Adobe Flash hooken/sniffen/abfangen

[acdc]

Ich sitze gerade an einem ziemlich verzwickten Problem.
Ich möchte den Netzwerkverkehr eines Flashobjektes im Browser abfangen.

Anfänglich habe ich dafür einen Socksv4 Server programmiert. Leider ignoriert Flash die Proxyeinstellungen einfach.

Dann habe ich es mit einem Winsock Hook probiert (obwohl ich mich da überhaupt noch nicht auskenne).
Der Injector funktioniert schonmal wunderbar, abgefangen wird allerdings gar nichts.
Hier der DLL-Code:

#include "stdafx.h"

#include <cstdio>
#include <ctime>
#include <fstream>
#include <iomanip>
#include <string>
#include <windows.h>
#include <winsock.h>
#include "detours.h"

typedef unsigned int SOCKET;
#ifdef _MANAGED
#pragma managed(push, off)
#endif

#pragma comment(lib, "detours.lib")
#pragma comment(lib, "detoured.lib")
#pragma comment(lib, "ws2_32.lib")

#define DATA_BUFSIZE 32768


/*
Fake export function
*/
extern "C" __declspec(dllexport) void fakeexportfunction()
{
return ;
}

// Functions to be Hooked/Detoured

int (WINAPI __stdcall * Real_send)(SOCKET a0, CONST char* a1, int a2, int a3) = send;
int (WINAPI __stdcall * Real_recv)(SOCKET a0, char* a1, int a2, int a3) = recv;
// Functions that replace Hooked/Detoured version

int WINAPI __stdcall Hook_send(SOCKET a0, char* a1, int a2, int a3)
{
    MessageBox(0,0,0,0);
    int rv = 0;
    char hookmsg[DATA_BUFSIZE];
    wchar_t dbgmsg [sizeof(hookmsg)*2];
    DWORD threadid = GetCurrentThreadId();
    __try {
        rv = Real_send(a0, a1, a2, a3);
    } __finally {
        if (rv == SOCKET_ERROR) {
            int err = WSAGetLastError();

            _snprintf_s(hookmsg, sizeof(hookmsg), "%p: Real_send(%d,,,) -> %x (%d)\n", a0, threadid, rv, err);
            hookmsg[sizeof(hookmsg) - 1] = 0;
            MultiByteToWideChar(CP_ACP, 0, hookmsg, sizeof(hookmsg), dbgmsg, sizeof(dbgmsg));
            OutputDebugString(dbgmsg);
        }
        else {

            _snprintf_s(hookmsg, sizeof(hookmsg), "%p: Real_send(%d,%s,,) -> %x\n", a0, threadid, a1, rv);
            hookmsg[sizeof(hookmsg) - 1] = 0;
            MultiByteToWideChar(CP_ACP, 0, hookmsg, sizeof(hookmsg), dbgmsg, sizeof(dbgmsg));
            OutputDebugString(dbgmsg);
        }
    };
    return rv;
}

int WINAPI __stdcall Hook_recv(SOCKET a0, char* a1, int a2, int a3)
{
    int rv = 0;
    char hookmsg[DATA_BUFSIZE];
    wchar_t dbgmsg [sizeof(hookmsg)*2];
    DWORD threadid = GetCurrentThreadId();
    
    __try {
        rv = Real_recv(a0, a1, a2, a3);
    } __finally {
    
        _snprintf_s(hookmsg, sizeof(hookmsg), "%p: Real_recv(%d,%s,,) -> %x\n", a0, threadid, a1, rv);
        hookmsg[sizeof(hookmsg) - 1] = 0;
        MultiByteToWideChar(CP_ACP, 0, hookmsg, sizeof(hookmsg), dbgmsg, sizeof(dbgmsg));
        OutputDebugString(dbgmsg);
    };
    return rv;
}




BOOL WINAPI DllMain(HINSTANCE hinst, DWORD dwReason, LPVOID reserved)
{
    LONG error;

    if (dwReason == DLL_PROCESS_ATTACH) {

        DetourRestoreAfterWith();

        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        //DetourAttach(&(PVOID&)Real_gethostbyname, Hook_gethostbyname);
        //DetourAttach(&(PVOID&)Real_WSASend, Hook_WSASend);
        DetourAttach(&(PVOID&)Real_send, Hook_send);
        //DetourAttach(&(PVOID&)Real_WSARecv, Hook_WSARecv);
        DetourAttach(&(PVOID&)Real_recv, Hook_recv);

        error = DetourTransactionCommit();

        if (error == NO_ERROR) {
            OutputDebugString(TEXT("testhooks.dll: Attach to functions called: \n"));
        }
        else {
            OutputDebugString(TEXT("testhooks.dll: Error attaching to fucntions: \n"));
        }



    }

    if (dwReason == DLL_PROCESS_DETACH) {

        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        //DetourDetach(&(PVOID&)Real_gethostbyname, Hook_gethostbyname);
        //DetourDetach(&(PVOID&)Real_WSASend, Hook_WSASend);
        DetourDetach(&(PVOID&)Real_send, Hook_send);
        //DetourDetach(&(PVOID&)Real_WSARecv, Hook_WSARecv);
        DetourDetach(&(PVOID&)Real_recv, Hook_recv);
        
        error = DetourTransactionCommit();
        
        OutputDebugString(TEXT("testhooks.dll: Detach from functions called: \n"));
    
    }

    return TRUE;
}

#ifdef _MANAGED
#pragma managed(pop)
#endif

Den Code habe ich mit freundlicher Unterstützung von Google gefunden.
WSA_Recv und WSA_Send habe ich herausgenommen, da das Flashobjekt nur Winsock 1.1 benutzt.

Also um es nochmal zusammenzufassen, brauche ich Hilfe für 1 der 2 Probleme:

• Flash über Socks Server umleiten (ohne externes Programm)

• oder: Winsock Hook DLL Fehler beheben

Viel Grüße
acdc