{"componentChunkName":"component---src-templates-post-template-js","path":"/windows-windbg-010-socket-en","result":{"data":{"markdownRemark":{"id":"b1138ecf-899a-5c29-92cc-4090434c6467","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I have been reverse-engineering my own modules in order to improve my reverse-engineering skills and become proficient with WinDbg.

\n

This time I will analyze a Windows socket communication program implemented in C.

\n

Note: This program was created for verification purposes and does not implement error handling, so it is not intended for production use.

\n\n

Table of Contents

\n\n

The Program

\n

The program created for this article is available in the following repository.

\n

Reference: Try2WinDbg/wintcpudp.c

\n

It implements the following two functions:

\n\n

The following header files are used:

\n
#include <winsock2.h>\n#include <stdio.h>\n#include <stdlib.h>\n#include <stdint.h>\n\n#pragma comment(lib, \"ws2_32.lib\")\n\n// Use when handling IP addresses, etc.\n// #include <ws2tcpip.h>\n// #include <iphlpapi.h>\n// #pragma comment(lib, \"iphlpapi.lib\")\n\n// When used alongside winsock2.h, always place this include after winsock2.h\n// #include <windows.h>
\n

winsock2

\n

winsock2.h is a header file used when implementing Windows Sockets 2 and related functionality.

\n

It contains API functions and other definitions used for socket communication on Windows.

\n

Reference: Winsock2.h header - Win32 apps | Microsoft Docs

\n

Reference: Windows Sockets 2 - Win32 apps | Microsoft Docs

\n

Reference: Winsock - Wikipedia

\n

The first step in Windows socket programming is to initialize the WSADATA structure using the WSAStartup function defined in winsock2.h.

\n

Reference: WSADATA (winsock.h) - Win32 apps | Microsoft Docs

\n

Reference: WSAStartup function (winsock2.h) - Win32 apps | Microsoft Docs

\n

WSAStartup takes two arguments: the Windows Sockets version to use, and the WSADATA structure to initialize.

\n

One slightly tricky point is that the first argument to WSAStartup is a 16-bit unsigned integer (WORD type), where the lower 8 bits specify the major version and the upper 8 bits specify the minor version of Windows Sockets.

\n

For this reason, the MAKEWORD macro is used to construct the argument value.

\n

Reference: MAKEWORD macro (Windows) | Microsoft Docs

\n

On success, WSAStartup returns 0; on failure, it returns one of the defined error codes.

\n

Although not included in this implementation, error handling for the WSAStartup return value should be added in practice.

\n

pragma comment()

\n

When you try to compile source files that include headers like winsock2.h, you may encounter errors such as error LNK2019: unresolved external symbol.

\n
win_tcp_udp.obj : error LNK2019: unresolved external symbol __imp__closesocket@4 referenced in function _send_http_post\nwin_tcp_udp.obj : error LNK2019: unresolved external symbol __imp__connect@12 referenced in function _send_http_post\nwin_tcp_udp.obj : error LNK2019: unresolved external symbol __imp__htons@4 referenced in function _send_http_post\nwin_tcp_udp.obj : error LNK2019: unresolved external symbol __imp__inet_addr@4 referenced in function _send_http_post\nwin_tcp_udp.obj : error LNK2019: unresolved external symbol __imp__send@16 referenced in function _send_http_post\nwin_tcp_udp.obj : error LNK2019: unresolved external symbol __imp__sendto@24 referenced in function _send_udp\nwin_tcp_udp.obj : error LNK2019: unresolved external symbol __imp__socket@12 referenced in function _send_http_post\nwin_tcp_udp.obj : error LNK2019: unresolved external symbol __imp__WSAStartup@8 referenced in function _send_http_post\nwin_tcp_udp.obj : error LNK2019: unresolved external symbol __imp__WSACleanup@0 referenced in function _send_http_post\n.\\build\\bin\\win_tcp_udp.exe : fatal error LNK1120: 9 unresolved externals
\n

This occurs when the compiler cannot link the required library.

\n

To resolve this, do one of the following:

\n\n

Since I am compiling the C file directly with cl.exe without creating a project, I will use pragma.

\n

pragma is a directive that instructs the compiler to perform a specific action at compile time.

