| View previous topic :: View next topic |
| Author |
Message |
iPromise
Grandmaster Cheater
![]() Reputation: -1
Joined: 27 Jun 2009
Posts: 529
Location: Canada
|
 Posted: Thu May 21, 2015 12:52 pm Post subject: Monitoring Internet downloads |
 |
|
I was planning on building a primitive anti-virus for fun.
I wanted to know how I could go about monitoring all user downloads. I figured that if I hooked whatever references there were for URLDownloadToFile in the kernel I'd be making some progress.
I wanted to confirm if that was how you would go about doing it, otherwise, get an idea of where I should go.
|
|
| Back to top |
|
 |
aikoncwd
Grandmaster Cheater
 Reputation: 23
Joined: 21 Dec 2012
Posts: 591
Location: Spain (Barcelona)
|
| Posted: Thu May 21, 2015 1:11 pm Post subject: Re: Monitoring Internet downloads |
|
|
| iPromise wrote: | I was planning on building a primitive anti-virus for fun.
I wanted to know how I could go about monitoring all user downloads. I figured that if I hooked whatever references there were for URLDownloadToFile in the kernel I'd be making some progress.
I wanted to confirm if that was how you would go about doing it, otherwise, get an idea of where I should go. |
There are so many ways to download info from internet, URLDownloadToFile is one, but there exist infinite methods to do the same without calling that API (for example with object like XMLHttpRequest). The best way to monitor, filter and controll every traffic is developing a driver that can be attached on the NIC (thats how Kaspersky firewall works, for example):
Doing something like this permit controll every pack-et that flows on the NIC (ethernet or wlan), so filter pack-ets that contains a pattern to determine inbound data, file download, etc...
Godd luck! haha
_________________
Hey Hitler
Test here your skill with CheatEngine, I coded a challenge for you. Try to beat it!
HERE |
|
| Back to top |
|
|
iPromise
Grandmaster Cheater
![]() Reputation: -1
Joined: 27 Jun 2009
Posts: 529
Location: Canada
|
| Posted: Thu May 21, 2015 1:42 pm Post subject: |
|
|
Do all of these functions have unique references in the kernel? I'm sure there's some common function that they both end up calling. I'll take a look into that.
That's the next best method I can think of other than monitoring every packet.
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
