{"id":13826735,"url":"https://github.com/mgostih/snifferih","last_synced_at":"2026-01-18T03:53:47.136Z","repository":{"id":144496740,"uuid":"98096614","full_name":"mgostIH/SnifferIH","owner":"mgostIH","description":"DLL Hooking Packet Sniffer","archived":false,"fork":false,"pushed_at":"2017-07-23T13:44:03.000Z","size":26,"stargazers_count":22,"open_issues_count":0,"forks_count":10,"subscribers_count":1,"default_branch":"master","last_synced_at":"2024-08-05T09:15:40.025Z","etag":null,"topics":["32-bit","asmx86","cpp","dll","dll-injection","hooking","packets","reverse-engineering","sniffer","windows"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mgostIH.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2017-07-23T12:32:57.000Z","updated_at":"2024-06-29T14:38:43.000Z","dependencies_parsed_at":null,"dependency_job_id":"86a3a22d-be04-44aa-8528-591fe470090b","html_url":"https://github.com/mgostIH/SnifferIH","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mgostIH%2FSnifferIH","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mgostIH%2FSnifferIH/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mgostIH%2FSnifferIH/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mgostIH%2FSnifferIH/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mgostIH","download_url":"https://codeload.github.com/mgostIH/SnifferIH/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225476383,"owners_count":17480215,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["32-bit","asmx86","cpp","dll","dll-injection","hooking","packets","reverse-engineering","sniffer","windows"],"created_at":"2024-08-04T09:01:43.324Z","updated_at":"2026-01-18T03:53:47.126Z","avatar_url":"https://github.com/mgostIH.png","language":"C++","funding_links":[],"categories":["\u003ca id=\"7bf0f5839fb2827fdc1b93ae6ac7f53d\"\u003e\u003c/a\u003e工具"],"sub_categories":["\u003ca id=\"32739127f0c38d61b14448c66a797098\"\u003e\u003c/a\u003e嗅探\u0026\u0026Sniff"],"readme":"# SnifferIH\n\nInjectable DLL that captures any traffic made by the application it has been injected to.\n\nThe traffic captured gets wrote in files inside the Send and Recv directories created by the DLL.\n\n\n## Details\n\nThe DLL uses hooking on the process it gets injected in, which is implemented on the `ws2_32.dll` `send` and `recv` in order to capture every packet sent and received.\n\n`ws2_32.dll` is the main DLL any recent Windows OS uses in order to transmit data over any protocol.\nSince this DLL is the main public \"gate\" user mode applications use to ask the kernel to transmit data, it doesn't matter what kind of networking library the target executable uses, since the request will always end up in those hooked points.\n\nWhile it's true that an application can use the older networking API (`ws2_32.dll`) which Windows provides for retro compatibility, on newer OSes it just ends up calling the new API, so the DLL will cover it aswell.\n\n\n## TODO\n\nAdd some other protocol functions such as WSASend and WSARecv and possibly sniffing on some connecting and binding ones.\n\nYou can however modify the DLL source code yourself, including new functions or changing the code applied on the hooks trampolines set up already.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmgostih%2Fsnifferih","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmgostih%2Fsnifferih","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmgostih%2Fsnifferih/lists"}