还是API Hook的难题(140分)

Kofer · 2002-02-21

我想截获系统某个进程对某个api函数所有的调用,原理有点象以前讨论的屏幕取词,但这次 我要拦截的是winsock的Send和Recv等函数和数据,谁能帮帮忙啊,分不够可以再加

NowCan · 2002-03-02

哈哈，这是个著名的难题了。我也不会。

热血 · 2002-03-02

截send recv一样的 dll文件是ws2_32.dll 不过如何要截数据 可以用微软的接口lsp

NowCan · 2002-03-05

靠！原来是这个dll。

JobsLee · 2002-03-05

这是以前doxpix发给我的，不知对你是否有帮助 ==================================== 如何截获API函数(转） 该程序是基于HOOK原理,主要是将自己的函数放到目标PROCESS的地址空间,这里是使用HOOK实 现.首先建立一个 MOUSE的HOOK程序,然后在全局鼠标HOOK的DLL中做截获动作,可以在PROCESS_ATTACH时做,也可 以在鼠标的HOOK链函数中做. 建立全局HOOK就不说了,可以在网上很多地方看到.主要是截获动作.通过PE格式(使用IMAGE) 改变API函数在调用时的地址 .DLL部分参考如下代码: static int WINAPI MyMessageBoxW(HWND hWnd , LPCWSTR lpText, LPCWSTR lpCaption, U INT uType)//自己的M essageBoxW函数 {return MessageBox(hWnd, "TNT"/*lpText*/, "TNT"/*lpCaption*/, uType); } 我定义了一个结构 typedef struct tag_HOOKAPI { LPCSTR szFunc;//待HOOK的API函数名 PROC pNewProc;//新的函数指针 PROC pOldProc;//老的函数指针 }HOOKAPI, *LPHOOKAPI; extern "C" __declspec(dllexport)PIMAGE_IMPORT_DESCRIPTOR GetNamedImportDescripto r (HMODULE hModule, LPCSTR szImportMod) {//首先是DOS头 PIMAGE_DOS_HEADER pDOSHeader = (PIMAGE_DOS_HEADER) hModule; if(pDOSHeader->e_magic != IMAGE_DOS_SIGNATURE) return NULL; PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pDOSHeader + (DWORD)(pDOSHeader->e_lfanew)); if(pNTHeader->Signature != IMAGE_NT_SIGNATURE) return NULL; //如果没有Import部分,返回失败 if(pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Virtual Address == 0) return NULL; //取Import部分 PIMAGE_IMPORT_DESCRIPTOR pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR) ((DWORD)pDOSHeader + (DWORD)(pNTHeader->OptionalHeader. DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress)); //寻找与szImportMod相配部分 while (pImportDesc->Name) { PSTR szCurrMod = (PSTR)((DWORD)pDOSHeader + (DWORD)(pImportDesc->Name)); if (stricmp(szCurrMod, szImportMod) == 0) break; //找到 pImportDesc++; } if(pImportDesc->Name == NULL) return NULL; return pImportDesc; } extern "C" __declspec(dllexport) HookAPIByName(HMODULE hModule/ *被HOOK的目标进程MODULE*/, LPCSTR szImportMod /*如GDI32.DLL*/,LPHOOKAPI pHookApi/*指定函数名,如"MessageBoxW"*/) { PIMAGE_IMPORT_DESCRIPTOR pImportDesc = GetNamedImportDescriptor(hModule, szImportMod); if (pImportDesc == NULL) return FALSE; //需要改换的API不能取到正确描PIMAGE_THUNK_DATA pOrigThunk = (PIMAGE_THUNK_DATA)((DWORD)hModule + (DWORD)(pImportDesc->OriginalFirstThunk)); PIMAGE_THUNK_DATA pRealThunk = (PIMAGE_THUNK_DATA)((DWORD)hModule + (DWORD)(pImportDesc->FirstThunk)); while(pOrigThunk->u1.Function) { if((pOrigThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG) != IMAGE_ORDINAL_FLAG) { PIMAGE_IMPORT_BY_NAME pByName = (PIMAGE_IMPORT_BY_NAME)((DWORD)hModule + (DWORD)(pOrigThunk->u1.AddressOfData)); if(pByName->Name[0] == '/0') return FALSE; //失败 if(strcmpi(pHookApi->szFunc, (char*)pByName->Name) == 0) { //改变thunk保护属性 MEMORY_BASIC_INFORMATION mbi_thunk; VirtualQuery(pRealThunk, &mbi_thunk, sizeof(MEMORY_BASIC_INFORMATION)); VirtualProtect(mbi_thunk.BaseAddress,mbi_thunk.RegionSize, PAGE_READWRITE, &mbi_ thunk.Protect); //保存原来的API函数指针 if(pHookApi->pOldProc == NULL) pHookApi->pOldProc = (PROC)pRealThunk->u1.Function; //改变API函数指针 pRealThunk->u1.Function = (PDWORD)pHookApi->pNewProc; //将thunk保护属性改回来 DWORD dwOldProtect; VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize, mbi_thunk.Protect, &dwOldProtect); } } pOrigThunk++; pRealThunk++; } SetLastError(ERROR_SUCCESS); return TRUE; } -----------------------------------------------------------------------------

