Disclaimer: I am very new to Reverse Engineering, though it captivates me. Hence, I'm apologizing beforehand if I say anything ridiculous in the following, and hope you will help me find the way!

Context: I have an application which seems coded in Adobe AIR and running on my x64 Windows 7. This application does a lot of things, but what interests me is: it communicates with an XMPP server through port 5223, through SSL. My goal is to be able to read the XML requests sent by the client to the server before they are SSL-encrypted (so right after the request is created, but right before it is encrypted).

Unsuccessful tries: I attempted to set up a MitM, but the application won't accept my custom-crafted certificate because it is different from the real server certificate. I also attempted to use Echo Mirage, but without any success.

I have read a bit about hooking, and figured it was adapted to my problem. I was thinking: if I can get the application to print the XMPP request before SSL-encrypting it, the job would be done. To do so, implementing a C# hook with EasyHook seemed like a good idea to me.

Am I largely mistaken? If not, how exactly would I go about getting my hook function to print the requests, and before which function call should I place it?
I am open to any documentation you might have for me!

1 Answer 1


Thanks for providing a good amount of context in your question.

Yes, hooking is the way to go. The function that you'd want to hook is the function that performs the SSL encryption, as it would be the function that receives the plaintext as input.

The hard part is finding that encryption function. To do so, I recommend that you use Process Monitor to capture the network-send events and double-click on those events to see the callstack. You can then use a disassembler and/or a debugger to analyze the functions in the callstack that are called prior to the low-level network send call. This will help you narrow down which functions to analyze so that you can more easily find the function that performs the encryption.

Alternatively, you can try to find the encryption function by searching for cryptographic functions via a tool like PEiD with its Krypto ANALyzer plugin and then analyzing them with a disassembler.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.