Tag Archives: deviare

SpyStudio Is Now Free: Create and Troubleshoot Application Virtualization Packages for Windows

SpyStudio is now free and available for download here. It is a Swiss Army knife for cyber security analysts, DevOps, QA engineers, and developers. You can take a look at the articles “Nektra and VMware are Collaborating to Simplify Application Virtualization Packaging” and “How Nektra Improved Desktop Virtualization for Symantec Corporation” to see how big vendors are using it. This multi-tool is useful for application virtualization, troubleshooting windows applications, application performance monitoring, malware analysis, and as a process monitor complement.

Windows 10 Support

Both, SpyStudio and Deviare In-Proc, and Deviare Windows hooking engine, work on Windows 10.

Application Virtualization


SpyStudio creates virtualization packages and layers for VMware ThinApp and Symantec Workspace Virtualization. You can see it in action in the videos Harvesting Applications and Creating VMware ThinApp Packages with SpyStudio and Creating a VMware ThinApp package for Firefox in less than two minutes with SpyStudio.


SpyStudio troubleshoots application virtualization issues in products like Microsoft App-V, VMware ThinApp, Symantec Workspace Virtualization, Citrix XenApp, Cameyo, and Spoon.

See the video Nektra SpyStudio and Troubleshooting ThinApp Package by Peter Björk Lead Specialist, EMEA EUC Practice at VMware.

Catalog of Ready To Use Application Virtualization Packages

Additionally, Nektra offers application virtualization packages built by our engineers for Microsoft Office, Microsoft Lync, and Internet Explorer. The Microsoft Office and Lync packages support volume licenses which require Microsoft Key Management Server (KMS).

Troubleshooting Windows Deployment Issues

When you don’t know why an application works in some environments but not in others you can use SpyStudio to help you spot the differences.

Please take a look at Fixing an Internet Explorer Issue Using SpyStudio video.

Application Performance Monitoring

With SpyStudio you can benchmark applications running in different environments and identify performance issues that are degrading the end-user experience. Windows native and .NET applications are supported.

Look at the following example: “Benchmarking Microsoft Office’s PowerPoint Virtualization” compares App-V and SWV“.

Malware Identification

SpyStudio performs dynamic analysis on 64-bit and 32-bit Windows applications. The application execution patterns allow you to detect malicious behavior.

The book “Malware Forensics: Investigating and Analyzing Malicious Code and Malware Forensics Field Guide for Windows Systems” discusses one way SpyStudio can be used to fight malware.

Process Monitor Complement

Process Monitor is great for looking at issues that can be detected in kernel mode but it does not show Windows API usage.

SpyStudio reads Process Monitor logs and displays them in a friendly UI to quickly spot issues connected to the Windows API.


Commercial support is also available here.

Deviare Hooking Engine is Open Source and Deviare In-Proc Supports .NET Hooking

We have good news for those interested in Windows Hooking. Deviare Hooking Engine is now open source and available on GitHub. The license is GPL but a commercial license and support are also available for users who want to distribute closed-source products based on Deviare. Our other open source hooking product, Deviare In-Proc, now supports hooking .NET methods. Our main competitor Microsoft Detours does not.

People can now use, learn from, and fork Deviare Hooking Engine. If you are new to Deviare and want to bootstrap a project please take a look at our related blog posts. Academic users might be interested in the following resources:

We have also added a new option to Deviare In-Proc which disallows reentrancy. If a hook is marked with the disallow reentrancy flag, then calling the hooked function from the detoured one will jump to the original API function. It also provides helper methods to facilitate DLL injection into other processes.

For other differences between Deviare Hooking Engine and Deviare In-Proc see the reddit thread: GPL alternative library to Microsoft Detours for binary instrumentation.

Case Studies

Related Solutions

Registration-Free Activation of Deviare Hooking Engine COM in x86 and x64 platforms

Deviare 101 Part 1

Welcome to the first installment of Deviare 101.

In this article, we’ll explain how to use Deviare’s Reg-Free COM capability to easily deploy applications on end-user machines.

This guide uses Visual Studio 2013 but can also be followed on earlier versions.

The Manifest File

Reg-Free COM requires an XML file called a “manifest”. Manifest files specify which DLLs to load, and sets other application run-time properties.

If your project includes multiple Windows target platforms, you must use a different manifest for each platform.

