Infinite detour?

Having a little trouble with this hook I'm trying to fix. This is my first time using the detours library by the way. Here's what I got so far.

Code:

#include "stdafx.h"
#include <detours.h>
#include <winsock2.h>

int(WINAPI* OriginalSend)(SOCKET s,const char* buf,int len,int flags) = send;

SOCKET SocketHook;

int WINAPI MySendHook(SOCKET s,const char* buf,int len,int flags)
{
	SocketHook = s;
	return OriginalSend(s,buf,len,flags);
}

BOOL WINAPI DllMain(HINSTANCE hInstance,DWORD Reason,void* Reserved)
{
	if(Reason == DLL_PROCESS_ATTACH)
	{
		DetourFunction((PBYTE)OriginalSend,(PBYTE)MySendHook);
	}
	return true;
}

As you can see, every time "send" is called it detours the function to my own. The problem is that I my function also calls "send". So this just creates an infinite loop of detours. What confuses me is that whenever "send" is called, the program with this DLL injected into it immediately closes. If you put a message box at the beginning of my function it DOES do an infinite loop sort of thing, the message box keeps appearing over and over again.

So, what I'm asking for is, is there anyway to NOT detour "send" when I call it? Or, if you have another method of doing this.

What I'm trying to accomplish with this is just to get a hold of the socket.

Note: I tryed hardcoding it... didn't go so well. Don't suggest hardcoding it as another possible method please.

Last thing, I'm injecting this into my own client which is connected to my own server, so I'm sure I'm hooking the right function.

apparently u need to have a DLL_PROCESS_DETACH flag under DllMain()
coz from what i know if u close an app windows calls the detach flag where it performs uninitialization(free memory and release resources)

Until I close the app, I don't want to detach the DLL from the program. I doubt it's relevant to my problem but I will try it anyways.

EDIT: I know the detour is working as it should be, I removed the last line of MySendHook so that it wouldn't loop and added a log. It logs the buffer but I still need to know how to be able to use "send" in my function without creating the infinite loop.

ITs not an infinite loop because the program uses the function a lot and it seems to be infinite. Or, if you actually think that is the problem after the first run and then unhook the function.

You way of detouring it is wrong

OriginalSend = DetourFunction((PBYTE)Address in the app you're injecting to, (PBYTE)MySendHook);
Use GetProcAddress to find the address

Originally Posted by Hell_Demon

You way of detouring it is wrong

OriginalSend = DetourFunction((PBYTE)Address in the app you're injecting to, (PBYTE)MySendHook);
Use GetProcAddress to find the address

Wow that worked. Thanks alot.

Would you mind explaining the difference between what you did and my method?
Here's the latest code, the one that works, using your method.

[php]#include "stdafx.h"
#include <detours.h>
#include <winsock2.h>

int(WINAPI* OriginalSend)(SOCKET s,const char* buf,int len,int flags) = send;

SOCKET SocketHook;

int WINAPI MySendHook(SOCKET s,const char* buf,int len,int flags)
{
MessageBox(NULL,"Called","Called",MB_OK);
SocketHook = s;
return OriginalSend(s,buf,len,flags);
}

void Keys()
{
while(true)
{
if(GetAsyncKeyState(VK_F1))
{
send(SocketHook,"Test",4,0);
}
}
}

BOOL WINAPI DllMain(HINSTANCE hInstance,DWORD Reason,void* Reserved)
{
if(Reason == DLL_PROCESS_ATTACH)
{
OriginalSend = (int(WINAPI*)(SOCKET,const char*,int,int))DetourFunction((PBYTE)GetProcAddres s(GetModuleHandle("ws2_32.dll"),"send"),(PBYTE)MyS endHook);
CreateThread(0,0,(LPTHREAD_START_ROUTINE)Keys,0,0, 0);
}
return true;
}
[/php]

What you did before was hooking your function pointer(overwriting parts of the original send) and make the hook point to your own send function, but if then you called original send, which still points to the modified send, so it again goes into your hooked one, creating an infinite loop.

The way I posted it hooks the original send to jump to your custom send, and store a pointer to the 'new original send' in your function pointer.

example:
original send before the detour:
bla
bla
bla
return

original send after the detour:
jmp yoursend
bla
return

as you can see the first 2 bla's are gone :O
now where did it put those?
ah at the returnvalue of DetourFunction ;D

the stuff at the returnvalue should look like this:
bla //the missing command ;D
bla //^
jmp originalsend+detoursize

so basicly you're redirecting the original send through your custom send, and the modified bytes get saved somewhere different in memory, where it will also jump back to the original send.

Infinite detour?

Similar Threads

Tags for this Thread