PhHttpSocketSendRequest() which part is the "body:" for this function

[Airick73]

Hello,

I am trying to understand how the PhHttpSocketSendRequest() works and it seems to have the following parameters.

PhHttpSocketSendRequest(
In PPH_HTTP_CONTEXT HttpContext,
In_opt PVOID RequestData,
In_opt ULONG RequestDataLength
);

In the function VirusTotalProcessApiThread() that uses PhHttpSocketSendRequest() it sends JsonArray->buffer for the parameter RequestData. Would this be considered the body such as when making an API POST call? I'm tried to word this the best I could but please let me know if I need to clarify further with my question and thank you to whoever might be able to provide some clarification to me.

Kindest regards,
Eric Kemmer

[Airick73]

I found this definition from the systeminformer.sln

Which I was able to google the windows function it calls: https://learn.microsoft.com/en-us/windows/win32/api/winhttp/nf-winhttp-winhttpsendrequest
But I was unable to find information regarding the Request Data parameter...

[jxy-s]

The information in that parameter is going to depend on what the server is expecting and the API contract with the server including headers and body.

Please carefully read the entire documentation on WinHttpSendRequest. Once you've done that. If it doesn't answer your question, you will have to provide more information on specifically what you're trying to achieve by making an HTTP request to a server, what the API contract looks like, what the server is expecting and what you expect to receive in response.

[Airick73]

Thank you for the advice. Re-reading over the documentation I believe that the RequestData parameter correlates to lpOptional parameter in WinHttpSendRequest. According to the documentation lpOptional is for "A pointer to a buffer that contains any optional data to send immediately after the request headers. This parameter is generally used for POST and PUT operations. The optional data can be the resource or data posted to the server" .

What I am looking to do is make an API request where the RequestData parameter is the body of my JSON request.

For further reference I am trying to make a POST request to the MetaDefender Cloud API V4 for "Retrieving scan reports for multiple data hashes". The body should contain multiple hashes and is labeled as "Content" (refer to the image below). I hope I was able to clarify my reasoning for this discussion.

[dmex]

Download Fiddler Classic and enable HTTPS decryption then you'll make sense of the parameters:
https://www.telerik.com/download/fiddler

[Airick73]

Fiddler was able to shed some light on my issue. It turns out the buffer was overflowing so my RequestData parameter had more than just the hashes I was trying to send. After passing in the correct size for RequestDataLength I was able to make a successful API POST. Thank you dmex!