This is what the manifest we use to support Deviare in the x86 platform looks like:

<?xml version=”1.0″ encoding=”utf-8″?>

<asmv1:assembly manifestVersion=”1.0″ xmlns=”urn:schemas-microsoft-com:asm.v1″ xmlns:asmv1=”urn:schemas-microsoft-com:asm.v1″ xmlns:asmv2=”urn:schemas-microsoft-com:asm.v2″ xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance”>

<assemblyIdentity version=”″ name=”myApp” processorArchitecture=”x86″/>




<assemblyIdentity type=”win32″ name=”DeviareCOM” version=”″ processorArchitecture=”x86″ />





Here is the manifest we use to support Deviare in the x64 platform:

<?xml version=”1.0″ encoding=”utf-8″?>

<asmv1:assembly manifestVersion=”1.0″ xmlns=”urn:schemas-microsoft-com:asm.v1″ xmlns:asmv1=”urn:schemas-microsoft-com:asm.v1″ xmlns:asmv2=”urn:schemas-microsoft-com:asm.v2″ xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance”>

<assemblyIdentity version=”″ name=”myApp” />




<assemblyIdentity type=”win32″ name=”DeviareCOM64″ version=”″ processorArchitecture=”amd64″ />





You must specify your application assembly name and version in the application’s <assemblyIdentity> tag. Additional attributes are optional.

How to Connect Your Application to the Manifest File

There are two ways to connect your application to the manifest file:

  • Place the manifest file in your application home directory. This requires the manifest file to have the same name as your application executable, with the “.manifest” suffix. For example, if your application executable is MyApp.exe, you must name the manifest MyApp.exe.manifest.
  • Embed the manifest in your application executable as a resource.

The second option involves a bit of work with project settings, and is described in the section below.

Deviare DLLs and database files should be placed in your application’s home directory or another searchable location (e.g: in the system path). Be aware that when you mix projects using Deviare with the Reg-Free COM mechanism with other projects using manual registration you may experience issues such as versioning problems. You can use the regsvr tool with the /U option to manually unregister Deviare.

Visual Studio C++ Project Setup Guide

To use Reg-Free COM Deviare in a C++ VS application, follow those steps:

  1. Create one manifest file for each target platform as shown at the beginning of this article. Name them “RegFreeCOM_x86.manifest” and “RegFreeCOM_x64.manifest”. Copy those files to your source file directory.
  2. Open your project settings, select the desired platform, go to “Manifest Tool >> Input and Output” and enter the filename in “Additional Manifest Files”. You can specify variables such as $(SolutionDir), $(ProjectDir) to modify the manifest path. Make sure the selected platform and manifest file platform match.


Do the same for the other platforms in your project,. In this case, the x64 platform:


DeviareCOM DLLs must be in the same directory as your executable. You can copy them manually; or use “Post-Build Event” in “Project Settings” to automate this step.


In the screenshot above, we show an example of how to use the “Command Line” field to copy Deviare DLLs and databases from a DLL directory within the solution directory ( $(SolutionDir) variable) to the output directory where the application executable is generated ( ($OutDir) variable).

  1. Build your project and test your application.

C# Project Setup Guide

Important: Visual Studio uses VSHOST.EXE to improve debugging when you launch an application. As a result Visual Studio ignores your embedded manifest and COM components are not loaded properly. There are two workarounds: 1) execute your application outside Visual Studio or 2) uncheck “Enable the Visual Studio hosting process” in your project settings:


If you want to use a single custom application manifest in a C# project, it’s easy to access the project settings dialog and choose a manifest file:


However, unlike Visual Studio C++ projects it is not possible to configure multiple-platform projects to use one manifest for each platform in Visual Studio C# projects. The above dialog only sets up a global manifest for the application.

Since Deviare 32-bit and 64-bit are different COM DLLs, you need to use different manifests to load them:

  1. Create manifest files as shown at the beginning of this article, one for each target platform. Name them “RegFreeCOM_x86.manifest” and “RegFreeCOM_x64.manifest”. Copy these files to your source file directory.
  2. Use a text editor to open your C# project file (“.csproj” extensión). Look for the “PropertyGroup” tags. There is one “PropertyGroup” for each configuration and platform target pair.

