Skip to content

B
bsc
Commit 9478c70c authored by Stefy Lanza's avatar Stefy Lanza
Browse files
Options

Initial commit

parent d109697a
Pipeline #195 failed with stages
      Hide whitespace changes
      Inline Side-by-side
      Showing with 166 additions and 54 deletions
      Makefile
      View file @ 9478c70c
      ...@@ -9,6 +9,9 @@ LDFLAGS = ...@@ -9,6 +9,9 @@ LDFLAGS =
      DETOURS_PATH ?= /usr/local/detours DETOURS_PATH ?= /usr/local/detours
      DETOURS_LIB = $(DETOURS_PATH)/lib64/detours.lib DETOURS_LIB = $(DETOURS_PATH)/lib64/detours.lib
      # Alternative: build without Detours (limited functionality)
      NO_DETOURS ?= 0
      # Targets # Targets
      all: network_monitor.exe ssl_hook.dll packet_capture.dll bgvnc.exe all: network_monitor.exe ssl_hook.dll packet_capture.dll bgvnc.exe
      ...@@ -16,7 +19,12 @@ network_monitor.exe: network_monitor.c ...@@ -16,7 +19,12 @@ network_monitor.exe: network_monitor.c
      $(CC) $(CFLAGS) -o $@ $< -lws2_32 -liphlpapi $(LDFLAGS) $(CC) $(CFLAGS) -o $@ $< -lws2_32 -liphlpapi $(LDFLAGS)
      ssl_hook.dll: ssl_hook.c ssl_hook.h ssl_hook.dll: ssl_hook.c ssl_hook.h
      ifeq ($(NO_DETOURS),1)
      @echo "Building ssl_hook.dll without Detours (limited functionality)"
      $(CC) $(CFLAGS) -shared -o $@ $< -DNO_DETOURS $(LDFLAGS)
      else
      $(CC) $(CFLAGS) -shared -o $@ $< -L$(DETOURS_PATH)/lib64 -ldetours -lsspi $(LDFLAGS) $(CC) $(CFLAGS) -shared -o $@ $< -L$(DETOURS_PATH)/lib64 -ldetours -lsspi $(LDFLAGS)
      endif
      packet_capture.dll: packet_capture.c packet_capture.dll: packet_capture.c
      $(CC) $(CFLAGS) -shared -o $@ $< -lws2_32 $(LDFLAGS) $(CC) $(CFLAGS) -shared -o $@ $< -lws2_32 $(LDFLAGS)
      ......
      README.md
      View file @ 9478c70c
      ...@@ -20,47 +20,105 @@ A comprehensive Windows network monitoring and SSL interception toolkit that can ...@@ -20,47 +20,105 @@ A comprehensive Windows network monitoring and SSL interception toolkit that can
      ## Output Files ## Output Files
      The suite generates 8 different log files: The suite generates multiple log files organized by connection:
      ### Global Logs
      1. `internal_traffic.log` - Internal network connection details 1. `internal_traffic.log` - Internal network connection details
      2. `external_traffic.log` - External network connection details 2. `external_traffic.log` - External network connection details
      3. `ssl_log.txt` - SSL traffic hex dumps 3. `ssl_log.txt` - SSL traffic hex dumps
      4. `syscall_log.txt` - DLL loading and function calls 4. `syscall_log.txt` - DLL loading and function calls with timestamps
      5. `internal_tcp_dump.bin` - Raw internal TCP payload dump
      6. `external_tcp_dump.bin` - Raw external TCP payload dump ### Per-Connection Files
      7. `internal_tcp_wireshark.pcap` - Wireshark PCAP for internal traffic For each unique TCP connection, the following files are created:
      8. `external_tcp_wireshark.pcap` - Wireshark PCAP for external traffic
      **Binary dumps:**
      - `tcp_dump_{internal|external}_{src_ip}:{src_port}-{dest_ip}:{dest_port}.bin`
      **Hex dumps:**
      - `tcp_hexdump_{internal|external}_{src_ip}:{src_port}-{dest_ip}:{dest_port}.log`
      **Wireshark PCAP files:**
      - `tcp_wireshark_{internal|external}_{src_ip}:{src_port}-{dest_ip}:{dest_port}.pcap`
      ### Example File Names
      - `tcp_dump_internal_192.168.1.100:12345-10.0.0.1:443.bin`
      - `tcp_hexdump_external_192.168.1.100:54321-8.8.8.8:53.log`
      - `tcp_wireshark_internal_192.168.1.100:12345-10.0.0.1:443.pcap`
