Question

Similar to freecap.

I am looking to develop a solution that works just on certain software and runs invisibly to the end-user. I would like to bundle the tunneler with a software package (of which I don’t have access to the source code).

I have heard the only way to do this is similar to what freecap does. Using DLL injection and then hook onto WinSock API. I am just wondering if there was an easier method besides DLL injection via .NET or C++. I can convert most C++ into C#, so that’s why I am open to that set.

If not, I would appreciate any advice or links you can provide about going about DLL injection and hooking into the WinSock API. Perhaps an opensource project similar to freecap.

Or, if you know of an application that I can launch via command line say freecap.exe --start myprogram.exe This way freecap would run invisibly to the end user.

Answer 1

API hooking is basically the only way to do this. There are a variety of approaches you could use to hook into WinSock and get your code running and DLL injection (via replacing entries in a process’ Import Address Table) is the most straightforward of these.

A dynamically-linked process’ IAT stores the memory locations of libraries which contain functions it needs during it’s execution. This technique works by modifying entries in this table to point to another library (one containing your code). There are other ways to insert your code into another process, but this is the most stable if you just want to affect the behaviour of a single process on your system.

If you want to avoid doing most of the implementation work yourself and just concentrate on getting something running, I would suggest using EasyHook.

EasyHook is licensed under the GNU Lesser General Public License or LGPL.

From the website:

EasyHook starts where Microsoft Detours ends.

This project supports extending (hooking) unmanaged code (APIs) with pure managed ones, from within
a fully managed environment like C# using Windows 2000 SP4 and later, including Windows XP x64,
Windows Vista x64 and Windows Server 2008 x64. Also 32- and 64-bit kernel mode hooking is supported
as well as an unmanaged user-mode API which allows you to hook targets without requiring a NET
Framework on the customers PC. An experimental stealth injection hides hooking from most of the
current AV software.

As the above says, this project should allow you to greatly simplify the hooking process, and allows you to do so while working in C#.

From the documentation, here’s the authors example of injecting a simple Filemon (now Process Monitor)-type utility into a target process:

// Copyright © 2008 Christoph Husse

using System; 
using System.Collections.Generic; 
using System.Runtime.Remoting; 
using System.Text; 
using EasyHook;

namespace FileMon 
{ 
    public class FileMonInterface : MarshalByRefObject 
    { 
        public void IsInstalled(Int32 InClientPID) 
        { 
            Console.WriteLine("FileMon has been installed in target {0}.\r\n", InClientPID); 
        } 

        public void OnCreateFile(Int32 InClientPID, String[] InFileNames) 
        { 
            for (int i = 0; i < InFileNames.Length; i++) 
            { 
                Console.WriteLine(InFileNames[i]); 
            } 
        } 

        public void ReportException(Exception InInfo) 
        { 
            Console.WriteLine("The target process has reported an error:\r\n"+ InInfo.ToString()); 
        } 
    } 

    class Program 
    { 
        static String ChannelName = null; 
     
        static void Main(string[] args) 
        { 
            try 
            {
                Config.Register( 
                "A FileMon like demo application.", 
                "FileMon.exe", 
                "FileMonInject.dll"); 

                RemoteHooking.IpcCreateServer<FileMonInterface>(ref ChannelName, WellKnownObjectMode.SingleCall); 
 
                RemoteHooking.Inject( 
                Int32.Parse(args[0]), 
                "FileMonInject.dll", 
                "FileMonInject.dll", 
                ChannelName); 

                Console.ReadLine(); 
           } 
           catch (Exception ExtInfo) 
           { 
                Console.WriteLine("There was an error while connecting to target:\r\n{0}", ExtInfo.ToString()); 
           } 
       } 
    } 
}

I hope this is helpful. Good luck!