shellapi · 2002-04-22

我想我应该能，虽然我没有拦过这两个函数。但我拦截过其他很多类似的网络函数。 联系我看看。 qq:1431432

Kofer · 2002-05-24

没人讨论，干脆结算

wql · 2002-06-10

不急!

未来107 · 2002-06-19

是有点难度！

未来107 · 2003-06-27

vc上说用jump跳转，替换api函数的方法不是很好！！！delphi高手，你们得鼓励鼓励delphi 搞点真正的阿！！！

mdc · 2002-10-27

学习

wjlsnet · 2002-12-12

learn

www · 2002-12-12

hehe, 看看这个例子吧,纯Delphi原码 http://www.tommstudio.com/newclub30/d_viewdownload.asp?type=progsources&id=41

深之蓝 · 2003-01-06

这个问题我在三个月前做项目时做过，需要替换WINDOWS SOCKAPI函数。 来邮即发DEMO。 toyzn2002@yahoo.com.cn

wenjinshan · 2003-05-23

API HOOK、屏幕取词的完整解决方案见我的《delphi深入windows核心编程》一书， 解决了IE、win98下的高技术难题,支持windows98/2000/xp, 我的主页http://wenjinshan.yeah.net

xtalk · 2003-06-19

写个DLL把wsock32.dll的API拦截下来啊 以send为例 library Hook; uses  SysUtils, Windows, Classes; {$R *.res} var  NewByte, OldByte: array [0..6] of byte;  psend: Pointer;  dwSize: Cardinal;  Data: DWORD;  tmp: array [0..3] of byte;  HHook: Cardinal; function Mysend(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall; begin  WriteProcessMemory(INVALID_HANDLE_VALUE, psend, @OldByte, 7, dwSize);  Result := send(s, Buf, flags);  WriteProcessMemory(INVALID_HANDLE_VALUE, pTextOut, @NewByte, 7, dwSize);  //做你想做的事情 end; function GetMsgProc(nCode: Integer; wParam, lParam: Integer): Integer; stdcall; begin  Result := CallNextHookEx(HHook, nCode, wParam, lParam); end; procedure Start; stdcall; begin  HHook := SetWindowsHookEx(WH_CALLWNDPROC, @GetMsgProc, LoadLibrary('Hook.dll'), 0); end; procedure HookOff(); begin  WriteProcessMemory(INVALID_HANDLE_VALUE, psend, @OldByte, 7, dwSize);  UnhookWindowsHookEx(HHook); end; procedure HookOn(); begin  pTextOut := GetProcAddress(LoadLibrary('wsock32'), send');  FillChar(OldByte, 7, 0);  ReadProcessMemory(INVALID_HANDLE_VALUE, psend, @OldByte, 7, dwSize);  Data := DWord(@Mysend);  Move(Data, Tmp, 4);  NewByte[0] := $B8;  NewByte[1] := Tmp[0];  NewByte[2] := Tmp[1];  NewByte[3] := Tmp[2];  NewByte[4] := Tmp[3];  NewByte[5] := $FF;  NewByte[6] := $E0;  WriteProcessMemory(INVALID_HANDLE_VALUE, psend, @NewByte, 7, dwSize); end; procedure DLLEntryPoint(dwReason: DWord); begin  case dwReason of    DLL_PROCESS_ATTACH: HookOn;    DLL_PROCESS_DETACH: HookOff;  end; end; exports  Start; begin  DllProc := @DLLEntryPoint;  DLLEntryPoint(DLL_PROCESS_ATTACH); end.

