Re: Api hooking papers ?

[Nicolas RUFF <nicolas.ruff () edelweb fr>]

> Well I want to hook winsock (send and receive ), maybe my aproach is wrong
> please correct me (???)  :> Or at least i wanna try :> I need so I can compress
> and decompress the data before it is sent or received and it is for a project
> (student), or maybe for a diploma work :>

Hooking Winsock API is not the easiest thing to do as a diploma work, 
because all function addresses are hardcoded and checked on startup ...

Exemple :

On Windows XP SP2, download the debug symbols for ws2_32.dll and look 
for CheckForHookersOrChainers(). This function will match 
GetProcAddress() results against all functions defined in the apfns[] 
array ...

Good luck !
- Nicolas RUFF
-----------------------------------
Security Consultant
EdelWeb (http://www.edelweb.fr/)
Mail : nicolas.ruff (at) edelweb.fr
-----------------------------------
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
https://lists.immunitysec.com/mailman/listinfo/dailydave