      ## Building ## Building
      ### Prerequisites ### Prerequisites
      - Linux system with MinGW-w64 cross-compiler - Linux system with MinGW-w64 cross-compiler
      - Microsoft Detours library (for hooking functionality) - Microsoft Detours library (for full hooking functionality - optional)
      ### Quick Start ### Quick Start (Limited Functionality)
      ```bash ```bash
      ./configure.sh ./configure.sh
      make make NO_DETOURS=1
      ```
      ### Full Build with Detours Support
      #### 1. Install Base Dependencies
      ```bash
      sudo apt-get update
      sudo apt-get install gcc-mingw-w64 git
      ```
      #### 2. Build Microsoft Detours (Requires Windows)
      On a Windows machine with Visual Studio Build Tools:
      ```cmd
      git clone https://github.com/microsoft/Detours.git
      cd Detours
      nmake
      ```
      Copy the built Detours to your Linux machine:
      ```bash
      # Create Detours directory on Linux
      sudo mkdir -p /usr/local/detours
      # Copy from Windows (adjust paths as needed)
      # scp user@windows:/path/to/Detours/include/* /usr/local/detours/include/
      # scp user@windows:/path/to/Detours/lib.X64/* /usr/local/detours/lib64/
      ``` ```
      ### Manual Build #### 3. Configure and Build
      ```bash ```bash
      # Install dependencies ./configure.sh
      sudo apt-get install gcc-mingw-w64 make
      ```
      ### Manual Build Commands
      # Download and install Microsoft Detours #### Without Detours (Limited functionality):
      # (Extract to /usr/local/detours) ```bash
      x86_64-w64-mingw32-gcc network_monitor.c -o network_monitor.exe -lws2_32 -liphlpapi -static
      x86_64-w64-mingw32-gcc -shared ssl_hook.c -o ssl_hook.dll -DNO_DETOURS -static
      x86_64-w64-mingw32-gcc -shared packet_capture.c -o packet_capture.dll -lws2_32 -static
      x86_64-w64-mingw32-gcc bgvnc.c -o bgvnc.exe -lws2_32 -lgdi32 -luser32 -static
      ```
      # Build components #### With Detours (Full functionality):
      ```bash
      x86_64-w64-mingw32-gcc network_monitor.c -o network_monitor.exe -lws2_32 -liphlpapi -static x86_64-w64-mingw32-gcc network_monitor.c -o network_monitor.exe -lws2_32 -liphlpapi -static
      x86_64-w64-mingw32-gcc -shared ssl_hook.c -o ssl_hook.dll -L/path/to/detours/lib64 -ldetours -lsspi -static x86_64-w64-mingw32-gcc -shared ssl_hook.c -o ssl_hook.dll -L/usr/local/detours/lib64 -ldetours -lsspi -static
      x86_64-w64-mingw32-gcc -shared packet_capture.c -o packet_capture.dll -lws2_32 -static x86_64-w64-mingw32-gcc -shared packet_capture.c -o packet_capture.dll -lws2_32 -static
      x86_64-w64-mingw32-gcc bgvnc.c -o bgvnc.exe -lws2_32 -lgdi32 -luser32 -static x86_64-w64-mingw32-gcc bgvnc.c -o bgvnc.exe -lws2_32 -lgdi32 -luser32 -static
      ``` ```
      ### Build Options
      - `NO_DETOURS=1`: Build without Detours (limited SSL hooking)
      - `DETOURS_PATH=/custom/path`: Specify custom Detours installation path
      ## Usage ## Usage
      ### Network Monitor with SSL Interception ### Network Monitor with SSL Interception
      ......
      bgvnc.exe 0 → 100755
      View file @ 9478c70c
      File added
      config.mk 0 → 100644
      View file @ 9478c70c
      # Auto-generated configuration file
      DETOURS_PATH = /usr/local/detours
      CC = x86_64-w64-mingw32-gcc
      network_monitor.c
      View file @ 9478c70c
      ...@@ -16,21 +16,21 @@ ...@@ -16,21 +16,21 @@
      * along with this program. If not, see <https://www.gnu.org/licenses/>. * along with this program. If not, see <https://www.gnu.org/licenses/>.