\n

In particular, using the comment pragma with the lib argument lets you specify from the source code which library to link at compile time.

\n

Reference: C Pragmas | Microsoft Docs

\n

Reference: comment pragma | Microsoft Docs

\n

Therefore, adding #pragma comment(lib, \"ws2_32.lib\") avoids the linker error for winsock2.h.

\n

ws2tcpip.h

\n

Not needed for this implementation, but ws2tcpip.h is a header file required for TCP/IP communication that defines structures related to IP address retrieval.

\n

Reference: Creating a Basic Winsock Application - Win32 apps | Microsoft Docs

\n

Reference: Ws2Tcpip.h header - Win32 apps | Microsoft Docs

\n

The POST Request Sending Function

\n

The function that sends a POST request to an arbitrary address is as follows:

\n
int send_http_post(unsigned char *senddata){\n    char destination[] = RSERVER;\n    unsigned short port = 80;\n    unsigned char httppath[20] = \"/upload\";\n    char httphost[] = LSERVER;\n    int dstSocket;\n    int result;\n \n    char toSendText[MAXBUF];\n    char postdata[MAXBUF];\n    int read_size;\n\n    // Initialize WSADATA\n    WSADATA data;\n    WSAStartup(MAKEWORD(2, 0), &data);\n\n    // Set AF_INET\n    struct sockaddr_in dstAddr;\n    memset(&dstAddr, 0, sizeof(dstAddr));\n    dstAddr.sin_port = htons(port);\n    dstAddr.sin_family = AF_INET;\n    dstAddr.sin_addr.s_addr = inet_addr(destination);\n\n    // Start socket communication (specify SOCK_STREAM)\n    printf(\"\\t==>Creating socket...\\n\");\n    dstSocket = socket(AF_INET, SOCK_STREAM, 0);\n    if (dstSocket < 0){\n        printf(\"\\t==>Creating socket failed!!\\n\");\n        return 0;\n    }\n    printf(\"\\t==>Creating socket succeeded!!\\n\");\n \n    // Establish connection\n    printf(\"\\t==>Connecting...\\n\");\n    result = connect(dstSocket, (struct sockaddr *) &dstAddr, sizeof(dstAddr));\n    if (result < 0){\n        printf(\"\\t==>Binding failed!!\\n\");\n        return 0;\n    }\n    printf(\"\\t==>Connecting succeeded!!\\n\");\n \n    // Build HTTP request\n    printf(\"\\t==>Creating HTTP request...\\n\");\n    sprintf(toSendText, \"POST %s HTTP/1.1\\r\\n\", httppath);\n    send(dstSocket, toSendText, strlen(toSendText) , 0);\n \n    sprintf(toSendText, \"Host: %s:%d\\r\\n\", httphost, port);\n    send(dstSocket, toSendText, strlen(toSendText), 0);\n\n    sprintf(postdata, \"%s\\r\\n\", senddata);\n    sprintf(toSendText, \"Content-Length: %d\\r\\n\", strlen(postdata));\n    send(dstSocket, toSendText, strlen(toSendText), 0);\n         \n    sprintf(toSendText, \"\\r\\n\");\n    send(dstSocket, toSendText, strlen(toSendText), 0);\n\n    // Send HTTP request\n    printf(\"\\t==>Sending HTTP request...\\n\");\n    send(dstSocket, postdata, strlen(postdata), 0);\n  \n    // Close connection\n    printf(\"\\t==>HTTP request is sent!!\\n\");\n    closesocket(dstSocket);\n    WSACleanup();\n\n    return 0;\n}
\n

Initializing WSADATA

\n

First, initialize the WSADATA structure required for socket communication using the WSAStartup function.

\n

Windows Sockets version 2.0 is specified.

\n
// Initialize WSADATA\nWSADATA data;\nWSAStartup(MAKEWORD(2, 0), &data);
\n

Specifying the Destination

\n
// Set AF_INET\nstruct sockaddr_in dstAddr;\nmemset(&dstAddr, 0, sizeof(dstAddr));\ndstAddr.sin_port = htons(port);\ndstAddr.sin_family = AF_INET;\ndstAddr.sin_addr.s_addr = inet_addr(destination);
\n

After initializing the WSADATA structure, create a sockaddr_in structure and set the address family, destination address, and port number.

