https://github.com/mgostih/snifferih

DLL Hooking Packet Sniffer
https://github.com/mgostih/snifferih

32-bit asmx86 cpp dll dll-injection hooking packets reverse-engineering sniffer windows

Last synced: 3 months ago
JSON representation

DLL Hooking Packet Sniffer

• Host: GitHub
• URL: https://github.com/mgostih/snifferih
• Owner: mgostIH
• License: mit
• Created: 2017-07-23T12:32:57.000Z (over 7 years ago)
• Default Branch: master
• Last Pushed: 2017-07-23T13:44:03.000Z (over 7 years ago)
• Last Synced: 2024-04-24T13:20:40.003Z (7 months ago)
• Topics: 32-bit, asmx86, cpp, dll, dll-injection, hooking, packets, reverse-engineering, sniffer, windows
• Language: C++
• Homepage:
• Size: 25.4 KB
• Stars: 20
• Watchers: 1
• Forks: 10
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-network-stuff - **8**星

README

        
# SnifferIH

Injectable DLL that captures any traffic made by the application it has been injected to.

The traffic captured gets wrote in files inside the Send and Recv directories created by the DLL.

## Details

The DLL uses hooking on the process it gets injected in, which is implemented on the `ws2_32.dll` `send` and `recv` in order to capture every packet sent and received.

`ws2_32.dll` is the main DLL any recent Windows OS uses in order to transmit data over any protocol.

Since this DLL is the main public "gate" user mode applications use to ask the kernel to transmit data, it doesn't matter what kind of networking library the target executable uses, since the request will always end up in those hooked points.

While it's true that an application can use the older networking API (`ws2_32.dll`) which Windows provides for retro compatibility, on newer OSes it just ends up calling the new API, so the DLL will cover it aswell.

## TODO

Add some other protocol functions such as WSASend and WSARecv and possibly sniffing on some connecting and binding ones.

You can however modify the DLL source code yourself, including new functions or changing the code applied on the hooks trampolines set up already.