The DLL describes itself in its own source:
#define SZAPPNAME "LKS WinSock Hook DLL"
#define SZDESCRIPTION "Logs WinSock calls - just a test at the moment but could be very useful... :)"
#define SZVERSION "Version 4.0"
#define SZRCOMPANYNAME "LKS Global Takeover Systems"
#define SZRCOPYRIGHT "<c> LKS 1999"When a process loads it, DllMain loads the real c:\windows\system\wsock32.dll and looks up each of its exports with GetProcAddress, keeping a real_… pointer for every function. A debug helper writes status messages straight onto the screen with TextOut, guarded by a critical section.
The list of functions to forward lives in exports.txt, taken from wsock32n.dll because, as its header says, wsock32.dll “doesn't seem to export any names”. The Perl script makehookvc.perl reads that list and writes the C forwarding code, a .def file for Visual C and an .lbc file for Watcom. Its header comment records what the hook was for: replacing every http://www.roland.co.uk/cgi-bin/ with http://www.spira.co.uk/roland/new/bin/.
Source 5 files
- wshookvc.c C · 711 lines
- makehookvc.perl Perl · 297 lines
- exports.txt Text · 92 lines
- wshookvc.def Module definition · 83 lines
- wshookvc.lbc Watcom linker file · 87 lines