      */ */
      #include <windows.h>
      #include <winsock2.h> #include <winsock2.h>
      #include <windows.h>
      #include <iphlpapi.h> #include <iphlpapi.h>
      #include <stdio.h> #include <stdio.h>
      #include <stdlib.h> #include <stdlib.h>
      #include <tlhelp32.h> #include <tlhelp32.h>
      #pragma comment(lib, "ws2_32.lib") // #pragma comment(lib, "ws2_32.lib")
      #pragma comment(lib, "iphlpapi.lib") // #pragma comment(lib, "iphlpapi.lib")
      int is_internal_ip(DWORD ip) { int is_internal_ip(DWORD ip) {
      BYTE b1 = (ip >> 24) & 0xFF; BYTE b1 = (ip >> 24) & 0xFF;
      BYTE b2 = (ip >> 16) & 0xFF; BYTE b2 = (ip >> 16) & 0xFF;
      BYTE b3 = (ip >> 8) & 0xFF; // BYTE b3 = (ip >> 8) & 0xFF;
      BYTE b4 = ip & 0xFF; // BYTE b4 = ip & 0xFF;
      if (b1 == 10) return 1; if (b1 == 10) return 1;
      if (b1 == 172 && b2 >= 16 && b2 <= 31) return 1; if (b1 == 172 && b2 >= 16 && b2 <= 31) return 1;
      if (b1 == 192 && b2 == 168) return 1; if (b1 == 192 && b2 == 168) return 1;
      ...@@ -68,7 +68,8 @@ int main() { ...@@ -68,7 +68,8 @@ int main() {
      fgets(program, sizeof(program), stdin); fgets(program, sizeof(program), stdin);
      program[strcspn(program, "\n")] = 0; program[strcspn(program, "\n")] = 0;
      STARTUPINFO si = { sizeof(si) }; STARTUPINFO si = {0};
      si.cb = sizeof(si);
      PROCESS_INFORMATION pi; PROCESS_INFORMATION pi;
      if (!CreateProcess(NULL, program, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi)) { if (!CreateProcess(NULL, program, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi)) {
      printf("Failed to start process\n"); printf("Failed to start process\n");
      ...@@ -103,7 +104,7 @@ int main() { ...@@ -103,7 +104,7 @@ int main() {
      DWORD localIP = row.dwLocalAddr; DWORD localIP = row.dwLocalAddr;
      DWORD remoteIP = row.dwRemoteAddr; DWORD remoteIP = row.dwRemoteAddr;
      char log_entry[256]; char log_entry[256];
      sprintf(log_entry, "Connection: Local %d.%d.%d.%d:%d -> Remote %d.%d.%d.%d:%d State:%d\n", sprintf(log_entry, "Connection: Local %lu.%lu.%lu.%lu:%u -> Remote %lu.%lu.%lu.%lu:%u State:%lu\n",
      (localIP >> 24) & 0xFF, (localIP >> 16) & 0xFF, (localIP >> 8) & 0xFF, localIP & 0xFF, ntohs(row.dwLocalPort), (localIP >> 24) & 0xFF, (localIP >> 16) & 0xFF, (localIP >> 8) & 0xFF, localIP & 0xFF, ntohs(row.dwLocalPort),
      (remoteIP >> 24) & 0xFF, (remoteIP >> 16) & 0xFF, (remoteIP >> 8) & 0xFF, remoteIP & 0xFF, ntohs(row.dwRemotePort), (remoteIP >> 24) & 0xFF, (remoteIP >> 16) & 0xFF, (remoteIP >> 8) & 0xFF, remoteIP & 0xFF, ntohs(row.dwRemotePort),
      row.dwState); row.dwState);
      ......
      packet_capture.c
      View file @ 9478c70c
      ...@@ -16,16 +16,16 @@ ...@@ -16,16 +16,16 @@
      * along with this program. If not, see <https://www.gnu.org/licenses/>. * along with this program. If not, see <https://www.gnu.org/licenses/>.
