Click here to Skip to main content
13,091,537 members (61,442 online)
Click here to Skip to main content
Add your own
alternative version


12 bookmarked
Posted 7 Nov 2011

Intercepting Calls in Web Services (Worker Process)

, 7 Nov 2011
Rate this:
Please Sign up or sign in to vote.
How to intercept Web Service calls directly in the worker process.


This is not a tutorial about Web Services and their usage. The usage of this technology is well known across the software industry.

The purpose of this article is to show a method for “how to intercept Web Service calls and show in screen”. We will work directly on the Worker process. Unfortunately, with sniffers, we can’t get traffic from localhost.

OK, let’s start:

Suppose you have an application which is calling a WebService.

  1. Open Windows Debugger: windbg.exe process.
  2. Press F6 and attach the w3wp.exe process.
  3. Once we get the process attached, execute the command (.loadby sos mscorwks in the case of .NET Framework < 4.0): .loadby sos mscoreei.
  4. After deep research, I found an interesting function which could be useful: System.Web.HttpRequest.GetEntireRawContent.
  5. Let’s try to see where this function is JITted:
  6. !name2ee * System.Web.HttpRequest.GetEntireRawContent

  7. The JITted address is 5241cfd0, so let’s put a breakpoint right there: bp 5241cfd0.
  8. Use your application and it will get frozen because the breakpoint was launched.
  9. On investigation, this function runs and returns the System.Web.HttpRawUploadedContent class. To run this method until the end, let’s put the pt command.
  10. By simple examination, we can see that this returns on the @eax register all the variables with the class HttpRawUploaded. Let us see the _data field.
  11. Good, we have the entire content in byte[] of the WebService call. How can we dump in screen every time this function is called? .printf "%ma",poi(eax+4)+8, where 4 is the offset to get the data in this class, eax is the return address of this method, and 8 is the address of the first char in the Web Service. %ma means ANSI characters.
  12. Let’s delete the first breakpoint and put a new one at the end of this function: bc *.
  13. Let’s put: Bp eip “.printf \"\\n%ma\",poi(eax+4)+8;gc”.
  14. We now have all the calls of the Web Service for monitoring.


This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


About the Author

Rene Pally
Tester / Quality Assurance
Bolivia Bolivia
Quality Assurance

You may also be interested in...


Comments and Discussions

SuggestionFiddler? Pin
vipera668-Nov-11 8:59
membervipera668-Nov-11 8:59 
GeneralRe: Fiddler? Pin
Rene Pally8-Nov-11 9:54
memberRene Pally8-Nov-11 9:54 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

Permalink | Advertise | Privacy | Terms of Use | Mobile
Web01 | 2.8.170813.1 | Last Updated 7 Nov 2011
Article Copyright 2011 by Rene Pally
Everything else Copyright © CodeProject, 1999-2017
Layout: fixed | fluid