请教高手: 截取网络程序的网络数据封包的@MySend、 @MyRecv不执行(100)

江上游者

Unregistered / Unconfirmed
GUEST, unregistred user!
在procedure HookAPI中能调用MySend、 MyRecv函数中的无法得到数据。 procedure HookAPI; var DLLModule: THandle; dwSize: cardinal; begin ProcessHandle := GetCurrentProcess; DLLModule := LoadLibrary('ws2_32.dll'); AddSend := GetProcAddress(DLLModule, 'send'); //取得API地址 AddRecv := GetProcAddress(DLLModule, 'recv'); JmpCode.JmpCode := $B8; JmpCode.MovEAX[0] := $FF; JmpCode.MovEAX[1] := $E0; JmpCode.MovEAX[2] := 0;//在这里放入数据可以传出????????????????????? ReadProcessMemory(ProcessHandle, AddSend, @OldProc[0], 8, dwSize); JmpCode.Address := @MySend; WriteProcessMemory(ProcessHandle, AddSend, @JmpCode, 8, dwSize); //修改Send入口 ReadProcessMemory(ProcessHandle, AddRecv, @OldProc[1], 8, dwSize); JmpCode.Address := @MyRecv; WriteProcessMemory(ProcessHandle, AddRecv, @JmpCode, 8, dwSize); //修改Recv入口 OldSend := AddSend; OldRecv := AddRecv; end; function MySend(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall; var dwSize: cardinal; begin//在这里放入数据不可以传出????????????????????????? //这儿进行发送的数据处理 MessageBeep(1000); //简单的响一声 //调用直正的Send函数 WriteProcessMemory(ProcessHandle, AddSend, @OldProc[0], 8, dwSize); Result := OldSend(S, Buf, len, flags); JmpCode.Address := @MySend; WriteProcessMemory(ProcessHandle, AddSend, @JmpCode, 8, dwSize); end; function MyRecv(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall; var dwSize: cardinal; begin//在这里放入数据不可以传出??????????????????????????? //这儿进行接收的数据处理 MessageBeep(1000); //简单的响一声 //调用直正的Recv函数 WriteProcessMemory(ProcessHandle, AddRecv, @OldProc[1], 8, dwSize); Result := OldRecv(S, Buf, len, flags); JmpCode.Address := @MyRecv; WriteProcessMemory(ProcessHandle, AddRecv, @JmpCode, 8, dwSize); end;
 
Top Bottom