NDIS Driver Filter VS API Hooking
- by Smarty Twiti
I've seen many developers asking for "How to intercept in/out HTTP packets ", "How to modify them on the fly". The most "clean" answer I've seen is to make a kernel-mode-driver filter from the scratch (TDI for XP and earlier winx9 or NDIS for NT systems).
An other way, is to use a user-mode-driver like Windivert, also Komodia has a great solution (without writing any single code).
The idea behind this introduction is just I want to know is API Hooking can be considered as alternative of writing of whole of driver-filter? writing a driver from the scratch is not an easy task, why just not Hooking the HttpSendRequest or any other API used by the browser? There are many free/commercial libraries to do this in a safe manner (eg: EasyHook, Mhook, Nektra..).
I'm not the first who ask, there already Sockscap that uses Hook(DLL injection) to change behavior to other applications and force them to use a Socks proxy, also Form grabbing attack 'used by keylogger..