Reak I post too much
Reputation: 0
Joined: 15 May 2007 Posts: 3496
|
Posted: Sun Jan 04, 2009 9:49 am Post subject: [Delphi CE Plugin] Removing hooks |
|
|
Hey,
Some of you may have looked at CE's (v 5.4.5) Packet Editor (Which is a plugin, in delphi).
It's hooking recv/recvfrom/WSArecv/WSArecvfrom ... same with send.
So, when injecting the Packet Editor into a process it's hooking those functions. But since after you'd unload it all send and recv functions wouldn't work no more and the application would probably crash I wanted to remove the hooks.
I started with recv.
This is how the packet editor (Its injector) hooks it:
ce_exported.ce_generateAPIHookScript('ws2_32!recv','cepe!ws2recv','cepe!ws2recvorig',x,1024);
So:
| Code: | alloc(originalcall0,2048) //2kb should be enough
label(returnhere0)
cepe!ws2recvorig:
dd originalcall0
originalcall0:
mov edi,edi
push ebp
mov ebp,esp
jmp returnhere0
ws2_32!recv:
jmp cepe!ws2recv
returnhere0: |
ws2recv is the hook function of the packet editor.
So now I've been wondering how I could remove the hook and thought of the following options:
- Copying cepe!ws2recvorig to ws2_32!recv
- ws2_32!recv: jmp cepe!ws2recvorig (But I can't unload the dll then right?)
How would you handle this? |
|