Wednesday, December 9, 2009

Hooking Winsock Function Using IAT Hooking Technique

Hmm, since me myself were searching for how to do this for 4 years. I think i should also share what i found with everyone else. Here it is "hooking winsock function without the need of microsoft detours, boxedapp or easyhook".

For anyone who loved Microsoft Detours and just wanna get rid of it's detoured.dll, you can try this link : (Thanks g3nuin3)

Why do i need it ?

People will start to ask, why do i need this? well basically this is only for programmer who was researching for same thing as me. This is also for a programmer that want to improve their knowledge.

How to use it ?

Include the hook.h and hook.cpp into your project and start using the function. Download the full source code to see how the code works.

Select the one you want to download :

Full source code (Recomended) :
Revision : 001
Archive Filename : WinsockHook.zip
Archive Size : 12.5kb
Note : DLL Injector needed
Download Link : MediaFire

hook.h and hook.cpp only :
Archive Filename : hook.zip
Archive Size :  2.21kb
Download Link :
MediaFire

Pros :

DOESN'T NEED TO INCLUDE ANY ADDITIONAL DLL JUST INCLUDE THE HOOK.H AND HOOK.CPP TO YOUR DLL PROJECT.


Cons :

Currently only works with 32bit. (I don't have 64bit computer to continue my research)


Notes :

  • I've only tried it with a simple client and server program so far. I'm not really sure if this will work in a big software. But from what i read, MIRC can also be intercepted.

  • hookAPI.h is the original of my hook.h and hook.cpp. I modified the code to make it look more better (as for me it is) and make it nearer to Microsoft Detours style so people who are using Microsoft Detours doesn't need to re-learn much to get this method to work. I make it portable to all people who are using this CodeProject example and only need some small modification.

Story behind the research :

For the past 4 years, i've been searching for anything that can make me do something like this and after 4 years i found one library that looks really good called Microsoft Detours. I stopped for about 2 month after founding Microsoft Detours since i have a school exam to take care of. After the exam, i continued my research but found out that Microsoft Detours is no longer in version 1.5 instead its already in version 2.1. From this version, i stopped liking it since it forced me to use the detoured.dll, i found a way to get rid of it but i scared that it will be against the Microsoft License. After that, i stumbled upon a new method by using easyhook but it was in C# and it still needed me to include its easyhook.dll. After sometime, i've found an alternative to Microsoft Detours called BoxedApp. Still, i need to buy it just to get the static library. Finally after a long time being searching for the right answer, i know that the only thing i need is IAT Hooking knowledge. But, it did not end here, i tried to search for IAT Hooking in Mr. Google but found too many search result. With these many search result, i clicked all the links one by one and read all of them. Finally after a very long time wasted, i get one link that is good enough to provide what i wanted. THE LINK WILL BE PROVIDED SOON.

No comments:

Post a Comment