xtalk · 2003-06-20

上面写错了 library Hook; uses   SysUtils,   Windows,   Dialogs,   Classes,   Winsock; {$R *.res} var   NewByte, OldByte: array [0..6] of byte;   psend: Pointer;   dwSize: Cardinal;   Data: DWORD;   tmp: array [0..3] of byte;   HHook: Cardinal; function Mysend(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall; var   Data: array [0..256] of char; begin   WriteProcessMemory(INVALID_HANDLE_VALUE, psend, @OldByte, 7, dwSize);   Result := send(s, Buf, len, flags);   WriteProcessMemory(INVALID_HANDLE_VALUE, psend, @NewByte, 7, dwSize);   CopyMemory(@Data, @Buf, len);   ShowMessage(String(Data));   //做你想做的事情 end; function GetMsgProc(nCode: Integer; wParam, lParam: Integer): Integer; stdcall; begin   Result := CallNextHookEx(HHook, nCode, wParam, lParam); end; procedure Start; stdcall; begin   HHook := SetWindowsHookEx(WH_CALLWNDPROC, @GetMsgProc, LoadLibrary('Hook.dll'), 0); end; procedure HookOff(); begin   WriteProcessMemory(INVALID_HANDLE_VALUE, psend, @OldByte, 7, dwSize);   UnhookWindowsHookEx(HHook); end; procedure HookOn(); begin   psend := GetProcAddress(LoadLibrary('wsock32'), 'send');   FillChar(OldByte, 7, 0);   ReadProcessMemory(INVALID_HANDLE_VALUE, psend, @OldByte, 7, dwSize);   Data := DWord(@Mysend);   Move(Data, Tmp, 4);   NewByte[0] := $B8;   NewByte[1] := Tmp[0];   NewByte[2] := Tmp[1];   NewByte[3] := Tmp[2];   NewByte[4] := Tmp[3];   NewByte[5] := $FF;   NewByte[6] := $E0;   WriteProcessMemory(INVALID_HANDLE_VALUE, psend, @NewByte, 7, dwSize); end; procedure DLLEntryPoint(dwReason: DWord); begin   case dwReason of     DLL_PROCESS_ATTACH: HookOn;     DLL_PROCESS_DETACH: HookOff;   end; end; exports   Start; begin   DllProc := @DLLEntryPoint;   DLLEntryPoint(DLL_PROCESS_ATTACH); end.

kcahcn · 2003-08-08

如果你懂怎么hook api 那么hook winsock api应该一样吧。 我以前没试过hook winsock api，有机会我试试看吧( 现在没有编程环境 [

