StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
primarykey
Id
15206339
data
AcceptedAnswerId
0
AnswerCount
0
ClosedDate
CommentCount
0
CommunityOwnedDate
CreationDate
2013-03-04T16:33:29.367
FavoriteCount
0
LastActivityDate
2013-03-04T16:33:29.367
LastEditDate
LastEditorUserId
0
OwnerUserId
1415618
ParentId
15190275
PostTypeId
2
Score
3
ViewCount
0
LastEditorDisplayName
text
Body
Ok. Its working now, even with DataExecutionPrevention enabled. In case someone has a similar problem in future, here is the working code: dllmain.cpp: <pre><code>#include "dll.h" #include <windows.h> #include <winsock2.h> #include <iostream> #include <fstream> #pragma comment(lib, "ws2_32.lib") using namespace std; DllClass::DllClass() { } DllClass::~DllClass () { } BYTE hook[6]; BYTE hook2[6]; BYTE jmp[6] = { 0xe9,0x00, 0x00, 0x00, 0x00 ,0xc3 }; ofstream myfile; ofstream myfile2; DWORD pPrevious; DWORD HookFunction(LPCSTR lpModule, LPCSTR lpFuncName, LPVOID lpFunction, unsigned char *lpBackup) { DWORD dwAddr = (DWORD)GetProcAddress(GetModuleHandle(lpModule), lpFuncName); ReadProcessMemory(GetCurrentProcess(), (LPVOID)dwAddr, lpBackup, 6, 0); DWORD dwCalc = ((DWORD)lpFunction - dwAddr - 5); VirtualProtect((void*) dwAddr, 6, PAGE_EXECUTE_READWRITE, &pPrevious); memcpy(&jmp[1], &dwCalc, 4); WriteProcessMemory(GetCurrentProcess(), (LPVOID)dwAddr, jmp, 6, 0); VirtualProtect((void*) dwAddr, 6, pPrevious, &pPrevious); FlushInstructionCache(GetCurrentProcess(),0,0); return dwAddr; } BOOL UnHookFunction(LPCSTR lpModule, LPCSTR lpFuncName, unsigned char *lpBackup) { DWORD dwAddr = (DWORD)GetProcAddress(GetModuleHandle(lpModule), lpFuncName); if (WriteProcessMemory(GetCurrentProcess(), (LPVOID)dwAddr, lpBackup, 6, 0)) return TRUE; FlushInstructionCache(GetCurrentProcess(),0,0); return FALSE; } int __stdcall nSend(SOCKET s, const char *buf, int len,int flags){ UnHookFunction("ws2_32.dll", "send", hook); int result = send(s,buf,len,flags); myfile.open ("C:\\tmp\\log.txt",ios::app | ios::binary); myfile << buf; myfile.close(); HookFunction("ws2_32.dll", "send", (LPVOID*) nSend, hook); return result; } int __stdcall nRecv(SOCKET s, char* buf, int len, int flags) { UnHookFunction("ws2_32.dll", "recv", hook2); DWORD tmp; len = recv(s, buf, len, flags); if (len > 0) { myfile2.open ("C:\\tmp\\log.txt",ios::app | ios::binary); myfile2 << buf; myfile2.close(); } HookFunction("ws2_32.dll", "recv", (LPVOID*) nRecv, hook2); return len; } void fun(){ HookFunction("ws2_32.dll", "send", (LPVOID*) nSend, hook); HookFunction("ws2_32.dll", "recv", (LPVOID*) nRecv, hook2); } BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) { switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: HookFunction("ws2_32.dll", "send", (LPVOID*) nSend, hook); HookFunction("ws2_32.dll", "recv", (LPVOID*) nRecv, hook2); case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: case DLL_PROCESS_DETACH: break; } return TRUE; } </code></pre> dll.h <pre><code>#ifndef _DLL_H_ #define _DLL_H_ #if BUILDING_DLL # define DLLIMPORT __declspec (dllexport) #else /* Not BUILDING_DLL */ # define DLLIMPORT __declspec (dllimport) #endif /* Not BUILDING_DLL */ class DLLIMPORT DllClass { public: DllClass(); virtual ~DllClass(void); private: }; extern "C" __declspec(dllexport) void fun(); #endif /* _DLL_H_ */ </code></pre> Tested and working with nearly all programs on Win XP 32bit and some programs on Win 7 x64
Tags
Title
singulars
PostAcceptedAnswerId
1. This table or related slice is empty.
PostParentId
1. POC++ hooking winsock
 singulars
 PostTypePostTypeId
 PTQuestion
PostTypePostTypeId
1. PTAnswer
UserLastEditorUserId
1. This table or related slice is empty.
UserOwnerUserId
1. USincognym
plurals
PostLinksPostIdRelatedPostId
1. This table or related slice is empty.
PostLinksRelatedPostIdPostId
1. This table or related slice is empty.
PostsAcceptedAnswerId
1. This table or related slice is empty.
PostsParentIdCreationDate
1. This table or related slice is empty.
VotesPostIdCreationDate
1. VO
 singulars
 PostPostId
 PO
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
CommentsPostId
1. This table or related slice is empty.

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.