vatyx / namedpipecapture

A Windows tool that can be used to stream data from named pipe between two other process to Wireshark

NamedPipeCapture

A Windows tool that can be used to stream data from named pipe between two other process to Wireshark through a named pipe

Installation

Download the latest version from the releases page.
Make sure NamedPipeLauncher.exe and NamedPipeCapturex64.dll is in the same directory

Usage

There are 3 mandatory parameters, 2 optional parameters and 2 commands that can be used.

Mandatory Parameters

• --input (shorthand -i): Specify the named pipe that will be captured (Ex: \myinputpipe)
• --output (shorthand -o): Specify the named pipe that the data will be sent to (Ex: \\.\pipe\myoutputpipe)
• --processid (shorthand -p): Specify the process whose functions will be overwritten

Optional Parameters

• --clientport (shorthand -c): Specify the client-side port. If the process writes something to the pipe, this port will represent the source of the data transfer. If the process reads something from the pipe, this port will be recorded as the destination.
• --serverport (shorthand -s): Specify the port that will represent any external process reading/writing to the target named pipe.

Commands

• --load (shorthand -l): Load the DLL into the targeted process and open the output named pipe
• --unload (shorthand -u): Unload the DLL from the application and close the output named pipe

Example

> NamedPipeCapture.exe --input \mynamedpipe --output \\.\pipe\myoutputpipe -processid 21457 -c 50 -s 51 --load

This will target the process with the id 21457, and the named pipe in the process with the name mynamedpipe. The data will be streamed to the named pipe myoutputpipe with the client port 50 and the server port 51

To stop the capture, run the unload command with the same process id

> NamedPipeCapture.exe -processid 21457 --unload

Streaming Data (using Wireshark)

Once the --load command has been executed on a process, the data can be seen in real time through Wireshark. Note that data will only begin to be captured once Wireshark has connected to the named pipe specified by the --output parameter.

1. Open up Wireshark and go to Capture -> Interfaces
2. Click on Options on the bottom of the Interfaces window
3. Click on Manage Interfaces near the top right of the Capture Options window
4. Click on New on the left under the pipe tab and put the name of the output named pipe that was specified earlier
5. Click Save and Close the window. (The error "The link type of interface [your pipe] was not specified" may pop up which is fine. Just close it.)
6. The newly added named pipe should be listed along with other interfaces in the Capture Options window. Make sure the capture tick box is ticked and then click on start in the bottom right hand corner.

Data should now be streaming into Wireshark in real time!

#Make sure Wireshark has stopped capturing data before the DLL is unloaded from the process.

namedpipecapture's Issues

Investigate "bytes captured" vs. actual data mismatches

InitializeProcess returned -1

In my case, InitializeProcess API call returns -1. Sadly I can't find more detailed information about this error.

The DLL gets attached to the target (verified with Process Explorer), the input pipe is there in the system, the output pipe does not get created - verified with PowerShell [System.IO.Directory]::GetFiles("\\.\\pipe\\")

Process ID refers to a normal user process, started by the same user trying the hook.

This is Microsoft Windows [Version 10.0.19045.3570]

C:\Programs\myhome>.\NamedPipeLauncher.exe --input \\.\pipe\Input_Pipe --output \\.\pipe\traffic --processid 14484  --load
orig fcn ptr = 00007FF6C9B01440
fcnptr = 0000000000000000
InitializeProcess returned 4294967295
Warning: Make certain the DLL is unloaded when the test is done.
If it is not unloaded, the DLL will remain within the process for the life
of the process.
Input pipe: \\.\pipe\Input_Pipe
Output pipe: \\.\pipe\traffic
Process ID: 14484
Client port: 0
Server port: 0

Record Named Pipe Disconnects

Add a disconnection sequence into the stream when a named pipe handle is closed.

Track named pipe server/client connection start

Add a Syn,Syn+ACK, ACK sequence into the stream to track the start of a given named pipe connection.

Track multiple connections

Multiple named pipe connections should be tracked as separate trackable connections within WireShark

Prime iocompletionport threads upon exit to unblock calls to GetQueuedCompletionportStatus

It is unknown whether or not this will cause a problem in a running process or not, as it is difficult to determine whether or not handling from GetQueuedCompletionportStatus is handled properly in a given process. Priming GetQueuedCompletionportStatus with PostCompletionportStatus may result in unknown behaviour.

If Wireshark is connected while attempting to unload, the target application will crash.