<PropertyGroup Condition=”‘$(Configuration)|$(Platform)’ == ‘Release|x86′”>


<PropertyGroup Condition=”‘$(Configuration)|$(Platform)’ == ‘Debug|x64′”>


<PropertyGroup Condition=”‘$(Configuration)|$(Platform)’ == ‘Release|x64′”>


<PropertyGroup Condition=”‘$(Configuration)|$(Platform)’ == ‘Debug|x86′”>


  1. With either VS closed or the project unloaded to allow modifications, you must insert the manifest declaration using the proper manifest file platform below the “<PropertyGroup …>” opening tag. If we have the RegFreeCOM_x86.manifest and RegFreeCOM_X64.manifest to use on the x86 and x64 builds, respectively, first, we’ll add the manifest declaration of the x86 build:

<PropertyGroup Condition=”‘$(Configuration)|$(Platform)’ == ‘Release|x86′”>


Repeat for all configuration combinations; be careful not to delete the existing tags between the PropertyGroup opening and closing tags.

<PropertyGroup Condition=”‘$(Configuration)|$(Platform)’ == ‘Debug|x64′”>


<PropertyGroup Condition=”‘$(Configuration)|$(Platform)’ == ‘Release|x64′”> <ApplicationManifest>RegFreeCOM_x64.manifest</ApplicationManifest>


<PropertyGroup Condition=”‘$(Configuration)|$(Platform)’ == ‘Debug|x86′”>


  1. Save the file, and reopen it in Visual Studio. Build the x86 and x64 platforms and test your application.

Checking Embedded Manifests

You may want to see if a manifest is properly embedded (or embedded at all) for debugging purposes. The Windows SDK included with VS provides a tool (MT) to work with manifest files.

To extract the manifest from your application, simply use the -inputresource and -out flags:

mt -inputresource:RegFreeComTest.Exe;#1 -out:CON

“CON” displays the manifest in the console. You can specify a filename to save it.

Additional Information

There’s plenty of general information about manifest files, and Registration-Free COM. Here are some useful links.


If you liked this article, you might also like:

The Changing Landscape of the Application Performance Monitoring Market

If you look at the last Gartner’s Magic Quadrant for APM and compare it with what is really happening in the market you will notice two things:

  1. With the exception of Compuware, the leaders, New Relic and AppDynamics, are all newcomers. All the old established companies are excluded from the leader’s quadrant.
  2. Gartner separates APM and analytics products, suggesting that the latter are mere complements. However, when paired with third-party applications, these analytics products are perfectly capable of replacing APM.

Our hypothesis is that the whole APM market will move into two specializations: analytics engines and agents for gathering performance metrics across different monitoring disciplines. Many new analytic or log management products are entering the market. Our new product ActivityLogger can send desktop and server metrics to an analytics product. In the example below, we send user experience metrics to Elasticsearch and display the results with Kibana.


If you liked this article, you might also like:

64-bit Microsoft Office Applications Do Not Like Stack Walking

Our SpyStudio tool intercepts application system calls and retrieves the called functions by inspecting the call-stack.

We were unable to access stack information in the last few 64-bit releases of Microsoft Office products. When we use SpyStudio to intercept an Office installation or most Office applications like Word or Excel, they start normally, but eventually exit silently.

Our initial research showed the culprit to be the Office Software Protection Platform, which would make sense, as it is supposed to hide an application’s safety mechanisms.

However, the Office Software Protection Platform did not keep us from intercepting the 32-bit version of Microsoft Office, so we decided to investigate further.

The .pdata Section

How does the 64-bit operating system do a stack walk when an exception occurs, and how can a debugger know who called a function?

Microsoft added new metadata information  which is stored on a special section named “.pdata” in the PE file format specification. When an application is compiled, the compiler stores information related to the prolog of each function. If a function handles exceptions, the compiler also stores data about actions that must happen when the unwind operation is executed.

The operating system and the debugger use a series of RUNTIME_FUNCTION structures to retrieve a variety of information about each function, like how much stack space is reserved for each function usage, which callbacks must be called in an unwind operation, and where assembly registers are stored.

If you want to do your own stack walking, you can start from the current program counter (the RIP register in x64) and look for the RUNTIME_FUNCTION that belongs to it. Then process the UNWIND_INFO items to determine stack usage, and lastly, retrieve the location of the return address of the parent function.