] &nbsp

。 看看： http://home.worldonline.dk/viksoe/wepmetering.htm 有VC代码。 CIONO1

爱元元的哥哥 · 2003-08-08

截获WINSOCKET 福州大学自动化研究所 林毅 　　TCP/IP协议是目前各网络操作系统主要的通讯协议，也是 INTERNET的通讯协议，WIN95/NT平台提供了TCP/IP协议的实现函数库WINSOCKET（WSOCKET.DLL）动态库，因而可以利用WINSOCKET 编写基于TCP/IP协议的应用系统。（UNIX平台提供BSD-SOCKET） 　　在实际应用开发中，我们总希望在调用正常的WINSOCKET接口函数时，先进行各自的特殊处理，如对于开发基于WIN95/NT平台的VPN客户端软件时，我们希望应用信息在发送前即在调用SEND函数时，先对信息进行加密后再发送。又如有的应用系统调用CONNECT 函数进行连接请求，我们需要截获此调用，插入我们自己的身份认证。模块，只有合法的身份，才可以调用正常的CONNECT函数，而非法的身份则不进行CONNECT调用。因而需要开发一种截获WINSOCKET函数调用的方法（INTERCEPT WINSOCKET），使在进行WINSOCK正常函数调用之前，使其先调用我们的身份认证模块，加解密模块。由于在WIN95/NT平台 WINSOCKET是以动态连接库（DLL）形式提供的，应而使各种应用系统在进行TCP/IP协议通讯时，无须任何修改，就先调用我们的应用模块，实现应用的透明性。 　　一般要截获动态库（DLL）的调用，可以用HOOK（钩子技术），或外包DLL 技术，即将原来的DLL库改名（如将WINSOCK库WSOCK32.DLL改为A.DLL），新建一个DLL库，WSOCKET32.DLL，在新的DLL库中调用旧的DLL库。 　　以下给出了利用VISUAL C++实现的截获WINSOCK的应用程序的源代码。 WSOCK32.CPP #include <windows.h> #include <stdio.h> void abc(char *p){FILE *fp=fopen("c://z.txt","a+");fprintf(fp,"%s/n",p);fclose(fp);} //日志文件 //必须输出与原WSOCK32.DLL库同样的函数。 HMODULE i;char aa[1000];FARPROC a;DWORD d; int (__stdcall *getsockopt1)(SOCKET ,int ,int ,char * , int * ); u_short (__stdcall *ntohs1)(u_short ); struct hostent * (__stdcall *gethostbyname1)(const char FAR * ); int (__stdcall *getsockname1)(SOCKET ,struct sockaddr *,int * ); int (__stdcall *bind1)(SOCKET ,const struct sockaddr *,int ); u_long (__stdcall *htonl1)(u_long); char * (__stdcall *inet_ntoa1)(struct in_addr); int (__stdcall *WsControl1)(int ,int ,int ,int ,int ,int ); unsigned long (__stdcall *inet_addr1)(const char FAR * ); int (__stdcall *__WSAFDIsSet1)(SOCKET,fd_set FAR *); int (__stdcall *WSAGetLastError1)(); int (__stdcall *recv1)(SOCKET ,char FAR * ,int ,int ); int (__stdcall *send1)(SOCKET ,const char * ,int ,int); int (__stdcall *connect1)(SOCKET,const struct sockaddr *,int); int (__stdcall *closesockinfo1)(int ); int (__stdcall *NPLoadNameSpaces1)(int ,int ,int ); int (__stdcall *closesocket1)(SOCKET ); int (__stdcall *select1)(int ,fd_set FAR *,fd_set FAR *,fd_set FAR *,const struct timeval FAR * ); HANDLE (__stdcall *WSAAsyncGetHostByName1)(HWND ,u_int ,const char FAR * , char FAR * ,int ); int (__stdcall *ioctlsocket1)(SOCKET ,long ,u_long FAR *); int (__stdcall *setsockopt1)(SOCKET ,int ,int ,const char * ,int ); int (__stdcall *WSAAsyncSelect1)(SOCKET,HWND ,u_int,long); SOCKET (__stdcall *socket1)(int ,int,int); u_short (__stdcall *htons1)(u_short); int (__stdcall *WSAStartup1)(WORD,LPWSADATA); int (__stdcall *WSACleanup1)(); int PASCAL FAR WSAStartup(WORD wVersionRequired, LPWSADATA lpWSAData) { abc("WSAStartup"); //记日志，当然也可以是您的模块 i=LoadLibrary("c://windows//system//wsock32.aaa"); //装载原动态库 a=GetProcAddress(i,"WSAStartup"); WSAStartup1=(int (_stdcall *)(WORD,LPWSADATA))a; return WSAStartup1(wVersionRequired,lpWSAData); //取得原同名函数地址 //执行真正的处理 } int PASCAL FAR WSACleanup(void) { abc("WSACleanup"); //记日志 a=GetProcAddress(i,"WSACleanup"); //取得原同名函数地址 WSACleanup1=(int (_stdcall *)())a; return WSACleanup1(); //执行真正的处理 } u_short PASCAL FAR htons (u_short hostshort) { abc("htons"); a=GetProcAddress(i,"htons"); htons1=(u_short (_stdcall *)(u_short))a; return htons1(hostshort); //取得原同名函数地址 //执行真正的处理 } SOCKET PASCAL FAR socket (int af, int type, int protocol) { abc("socket"); a=GetProcAddress(i,"socket"); socket1=(SOCKET (_stdcall *)(int ,int,int))a; return socket1(af,type,protocol); //取得原同名函数地址 //执行真正的处理 } int PASCAL FAR WSAAsyncSelect(SOCKET s, HWND hWnd, u_int wMsg,long lEvent) { abc("WSAAsyncSelect"); a=GetProcAddress(i,"WSAAsyncSelect"); WSAAsyncSelect1=(int (_stdcall *)(SOCKET,HWND ,u_int,long ))a; return WSAAsyncSelect1(s,hWnd,wMsg,lEvent); //取得原同名函数地址 //执行真正的处理 } int PASCAL FAR setsockopt(SOCKET