Re: Api hooking papers ?

[Blue Boar <BlueBoar () thievco com>]

Nicolas RUFF wrote:
> On Windows XP SP2, download the debug symbols for ws2_32.dll and look 
> for CheckForHookersOrChainers(). This function will match 
> GetProcAddress() results against all functions defined in the apfns[] 
> array ...

On the other hand, so far all of the XP SP2 dlls I've looked at so far 
have left room at the beginning of each function for a couple of JMPs, 
which would making hooking that much easier if you switch techniques.  I 
haven't checked ws2_32.dll specifically, yet.

                                                BB
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
https://lists.immunitysec.com/mailman/listinfo/dailydave