Fortunately, there are some new APIs which makes the job easier. They are RtlLookupFunctionEntry and RtlVirtualUnwind. A stack walking code sample:

VOID StackTrace64(VOID)
    CONTEXT Context;
    UNWIND_HISTORY_TABLE UnwindHistoryTable;
    PRUNTIME_FUNCTION RuntimeFunction;
    PVOID HandlerData;
    ULONG64 EstablisherFrame, ImageBase;

    DbgPrint("StackTrace64: Executing stack trace...\n");
    // First, we'll get the caller's context.
    // Initialize the (optional) unwind history table.
    RtlZeroMemory(&UnwindHistoryTable, sizeof(UNWIND_HISTORY_TABLE));
    UnwindHistoryTable.Unwind = TRUE;
    // This unwind loop intentionally skips the first call frame, as it shall
    // correspond to the call to StackTrace64, which we aren't interested in.
    for (ULONG Frame = 0; ; Frame++)
        // Try to look up unwind metadata for the current function.
        RuntimeFunction = RtlLookupFunctionEntry(Context.Rip, &ImageBase,
        RtlZeroMemory(&NvContext, sizeof(KNONVOLATILE_CONTEXT_POINTERS));
        if (!RuntimeFunction)
            // If we don't have a RUNTIME_FUNCTION, then we've encountered
            // a leaf function.  Adjust the stack approprately.
            Context.Rip  = (ULONG64)(*(PULONG64)Context.Rsp);
            Context.Rsp += 8;
            // Otherwise, we call upon RtlVirtualUnwind to execute the unwind
            // for us.
            RtlVirtualUnwind(UNW_FLAG_NHANDLER, ImageBase, Context.Rip,
                             RuntimeFunction, &Context, &HandlerData,
                             &EstablisherFrame, &NvContext);

        // If we reach an RIP of zero, this means that we've walked off the
        // end of the call stack and are done.

        if (!Context.Rip)
        // Display the context
        DbgPrint("FRAME %02x: Rip=%p Rsp=%p Rbp=%p\n", Frame, Context.Rip,
                 Context.Rsp, Context.Rsp);

Source: Programming against the x64 exception handling support, part 7

Because the .pdata section is created when the application is compiled, if the program generates dynamic code, like the .NET JIT profiler does, it should also create the corresponding RUNTIME_FUNCTION metadata and inform the operating system of the new dynamic code.

The RtlInstallFunctionTableCallback API adds an entry in an internal processes table maintained by NtDll.dll that helps RtlLookupFunctionEntry and RtlVirtualUnwind find information on how to walk the stack when your dynamically generated code is in the middle of the function calls chain.

Microsoft Office Installer and Applications

So what explains the silent exit of an Office application like Word?

At first we thought that some kind of intentional data corruption was happening in the internal table. It seemed like some kind of anti-debugging technique to keep reverse engineers from seeing the product activation mechanism.

After some trial and error we noticed that RtlInstallFunctionTableCallback was installing a callback to a suspicious routine. Surprisingly, that routine calls TerminateProcess API! When our stack walker function wanted to know the chain of calls, RtlLookupFunctionEntry indirectly called that routine and the program terminated silently.

Could the guys at Microsoft have decided to use this strange method to protect their code? The annoying callback function was added and removed frequently during many operations.

The solution was to add a simple hook to the RtlInstallFunctionTableCallback API to keep it from being added. Now the issue is resolved and the fixed versions of Deviare “Hooking for the Masses” and SpyStudio will be available soon.

If you liked this article, you might also like:

Instrumenting Microsoft SQL Server to Abort Dangerous Queries

Hernan has added a new feature to the code offered in our article SQL Server Interception and SQL Injection Attack Prevention. Now it is possible to cancel queries as well as watch them. The code sample uses the Deviare Interception Engine’s call-skipping feature to abort the execution of the CSQLSource::Execute function. The code distribution includes a customized Deviare database for adding the definition of CSQLSource::Execute function parameters. To use this feature you must invoke the application with the “-a” switch in the command line.

We also improved console debugging output and fixed errors that came up when exiting sqlservr.exe. If the developer has a Deviare license, it can be added as a license.txt file in the application directory to disable the splash window.

