14

How is it possible to get the Socket ID (Handle) of the created sockets of a program?

I know I can get all the open sockets in all programs by GetTcpTable() but it has two problems:

  1. It shows all programs sockets
  2. It doesn't return ID (Handle) of sockets
5
  • You could enumerate all objects in a process (the PID can be obtained with GetExtendedTcpTable and TCP_TABLE_OWNER_PID_ALL) and look for handles that are named something 'Device\Tcp' (see github.com/dzzie/SysAnalyzer/blob/master/source/sysanalyzer/… or powerbasic.com/support/forums/Forum4/HTML/012185.html). A quick scan with Process Explorer showed that this naming scheme doesn't work anymore on Windows 8 though. What do you need the socket handle for? Maybe there is other way to solve your probem that doesn't involve hijacking socket handles. Apr 28, 2013 at 11:09
  • @DanielStelter I simply want to send packets with their socket
    – Shahriyar
    Apr 28, 2013 at 11:14
  • 1
    @Shahriyar: What you are asking for is not trivial. In order for one process to access another process's socket, the source process must call WSADuplicateSocket() on its own socket and then pass that info to the target process via IPC. The target then passes the info to WSASocket() to gain access to the source's existing connection. Unless you are writing both apps, the source app will not call WSADuplicateSocket() for you, so you would have to inject your own code into the source process, such as with CreateRemoteThread(), to call WSADuplicateSocket() and get the info back. Apr 28, 2013 at 19:51
  • @RemyLebeau - Even if he managed to inject code into the other process with CreateRemoteThread, he still doesn't have a socket value to pass to the call to WSADuplicateSocket.
    – selbie
    Apr 29, 2013 at 10:02
  • @selbie: that is the whole purpose of the original question - how to get the socket handle of another process. Daniel answered that - enumerate the process's kernel objects looking for Device\Tcp objects until you find the desired handle. Apr 29, 2013 at 15:37

2 Answers 2

7

As Remy said, its not trivial. You have to call OpenProcess with PROCESS_DUP_HANDLE for each process in the system. You might also need PROCESS_QUERY_INFORMATION and PROCESS_VM_READ, but I've never needed it (I've seen other code that uses it).

For each process, you access the donor process's handle table with NtQuerySystemInformation (with an information class of SystemHandleInformation). Finally, you call DuplicateHandle to make the process's handle your handle, too.

You will have to filter the handle types when enumerating the donor process's handle table. For each handle you have duplicated, call NtQueryObject with ObjectTypeInformation. If the type is a socket, you keep it open and put it in your list. Otherwise, close it and go on.

To perform the compare, the code looks similar to below. The type is returned as a UNICODE_STRING:

// info was returned from NtQueryObject, ObjectTypeInformation
POBJECT_TYPE_INFORMATION pObjectTypeInfo = (POBJECT_TYPE_INFORMATION)(LPVOID)info;

wstring type( pObjectTypeInfo->Name.Buffer, pObjectTypeInfo->Name.Length );
if( 0 != wcscmp( L"Socket", type.c_str() ) ) { /* Not a Socket */ }

If there is no Socket type (I don't recall), you should try to get the name associated with the handle (its still a UNICODE_STRING), and look for \\Device\\Tcp. This time, you would use the same handle, but call NtQueryObject with ObjectNameInformation:

// info was returned from NtQueryObject, ObjectNameInformation
POBJECT_NAME_INFORMATION pObjectNameInfo = (POBJECT_NAME_INFORMATION)(LPVOID)info;

wstring name( pObjectNameInfo->Name.Buffer, pObjectNameInfo->Name.Length );
if( name.substr(0, 11) == "\\Device\\Tcp" ) ) { /* It's a TCP Socket */ }

Myself an another fellow did similar a few years ago. Instead of Sockets, we used Mutexes and Events to crash privileged Antivirus components from their userland UI program (which was sharing handles with the privileged component for IPC). See Old Dogs and New Tricks: Do You Know Where Your Handles Are?.

3
  • 1
    Also see Socket Handles on Sysinternals forums.
    – jww
    May 2, 2013 at 4:50
  • Thanks, but what happens if that program has more than one socket ?
    – Shahriyar
    May 2, 2013 at 10:23
  • Shahriyar - you will get all the sockets that are in the handle table.
    – jww
    May 4, 2013 at 7:12
4

Ok, thanks to everyone that tried to solve my problem
After a lot of works I get how to handle it myself, this is how i tried to get the specified socket :

  • At the first I looked in to program's disassembly and find out the calls to WS2_32 Send function.

Disassembly Code

As the picture show there is a call to Socket send function at 0x467781 and the Socket handle saved to the stack in the EDX register

  • Now what i need to do is to Hook my code in to that function.

    void GetSocket(int Flag,int DataSize, char* Data, SOCKET Socket)
     {
         sSocket = Socket;
         sFlag = Flag;
         sDataSize = DataSize;
         sData = Data;
         SendPacket(sSocket,Data,DataSize); //Send packets manually
     }
    
    __declspec(naked) void MyFunc()
     {
        __asm
          {
               PUSH EDX // Socket
               PUSH ECX // Buffer
               PUSH EAX // Buffer Size
               PUSH 0   // Flag
               CALL GetSocket
               MOV EAX, sDataSize
               MOV ECX, sData
               MOV EDX, sWowSocket
               JMP [JumpAddress] // JumpAddress = 0x467787 (After that CALL)
           }
     }
    

    And now i all have to do is to change that CALL (in 0x467781) to a JMP to our function(MyFunc) and it can be done with the following function :

    *(DWORD*)   (0x467781  + 0x01)  =   (DWORD)MyFunc- (0x467781  + 0x05);
    

Now I'm done,I can easily see each packet that it sends to server and change them if necessary and also send my custom packets whit its Socket :)

1
  • 1
    "... all have to do is to change that CALL" - I believe the Detours Library will do it for you ;)
    – jww
    May 3, 2013 at 5:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.