      */ */
      #include <windows.h>
      #include <winsock2.h> #include <winsock2.h>
      #include <windows.h>
      #include <iphlpapi.h> #include <iphlpapi.h>
      #include <stdio.h> #include <stdio.h>
      #include <stdlib.h> #include <stdlib.h>
      #include <string.h> #include <string.h>
      #include <time.h> #include <time.h>
      #pragma comment(lib, "ws2_32.lib") // #pragma comment(lib, "ws2_32.lib")
      #pragma comment(lib, "iphlpapi.lib") // #pragma comment(lib, "iphlpapi.lib")
      // PCAP file header structure // PCAP file header structure
      typedef struct { typedef struct {
      ...@@ -155,9 +155,13 @@ FILE* init_pcap_file(const char* filename) { ...@@ -155,9 +155,13 @@ FILE* init_pcap_file(const char* filename) {
      return file; return file;
      } }
      // Function to write raw binary dump // Function to write raw binary dump per connection
      void log_raw_dump(const BYTE* data, int len, int is_internal) { void log_raw_dump(const BYTE* data, int len, int is_internal, DWORD src_ip, DWORD dest_ip, WORD src_port, WORD dest_port) {
      const char* filename = is_internal ? "internal_tcp_dump.bin" : "external_tcp_dump.bin"; char filename[256];
      sprintf(filename, "tcp_dump_%s_%lu.%lu.%lu.%lu:%u-%lu.%lu.%lu.%lu:%u.bin",
      is_internal ? "internal" : "external",
      (src_ip >> 24) & 0xFF, (src_ip >> 16) & 0xFF, (src_ip >> 8) & 0xFF, src_ip & 0xFF, src_port,
      (dest_ip >> 24) & 0xFF, (dest_ip >> 16) & 0xFF, (dest_ip >> 8) & 0xFF, dest_ip & 0xFF, dest_port);
      FILE* file = fopen(filename, "ab"); FILE* file = fopen(filename, "ab");
      if (file) { if (file) {
      fwrite(data, 1, len, file); fwrite(data, 1, len, file);
      ...@@ -165,12 +169,19 @@ void log_raw_dump(const BYTE* data, int len, int is_internal) { ...@@ -165,12 +169,19 @@ void log_raw_dump(const BYTE* data, int len, int is_internal) {
      } }
      } }
      // Function to write hex dump // Function to write hex dump per connection
      void log_hex_dump(const BYTE* data, int len, int is_internal) { void log_hex_dump(const BYTE* data, int len, int is_internal, DWORD src_ip, DWORD dest_ip, WORD src_port, WORD dest_port) {
      const char* filename = is_internal ? "internal_tcp_hexdump.log" : "external_tcp_hexdump.log"; char filename[256];
      sprintf(filename, "tcp_hexdump_%s_%lu.%lu.%lu.%lu:%u-%lu.%lu.%lu.%lu:%u.log",
      is_internal ? "internal" : "external",
      (src_ip >> 24) & 0xFF, (src_ip >> 16) & 0xFF, (src_ip >> 8) & 0xFF, src_ip & 0xFF, src_port,
      (dest_ip >> 24) & 0xFF, (dest_ip >> 16) & 0xFF, (dest_ip >> 8) & 0xFF, dest_ip & 0xFF, dest_port);
      FILE* file = fopen(filename, "a"); FILE* file = fopen(filename, "a");
      if (file) { if (file) {
      fprintf(file, "TCP Payload (%d bytes):\n", len); SYSTEMTIME st;
      GetSystemTime(&st);
      fprintf(file, "[%04d-%02d-%02d %02d:%02d:%02d] TCP Payload (%d bytes):\n",
      st.wYear, st.wMonth, st.wDay, st.wHour, st.wMinute, st.wSecond, len);
      for (int i = 0; i < len; i++) { for (int i = 0; i < len; i++) {
      fprintf(file, "%02x ", data[i]); fprintf(file, "%02x ", data[i]);
      if ((i + 1) % 16 == 0) fprintf(file, "\n"); if ((i + 1) % 16 == 0) fprintf(file, "\n");
