Hooking syscalls from userspace on Windows

Question

I'm patching connect() to redirect network traffic as part of a library (NetHooker) and this works well, but it depends on ws2_32.dll remaining the same and doesn't work if the syscall is used directly. So what I'm wondering is if there's a way to catch the syscall itself without a driver. Anyone know if this is possible?

Answer 1

Cody, maybe you could take a look at http://research.microsoft.com/en-us/projects/detours/

Also, I wrote some code that, given the name of dll export will redirect it to another function pointer by patching the image in memory, let me know if you want the code.

Answer 2

Cody,

Instead of system call hooking, you might want to look into writing a layered service provider.

http://www.microsoft.com/msj/0599/LayeredService/LayeredService.aspx

Answer 3

Apart from Detours library, you might also take a look at easyhook library. Both libraries are designed to patch the image in memory.