FreeTDS Development Group

["Joseph L. Petronio" <jpetronio AT okena.com>]

I'm trying to interpret the incoming data stream to MS SQL Server 2000's
ssnetlib.dll on Win2K.  The registry key,
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Client\TDS hold the value
'7.0' which I assume is the TDS version.  My goal is to intercept and
inspect any query before it's allowed to reach the server, in order to
detect SQL injection hacking.  I've determined that the correct function to
monitor is ConnectionReadAsync()  who's prototype (I'm 99% certain sure)
looks like this :
 
USHORT ConnectionReadAsync(VOID * ConnectionObject, BYTE * pBuffer, USHORT
readcount, 
                                    USHORT readmax, USHORT timeout, LONG *
pErrno)
 
Specifically, I'm trying to interpret the data coming in via the
"ConnectionObject", which I assumed was a TDS buffer or control block. I'm
using "osql.exe -E" as my client application and viewing the data via Visual
Studio's debugger.  The only data item that seems to match the TDS
structures I've studied from the documents on this site, is the initial
value '02', which means a 'Login' is being processed. However, none of the
data that follows seems to match the TDS 7 Login structure.... or any other
structure.
 
Later, I tried issuing a simple query, and noticed the data structure again,
started with '02', and several hundred bytes later, I saw an address which I
followed to a buffer that held the query in 2-byte  Unicode (UCS-16?).
 
If anyone knows how to interpret the Connection Object data stream, please
contact me or point me to some documentation.
 
Joe Petronio