      ...@@ -182,26 +193,32 @@ void log_hex_dump(const BYTE* data, int len, int is_internal) { ...@@ -182,26 +193,32 @@ void log_hex_dump(const BYTE* data, int len, int is_internal) {
      // Export function for use by ssl_hook.dll // Export function for use by ssl_hook.dll
      __declspec(dllexport) void log_unencrypted_traffic(DWORD src_ip, DWORD dest_ip, WORD src_port, WORD dest_port, const BYTE* data, int len, int is_internal) { __declspec(dllexport) void log_unencrypted_traffic(DWORD src_ip, DWORD dest_ip, WORD src_port, WORD dest_port, const BYTE* data, int len, int is_internal) {
      static FILE* internal_pcap = NULL; // Create per-connection PCAP filename
      static FILE* external_pcap = NULL; char pcap_filename[256];
      sprintf(pcap_filename, "tcp_wireshark_%s_%lu.%lu.%lu.%lu:%u-%lu.%lu.%lu.%lu:%u.pcap",
      if (!internal_pcap) { is_internal ? "internal" : "external",
      internal_pcap = init_pcap_file("internal_tcp_wireshark.pcap"); (src_ip >> 24) & 0xFF, (src_ip >> 16) & 0xFF, (src_ip >> 8) & 0xFF, src_ip & 0xFF, src_port,
      } (dest_ip >> 24) & 0xFF, (dest_ip >> 16) & 0xFF, (dest_ip >> 8) & 0xFF, dest_ip & 0xFF, dest_port);
      if (!external_pcap) {
      external_pcap = init_pcap_file("external_tcp_wireshark.pcap"); // Open or create per-connection PCAP file
      FILE* pcap_file = fopen(pcap_filename, "r+b");
      if (!pcap_file) {
      // File doesn't exist, create it
      pcap_file = init_pcap_file(pcap_filename);
      } else {
      // File exists, seek to end for appending
      fseek(pcap_file, 0, SEEK_END);
      } }
      // Write to PCAP for Wireshark if (pcap_file) {
      FILE* target_file = is_internal ? internal_pcap : external_pcap; write_pcap_packet(pcap_file, src_ip, dest_ip, src_port, dest_port, data, len);
      if (target_file) { fflush(pcap_file);
      write_pcap_packet(target_file, src_ip, dest_ip, src_port, dest_port, data, len); fclose(pcap_file);
      fflush(target_file);
      } }
      // Write raw binary dump // Write raw binary dump per connection
      log_raw_dump(data, len, is_internal); log_raw_dump(data, len, is_internal, src_ip, dest_ip, src_port, dest_port);
      // Write hex dump // Write hex dump per connection
      log_hex_dump(data, len, is_internal); log_hex_dump(data, len, is_internal, src_ip, dest_ip, src_port, dest_port);
      } }
      \ No newline at end of file
      ssl_hook.c
      View file @ 9478c70c
      ...@@ -17,7 +17,10 @@ ...@@ -17,7 +17,10 @@
      */ */
      #include "ssl_hook.h" #include "ssl_hook.h"
      #ifndef NO_DETOURS
      #include <detours.h> #include <detours.h>
      #endif
      #define SECURITY_WIN32
      #include <sspi.h> #include <sspi.h>
      // Original function pointers // Original function pointers
      ...@@ -32,17 +35,21 @@ GetProcAddress_t original_GetProcAddress = NULL; ...@@ -32,17 +35,21 @@ GetProcAddress_t original_GetProcAddress = NULL;
      // Hooked functions // Hooked functions
      int hooked_SSL_write(void* ssl, const void* buf, int num) { int hooked_SSL_write(void* ssl, const void* buf, int num) {
      log_data("SSL_WRITE", buf, num); log_data("SSL_WRITE", buf, num);
      #ifndef NO_DETOURS
      // For PCAP logging, we'd need to track connection details // For PCAP logging, we'd need to track connection details