s,int level,int optname,const char * optval,int optlen) { abc("setsockopt"); a=GetProcAddress(i,"setsockopt"); setsockopt1=(int (_stdcall *)(SOCKET ,int ,int ,const char * ,int ))a; return setsockopt1(s,level,optname,optval,optlen); //取得原同名函数地址 //执行真正的处理 } int PASCAL FAR ioctlsocket(SOCKET s, long cmd, u_long FAR *argp) { abc("ioctlsocket"); a=GetProcAddress(i,"ioctlsocket"); ioctlsocket1=(int (_stdcall *)(SOCKET ,long ,u_long FAR *))a; return ioctlsocket1(s,cmd,argp); //取得原同名函数地址 //执行真正的处理 } HANDLE PASCAL FAR WSAAsyncGetHostByName(HWND hWnd, u_int wMsg,const char FAR * name, char FAR * buf,int buflen) { abc("WSAAsyncGetHostByName"); a=GetProcAddress(i,"WSAAsyncGetHostByName"); WSAAsyncGetHostByName1=(HANDLE (_stdcall *)(HWND ,u_int ,const char FAR * , char FAR * ,int ))a; return WSAAsyncGetHostByName1(hWnd,wMsg,name,buf,buflen); //取得原同名函数地址 //执行真正的处理 } int PASCAL FAR select(int nfds, fd_set FAR *readfds, fd_set FAR *writefds,fd_set FAR *exceptfds, const struct timeval FAR *timeout) { abc("select"); a=GetProcAddress(i,"select"); select1=(int (_stdcall *)(int ,fd_set FAR *,fd_set FAR *,fd_set FAR *,const struct timeval FAR *))a; return select1(nfds,readfds,writefds,exceptfds,timeout); //取得原同名函数地址 //执行真正的处理 } int PASCAL FAR closesocket(SOCKET s) { abc("closesocket"); a=GetProcAddress(i,"closesocket"); closesocket1=(int (_stdcall *)(SOCKET ))a; return closesocket1(s); //取得原同名函数地址 //执行真正的处理 } int PASCAL FAR NPLoadNameSpaces(int p,int q,int r) { abc("NPLoadNameSpaces"); a=GetProcAddress(i,"NPLoadNameSpaces"); NPLoadNameSpaces1=(int (_stdcall *)(int ,int ,int ))a; return NPLoadNameSpaces1(p,q,r); //取得原同名函数地址 //执行真正的处理 } int PASCAL FAR closesockinfo(int p) { abc("closesockinfo"); a=GetProcAddress(i,"closesockinfo"); closesockinfo1=(int (_stdcall *)(int))a; return closesockinfo1(p); //取得原同名函数地址 //执行真正的处理 } int PASCAL FAR connect(SOCKET s,const struct sockaddr *name, int namelen) { abc("connect"); a=GetProcAddress(i,"connect"); connect1=(int (_stdcall *)(SOCKET ,const struct sockaddr *,int ))a; return connect1(s,name,namelen); //取得原同名函数地址 //执行真正的处理 } int PASCAL FAR WSAGetLastError(void) { a=GetProcAddress(i,"WSAGetLastError"); WSAGetLastError1=(int (_stdcall *)())a; d=WSAGetLastError1(); sprintf(aa,"WSAGetLastError %d",d); abc(aa); return d; //取得原同名函数地址 //执行真正的处理 } int PASCAL FAR send(SOCKET s,const char * buf,int len,int flags) { abc("send"); a=GetProcAddress(i,"send"); send1=(int (_stdcall *)(SOCKET ,const char * ,int ,int ))a; return send1(s,buf,len,flags); //取得原同名函数地址 //执行真正的处理 } int PASCAL FAR recv(SOCKET s, char FAR * buf, int len, int flags) { abc("recv"); a=GetProcAddress(i,"recv"); recv1=(int (_stdcall *)(SOCKET ,char FAR * ,int ,int ))a; return recv1(s, buf, len, flags); //取得原同名函数地址 //执行真正的处理 } int PASCAL FAR __WSAFDIsSet(SOCKET p,fd_set FAR *q) { abc("__WSAFDIsSet"); a=GetProcAddress(i,"__WSAFDIsSet"); __WSAFDIsSet1=(int (_stdcall *)(SOCKET,fd_set FAR *))a; return __WSAFDIsSet1(p,q); //取得原同名函数地址 //执行真正的处理 } unsigned long PASCAL inet_addr(const char FAR * cp) { abc("inet_addr"); a=GetProcAddress(i,"inet_addr"); inet_addr1=(unsigned long (_stdcall *)(const char FAR * ))a; return inet_addr1(cp); //取得原同名函数地址 //执行真正的处理 } int PASCAL WsControl(int p,int q,int r,int s,int t,int u) { abc("WsControl"); a=GetProcAddress(i,"WsControl"); WsControl1=(int (_stdcall *)(int ,int ,int ,int ,int ,int ))a; return WsControl1(p,q,r,s,t,u); //取得原同名函数地址 //执行真正的处理 } char * PASCAL inet_ntoa (struct in_addr in) { abc("inet_ntoa"); a=GetProcAddress(i,"inet_ntoa"); inet_ntoa1=(char * (_stdcall *)(struct in_addr))a; return inet_ntoa1(in); //取得原同名函数地址 //执行真正的处理 } u_long PASCAL FAR htonl(u_long hostlong) { abc("htonl"); a=GetProcAddress(i,"htonl"); htonl1=(u_long (_stdcall *)(u_long))a; return htonl1(hostlong); //取得原同名函数地址 //执行真正的处理 } int PASCAL bind(SOCKET s, const struct sockaddr FAR *addr, int namelen) { abc("bind"); a=GetProcAddress(i,"bind"); bind1=(int (_stdcall *)(SOCKET ,const struct sockaddr *,int ))a; return bind1(s,addr,namelen); //取得原同名函数地址 //执行真正的处理 } int PASCAL getsockname(SOCKET s, struct sockaddr *name,int * namelen) { abc("getsockname"); a=GetProcAddress(i,"getsockname"); getsockname1=(int (_stdcall *)(SOCKET ,struct sockaddr *,int * ))a; return getsockname1(s,name,namelen); //取得原同名函数地址 //执行真正的处理 } struct hostent * PASCAL FAR gethostbyname(const char FAR * name) { abc("gethostbyname"); a=GetProcAddress(i,"gethostbyname"); gethostbyname1=(struct hostent * (_stdcall *)(const char FAR * ))a; return gethostbyname1(name); //取得原同名函数地址 //执行真正的处理 } u_short PASCAL ntohs(u_short netshort) { abc("ntohs"); a=GetProcAddress(i,"ntohs"); ntohs1=(u_short (_stdcall *)(u_short))a; return ntohs1(netshort); //取得原同名函数地址 //执行真正的处理 } int PASCAL getsockopt(SOCKET s,int level,int optname,char * optval, int *optlen) { abc("getsockopt"); a=GetProcAddress(i,"getsockopt"); getsockopt1=(int (_stdcall *)(SOCKET ,int ,int ,char * , int *))a; return getsockopt1(s,level,optname,optval,optlen); //取得原同名函数地址 //执行真正的处理 } SOCKET PASCAL FAR accept (SOCKET s, struct sockaddr FAR *addr,int FAR *addrlen){abc("1");return 0;} int PASCAL FAR getpeername (SOCKET s, struct sockaddr FAR *name,int FAR * namelen){abc("5");return 0;} int PASCAL FAR listen (SOCKET s, int backlog){abc("13");return 0;} u_long PASCAL FAR ntohl (u_long netlong){abc("14");return 0;} int PASCAL FAR recvfrom (SOCKET s, char FAR * buf, int len, int flags,struct sockaddr FAR *from, int FAR * fromlen){abc("17");return 0;} int PASCAL FAR sendto (SOCKET s, const char FAR * buf, int len, int flags,const struct sockaddr FAR *to, int tolen){abc("20");return 0;} int PASCAL FAR shutdown (SOCKET s, int how){abc("22");return 0;} struct hostent FAR * PASCAL FAR gethostbyaddr(const char FAR * addr,int len, int type){abc("24");return 0;} struct protoent FAR * PASCAL FAR getprotobynumber(int proto){abc("26");return 0;} struct protoent FAR * PASCAL FAR getprotobyname(const char FAR * name){abc("27");return 0;} struct servent FAR * PASCAL FAR getservbyport(int port, const char FAR * proto){abc("28");return 0;} struct servent FAR * PASCAL FAR getservbyname(const char FAR * name,const char FAR * proto){abc("29");return 0;} int PASCAL FAR gethostname (char FAR * name, int namelen){abc("30");return 0;} HANDLE PASCAL FAR WSAAsyncGetServByName(HWND hWnd, u_int wMsg,const char FAR * name,const char FAR * proto,char FAR * buf, int buflen){abc("32");return 0;} HANDLE PASCAL FAR WSAAsyncGetServByPort(HWND hWnd, u_int wMsg, int port,const char FAR * proto, char FAR * buf,int buflen){abc("33");return 0;} HANDLE PASCAL FAR WSAAsyncGetProtoByName(HWND hWnd, u_int wMsg,const char FAR * name, char FAR * buf,int buflen){abc("34");return 0;} HANDLE PASCAL FAR WSAAsyncGetProtoByNumber(HWND hWnd, u_int wMsg,int number, char FAR * buf,int buflen){abc("35");return 0;} HANDLE PASCAL FAR WSAAsyncGetHostByAddr(HWND hWnd, u_int wMsg,const char FAR * addr, int len, int type,char FAR * buf, int buflen){abc("37");return 0;} int PASCAL FAR WSACancelAsyncRequest(HANDLE hAsyncTaskHandle){abc("38");return 0;} FARPROC PASCAL FAR WSASetBlockingHook(FARPROC lpBlockFunc){abc("39");return 0;} int PASCAL FAR WSAUnhookBlockingHook(void){abc("40");return 0;} void PASCAL FAR WSASetLastError(int iError){abc("41");} int PASCAL FAR WSACancelBlockingCall(void){abc("43");return 0;} BOOL PASCAL FAR WSAIsBlocking(void){abc("44");return 0;} int PASCAL FAR