How to breakpoint exe tcp packet

Question

I am debugging an executable in windows with IDA.

My exe sends a TCP packet and I want to see which function it uses to send the packets. I looked on the import tab and haven't found any function that had the strings tcp or send buffer in their names or something like this.

How can I find the function responsible for sending the TCP packet and how can I can see the buffer that is being sent (right before sending)?

Answer 1

open procmon from sysinternals

add a filter with your process name

and take a look at stack trace

if you have configured symbols then you get a pretty good overview

a small python server and client (mod from wiki.python)

:\>cat server.py
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('127.0.0.1', 5005))
s.listen(1)

conn, addr = s.accept()
print 'Connection address:', addr
while 1:
    data = conn.recv(20)
    if not data: break
    print "received data:", data
    conn.send(data)  # echo
conn.close()


:\>cat client.py
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('127.0.0.1', 5005))
s.send("Hello, World!")
data = s.recv(1024)
s.close()
print "received data:", data
:\>

procmon filtering only network activity of python.exe

executing the server and client

procmon captured these network events

and here is the call stack for the First TcpConnectEvent

Frame,          Module,         Location
00,         ntkrnlpa.exe,       EtwpTraceNetwork + 0x55
01,         tcpip.sys,          TcpTraceConnectionEstablishment + 0xdc
02,         tcpip.sys,          TcpCreateAndConnectTcbComplete + 0x576
03,         tcpip.sys,          TcpSynchronizeTcbDelivery + 0x28
04,         tcpip.sys,          TcpTcbCarefulDatagram + 0x47e
05,         tcpip.sys,          TcpTcbReceive + 0x228
06,         tcpip.sys,          TcpMatchReceive + 0x237
07,         tcpip.sys,          TcpPreValidatedReceive + 0x293
8,          tcpip.sys,          TcpReceive + 0x2d
9,          tcpip.sys,          TcpNlClientReceiveDatagrams + 0x12
10,         tcpip.sys,          IppDeliverListToProtocol + 0x49
11,         tcpip.sys,          IppProcessDeliverList + 0x2a
12,         tcpip.sys,          IppReceiveHeaderBatch + 0x1fb
13,         tcpip.sys,          IppLoopbackTransmit + 0x226
14,         tcpip.sys,          IppLoopbackEnqueue + 0x13d
15,         tcpip.sys,          IppDispatchSendPacketHelper + 0xf6
16,         tcpip.sys,          IppPacketizeDatagrams + 0x8d6
17,         tcpip.sys,          IppSendDatagramsCommon + 0x652
18,         tcpip.sys,          IpNlpSendDatagrams + 0x4b
19,         tcpip.sys,          IppSlowSendDatagram + 0x31
20,         tcpip.sys,          IpNlpFastSendDatagram + 0x1067
21,         tcpip.sys,          TcpTcbSend + 0x787
22,         tcpip.sys,          TcpCreateAndConnectTcbRateLimitComplete + 0x6d2
23,         tcpip.sys,          TcpCreateAndConnectTcbInspectConnectComplete + 0x20d
24,         tcpip.sys,          TcpContinueCreateAndConnect + 0x69b
25,         tcpip.sys,          TcpCreateAndConnectTcbInspectConnectRequestComplete + 0xf8
26,         tcpip.sys,          TcpCreateAndConnectTcbWorkQueueRoutine + 0x4df
27,         tcpip.sys,          TcpCreateAndConnectTcb + 0x82a
28,         afd.sys,            AfdConnect + 0x826
29,         afd.sys,            AfdDispatchDeviceControl + 0x3b
30,         ntkrnlpa.exe,       IofCallDriver + 0x63
31,         aswArPot.sys,       aswArPot.sys + 0xfef3
32,         ntkrnlpa.exe,       IofCallDriver + 0x63
33,         ntkrnlpa.exe,       IopSynchronousServiceTail + 0x1f8
34,         ntkrnlpa.exe,       IopXxxControlFile + 0x6aa
35,         ntkrnlpa.exe,       NtDeviceIoControlFile + 0x2a
36,         ntkrnlpa.exe,       KiSystemServicePostCall
37,         ntdll.dll,          ZwDeviceIoControlFile + 0xc
38,         mswsock.dll,        SockDoConnectReal + 0x29e
39,         mswsock.dll,        SockDoConnect + 0x3a1
40,         mswsock.dll,        WSPConnect + 0x1f <<------
41,         ws2_32.dll,         connect + 0x52 <<<<----
42,         _socket.pyd,        init_sockobject + 0xf78  <<--parent
43,         _socket.pyd,        init_sockobject + 0x10f2
44,         python27.dll,       PyCFunction_Call + 0xe3
45,         python27.dll,       PyEval_GetFuncDesc + 0xb0a
46,         python27.dll,       PyEval_EvalFrameEx + 0x247b
47,         python27.dll,       PyEval_EvalCodeEx + 0x7dc
48,         python27.dll,       PyFunction_SetClosure + 0x9a1
49,         python27.dll,       PyObject_Call + 0x4c
50,         python27.dll,       python27.dll + 0x7ac5
51,         python27.dll,       PyObject_Call + 0x4c
52,         python27.dll,       PyEval_GetFuncDesc + 0x834
53,         python27.dll,       PyEval_GetFuncDesc + 0x3d5
54,         python27.dll,       PyEval_EvalFrameEx + 0x23cf
55,         python27.dll,       PyEval_EvalCodeEx + 0x7dc
56,         python27.dll,       PyRun_FileExFlags + 0xcf
57,         python27.dll,       PyRun_FileExFlags + 0x6e
58,         python27.dll,       PyRun_SimpleFileExFlags + 0x201
59,         python27.dll,       PyRun_AnyFileExFlags + 0x57
60,         python27.dll,       Py_Main + 0xa4c
61,         python.exe,         python.exe + 0x1180
62,         kernel32.dll,       BaseThreadInitThunk + 0xe
63,         ntdll.dll,          __RtlUserThreadStart + 0x70
64,         ntdll.dll,          _RtlUserThreadStart + 0x1b

Answer 2

There's a huge variary of windows API functions that let a program send TCP packets. Non of those (as far as I recall) contain the strings tcp or send buffer in their name.

to reverse engineer network communication, you should start by gaining some knowledge on how packets are sent my programs, what are the relevant APIs and how they're used. This will most likely begin with reading the documentation over at MSDN.

Here are some pointers:

1. send
2. introduction to the winsock subsystem
3. a winsock walkthrough