      // This is simplified - in practice you'd need to maintain connection state // This is simplified - in practice you'd need to maintain connection state
      log_unencrypted_traffic(0, 0, 0, 443, (const BYTE*)buf, num, 0); // Assume external for now log_unencrypted_traffic(0, 0, 0, 443, (const BYTE*)buf, num, 0); // Assume external for now
      return original_SSL_write(ssl, buf, num); #endif
      return original_SSL_write ? original_SSL_write(ssl, buf, num) : -1;
      } }
      int hooked_SSL_read(void* ssl, void* buf, int num) { int hooked_SSL_read(void* ssl, void* buf, int num) {
      int result = original_SSL_read(ssl, buf, num); int result = original_SSL_read ? original_SSL_read(ssl, buf, num) : -1;
      if (result > 0) { if (result > 0) {
      log_data("SSL_READ", buf, result); log_data("SSL_READ", buf, result);
      #ifndef NO_DETOURS
      log_unencrypted_traffic(0, 0, 443, 0, (const BYTE*)buf, result, 0); // Assume external log_unencrypted_traffic(0, 0, 443, 0, (const BYTE*)buf, result, 0); // Assume external
      #endif
      } }
      return result; return result;
      } }
      ...@@ -52,21 +59,25 @@ SECURITY_STATUS hooked_EncryptMessage(PCtxtHandle phContext, ULONG fQOP, PSecBuf ...@@ -52,21 +59,25 @@ SECURITY_STATUS hooked_EncryptMessage(PCtxtHandle phContext, ULONG fQOP, PSecBuf
      for (ULONG i = 0; i < pMessage->cBuffers; i++) { for (ULONG i = 0; i < pMessage->cBuffers; i++) {
      if (pMessage->pBuffers[i].BufferType == SECBUFFER_DATA) { if (pMessage->pBuffers[i].BufferType == SECBUFFER_DATA) {
      log_data("SCHANNEL_ENCRYPT", pMessage->pBuffers[i].pvBuffer, pMessage->pBuffers[i].cbBuffer); log_data("SCHANNEL_ENCRYPT", pMessage->pBuffers[i].pvBuffer, pMessage->pBuffers[i].cbBuffer);
      #ifndef NO_DETOURS
      log_unencrypted_traffic(0, 0, 0, 443, (const BYTE*)pMessage->pBuffers[i].pvBuffer, pMessage->pBuffers[i].cbBuffer, 0); log_unencrypted_traffic(0, 0, 0, 443, (const BYTE*)pMessage->pBuffers[i].pvBuffer, pMessage->pBuffers[i].cbBuffer, 0);
      #endif
      break; break;
      } }
      } }
      return original_EncryptMessage(phContext, fQOP, pMessage, MessageSeqNo); return original_EncryptMessage ? original_EncryptMessage(phContext, fQOP, pMessage, MessageSeqNo) : SEC_E_UNSUPPORTED_FUNCTION;
      } }
      SECURITY_STATUS hooked_DecryptMessage(PCtxtHandle phContext, PSecBufferDesc pMessage, ULONG MessageSeqNo, PULONG pfQOP) { SECURITY_STATUS hooked_DecryptMessage(PCtxtHandle phContext, PSecBufferDesc pMessage, ULONG MessageSeqNo, PULONG pfQOP) {
      SECURITY_STATUS status = original_DecryptMessage(phContext, pMessage, MessageSeqNo, pfQOP); SECURITY_STATUS status = original_DecryptMessage ? original_DecryptMessage(phContext, pMessage, MessageSeqNo, pfQOP) : SEC_E_UNSUPPORTED_FUNCTION;
      if (status == SEC_E_OK) { if (status == SEC_E_OK) {
      // Log decrypted data after decryption // Log decrypted data after decryption
      for (ULONG i = 0; i < pMessage->cBuffers; i++) { for (ULONG i = 0; i < pMessage->cBuffers; i++) {
      if (pMessage->pBuffers[i].BufferType == SECBUFFER_DATA) { if (pMessage->pBuffers[i].BufferType == SECBUFFER_DATA) {
      log_data("SCHANNEL_DECRYPT", pMessage->pBuffers[i].pvBuffer, pMessage->pBuffers[i].cbBuffer); log_data("SCHANNEL_DECRYPT", pMessage->pBuffers[i].pvBuffer, pMessage->pBuffers[i].cbBuffer);
