How to hook DNS query request in windows? - windows

Question

I want to hook DNS query request in windows, I use IAThook to hook "gethostbyname","getaddrinfo","GetAddrInfoW", "GetAddrInfoExA","GetAddrInfoExW","WSAAsyncGetHostByName", but seems most app didn't link the ws2_32.dll statically at all. So I also hook "GetProcAddress" in kernel32.dll, but them also don't use "gethostbyname"...at all(but the DNS query request actually be sent). I test this with MsEdge explorer and many other apps. I do this in LSP.
Do these apps not usr such as "gethostbyname" function to send a DNS request? How can I do?
Can somebody give me some help?
my code like this:
long hookGetProcAddress()
{
long ret = 0;
FUNCBEGINLOG
if (g_hHook_GetProcAddressFunc != NULL)
{
dbgprint("%s hookGetProcAddress already hooked!", moduleBaseName);
return ret;
}
ret = IATHook(GetModuleHandleW(NULL), "kernel32.dll", "GetProcAddress",
LSPGetProcAddress, &g_hHook_GetProcAddressFunc);
dbgprint("%s hookGetProcAddress func ret %d!", moduleBaseName, ret);
FUNCFINISHLOG
return ret;
}
long hookgethostbyname()
{
long ret = 0;
FUNCBEGINLOG
if (g_hHook_gethostbynameFunc != NULL)
{
dbgprint("%s hookgethostbyname already hooked!", moduleBaseName);
return ret;
}
ret = IATHook(GetModuleHandleW(NULL), "Ws2_32.dll", "gethostbyname",
LSPgethostbyname,
&g_hHook_gethostbynameFunc);
dbgprint("%s hookgethostbyname func ret %d!", moduleBaseName, ret);
FUNCFINISHLOG
return ret;
}
long hookgetaddrinfo()
{
long ret = 0;
FUNCBEGINLOG
if (g_hHook_getaddrinfoFunc != NULL)
{
dbgprint("%s hookgetaddrinfo already hooked!", moduleBaseName);
return ret;
}
ret = IATHook(GetModuleHandleW(NULL), "Ws2_32.dll", "getaddrinfo", LSPgetaddrinfo, &g_hHook_getaddrinfoFunc);
dbgprint("%s hookgetaddrinfo func ret %d!", moduleBaseName, ret);
FUNCFINISHLOG
return ret;
}