Click here to Skip to main content
15,113,004 members
Articles / All Topics
Posted 7 Nov 2011

Tagged as


12 bookmarked

Intercepting Calls in Web Services (Worker Process)

Rate me:
Please Sign up or sign in to vote.
5.00/5 (3 votes)
7 Nov 2011CPOL2 min read
How to intercept Web Service calls directly in the worker process.


This is not a tutorial about Web Services and their usage. The usage of this technology is well known across the software industry.

The purpose of this article is to show a method for “how to intercept Web Service calls and show in screen”. We will work directly on the Worker process. Unfortunately, with sniffers, we can’t get traffic from localhost.

OK, let’s start:

Suppose you have an application which is calling a WebService.

  1. Open Windows Debugger: windbg.exe process.
  2. Press F6 and attach the w3wp.exe process.
  3. Once we get the process attached, execute the command (.loadby sos mscorwks in the case of .NET Framework < 4.0): .loadby sos mscoreei.
  4. After deep research, I found an interesting function which could be useful: System.Web.HttpRequest.GetEntireRawContent.
  5. Let’s try to see where this function is JITted:
  6. !name2ee * System.Web.HttpRequest.GetEntireRawContent

    Image 1

  7. The JITted address is 5241cfd0, so let’s put a breakpoint right there: bp 5241cfd0.
  8. Use your application and it will get frozen because the breakpoint was launched.
  9. On investigation, this function runs and returns the System.Web.HttpRawUploadedContent class. To run this method until the end, let’s put the pt command.
  10. Image 2

  11. By simple examination, we can see that this returns on the @eax register all the variables with the class HttpRawUploaded. Let us see the _data field.
  12. Image 3

  13. Good, we have the entire content in byte[] of the WebService call. How can we dump in screen every time this function is called? .printf "%ma",poi(eax+4)+8, where 4 is the offset to get the data in this class, eax is the return address of this method, and 8 is the address of the first char in the Web Service. %ma means ANSI characters.
  14. Image 4

  15. Let’s delete the first breakpoint and put a new one at the end of this function: bc *.
  16. Let’s put: Bp eip “.printf \"\\n%ma\",poi(eax+4)+8;gc”.
  17. We now have all the calls of the Web Service for monitoring.

Image 5


This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


About the Author

Rene Pally
Tester / Quality Assurance
Bolivia Bolivia
Quality Assurance

Comments and Discussions

SuggestionFiddler? Pin
vipera668-Nov-11 9:59
Membervipera668-Nov-11 9:59 
GeneralRe: Fiddler? Pin
Rene Pally8-Nov-11 10:54
MemberRene Pally8-Nov-11 10:54 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.