\n

The official documentation shows a method using the addrinfo structure, but this implementation uses sockaddr_in.

\n

Reference: Creating a Socket for the Client - Win32 apps | Microsoft Docs

\n

The sockaddr_in structure is only for IPv4 communication; use sockaddr_in6 for IPv6.

\n

The addrinfo structure used in the official documentation works with both IPv4 and IPv6 sockets.

\n

Unless there is a specific reason, using addrinfo should be fine.

\n

Reference: Operating System 9 | Socket Programming Experiment 2: Enable IPv4 and IPv6 | by Adam Edelweiss | SereneField | Medium

\n

Reference: c - What is the difference between struct addrinfo and struct sockaddr - Stack Overflow

\n

AF_INET is specified as the address family.

\n

AF_INET is the address family for IPv4 communication.

\n

Reference: sockets - What is AF_INET, and why do I need it? - Stack Overflow

\n

Creating the Socket

\n

Create a socket using the socket function.

\n
// Start socket communication (specify SOCK_STREAM)\nprintf(\"\\t==>Creating socket...\\n\");\ndstSocket = socket(AF_INET, SOCK_STREAM, 0);\nif (dstSocket < 0){\n    printf(\"\\t==>Creating socket failed!!\\n\");\n    return 0;\n}\nprintf(\"\\t==>Creating socket succeeded!!\\n\");
\n

Because this is a TCP connection, SOCK_STREAM is specified as the second argument.

\n

Reference: socket function (winsock2.h) - Win32 apps | Microsoft Docs

\n

The third argument is the protocol parameter, which defines the protocol to use.

\n

Here TCP is not explicitly specified; 0 is passed instead.

\n

This means the caller does not specify a protocol.

\n

Reference: c - what does 0 indicate in socket() system call? - Stack Overflow

\n

Establishing the Connection

\n

Next, use the connect function to establish the socket connection.

\n
// Establish connection\nprintf(\"\\t==>Connecting...\\n\");\nresult = connect(dstSocket, (struct sockaddr *) &dstAddr, sizeof(dstAddr));\nif (result < 0){\n    printf(\"\\t==>Binding failed!!\\n\");\n    return 0;\n}\nprintf(\"\\t==>Connecting succeeded!!\\n\");
\n

The connect function performs the client-side connection in socket communication.

\n

Reference: Connecting to a Socket - Win32 apps | Microsoft Docs

\n

This function establishes a TCP connection with the bound socket server.

\n

\"https://www.tutorialspoint.com/unix_sockets/images/socket_client_server.gif\"

\n

Image source: Unix Socket - Client Server Model

\n

Sending the HTTP Request

\n

The pre-built POST request data is sent to the server using the send function.

\n
// Send HTTP request\nprintf(\"\\t==>Sending HTTP request...\\n\");\nsend(dstSocket, postdata, strlen(postdata), 0);
\n

Although not implemented here, receiving a response would use the recv function.

\n

Reference: Sending and Receiving Data on the Client - Win32 apps | Microsoft Docs

\n

The UDP Communication Function

\n

The function that performs UDP communication is as follows:

\n
int send_udp(unsigned char *senddata)\n{\n    char destination[] = RSERVER;\n    unsigned short port = 80;\n    char httphost[] = LSERVER;\n    int dstSocket;\n    int result;\n\n    char toSendText[MAXBUF];\n    int read_size;\n\n    // Initialize WSADATA\n    WSADATA wsaData;\n    WSAStartup(MAKEWORD(2, 0), &wsaData);\n\n    struct sockaddr_in dstAddr;\n    memset(&dstAddr, 0, sizeof(dstAddr));\n    dstAddr.sin_port = htons(port);\n    dstAddr.sin_family = AF_INET;\n    dstAddr.sin_addr.s_addr = inet_addr(destination);\n\n    // Start socket communication (specify SOCK_DGRAM)\n    printf(\"\\t==>Creating socket...\\n\");\n    dstSocket = socket(AF_INET, SOCK_DGRAM, 0);\n    if (dstSocket < 0)\n    {\n        printf(\"\\t==>Creating socket failed!!\\n\");\n        return 0;\n    }\n    printf(\"\\t==>Creating socket succeeded!!\\n\");\n\n    // Send UDP packet\n    printf(\"\\t==>Sending UDP...\\n\");\n    sendto(dstSocket, senddata, strlen(senddata), 0, (SOCKADDR *)&dstAddr, sizeof(dstAddr));\n\n    printf(\"\\t==>UDP is sent!!\\n\");\n    closesocket(dstSocket);\n    WSACleanup();\n\n    return 0;\n}
\n

The implementation is essentially the same as the TCP version, so details are omitted.