If you liked this article, you might also like:

  1. Capturing Unencrypted HTTPS Requests and Responses (As Seen at BlackHat USA 2013)
  2. Recording Direct3D Video Games and Calculating Frames per Second
  3. Controlling the Speed of YouTube Videos


  1. Open Web Application Security Project

Capturing Unencrypted HTTPS Requests and Responses (As Seen at BlackHat Arsenal)

Today Manuel Fernandez is presenting HookME at Black Hat USA Arsenal 2013. HookME is software designed for intercepting communications which uses the Nektra Deviare Engine for binary instrumentation. HookME can intercept unencrypted HTTPS web traffic.

Many different proxy servers are used to intercept HTTP traffic. Fiddler is the most popular one for generic purposes. Burp Proxy is the leader for security testing. The issue with intercepting HTTPS traffic is that the proxy application acts as the man in the middle for HTTPS requests and the certificates being presented to the client are not the real ones. For example, intercepting network traffic to Amazon leads to a warning in the browser because the certificate being presented is unsigned. Another issue is that it is time consuming to set up the keys and certificates needed to configure the proxy.

Instead of using a proxy, you can intercept the EncryptMessage function in the Secure32.dll as HookME does:

You can also intercept the WinINet.dll before data is encrypted in the HTTPS request, and after data is decrypted in the HTTPS response. This way, no change is made to any certificate and no man in the middle attack is simulated. These concepts are a starting point for more sophisticated web security, debugging tools, and support for Firefox and Chrome browsers. You can start by intercepting synchronous functions in WinINet.DLL such as InternetOpen, HttpOpenRequest, HttpSendRequest, HttpAddRequestHeaders, InternetReadFile, InternetWriteFile, and their “Ex” functions counterpart.


If you liked this article, you might also like:

Related Nektra Products

Related Third Party Products

Further Reading

  1. Sniffing the Unsniffable

Instrumenting Direct3D Applications to Capture Video and Calculate FPS

What is your computer’s maximum render quality, resolution, and frames per second for Battlefield 3? Hard core gamers are eager to show off their expensive, tuned setup at its full potential. Overclocked processors and computers cooled with liquid hydrogen are lovely parts of the gaming folklore. The source code below instruments Direct3D 9 applications to calculate frames per second and capture video. It produces an AVI container using the video codec of your choice. It is also possible to capture game screenshots in the 32-bit BMP format by pressing “delete”. The shortcuts for starting and stopping video recording are “F11” and “F12”.

The code we have provided starts the target process in suspended mode, and hooks the Direct3DCreate9 entry point in the d3d9.dll.

Once we catch a Direct3DCreate9 call, we can use the returned IDirect3D9 pointer to index the VTable. Since the call occurred in the target process address space, we cannot use the pointer directly in our host application; however, we can use Deviare’s functions to read the hooked process memory (starting with the IDirect3D9 pointer) to get the method addresses. This is a very interesting and useful technique which avoids sending address data from the intercepted process to the host processes [1].

We use the object’s VTable address to get the address of the CreateDevice method and hook the device creation with INktSpyMgr::CreateHookForAddress and INktSpyMgr::AddCustomHandler. Note that the resulting events INktSpyMgr will trigger both local hook handlers in the SpyMgr host process, and remote hook handlers in the intercepted process. The local handler creates hooks for IDirect3DDevice9::EndScene, IDirect3DDevice9::Reset, IDirect3DDevice9::Present, and IDirect3DDevice9::Release using the remote VTable indexing technique. The remote handler initializes the FPS display, keyboard hook, font, and sprite resources for the console.

All hooking is done from the Deviare host executable. The plugin that resides in the target process address space does not create additional Deviare hooks. Once all needed IDirect3DDevice9 methods are successfully hooked, we can focus on implementing video capture and FPS display.

In order to implement video capture and FPS display we must define the behavior of the pre-call and post-call handlers for the Present, EndScene, and Reset methods.

In the pre-call to Present, we peek at the first item in the keyboard command queue to check for user actions. If it is the “take screenshot” command, we read the current display device backbuffer and save it to disk. If the first item is the “start recording” command, we create and setup the AVI Video file and it’s streams. If it is the “stop recording” command, we simply close the AVI file if it was recording frames. If video recording has been enabled, we add a frame to the current AVI file and update the frame per second statistics. The number of frames recorded depends on the specified frame rate (the default is 15).

In the pre-call to EndScene, if the device is not currently in a reset state, we update the console and frame counter text in the display. If it was not changed, it is simply redrawn with the current string buffer.

