title: C++ hooking winsock
body: <p>I am trying to hook winsock send and recv in order to read all traffic of a process.
  I am injectin the following code as a dll inside the target process</p>
  
  <pre><code>#include "dll.h"
  #include &lt;windows.h&gt;
  #include &lt;winsock2.h&gt;
  #include &lt;iostream&gt;
  #include &lt;fstream&gt;
  
  #pragma comment(lib, "ws2_32.lib")
  
  using namespace std;
  
  DllClass::DllClass()
  {
  
  }
  
  
  DllClass::~DllClass ()
  {
  
  }
  
  BYTE hook[6];
  BYTE hook2[6];
  BYTE jmp[6] = { 0xe9,0x00, 0x00, 0x00, 0x00 ,0xc3 };  
  ofstream myfile;
  ofstream myfile2;
  
  DWORD HookFunction(LPCSTR lpModule, LPCSTR lpFuncName, LPVOID lpFunction, unsigned char *lpBackup)
  {  
        DWORD dwAddr = (DWORD)GetProcAddress(GetModuleHandle(lpModule), lpFuncName);
        ReadProcessMemory(GetCurrentProcess(), (LPVOID)dwAddr, lpBackup, 6, 0);
        DWORD dwCalc = ((DWORD)lpFunction - dwAddr - 5);
        memcpy(&amp;jmp[1], &amp;dwCalc, 4);
        WriteProcessMemory(GetCurrentProcess(), (LPVOID)dwAddr, jmp, 6, 0);
        return dwAddr;
  }    
  
  BOOL UnHookFunction(LPCSTR lpModule, LPCSTR lpFuncName, unsigned char *lpBackup)
  {
  DWORD dwAddr = (DWORD)GetProcAddress(GetModuleHandle(lpModule), lpFuncName);
  if (WriteProcessMemory(GetCurrentProcess(), (LPVOID)dwAddr, lpBackup, 6, 0))
          return TRUE;
  return FALSE;  
  }
  
  int nSend(SOCKET s, const char *buf, int len,int flags){
  UnHookFunction("ws2_32.dll", "send", hook);
  
  
  int result = send(s,buf,len,flags);
  
  
    myfile.open ("C:\\tmp\\log.txt",ios::app | ios::binary);
    myfile &lt;&lt; buf;
    myfile.close();
  
  
  
  
  HookFunction("ws2_32.dll", "send", (LPVOID*) nSend, hook);
  return result;
  } 
  
  int nRecv(SOCKET s, char* buf, int len, int flags)
  {
      UnHookFunction("ws2_32.dll", "recv", hook2);
      DWORD tmp;
  
      len = recv(s, buf, len, flags);
  
      if (len &gt; 0)
      {
  
          myfile2.open ("C:\\tmp\\log.txt",ios::app | ios::binary);
          myfile2 &lt;&lt; buf;
          myfile2.close();
      }
     HookFunction("ws2_32.dll", "recv", (LPVOID*) nRecv, hook2);
      return len;
  }
  void fun(){ // &lt;-- this is called after the DLL has been injected
  HookFunction("ws2_32.dll", "send", (LPVOID*) nSend, hook);
  HookFunction("ws2_32.dll", "recv", (LPVOID*) nRecv, hook2);
  }
  
  BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
  {
  switch (ul_reason_for_call)
  {
  case DLL_PROCESS_ATTACH:
  
  case DLL_THREAD_ATTACH:
  case DLL_THREAD_DETACH:
  case DLL_PROCESS_DETACH:
  break;
  }
  return TRUE;
  }
  </code></pre>
  
  <p>This works in some cases and in some it doesnt.
  If i inject it into filezilla ftp it works like a charm and writes everything that is send or recieved to a file.</p>
  
  <p>But on nearly all other programms (internet explorer, firefox usw.) it just writes some bytes to the file and then the process crashes...</p>
  
  <p>Has anyone an idea what is going wrong?</p>