关于API HOOK(300分)

DELPHI对于windows的系统编程是非常困难吗？<br>我现在想用DELPHI使用APIHOOK截获某程序的网络封包，希望各位大富翁给我指点一二，<br>如果有例子最好，资料也可以。<br>分不是问题，谢谢了。

應該可以吧，只是很多都有加密了吧。這樣有點黑客的味道。

我想学习这方面的知识，可是资料太少了！

学学吧

我有一个不用VXD驱动的源码!就可以截封包的源码!你要的话留下email。但要给分哦!

Win2K下的Api函数的拦截 <br>原创：tomh（tomh） <br>&nbsp;<br>&nbsp; 这么多高手在这里，哎，小弟愿意向各位高手学习 <br>&nbsp; Api拦截并不是一个新的技术，很多商业软件都采用这种技术。对windows的Api函数的拦截，不外乎两种方法，第一种是Mr. Jeffrey Richter 的修改exe文件的模块输入节，种方法，很安全，但很复杂，而且有些exe文件，没有Dll的输入符号的列表，有可能出现拦截不到的情况。第二种方法就是常用的JMP XXX的方法，虽然很古老，却很简单实用。 <br>&nbsp; &nbsp; 本文一介绍第二种方法在Win2k下的使用。第二种方法，Win98/me 下因为进入Ring0级的方法很多，有LDT,IDT,Vxd等方法，很容易在内存中动态修改代码，但在Win2k下，这些方法都不能用，写WDM太过复杂，表面上看来很难实现， <br>其实不然。Win2k为我们提供了一个强大的内存Api操作函数---VirtualProtectEx，WriteProcessMemeory,ReadProcessMemeory，有了它们我们就能在内存中动态修改代码了，其原型为： <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;BOOL VirtualProtectEx( <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;HANDLE hProcess, &nbsp; &nbsp; // 要修改内存的进程句柄 <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LPVOID lpAddress, &nbsp; &nbsp;// 要修改内存的起始地址 <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;DWORD dwSize, &nbsp; &nbsp; &nbsp; &nbsp;// 修改内存的字节 <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;DWORD flNewProtect, &nbsp;// 修改后的内存属性 <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;PDWORD lpflOldProtect &nbsp;// 修改前的内存属性的地址 <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ); <br>&nbsp; &nbsp; &nbsp; &nbsp; BOOL WriteProcessMemory( <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;HANDLE hProcess, &nbsp;// 要写进程的句柄 <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LPVOID lpBaseAddress, &nbsp;// 写内存的起始地址 <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LPVOID lpBuffer, &nbsp;// 写入数据的地址 <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;DWORD nSize, &nbsp; &nbsp; &nbsp;// 要写的字节数 <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LPDWORD lpNumberOfBytesWritten &nbsp;// 实际写入的子节数 <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br>&nbsp; &nbsp; &nbsp; &nbsp;BOOL ReadProcessMemory( <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;HANDLE hProcess, &nbsp;// 要读进程的句柄 <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LPCVOID lpBaseAddress, &nbsp; // 读内存的起始地址 <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LPVOID lpBuffer, &nbsp;// 读入数据的地址 <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;DWORD nSize, &nbsp; &nbsp; &nbsp;// 要读入的字节数 <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LPDWORD lpNumberOfBytesRead &nbsp; &nbsp;// 实际读入的子节数 <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ); <br>具体的参数请参看MSDN帮助。在Win2k下因为Dll和所属进程在同一地址空间，这点又和Win9x/me存在所有进程存在共享的地址空间不同， <br>因此，必须通过钩子函数和远程注入进程的方法，现以一个简单采用钩子函数对MessageBoxA进行拦截例子来说明： <br>其中Dll文件为： <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; HHOOK g_hHook; <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; HINSTANCE g_hinstDll; <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; FARPROC pfMessageBoxA; <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; int WINAPI MyMessageBoxA(HWND hWnd, LPCTSTR lpText,LPCTSTR lpCaption,UINT uType); <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; BYTE OldMessageBoxACode[5],NewMessageBoxACode[5]; <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; HMODULE hModule ; <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; DWORD dwIdOld,dwIdNew; <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; BOOL bHook=false; <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; void HookOn(); <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; void HookOff(); <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; BOOL init(); <br>LRESULT WINAPI MousHook(int nCode,WPARAM wParam,LPARAM lParam); <br>BOOL APIENTRY DllMain( HANDLE hModule, <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;DWORD &nbsp;ul_reason_for_call, <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LPVOID lpReserved <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp <br>{ <br>&nbsp; &nbsp; switch (ul_reason_for_call) <br>&nbsp; &nbsp; { <br>&nbsp; &nbsp; &nbsp; &nbsp; case DLL_PROCESS_ATTACH: <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(!init()) <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; { <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MessageBoxA(NULL,"Init","ERROR",MB_OK); <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return(false); <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; } <br>&nbsp; &nbsp; &nbsp; &nbsp; case DLL_THREAD_ATTACH: <br>&nbsp; &nbsp; &nbsp; &nbsp; case DLL_THREAD_DETACH: <br>&nbsp; &nbsp; &nbsp; &nbsp; case DLL_PROCESS_DETACH: <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(bHook) UnintallHook(); &nbsp; <br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break; <br>&nbsp; &nbsp; } <br>&nbsp; &nbsp; return TRUE; <br>} <br>LRESULT WINAPI Hook(int nCode,WPARAM wParam,LPARAM lParam)//空的钩子函数 <br>{ <br>&nbsp; &nbsp; &nbsp;<br>&nbsp; &nbsp; return(CallNextHookEx(g_hHook,nCode,wParam,lParam)); <br>} <br>HOOKAPI2_API BOOL InstallHook()//输出安装空的钩子函数 <br>{ &nbsp; <br>&nbsp; &nbsp;g_hinstDll=LoadLibrary("HookApi2.dll"); <br>&nbsp; &nbsp;g_hHook=SetWindowsHookEx(WH_GETMESSAGE,(HOOKPROC)Hook,g_hinstDll,0); <br>&nbsp; if (!g_hHook) <br>&nbsp; { <br>&nbsp; &nbsp; &nbsp; &nbsp; MessageBoxA(NULL,"SET ERROR","ERROR",MB_OK); <br>&nbsp; &nbsp; &nbsp; &nbsp; return(false); <br>&nbsp; &nbsp;} <br>&nbsp; &nbsp;<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<br>&nbsp; &nbsp;return(true); <br>} <br>HOOKAPI2_API BOOL UninstallHook()//输出御在钩子函数 <br>{ <br>&nbsp; &nbsp;<br>&nbsp; &nbsp; return(UnhookWindowsHookEx(g_hHook)); <br>

shean8375<br><br>一个不用VXD驱动的源码!就可以截封包的源码!<br>那个源码能够改封包吗?我指的是改动源码后可以改封包~<br>如果可以,把那个源码给我,我给你分.<br>dongmenbianxue@163.com

好象原码空间有这方面的例子

to shean8375:<br>公司这段时间不能上网了，一直没有看，不好意思！<br>我的邮箱是：nibul@163.com，收到就给分了。

to nibul:<br>&nbsp; &nbsp;已发。请查收!

ding!

http://delphibbs.com/delphibbs/dispq.asp?lid=2367407

多人接受答案了。