flat assembler
Message board for the users of flat assembler.

Index > Windows > API Hook

Author
Thread Post new topic Reply to topic
bcdsys



Joined: 04 Aug 2008
Posts: 41
bcdsys
What is best way to hook win32 api (most interest sockets linke gethostbyname) in usermode? I need to hook both call with IAT and GetProcAddress run time determine and call.
Post 23 Sep 2008, 02:58
View user's profile Send private message Reply with quote
asmcoder



Joined: 02 Jun 2008
Posts: 784
asmcoder
[content deleted]


Last edited by asmcoder on 14 Aug 2009, 14:56; edited 1 time in total
Post 23 Sep 2008, 10:33
View user's profile Send private message Reply with quote
dxl



Joined: 17 Sep 2005
Posts: 16
dxl
bcdsys:

If you don't know Portable Executable format you cannot write a program to set a hook on tcp socket api function in usermode.

A PE executable contains a table fullfilled with addresses of api functions imported when the program is loaded in memory by Windows.

Some programs import dynamically api functions directly using LoadLibrary/GetProcaddress api functions

When imports table do exist, you can add a routine in the targeted program to patch the table with a new address at runtime for the desired api function to set a hook.
Or you can write another program to do the job.
(in this case, some problems will probably occur with the hardware protection used in not too old microprocessors: memory section have or have not a "execute" attrbute. Trying to run a program, for example in the stack, will
lead to an error message box !)
Post 27 Sep 2008, 16:50
View user's profile Send private message Reply with quote
vid
Verbosity in development


Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia
vid
Post 27 Sep 2008, 17:08
View user's profile Send private message Visit poster's website AIM Address MSN Messenger ICQ Number Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on YouTube, Twitter.

Website powered by rwasa.