if I load in my C# application a flash application A that opens a socket with a server B, is it possible to setup a local hook so that i can read the packets exchanged between A and the server B?
- I may obtain the flash application sources if needed, but I'm not the one who wrote them
- I'm new to C# ( to be honest, I'm still wondering what's the best language to write this kind of application for windows ) and to hooking, so any example would be really appreciated :)
- I'm working client side
Yes you can.
You should use EasyHook library to hook native socket API calls from C#.
And by placing hooks on connect, send and recv functions you can hook any traffic in Windows based application.
Here's an example:
private IntPtr _socketsLib;
private LocalHook _createConnectHook;
private LocalHook _createRecvHook;
private LocalHook _createSendHook;
_socketsLib = NativeAPI.LoadLibrary("Ws2_32.dll");
_createConnectHook = LocalHook.Create(LocalHook.GetProcAddress("Ws2_32.dll", "connect"), new NativeSocketMethod.DConnect(connect_Hooked), this);
_createRecvHook = LocalHook.Create(LocalHook.GetProcAddress("Ws2_32.dll", "recv"),
new NativeSocketMethod.Drecv(recv_Hooked), this);
_createSendHook = LocalHook.Create(LocalHook.GetProcAddress("Ws2_32.dll", "send"),
new NativeSocketMethod.Dsend(send_Hooked), this);
_createConnectHook.ThreadACL.SetExclusiveACL(new int[1]);
_createRecvHook.ThreadACL.SetExclusiveACL(new int[1]);
_createSendHook.ThreadACL.SetExclusiveACL(new int[1]);
private static int connect_Hooked(IntPtr socketHandle, ref NativeSocketMethod.sockaddr name, ref int namelen)
{
// TODO: do something with data here
return NativeSocketMethod.connect(socketHandle, ref name, ref namelen);
}
private static int recv_Hooked(IntPtr socketHandle, IntPtr buf, int count, int socketFlags)
{
// TODO: do something with data here
return NativeSocketMethod.recv(socketHandle, buf, count, socketFlags);
}
private static int send_Hooked(IntPtr socketHandle, IntPtr buf, int count, int socketFlags)
{
// TODO: do something with data here
return NativeSocketMethod.send(socketHandle, buf, count, socketFlags);
}
And NativeSocketMethod.cs
public static class NativeSocketMethod
{
[DllImport("Ws2_32.dll")]
public static extern int connect(IntPtr socketHandle, ref sockaddr Address, ref int Addresslen);
[DllImport("Ws2_32.dll")]
public static extern int getpeername(IntPtr s, ref sockaddr Address, ref int namelen);
[DllImport("ws2_32.dll")]
public static extern IntPtr inet_ntoa(in_addr a);
[DllImport("ws2_32.dll")]
public static extern ushort ntohs(ushort netshort);
[DllImport("Ws2_32.dll")]
public static extern int recv(IntPtr socketHandle, IntPtr buf, int Buffercount, int socketFlags);
[DllImport("Ws2_32.dll")]
public static extern int send(IntPtr socketHandle, IntPtr buf, int count, int socketFlags);
public enum AddressFamily
{
AppleTalk = 0x11,
BlueTooth = 0x20,
InterNetworkv4 = 2,
InterNetworkv6 = 0x17,
Ipx = 4,
Irda = 0x1a,
NetBios = 0x11,
Unknown = 0
}
[UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet=CharSet.Unicode, SetLastError=true)]
public delegate int DConnect(IntPtr socketHandle, ref NativeSocketMethod.sockaddr Address, ref int Addresslen);
[UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet=CharSet.Unicode, SetLastError=true)]
public delegate int Drecv(IntPtr socketHandle, IntPtr buf, int Buffercount, int socketFlags);
[UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet=CharSet.Unicode, SetLastError=true)]
public delegate int Dsend(IntPtr socketHandle, IntPtr buf, int count, int socketFlags);
[StructLayout(LayoutKind.Sequential)]
public struct in_addr
{
[MarshalAs(UnmanagedType.ByValArray, SizeConst=4)]
public byte[] sin_addr;
}
public enum ProtocolType
{
BlueTooth = 3,
ReliableMulticast = 0x71,
Tcp = 6,
Udp = 0x11
}
[StructLayout(LayoutKind.Sequential)]
public struct sockaddr
{
public short sin_family;
public ushort sin_port;
public NativeSocketMethod.in_addr sin_addr;
[MarshalAs(UnmanagedType.ByValArray, SizeConst=8)]
public byte[] sin_zero;
}
public enum SocketType
{
Unknown,
Stream,
DGram,
Raw,
Rdm,
SeqPacket
}
}