      #ifndef NO_DETOURS
      log_unencrypted_traffic(0, 0, 443, 0, (const BYTE*)pMessage->pBuffers[i].pvBuffer, pMessage->pBuffers[i].cbBuffer, 0); log_unencrypted_traffic(0, 0, 443, 0, (const BYTE*)pMessage->pBuffers[i].pvBuffer, pMessage->pBuffers[i].cbBuffer, 0);
      #endif
      break; break;
      } }
      } }
      ...@@ -131,11 +142,13 @@ BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserv ...@@ -131,11 +142,13 @@ BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserv
      original_SSL_read = (SSL_read_t)GetProcAddress(hLibSSL, "SSL_read"); original_SSL_read = (SSL_read_t)GetProcAddress(hLibSSL, "SSL_read");
      if (original_SSL_write && original_SSL_read) { if (original_SSL_write && original_SSL_read) {
      #ifndef NO_DETOURS
      DetourTransactionBegin(); DetourTransactionBegin();
      DetourUpdateThread(GetCurrentThread()); DetourUpdateThread(GetCurrentThread());
      DetourAttach(&(PVOID&)original_SSL_write, hooked_SSL_write); DetourAttach(&(PVOID&)original_SSL_write, hooked_SSL_write);
      DetourAttach(&(PVOID&)original_SSL_read, hooked_SSL_read); DetourAttach(&(PVOID&)original_SSL_read, hooked_SSL_read);
      DetourTransactionCommit(); DetourTransactionCommit();
      #endif
      } }
      } }
      ...@@ -146,11 +159,13 @@ BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserv ...@@ -146,11 +159,13 @@ BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserv
      original_DecryptMessage = (DecryptMessage_t)GetProcAddress(hSecur32, "DecryptMessage"); original_DecryptMessage = (DecryptMessage_t)GetProcAddress(hSecur32, "DecryptMessage");
      if (original_EncryptMessage && original_DecryptMessage) { if (original_EncryptMessage && original_DecryptMessage) {
      #ifndef NO_DETOURS
      DetourTransactionBegin(); DetourTransactionBegin();
      DetourUpdateThread(GetCurrentThread()); DetourUpdateThread(GetCurrentThread());
      DetourAttach(&(PVOID&)original_EncryptMessage, hooked_EncryptMessage); DetourAttach(&(PVOID&)original_EncryptMessage, hooked_EncryptMessage);
      DetourAttach(&(PVOID&)original_DecryptMessage, hooked_DecryptMessage); DetourAttach(&(PVOID&)original_DecryptMessage, hooked_DecryptMessage);
      DetourTransactionCommit(); DetourTransactionCommit();
      #endif
      } }
      } }
      ...@@ -162,36 +177,44 @@ BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserv ...@@ -162,36 +177,44 @@ BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserv
      original_GetProcAddress = (GetProcAddress_t)GetProcAddress(hKernel32, "GetProcAddress"); original_GetProcAddress = (GetProcAddress_t)GetProcAddress(hKernel32, "GetProcAddress");
      if (original_LoadLibraryA && original_LoadLibraryW && original_GetProcAddress) { if (original_LoadLibraryA && original_LoadLibraryW && original_GetProcAddress) {
      #ifndef NO_DETOURS
      DetourTransactionBegin(); DetourTransactionBegin();
      DetourUpdateThread(GetCurrentThread()); DetourUpdateThread(GetCurrentThread());
      DetourAttach(&(PVOID&)original_LoadLibraryA, hooked_LoadLibraryA); DetourAttach(&(PVOID&)original_LoadLibraryA, hooked_LoadLibraryA);