WSARecvEx (SOCKET s, char FAR * buf, int len, int FAR *flags){abc("47");return 0;} BOOL PASCAL FAR TransmitFile (IN SOCKET hSocket,IN HANDLE hFile,IN DWORD nNumberOfBytesToWrite,IN DWORD nNumberOfBytesPerSend,IN LPOVERLAPPED lpOverlapped,IN void *lpTransmitBuffers,IN DWORD dwReserved){abc("48");return 0;} int PASCAL FAR Arecv (){abc("a3");return 0;} int PASCAL FAR Asend (){abc("a4");return 0;} int PASCAL FAR WSHEnumProtocols(){abc("a5");return 0;} int PASCAL FAR inet_network (){abc("a6");return 0;} int PASCAL FAR getnetbyname (){abc("a7");return 0;} int PASCAL FAR rcmd (){abc("a8");return 0;} int PASCAL FAR rexec (){abc("a9");return 0;} int PASCAL FAR rresvport (){abc("a10");return 0;} int PASCAL FAR sethostname (){abc("a11");return 0;} int PASCAL FAR dn_expand (){abc("a12");return 0;} int PASCAL FAR s_perror (){abc("a13");return 0;} int PASCAL FAR GetAddressByNameA (){abc("a14");return 0;} int PASCAL FAR GetAddressByNameW (){abc("a15");return 0;} int PASCAL FAR EnumProtocolsA (){abc("a16");return 0;} int PASCAL FAR EnumProtocolsW (){abc("a17");return 0;} int PASCAL FAR GetTypeByNameA (){abc("a18");return 0;} int PASCAL FAR GetTypeByNameW (){abc("a19");return 0;} int PASCAL FAR GetNameByTypeA (){abc("a20");return 0;} int PASCAL FAR GetNameByTypeW (){abc("a21");return 0;} int PASCAL FAR SetServiceA (){abc("a22");return 0;} int PASCAL FAR SetServiceW (){abc("a23");return 0;} int PASCAL FAR GetServiceA (){abc("a24");return 0;} int PASCAL FAR GetServiceW (){abc("a25");return 0;} //BOOL PASCAL FAR AcceptEx (IN SOCKET sListenSocket,IN SOCKET sAcceptSocket,IN PVOID lpOutputBuffer,IN DWORD dwReceiveDataLength,IN DWORD dwLocalAddressLength,IN DWORD dwRemoteAddressLength,OUT LPDWORD lpdwBytesReceived,IN LPOVERLAPPED lpOverlapped){abc("1");return 0;} //VOID PASCAL FAR GetAcceptExSockaddrs (IN PVOID lpOutputBuffer,IN DWORD dwReceiveDataLength,IN DWORD dwLocalAddressLength,IN DWORD dwRemoteAddressLength,OUT struct sockaddr **LocalSockaddr,OUT LPINT LocalSockaddrLength,OUT struct sockaddr **RemoteSockaddr,OUT LPINT RemoteSockaddrLength){abc("1");return 0;} //在WSOCK32.DEF中定义输出函数 msock32.def LIBRARY "wsock32" EXPORTS 　　accept @1 　　bind @2 　　closesocket @3 　　connect @4 　　getpeername @5 　　getsockname @6 　　getsockopt @7 　　htonl @8 　　htons @9 　　inet_addr @10 　　inet_ntoa @11 　　ioctlsocket @12 　　listen @13 　　ntohl @14 　　ntohs @15 　　recv @16 　　recvfrom @17 　　select @18 　　send @19 　　sendto @20 　　setsockopt @21 　　shutdown @22 　　socket @23 　　gethostbyaddr @51 　　gethostbyname @52 　　getprotobyname @53 　　getprotobynumber @54 　　getservbyname @55 　　getservbyport @56 　　gethostname @57 　　WSAAsyncSelect @101 　　WSAAsyncGetHostByAddr @102 　　WSAAsyncGetHostByName @103 　　WSAAsyncGetProtoByNumber @104 　　WSAAsyncGetProtoByName @105 　　WSAAsyncGetServByPort @106 　　WSAAsyncGetServByName @107 　　WSACancelAsyncRequest @108 　　WSASetBlockingHook @109 　　WSAUnhookBlockingHook @110 　　WSAGetLastError @111 　　WSASetLastError @112 　　WSACancelBlockingCall @113 　　WSAIsBlocking @114 　　WSAStartup @115 　　WSACleanup @116 　　__WSAFDIsSet @151 WsControl @1001 closesockinfo @1002 Arecv @1003 Asend @1004 WSHEnumProtocols @1005 inet_network @1100 getnetbyname @1101 rcmd @1102 rexec @1103 rresvport @1104 sethostname @1105 dn_expand @1106 　　WSARecvEx @1107 s_perror @1108 GetAddressByNameA @1109 GetAddressByNameW @1110 EnumProtocolsA @1111 EnumProtocolsW @1112 GetTypeByNameA @1113 GetTypeByNameW @1114 GetNameByTypeA @1115 GetNameByTypeW @1116 SetServiceA @1117 SetServiceW @1118 GetServiceA @1119 GetServiceW @1120 NPLoadNameSpaces @1130 　　TransmitFile @1140 　　先将WINSOCK库WSOCK32.DLL该名为AAA.DLL，WSOCK32.AAA 　　利用VISUAL C++创建一个DLL项目 WSOCK32.DLL 　　目前加入的模块为一个日志处理。 特别感谢『九头鸟』自发编辑『 dy 』| |

