| View previous topic :: View next topic |
| Author |
Message |
John Smith
Guest
|
 Posted: Sat Mar 19, 2005 4:50 pm Post subject: Re: Hooking Winsock Functions |
 |
|
Any source code examples available which do NOT rely on thirdparty,
compiled, exes, libs or dlls? If not, sounds like a plausable hack...
Regards
"Remy Lebeau (TeamB)" <no.spam (AT) no (DOT) spam.com> wrote
| Quote: |
"KR" <kr (AT) nospamme (DOT) net> wrote in message
news:pan.2004.12.04.14.44.41.939127 (AT) nospamme (DOT) net...
No driver needed. Do a google search on "api hooking" and
"dll injection". Can be complicated, but not as much as
writing a driver (plus there are tools to simplify this).
Using API hooking is much more complicated, not to mentio more dangerous,
than using a driver. The NDIS architecture is specifically designed for
allowing such hooking. API hooking, on the other hand, is a programming
hack, it is not the offcial way to approach this issue.
Most winsock-intercepting programs (firewalls, etc) use this
method I think, and don't resort to installing drivers.
That is completely wrong. They do take the driver approach. For one
thing,
it is much easier to install and uninstall. Just install a single file
onto
the machine and set up a few official config values so that WinSock loads
the driver. Using API hooking, on the other hand, you have to use a
global
DLL hook that is installed into every process, altering that process's
memory in order to redirect the function calls to new memory that the DLL
owns. That can be VERY dangerous, not to mention that it triggers
anti-virus protections because it is virus-like behavior to alter a
program's memory. Second, it is much more accurate and reliable from a
programming standpoint to use a driver than hooking API calls anyway.
Gambit
|
|
|
| Back to top |
|
 |
Remy Lebeau (TeamB)
Guest
|
| Posted: Sat Mar 19, 2005 10:58 pm Post subject: Re: Hooking Winsock Functions |
|
|
"John Smith" <assemblywizard (AT) gmail (DOT) com> wrote
| Quote: | Any source code examples available which do NOT rely
on thirdparty, compiled, exes, libs or dlls?
|
Source code to do what exactly? Write an NDIS driver? Or write a DLL hook
that hacks every running process?
Gambit
|
|
| Back to top |
|
|
John Smith
Guest
|
| Posted: Sun Mar 20, 2005 1:02 am Post subject: Re: Hooking Winsock Functions |
|
|
I am speaking of the source code for libaries for building a kernel driver
for NDIS, and examples... all I have been able to find is 3rd party code
which you must purchase, and some you do not even get the source with!
Regards
"Remy Lebeau (TeamB)" <no.spam (AT) no (DOT) spam.com> wrote
| Quote: |
"John Smith" <assemblywizard (AT) gmail (DOT) com> wrote in message
news:423c5867 (AT) newsgroups (DOT) borland.com...
Any source code examples available which do NOT rely
on thirdparty, compiled, exes, libs or dlls?
Source code to do what exactly? Write an NDIS driver? Or write a DLL hook
that hacks every running process?
Gambit
|
|
|
| Back to top |
|
|
Remy Lebeau (TeamB)
Guest
|
| Posted: Sun Mar 20, 2005 1:46 am Post subject: Re: Hooking Winsock Functions |
|
|
"John Smith" <assemblywizard (AT) gmail (DOT) com> wrote
| Quote: | I am speaking of the source code for libaries for building
a kernel driver for NDIS, and examples...
|
You cannot build NDIS drivers with BCB. You need to use Microsoft's DDK for
that.
Gambit
|
|
| Back to top |
|
|
Mike Harris
Guest
|
| Posted: Sun Mar 20, 2005 2:46 am Post subject: Re: Hooking Winsock Functions |
|
|
I am reasonably sure a person can build a kernel mod driver with bcb.
|
|
| Back to top |
|
|
Remy Lebeau (TeamB)
Guest
|
| Posted: Sun Mar 20, 2005 4:59 am Post subject: Re: Hooking Winsock Functions |
|
|
"Mike Harris" <nospam (AT) nospam (DOT) com> wrote
| Quote: | I am reasonably sure a person can build a kernel mod driver with bcb.
|
BCB does not support driver development. As I mentioned earlier, you need
to use the DDK (Driver Development Kit) for that.
To hook the socket API from a BCB project without writing your own driver is
to use a third-party ready-made driver, such as the one provided with
WinPCap ([url]http://winpcap.polito.it)[/url].
Gambit
|
|
| Back to top |
|
|
Mike Harris
Guest
|
| Posted: Sun Mar 20, 2005 5:24 am Post subject: Re: Hooking Winsock Functions |
|
|
Driver development has been discussed in these groups many times. I and
several other people have reported success writing drivers such as wmi and
other..
"Remy Lebeau (TeamB)" <no.spam (AT) no (DOT) spam.com> wrote
| Quote: |
"Mike Harris" <nospam (AT) nospam (DOT) com> wrote in message
news:423ce3e7 (AT) newsgroups (DOT) borland.com...
I am reasonably sure a person can build a kernel mod driver with bcb.
BCB does not support driver development. As I mentioned earlier, you need
to use the DDK (Driver Development Kit) for that.
To hook the socket API from a BCB project without writing your own driver
is
to use a third-party ready-made driver, such as the one provided with
WinPCap ([url]http://winpcap.polito.it)[/url].
Gambit
|
|
|
| Back to top |
|
|
Remy Lebeau (TeamB)
Guest
|
| Posted: Sun Mar 20, 2005 12:44 pm Post subject: Re: Hooking Winsock Functions |
|
|
"Mike Harris" <nospam (AT) nospam (DOT) com> wrote
| Quote: | Driver development has been discussed in these groups many times.
I and several other people have reported success writing drivers such
as wmi and other..
|
Care to share the details?
Gambit
|
|
| Back to top |
|
|
Mike Harris
Guest
|
|
| Back to top |
|
|
Remy Lebeau (TeamB)
Guest
|
| Posted: Sun Mar 20, 2005 8:03 pm Post subject: Re: Hooking Winsock Functions |
|
|
"Mike Harris" <nospam (AT) nospam (DOT) com> wrote
Please do not post links to Taramack search results. They are session-based
and expire quickly. Linking to Tamarack results never works. Use
Google/Deja instead.
Gambit
|
|
| Back to top |
|
|
Mike Harris
Guest
|
| Posted: Sun Mar 20, 2005 11:08 pm Post subject: Re: Hooking Winsock Functions |
|
|
oops, forgot about the Taramack thing.
It would be easier to make a brief description and paste something you can
search.
one of many indications others have done the same as I.
Alex Bakaev [TeamB] wrote.
"
The compiler is not 100% compatible with the ntddk.h ( and probably few
others ) header. This is mostly in the area of inline functions
containing inline assembly and some assembly constructs in other
functions. This is easy to work around tho.
I was able to build WDM drivers without much problem after tweaking the
headers. Also, you will need to provide your own startup code (simple
jmp DriverEntry ) and some C/C++ RTL functions.
HTH,
Alex
"
basics.
1 ) hand build an asm unit.
use const.asm for a reference if needed.
2 ) port ddk headers needed.
3 ) compile in a dll project.
4 ) build a small utility to 'adjust' pe header info as needed for device
drivers.
might want to 'save as' while the file is open.
5 ) install.
Michael Harris
"Remy Lebeau (TeamB)" <no.spam (AT) no (DOT) spam.com> wrote
| Quote: |
Please do not post links to Taramack search results. They are
session-based
and expire quickly. Linking to Tamarack results never works. Use
Google/Deja instead.
Gambit
|
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
