recv" internally resulted in WinSock 2's "recv" being called. So your hook got all the WinSock 1 calls, too. But now look what WinSock 1 "recv" does internally in XP:

71a31020 public recv:                     ; function entry point
71a31020   push    ebp
71a31021   mov     ebp, esp
71a31023   push    ecx
71a31024   push    ecx
71a31025   mov     eax, [ebp+$10]
71a31028   mov     [ebp-8], eax
71a3102b   mov     eax, [ebp+$c]
71a3102e   mov     [ebp-4], eax
71a31031   mov     eax, [ebp+$14]
71a31034   push    0
71a31036   push    0
71a31038   mov     [ebp+$c], eax
71a3103b   lea     eax, [ebp+$c]
71a3103e   push    eax
71a3103f   lea     eax, [ebp+$10]
71a31042   push    eax
71a31043   push    1
71a31045   lea     eax, [ebp-8]
71a31048   push    eax
71a31049   push    dword ptr [ebp+8]
71a3104c   call    +$16 ($71a31067)       ; WSARecv (WS2_32.dll)
71a3104c
71a31051   cmp     eax, -1
71a31054   jz      loc_71a3106d
71a31054
71a31056   test    byte ptr [ebp+$d], $80
71a3105a   jnz     loc_71a32eb3
71a3105a
71a31060 loc_71a31060:
71a31060   mov     eax, [ebp+$10]
71a31063   leave
71a31064   ret     $10
71a31064
71a31064 ; ---------------------------------------------------------
71a31064
71a3106d loc_71a3106d:
71a3106d   or      [ebp+$10], eax
71a31070   jmp     loc_71a31060
71a31070
71a31070 ; ---------------------------------------------------------
71a31070
71a32eb3 loc_71a32eb3:
71a32eb3   neg     dword ptr [ebp+$10]
71a32eb6   push    $2738
71a32ebb   call    dword ptr [$71a31014]  ; RtlRestoreLastWin32Error (ntdll.dll)
71a32ebb
71a32ec1   jmp     loc_71a31060

P.S: BTW, this is a disassembling created by madDisAsm. You can get such disassemblings yourself by using this code:

uses WinSock, madDisAsm, madRemote, madCodeHook, madExcept;

var s1 : string;
begin
  ParseFunction(FindRealCode(@recv), s1);
  FillClipboard(s1);   // exported by madExcept

Try this code in win9x. Probably you'll see that w2_32.dll's "recv" is being called.
0
 

Author Comment

by:MrCalab666
ID: 10854153
That was the solution, now it's working as intended in XP as well, thanks a bunch :).

Greetings,
Michael

p.s. Am simply "routing" both functions now to my own one and always call WinSock2's recv, works fine:
   b:=HookAPI('ws2_32.dll', 'recv', @recvCallback, @recvNext);
   if(b) then writeln(t,'recv succesfuly hooked') else writeln(t,'recv couldn''t be hooked');
   b:=HookAPI('wsock32.dll', 'recv', @recvCallback, @recvOldNext);
   if(b) then writeln(t,'WinSock1 recv succesfuly hooked') else writeln(t,'WinSock1 recv couldn''t be hooked');
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

The uses clause is one of those things that just tends to grow and grow. Most of the time this is in the main form, as it's from this form that all others are called. If you have a big application (including many forms), the uses clause in the in…
Creating an auto free TStringList The TStringList is a basic and frequently used object in Delphi. On many occasions, you may want to create a temporary list, process some items in the list and be done with the list. In such cases, you have to…
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now