Rocklee · 2003-09-18

wenjinshan，你的书我已经买来看了，我最想知道的就是win98 win95下，Delphi如何Hookapi，而你就偏偏一笔带过，说Delphi 很难做到，不讲了。 而我也试做过，反正一启动Hookapi，就很容易造成系统崩溃：（（

还是API Hook的难题(140分)

Kofer

Unregistered / Unconfirmed

NowCan

Unregistered / Unconfirmed

热血

Unregistered / Unconfirmed

NowCan

Unregistered / Unconfirmed

JobsLee

Unregistered / Unconfirmed

shellapi

Unregistered / Unconfirmed

Kofer

Unregistered / Unconfirmed

wql

Unregistered / Unconfirmed

未来107

Unregistered / Unconfirmed

未来107

Unregistered / Unconfirmed

mdc

Unregistered / Unconfirmed

wjlsnet

Unregistered / Unconfirmed

www

Unregistered / Unconfirmed

深之蓝

Unregistered / Unconfirmed

wenjinshan

Unregistered / Unconfirmed

xtalk

Unregistered / Unconfirmed

xtalk

Unregistered / Unconfirmed

kcahcn

Unregistered / Unconfirmed

爱元元的哥哥

Unregistered / Unconfirmed

Rocklee

Unregistered / Unconfirmed

Similar threads