Hey zamolx32, madshi
I am too trying to write a traffic analyzer/personal firewall/you name it!!
aka winsock hook app and I found something interesting. Namely there are differences in my app's behaviour whether I hook ws2_32.dll or WSOCK32.dll
My approach is to filter traffic in the user gui app by using an IPC message sent from the DLL to the app and waiting for a reply from the app. - as madshi suggested
From the tries I undertook so far I got some very awkward results. Periodically IE crashes when hooked although I am only displaying the packet content in my app and returning a PASS action to the packet.
If I hook ws2_32.dll i get the result abouve mentioned. If I hook wsock32.dll, strangely enough the crashes seem to apear less often.
I think there is a different approach in how ws2_32.dll and wsock32.dll work even though they export the same functions. I'm not really sure when is one used and when another.
So far, I'll stick to hooking wsock32.dll rather than ws2_32.dll
That's because I want to do packet filtering at the user level, not the dll level. First thing is because at user level I can change the filter rule list with much more flexibility (only one place to update) whereas in the DLL, i'd have to load the latest version of the traffic filter rules list everytime a filter should occur. And that's slow.