Pre-call handling of device Reset occurs when windows are resized, video mode changes, or fullscreen mode is entered or exited. If video is being recorded we stop recording since we do not handle multiple resolution streams in our code. Next, we release our font and sprite resources, and our backing display surface. During post-call Reset function handling, we also check for video recording. Additionally, we recreate the surface, sprite and font resources that we released in the Reset pre-call stage.

Possible Improvements

This code can be improved to include instrumentation of DirectX 11 as well as OpenGL applications and games. The technique would be similar. DirectX 10/11 applications use DXGI low-level interfaces to swap back and front buffers and there are no “lost devices”, so instead of hooking EndScene, Present, and Reset, we would hook DXGI library function calls. This approach would be easier than instrumenting DirectX9, since display device handling is simplified.

Audio Capture: Windows Vista and later systems direct all DirectX audio streams through the native AudioSession APIs. The easiest way to capture audio is through the documented loopback audio device. The limitation is that all system audio is captured, not only audio from our desired application.

If audio isolation is required, hooking the IAudioRenderClient interface should copy audio buffer data into user application memory. Audio data could then be transferred to the audio stream in the AVI file.

The key problem of audio capturing is resampling. If the sample rate and bit depth of the AVI stream and audio buffer do not match, the audio must be resampled. Writing a good resampler is not trivial task. Our Audio Recorder SDK provides a basic and fast resampling code.


The AVRecorderTool code is available on github.


  1. Deviare Instrumentation Engine
  2. Copy Deviare32.db, Deviare64.db, DeviareCOM.dll, DeviareCom64.dll, DvAgent.dll, and DvAgent64.dll to AVRecorderTool\dll


Sebastian Wain contributed with the writing of the introduction.


  1. The Intercepting Direct3D COM Objects and Making Game Walls Invisible article used IPC to send the remote IDirect3D interface address to the host application’s SpyMgr.

Related Products

  1. Deviare Hooking Engine
  2. Deviare In-Process
  3. SpyStudio
  4. Audio Recorder API

If you liked this article, you might also like:

  1. Injecting a DLL in a Modern UI Metro Application
  2. Intercepting Direct3D COM Objects and Making Game Walls Invisible
  3. How to Identify Virtual Table Functions with the VTBL IDA Pro Plugin
  4. Controlling the Speed of YouTube, Flash, HTML5, and Desktop Videos with Deviare Hooks
  5. Logging Printer Activity

Intercepting Direct3D COM Objects and Making Game Walls Invisible

Using Deviare to Cheat on Games

This simple Deviare code allows you to to see through game walls. We intercept Direct3D objects and select wireframe mode so the walls are transparent. This code injects a DLL to create an object based on the IDirect3D9 interface and hook the address of the CreateDevice COM method from the virtual table. The hooked CreateDevice COM method receives an object with IDirect3DDevice9 interface, which is used to set the wireframe mode by calling pDeviceInterface->SetRenderState(D3DRS_FILLMODE, D3DFILL_WIREFRAME). The pDeviceInterface->SetRenderState(D3DRS_FILLMODE, D3DFILL_SOLID) call reverts to the solid mode. You can switch between the wireframe and the solid modes by using the INSERT and DELETE keys.

Deviare can be used to develop a lot of other game tools. Some ideas to try yourself are:

  • Hooking the random function in the Minesweeper to return zero and solve the game with just one click
  • Retrieving the 3D models from games which encrypt them
  • Implementing an Aimbot

It would be a dangerous thing for the gamer community if streamed online games such as OnLive succeeded. You cannot reverse engineer the cloud. Game cheating has a long early history, it would be bad to cut it. Gamers have been cheating on video games since their invention. It would be a shame to stop the fun.


  1. Deviare interception engine


Code sample written by Douglas from Nektra.

If you like this article, you might also like:

  1. Instrumenting Direct3D Applications to Capture Video and Calculate FPS
  2. Controlling the Speed of YouTube, Flash, HTML5, and Desktop Videos with Deviare Hooks
  3. Automating Google’s Doodles: 4.9 Second Record on Hurdles
  4. SQL Server Interception and SQL Injection Attack Prevention

SQL Server Interception and SQL Injection Attack Prevention

Note: we updated the code on August 23, 2013. The new code includes an “abort” feature, discussed in the article Instrumenting Microsoft SQL Server to Abort Dangerous Queries.

