Click here to Skip to main content
65,938 articles
CodeProject is changing. Read more.
Articles / All-Topics

Intercepting Calls in Web Services (Worker Process)

5.00/5 (3 votes)
7 Nov 2011CPOL2 min read 18.1K  
How to intercept Web Service calls directly in the worker process.

Introduction

This is not a tutorial about Web Services and their usage. The usage of this technology is well known across the software industry.

The purpose of this article is to show a method for “how to intercept Web Service calls and show in screen”. We will work directly on the Worker process. Unfortunately, with sniffers, we can’t get traffic from localhost.

OK, let’s start:

Suppose you have an application which is calling a WebService.

  1. Open Windows Debugger: windbg.exe process.
  2. Press F6 and attach the w3wp.exe process.
  3. Once we get the process attached, execute the command (.loadby sos mscorwks in the case of .NET Framework < 4.0): .loadby sos mscoreei.
  4. After deep research, I found an interesting function which could be useful: System.Web.HttpRequest.GetEntireRawContent.
  5. Let’s try to see where this function is JITted:
  6. !name2ee * System.Web.HttpRequest.GetEntireRawContent

    Image 1

  7. The JITted address is 5241cfd0, so let’s put a breakpoint right there: bp 5241cfd0.
  8. Use your application and it will get frozen because the breakpoint was launched.
  9. On investigation, this function runs and returns the System.Web.HttpRawUploadedContent class. To run this method until the end, let’s put the pt command.
  10. Image 2

  11. By simple examination, we can see that this returns on the @eax register all the variables with the class HttpRawUploaded. Let us see the _data field.
  12. Image 3

  13. Good, we have the entire content in byte[] of the WebService call. How can we dump in screen every time this function is called? .printf "%ma",poi(eax+4)+8, where 4 is the offset to get the data in this class, eax is the return address of this method, and 8 is the address of the first char in the Web Service. %ma means ANSI characters.
  14. Image 4

  15. Let’s delete the first breakpoint and put a new one at the end of this function: bc *.
  16. Let’s put: Bp eip “.printf \"\\n%ma\",poi(eax+4)+8;gc”.
  17. We now have all the calls of the Web Service for monitoring.

Image 5

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)