WinSock hooking and WSAGetLastError problem

Aug 20, 2012 at 12:45 PM



I am trying to hook connect function of WinSock 2 (ws2_32.dll) and I was successful, but there is a big problem here.

All modern browsers use not-blocking connections and when using connect function on a not-blocking connection, it will raise error 10035 mean that this operation can't complete immediately and you need to check later and see if we are connected or not. This is a normal behavior and this error is not really an error. Something like an info or warning.

Most of browsers expect this error and if we don't have this error they will kill the connection. The problem is here that WSAGetLastError is thread related so if you run connect function on an other thread you can't read related error. And it seems that EasyHook will run in an other thread separated from calling thread, so when I try to route this function by calling original connect from my hook, any error generated is inaccessible for calling thread. (Only I can access it from hook, not application it-self)

So IE, Chrome and Firefox that expect error 10035 will face with error 0 (no error) because connection made in EasyHook thread not there, I don't know if EasyHook can solve this types of problems. Seems little hard to solve. What i think is, Is there any way to run a block of code in calling thread (application it-self)?! So i can set error myself using WSASetLastError on that thread?! This will force any WSAGetLastError call after that to return my last submitted error code.

Currently I can hook WSAGetLastError too, but this makes another problems because EasyHook's thread also have no access to calling thread's errors. Errors that may come from other methods (other than connect method). The only way I can think of currently is to hook all ws2_32.dll methods which is hard.

Any help is appreciated

Aug 20, 2012 at 10:50 PM

Your hook should already be running in the correct thread, I think maybe there is something else happening here that is messing with the SetLastError.

Aug 20, 2012 at 10:50 PM
This discussion has been copied to a work item. Click here to go to the work item and continue the discussion.