Our Deviare hooking engine can be used to hook into Microsoft SQL Server 2012 RTM (11.00.2100.60) and 2014 CTP1 queries at the application level. Tools like WireShark use a different approach since they intercept SQL Server traffic at the network level. The key benefits of intercepting queries at the application level are:

  • Since the query is a string you do not need to understand a protocol to retrieve it
  • As the query is received on a single point, you do not have to handle a variety of communication channels between the client and the server
  • It is possible to change the flow of the application and modify or cancel a query

The sample code below dynamically loads SQL Server public debugging symbols and hooks the CSQLSource::Execute function.

In 2013, the most critical security risk is injection. Our code can be used to develop your own monitoring and mitigation tool. With a lot of zero day bugs around it is not possible to depend only on vendors and their hotfixes. The problem is even worse for closed source applications. For example, Microsoft is ending support for Windows XP on April 8, 2014. How can your organization deal with that? The three main options are:

  1. Migrating to a newer operating system
  2. Paying for extra support
  3. Using tools like Deviare to quickly implement custom security sandboxes and security mitigation tools.


The code is available on github.


  1. Download Deviare and register it for 32-bit or 64-bit
  2. To enable the Deviare engine to use debugging symbols, the following library files are required: symsrv.dll which can be obtained in the Debugging Tools for Windows package and msdiaXX.dll which is part of the DIA SDK, available in Microsoft Visual Studio installation folder, under DIA SDK/bin directory. The Recommended Debugging Tools for Windows version is 6.12.2633 or higher. Tested DIA SDK versions are 9.0 (msdia90.dll), 10.0 (msdia100.dll) and 11.0 (msdia110.dll).
  3. You must copy those 32 and/or 64-bit DLLs to the dllx86 and dllx64 folders in the root directory of the project, depending on which platforms you want to target.
  4. SQL Server SQLSERVR.EXE service platform should match the project architecture for the interception to succeed.


  1. Compile the solution
  2. Make sure sqlservr.exe service is running
  3. Copy all database files from the project’s DB folder into the binary output folder. See below for information about user-defined databases.
  4. Run SQLSvrIntercept.exe from the commandline with Administrator rights. It will load and cache the symbols under c:\symbols and then displays “Ready.”.

Development Notes

If the application will be deployed to a Microsoft Windows environment which does not have Visual Studio 2012, make sure that the runtime C++ dependencies are available. If they are missing:

  1. To deploy the Debug compilation you can copy the library from %ProgramFiles%\Microsoft Visual Studio 11.0\VC\redist\Debug_NonRedist\x64\Microsoft.VC110.DebugCRT to the System32 directory in the destination computer.
  2. To deploy the Release compilation you can copy the %ProgramFiles%\Microsoft Visual Studio 11.0\VC\redist\x64\Microsoft.VC110.CRT to the System32 directory in the destination computer, or install the Visual Studio 2012 Redistributables from http://www.microsoft.com/en-us/download/details.aspx?id=30679

Generating User Defined Databases

Deviare offers many advanced features such as counting, inspecting and dereferencing function parameters, getting parameter types, and intercepted function skip. A database containing the function signature is required for those features to work with a specific function.

The default Deviare databases are enough for most standard operating system libraries.
However, in case you need to intercept a function that is not present in the default databases, Deviare provides a tool to generate user defined databases. This tool is located in the Deviare-DbGenerator distribution. It should be fed with a C header file containing the function and type definitions to add.

A simple example (along with our own CSQLSource::Execute signature definition) is included in the DB folder for this project. The database files were generated from the sample BASE.H file.

Note that databases are not required for basic interception: you can intercept an anonymous function by specifying its address. However databases are required for query blocking, which uses the Deviare’s call-skipping feature.


Nektra’s Hernan Di Pietro wrote the SQL Server interception tool. After researching a bit without finding the correct function to hook he asked on Reverse Engineering Q&A where Brendan Dolan-Gavitt kindly pointed him to the correct function, allowing him to complete the project.


  1. Some of Microsoft’s product versions do not have public debugging symbols, which are required in order to use the SQL Server interception tool
  2. Not tested on SQL Server 2005 or SQL Server 2008

See Also

  1. Injecting a DLL in a Modern UI Metro Application
  2. Logging Printer Activity
  3. How to Identify Virtual Table Functions with the VTBL IDA Pro Plugin

Further Reading

  1. SQLProb: A Proxy-based Architecture towards Preventing SQL Injection Attacks