拦截其它程序的网络数据封包

PJmpCode = ^TJmpCode;

TJmpCode = packed record

JmpCode: BYTE;

Address: TSockProc;

MovEAX: Array [0..2] of BYTE;

end;

//--------------------函数声明---------------------------

procedure HookAPI;

procedure UnHookAPI;

var

OldSend, OldRecv: TSockProc; //原来的API地址

JmpCode: TJmpCode;

OldProc: array [0..1] of TJmpCode;

AddSend, AddRecv: pointer; //API地址

TmpJmp: TJmpCode;

ProcessHandle: THandle;

implementation

{---------------------------------------}

{函数功能:Send函数的HOOK

{函数参数:同Send

{函数返回值:integer

{---------------------------------------}

function MySend(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall;

var

dwSize: cardinal;

begin

//这儿进行发送的数据处理

MessageBeep(1000); //简单的响一声

//调用直正的Send函数

WriteProcessMemory(ProcessHandle, AddSend, @OldProc[0], 8, dwSize);

Result := OldSend(S, Buf, len, flags);

JmpCode.Address := @MySend;

WriteProcessMemory(ProcessHandle, AddSend, @JmpCode, 8, dwSize);

end;

{---------------------------------------}

{函数功能:Recv函数的HOOK

{函数参数:同Recv

{函数返回值:integer

{---------------------------------------}

function MyRecv(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall;

var

dwSize: cardinal;

begin

//这儿进行接收的数据处理

MessageBeep(1000); //简单的响一声

//调用直正的Recv函数

WriteProcessMemory(ProcessHandle, AddRecv, @OldProc[1], 8, dwSize);

Result := OldRecv(S, Buf, len, flags);

JmpCode.Address := @MyRecv;

WriteProcessMemory(ProcessHandle, AddRecv, @JmpCode, 8, dwSize);

end;

{------------------------------------}

{过程功能:HookAPI

{过程参数:无

{------------------------------------}

procedure HookAPI;

var

DLLModule: THandle;

dwSize: cardinal;

begin

ProcessHandle := GetCurrentProcess;

DLLModule := LoadLibrary("ws2_32.dll");

AddSend := GetProcAddress(DLLModule, "send"); //取得API地址

AddRecv := GetProcAddress(DLLModule, "recv");

JmpCode.JmpCode := $B8;

JmpCode.MovEAX[0] := $FF;

JmpCode.MovEAX[1] := $E0;

JmpCode.MovEAX[2] := 0;

ReadProcessMemory(ProcessHandle, AddSend, @OldProc[0], 8, dwSize);

JmpCode.Address := @MySend;

WriteProcessMemory(ProcessHandle, AddSend, @JmpCode, 8, dwSize); //修改Send入口

ReadProcessMemory(ProcessHandle, AddRecv, @OldProc[1], 8, dwSize);

JmpCode.Address := @MyRecv;

WriteProcessMemory(ProcessHandle, AddRecv, @JmpCode, 8, dwSize); //修改Recv入口

OldSend := AddSend;

OldRecv := AddRecv;

end;

{------------------------------------}

{过程功能:取消HOOKAPI

{过程参数:无

{------------------------------------}

procedure UnHookAPI;

var

dwSize: Cardinal;

begin

WriteProcessMemory(ProcessHandle, AddSend, @OldProc[0], 8, dwSize);

WriteProcessMemory(ProcessHandle, AddRecv, @OldProc[1], 8, dwSize);

end;

end.

---------------------------------------------------------------------------------------------

编译这个DLL后,再新建一个程序调用这个DLL的InstallHook并传入目标进程的主窗口句柄就可:

unit fmMain;

interface

uses

Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,

Dialogs, StdCtrls;

type

TForm1 = class(TForm)

Button1: TButton;

Button2: TButton;

Edit1: TEdit;

procedure Button1Click(Sender: TObject);

procedure Button2Click(Sender: TObject);

private

{ Private declarations }

public

{ Public declarations }

end;

var

Form1: TForm1;

InstallHook: function (SWindow: THandle):Boolean;stdcall;

UnHook: procedure;stdcall;

implementation

{$R *.dfm}

procedure TForm1.Button1Click(Sender: TObject);

var

ModuleHandle: THandle;

TmpWndHandle: THandle;

begin

TmpWndHandle := 0;

TmpWndHandle := FindWindow(nil, "目标窗口的标题");

if not isWindow(TmpWndHandle) then

begin

MessageBox(self.Handle, "没有找到窗口", "!!!", MB_OK);

exit;

end;

ModuleHandle := LoadLibrary("Hook.dll");

@InstallHook := GetProcAddress(ModuleHandle, "InstallHook");

@UnHook := GetProcAddress(ModuleHandle, "UnHook");

if InstallHook(FindWindow(nil, "Untitled")) then

ShowMessage("Hook OK");

end;

procedure TForm1.Button2Click(Sender: TObject);

begin

UnHook

end;

end.

查看本文来源