本机的就容易了.要是能接触到该电脑(能在上面运行程序),真是什么都能搞....跟网络的不是一个层次的...
type
TSockProc = function(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall;
TConnectProc = function(s: TSocket; var name: TSockAddr; namelen: Integer): Integer; stdcall;
PJmpCode = ^TJmpCode;
TJmpCode = packed record
JmpCode: BYTE;
Address: TSockProc;
MovEAX: array[0..2] of BYTE;
end;
var
HookWho: Integer;
OldSend, OldRecv: TSockProc;
OldConnect: TConnectProc;
JmpCode: TJmpCode;
OldProc: array[0..2] of TJmpCode;
AddSend, AddRecv, AddConnect: pointer;
TmpJmp: TJmpCode;
ProcessHandle: THandle;
bStart: Boolean;
procedure HookAPI;
var
DLLModule: THandle;
dwSize: cardinal;
begin
bStart := False;
JmpCode.JmpCode := $B8;
JmpCode.MovEAX[0] := $FF;
JmpCode.MovEAX[1] := $E0;
JmpCode.MovEAX[2] := 0;
ProcessHandle := GetCurrentProcess;
if HookWho = 0 then
begin
DLLModule := LoadLibrary('ws2_32.dll');
AddSend := GetProcAddress(DLLModule, 'send'); //取得API地址
DLLModule := LoadLibrary('ws2_32.dll'); //注意:IE的是WSOCK32.DLL
AddRecv := GetProcAddress(DLLModule, 'recv'); //取得API地址
ReadProcessMemory(ProcessHandle, AddSend, @OldProc[0], 8, dwSize);
JmpCode.Address := @MySend;
WriteProcessMemory(ProcessHandle, AddSend, @JmpCode, 8, dwSize); //修改Send入口
ReadProcessMemory(ProcessHandle, AddRecv, @OldProc[1], 8, dwSize);
JmpCode.Address := @MyRecv;
WriteProcessMemory(ProcessHandle, AddRecv, @JmpCode, 8, dwSize); //修改Recv入口
OldSend := AddSend;
OldRecv := AddRecv;
end;
if HookWho = 0 then
begin
DLLModule := LoadLibrary('WSOCK32.DLL');
AddConnect := GetProcAddress(DLLModule, 'connect');
ReadProcessMemory(ProcessHandle, AddConnect, @OldProc[2], 8, dwSize);
JmpCode.Address := @MyConnect;
WriteProcessMemory(ProcessHandle, AddConnect, @JmpCode, 8, dwSize);
OldConnect := AddConnect;
end;
end;
procedure UnHookAPI;
var
dwSize: Cardinal;
begin
if HookWho = 0 then
begin
WriteProcessMemory(ProcessHandle, AddSend, @OldProc[0], 8, dwSize);
WriteProcessMemory(ProcessHandle, AddRecv, @OldProc[1], 8, dwSize);
end;
if HookWho = 0 then
WriteProcessMemory(ProcessHandle, AddConnect, @OldProc[2], 8, dwSize);
end;
function MyConnect(s: TSocket; var name: TSockAddr; namelen: Integer): Integer; stdcall;
var
dwSize: cardinal;
begin
WriteProcessMemory(ProcessHandle, AddConnect, @OldProc[2], 8, dwSize);
Result := OldConnect(S, name, namelen);
JmpCode.Address := @MyConnect;
WriteProcessMemory(ProcessHandle, AddConnect, @JmpCode, 8, dwSize);
end;
function MyRecv(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall;
var
dwSize: cardinal;
DataSize: Integer;
Buffer{, UnCryptBuf}: array of byte;
begin
WriteProcessMemory(ProcessHandle, AddRecv, @OldProc[1], 8, dwSize);
Result := OldRecv(S, Buf, len, flags);
JmpCode.Address := @MyRecv;
WriteProcessMemory(ProcessHandle, AddRecv, @JmpCode, 8, dwSize);
try
if (HookWho <> 0) or (GetCurrentThreadID = PostThreadID) or (GetCurrentThreadID = PostThreadID2) then exit;
if (Result <= 0) then exit;
DataSize := Result;
SetLength(Buffer, Result);
Move(Buf, Buffer[0], DataSize);
except
end;
end;
function MySend(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall;
var
ks: integer;
// n: integer;
dwSize: cardinal;
i, DataSize: Integer;
// strTemp: string;
Buffer, UnCryptBuf: array of byte;
begin
try
if (HookWho = 0) and (GetCurrentThreadID <> PostThreadID) and (GetCurrentThreadID <> PostThreadID2) then
begin
DataSize := len;
SetLength(Buffer, len);
Move(Buf, Buffer[0], DataSize);
{
WriteDat('ip:' + GetConnectIpAddress);
strTemp := '';
for i := Low(Buffer) to High(Buffer) do strTemp := strTemp + IntToHex(Buffer, 2) + ' ';
WriteDat('s:' + strTemp);
..................
except
end;
//调用真正的Send函数
WriteProcessMemory(ProcessHandle, AddSend, @OldProc[0], 8, dwSize);
Result := OldSend(S, Buf, len, flags); //发送数据API
JmpCode.Address := @MySend;
WriteProcessMemory(ProcessHandle, AddSend, @JmpCode, 8, dwSize);
end;