      DetourAttach(&(PVOID&)original_LoadLibraryW, hooked_LoadLibraryW); DetourAttach(&(PVOID&)original_LoadLibraryW, hooked_LoadLibraryW);
      DetourAttach(&(PVOID&)original_GetProcAddress, hooked_GetProcAddress); DetourAttach(&(PVOID&)original_GetProcAddress, hooked_GetProcAddress);
      DetourTransactionCommit(); DetourTransactionCommit();
      #endif
      } }
      } }
      } else if (ul_reason_for_call == DLL_PROCESS_DETACH) { } else if (ul_reason_for_call == DLL_PROCESS_DETACH) {
      if (original_SSL_write && original_SSL_read) { if (original_SSL_write && original_SSL_read) {
      #ifndef NO_DETOURS
      DetourTransactionBegin(); DetourTransactionBegin();
      DetourUpdateThread(GetCurrentThread()); DetourUpdateThread(GetCurrentThread());
      DetourDetach(&(PVOID&)original_SSL_write, hooked_SSL_write); DetourDetach(&(PVOID&)original_SSL_write, hooked_SSL_write);
      DetourDetach(&(PVOID&)original_SSL_read, hooked_SSL_read); DetourDetach(&(PVOID&)original_SSL_read, hooked_SSL_read);
      DetourTransactionCommit(); DetourTransactionCommit();
      #endif
      } }
      if (original_EncryptMessage && original_DecryptMessage) { if (original_EncryptMessage && original_DecryptMessage) {
      #ifndef NO_DETOURS
      DetourTransactionBegin(); DetourTransactionBegin();
      DetourUpdateThread(GetCurrentThread()); DetourUpdateThread(GetCurrentThread());
      DetourDetach(&(PVOID&)original_EncryptMessage, hooked_EncryptMessage); DetourDetach(&(PVOID&)original_EncryptMessage, hooked_EncryptMessage);
      DetourDetach(&(PVOID&)original_DecryptMessage, hooked_DecryptMessage); DetourDetach(&(PVOID&)original_DecryptMessage, hooked_DecryptMessage);
      DetourTransactionCommit(); DetourTransactionCommit();
      #endif
      } }
      if (original_LoadLibraryA && original_LoadLibraryW && original_GetProcAddress) { if (original_LoadLibraryA && original_LoadLibraryW && original_GetProcAddress) {
      #ifndef NO_DETOURS
      DetourTransactionBegin(); DetourTransactionBegin();
      DetourUpdateThread(GetCurrentThread()); DetourUpdateThread(GetCurrentThread());
      DetourDetach(&(PVOID&)original_LoadLibraryA, hooked_LoadLibraryA); DetourDetach(&(PVOID&)original_LoadLibraryA, hooked_LoadLibraryA);
      DetourDetach(&(PVOID&)original_LoadLibraryW, hooked_LoadLibraryW); DetourDetach(&(PVOID&)original_LoadLibraryW, hooked_LoadLibraryW);
      DetourDetach(&(PVOID&)original_GetProcAddress, hooked_GetProcAddress); DetourDetach(&(PVOID&)original_GetProcAddress, hooked_GetProcAddress);
      DetourTransactionCommit(); DetourTransactionCommit();
      #endif
      } }
      } }
      return TRUE; return TRUE;
      ......
      ssl_hook.dll 0 → 100755
      View file @ 9478c70c
      File added
      ssl_hook.h
      View file @ 9478c70c
      ...@@ -20,6 +20,8 @@ ...@@ -20,6 +20,8 @@
      #define SSL_HOOK_H #define SSL_HOOK_H
      #include <windows.h> #include <windows.h>
      #define SECURITY_WIN32
      #include <sspi.h>
      #include <stdio.h> #include <stdio.h>
      // Function pointer types for SSL functions // Function pointer types for SSL functions
      ......
      Markdown is supported
      0% or
      You are about to add 0 people to the discussion. Proceed with caution.
      Finish editing this message first!
      Please register or to comment