🚀 go-pugleaf

"KR" <kr@nospamme.net> wrote in message
news:pan.2004.12.04.14.44.41.939127@nospamme.net...

> No driver needed.  Do a google search on "api hooking" and
> "dll injection".  Can be complicated, but not as much as
> writing a driver (plus there are tools to simplify this).

Using API hooking is much more complicated, not to mentio more dangerous,
than using a driver.  The NDIS architecture is specifically designed for
allowing such hooking.  API hooking, on the other hand, is a programming
hack, it is not the offcial way to approach this issue.

> Most winsock-intercepting programs (firewalls, etc) use this
> method I think, and don't resort to installing drivers.

That is completely wrong.  They do take the driver approach.  For one thing,
it is much easier to install and uninstall.  Just install a single file onto
the machine and set up a few official config values so that WinSock loads
the driver.  Using API hooking, on the other hand, you have to use a global
DLL hook that is installed into every process, altering that process's
memory in order to redirect the function calls to new memory that the DLL
owns.  That can be VERY dangerous, not to mention that it triggers
anti-virus protections because it is virus-like behavior to alter a
program's memory.  Second, it is much more accurate and reliable from a
programming standpoint to use a driver than hooking API calls anyway.


Gambit