v1.0.8

Changes in v1.0.8:

• Fixed SOCKS5 response parsing to read exactly the expected bytes (TCP stream-safe)
• Added debug logging via OutputDebugStringA (capture with DebugView from Sysinternals)

v1.0.7 was included in this release:

• Bypass proxy for DNS (port 53) — fixes getaddrinfo() thread failed to start
• Bypass proxy for loopback (127.x.x.x)

Test commands:

proxy_wrapper.exe -proxy=127.0.0.1:1080 -target=cmd.exe /c "curl.exe http://api.ipify.org"

To capture debug logs, run DebugView as Administrator before testing.

Full Changelog: v1.0.7...v1.0.8

v1.0.7

Fix: Bypass proxy for DNS (port 53) and loopback (127.x.x.x)

The connect() hook was intercepting internal system connections:

• DNS-over-TCP (port 53) — intercepting these broke getaddrinfo(), causing curl to fail with "getaddrinfo() thread failed to start"
• Loopback addresses (127.x.x.x) — these should never be proxied

Full Changelog: v1.0.6...v1.0.7

v1.0.6

v1.0.6 — Root cause fix

Root Cause (confirmed)

VirtualAlloc(NULL, ...) can return memory >2GB from the target function. On x64 this causes:

1. 32-bit tail JMP overflow → wrong address.
2. (int)(func - tramp) truncation → wrong RIP-relative adjustment.
3. AccessViolationException.

MinHook/Detours solve this by allocating within a fixed range of the target.

Fixes

1. alloc_near() — Allocates within 512MB of target using VirtualQuery (MinHook algorithm).
2. Diff overflow guard — Explicit check before using (int)diff.
3. Comprehensive rip_disp_off() — Blacklist of non-ModRM opcodes instead of incomplete whitelist.
4. Complete inst_len() — All missing ModRM opcodes (ADD r/m8,r8, MOVSXD, IMUL imm, Group 2/4, SETcc, CMPXCHG, XADD, RET imm16, etc.)

Status

36/36 decoder tests pass.

Full Changelog: v1.0.5...v1.0.6

v1.0.5

Fixes

• Fixed RIP-relative displacement in trampoline: when kernel32 functions like CreateProcessW start with an indirect JMP (FF 25 xx xx xx xx = JMP [rip+offset]), copying the instruction byte-for-byte into the trampoline produces a JMP to the wrong address — because rip differs between the original function and the trampoline. The displacement is now adjusted by func_addr - tramp_addr to compensate.

Status

Still crashing with AccessViolationException even after decoder fixes. This RIP-relative adjustment is the remaining likely cause.

Full Changelog: v1.0.4...v1.0.5

v1.0.4

Fixes

• Fixed instruction decoder missing 0xFF opcode: on modern Windows, kernel32!CreateProcessW is a 6-byte indirect JMP (FF 25 xx xx xx xx = JMP [rip+offset]). The decoder didn't handle 0xFF at all, causing it to save only 5 bytes of this 6-byte instruction → trampoline executed a partial instruction → AccessViolationException.
• Also added 0x8F (POP r/m), 0x6A (PUSH imm8), 0x68 (PUSH imm32) to the x64 decoder.

Full Changelog: v1.0.3...v1.0.4

v1.0.3

Fixes

• Fixed instruction length decoder crash: the SIB (scale-index-base) byte and displacement were calculated in the wrong order, producing an invalid trampoline that caused AccessViolationException when the CreateProcess hook was triggered. This is the root cause of the crash in v1.0.2.
• Added debug-flag guard: skips child process injection when DEBUG_PROCESS or DEBUG_ONLY_THIS_PROCESS flags are set
• Reduced injection timeout from 5s to 2s

Full Changelog: v1.0.2...v1.0.3

v1.0.2

What's new

• Child process injection: hooks CreateProcessW/A so child processes (e.g., powershell spawning curl.exe) automatically get the proxy hook injected too
• WSAConnect hooking: .NET apps (PowerShell, C#, etc.) now go through the proxy
• Fix proxy resolution: uses inet_addr for IP-based proxies (no WSAStartup needed), defers hostname resolution to when it's actually needed
• In-process testing: use -target=powershell.exe -Command Invoke-WebRequest -Uri http://api.ipify.org to test without child process spawning

Full Changelog: v1.0.1...v1.0.2

v1.0.1

Fixes

• Hook WSAConnect in addition to connect() — fixes proxying for .NET applications (PowerShell, C#, etc.)
• Force-load ws2_32.dll — ensures hooks are installed even when Winsock hasn't been loaded yet at injection time
• Fix trampoline instruction boundaries — added instruction-length decoder to prevent the trampoline from splitting x86/x64 instructions
• Fixed command-line quoting — target arguments with spaces are now properly re-quoted before passing to CreateProcess

Full Changelog: v1.0.0...v1.0.1

v1.0.0

Initial release of proxy_wrapper — SOCKS5 proxy wrapper for Windows executables.

Usage:
proxy_wrapper.exe -proxy=127.0.0.1:1080 -target=chrome.exe

Downloads:

• proxy_wrapper_x64.zip — 64-bit (x86_64)
• proxy_wrapper_x86.zip — 32-bit (x86)

Full Changelog: https://github.com/DoubleAAGuy/proxy_wrapper/commits/v1.0.0