\n

The differences are: the socket is created with SOCK_DGRAM for UDP, and since there is no three-way handshake, connect is not used; data is transferred with sendto instead.

\n

Verifying Communication

\n

I ran this program and used Wireshark to verify that communication was actually taking place.

\n

First, I confirmed that the POST request was sent:

\n

\n \n \n \n \n \n \n \n \n

\n

Now that I’ve confirmed the program works correctly, let’s reverse-engineer it.

\n

Reversing

\n

Decompiling with Ghidra

\n

I started by locating the main function from the entry function.

\n

I then identified the send_http_post and send_udp functions, and set the image base to the value loaded when win_tcp_udp.exe was executed.

\n

Capturing a TTD Trace with WinDbg

\n

To facilitate analysis, I captured a TTD trace of the compiled program.

\n

The TTD trace capture procedure is described in the following article:

\n

Reference: Introduction to a New Debugging Method with WinDbg Preview Time Travel Debugging

\n

The captured trace file is also available in the following repository:

\n

Reference: kash1064/Try2WinDbg

\n

Tracing the Socket Internals

\n

As the first analysis target, I decided to trace the behavior of the socket function.

\n

\n \n \n \n \n \n \n \n \n

\n

From Ghidra’s disassembly output, I set a breakpoint at 0xdf726e and advanced execution with the g command.

\n
> bu 0x00df726e\n> g
\n

Stepping into the socket function, I could see that it handles an object with Prolog in its name.

\n

\n \n \n \n \n \n \n \n \n

\n

I searched for information about Prolog for a while but couldn’t find anything relevant, so I skipped it for now.

\n

If anyone has more insight, please let me know.

\n

The Created Socket

\n

Next, let’s look at the line immediately after the socket function call.

\n

\n \n \n \n \n \n \n \n \n

\n

Checking the memset return value, I found that the allocated memory starts at 0x55d810.

\n
> r eax\neax=0055d810
\n

Looking at the memory, it appears that a 16-byte region has values set.

\n

The sockaddr_in structure uses 2 bytes each for the port and address family, 4 bytes for the IP address, and 8 bytes for the system-reserved field.

\n

\n \n \n \n \n \n \n \n \n

\n

Advancing execution, the port number, address family, and IP address were written into the previously empty memory region.

\n

\n \n \n \n \n \n \n \n \n

\n

This was a bit hard to read, so I changed the display format:

\n
> dyb 0055d810\n          76543210 76543210 76543210 76543210\n          -------- -------- -------- --------\n0055d810  00000010 00000000 00000000 01010000  02 00 00 50\n0055d814  10101001 11111110 01100100 00011110  a9 fe 64 1e\n0055d818  00000000 00000000 00000000 00000000  00 00 00 00\n0055d81c  00000000 00000000 00000000 00000000  00 00 00 00
\n

Port 80 is stored as 0x0050 in network byte order (big-endian).

\n

The 4 bytes starting at 0x55d814 contain the IP address, also in network byte order.

\n

Summary

\n

I spent the end of the year doing socket programming and reverse-engineering.

\n

Hope the new year brings good things.

","fields":{"slug":"/windows-windbg-010-socket-en","tagSlugs":["/tag/win-dbg-en/","/tag/kernel-en/","/tag/reversing-en/","/tag/c-c-en/","/tag/english/"]},"frontmatter":{"date":"2022-01-01","description":"","tags":["WinDbg (en)","Kernel (en)","Reversing (en)","C/C++ (en)","English"],"title":"Reversing a Windows Sockets TCP/UDP Communication Program","socialImage":{"publicURL":"/static/5c0b851ce6b11ba9ab8d74d12a5a4a1b/windows-windbg-010-socket.png"}}}},"pageContext":{"slug":"/windows-windbg-010-socket-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}