IDAPython script showcasing API hooking on ssl functions. http://adelmas.com/blog/ida_api_hooking.php

ida_api_hooking.py

# coding: utf-8

RunPlugin("python", 3)
AttachProcess(2892, -1) # PID

off_ssl_read = LocByName("_ssl3_read")
off_ssl_write = LocByName("_ssl3_write")

# - Hooks on _ssl3_write, _ssl3_read ---------------------------------------
cond_read = """
stack = GetRegValue('ESP')
len = DbgDword(stack+4+8)
buffer = DbgDword(stack+4+4)
end = FindFuncEnd(off_ssl_read)
RunTo(end)	# post-call hook
str = GetManyBytes(buffer, len, True)
print "Bp read, buffer @ %s - len = %d :" % (hex(buffer), len)
for b in str:
	print "0x%X '%c'" % (ord(b), b)
return False # IDA will continue execution, True if you want IDA to pause
"""

cond_write = """
stack = GetRegValue('ESP')
len = DbgDword(stack+4+8)
buffer = DbgDword(stack+4+4)
str = GetManyBytes(buffer, len, True)
print "Bp write, buffer @ %s - len = %d :" % (hex(buffer), len)
for b in str:
	print "0x%X '%c'" % (ord(b), b)
return False
"""

AddBpt(off_ssl_write)
AddBpt(off_ssl_read)
EnableBpt(off_ssl_write, True)
EnableBpt(off_ssl_read, True)

SetBptCnd(off_ssl_read, cond_read)
SetBptCnd(off_ssl_write, cond_write)
# --------------------------------------------------------------------------

print "BP SET"

GetDebuggerEvent(WFNE_SUSP, -1)