利用HOOK拦截封包原理

;;;;;截获API是个很有用的东西,比如你想分析一下别人的程序是怎样工作的 。这里我介绍一下一种我自己试验通过的方法 。;
首先,我们必须设法把自己的代码放到目标程序的进程空间里去 。Windows Hook可以帮我们实现这一点 。SetWindowsHookEx的声明如下:;
HHOOK SetWindowsHookEx(;
int idHook, // hook type;
HOOKPROC lpfn, // hook procedure;
HINSTANCE hMod, // handle to application instance;
DWORD dwThreadId // thread identifier;
)
具体的参数含义可以翻阅msdn,没有msdn可谓寸步难行 。;
这里Hook本身的功能并不重要,我们使用它的目的仅仅只是为了能够让Windows把我们的代码植入别的进程里去 。hook Type我们任选一种即可,只要保证是目标程序肯定会调用到就行,这里我用的是WH_CALLWNDPROC 。lpfn和hMod分别指向我们的钩子代码及其所在的dll,dwThreadId设为0,表示对所有系统内的线程都挂上这样一个hook,这样我们才能把代码放到别的进程里去 。;;
之后,我们的代码就已经进入了系统内的所有进程空间了 。必须注意的是,我们只需要截获我们所关心的目标程序的调用,因此还必须区分一下进程号 。我们自己的钩子函数中,第一次运行将进行最重要的API重定向的工作 。也就是通过将所需要截获的API的开头几个字节改为一个跳转指令,使其跳转到我们的API中来 。这是最关键的部分 。这里我想截三个调用,ws2_32.dll中的send和recv、user32.dll中的GetMessageA 。;

DWORD dwCurrentPID = 0
HHOOK hOldHook = NULL
DWORD pSend = 0
DWORD pRecv = 0
GETMESSAGE pGetMessage = NULL

BYTE btNewBytes[8] = { 0x0B8, 0x0, 0x0, 0x40, 0x0, 0x0FF, 0x0E0, 0 }
DWORD dwOldBytes[3][2]

HANDLE hDebug = INVALID_HANDLE_value

LRESULT CALLBACK CallWndProc( int nCode, WPARAM wParam, LPARAM lParam );
{;
DWORD dwSize
DWORD dwPIDWatched
HMODULE hLib

if( dwCurrentPID == 0 );
{;
dwCurrentPID = GetCurrentProcessId()
HWND hwndMainHook
wndMainHook = ::FindWindow( 0, "MainHook )
dwPIDWatched = ::SendMessage( hwndMainHook, (WM_USER 100), 0, 0 )
hOldHook = (HHOOK)::SendMessage( hwndMainHook, (WM_USER 101), 0, 0 )

if( dwCurrentPID == dwPIDWatched );
{;
Lib = LoadLibrary( "ws2_32.dll )
Send = (DWORD)GetProcAddress( hLib, "send )
Recv = (DWORD)GetProcAddress( hLib, "recv )

::ReadProcessMemory( INVALID_HANDLE_value, (void *)pSend, (void *)dwOldBytes[0], sizeof(DWORD)*2, &dwSize )
*(DWORD *)( btNewBytes1 ) = (DWORD)new_send
::WriteProcessMemory( INVALID_HANDLE_value, (void *)pSend, (void *)btNewBytes, sizeof(DWORD)*2, &dwSize )

::ReadProcessMemory( INVALID_HANDLE_value, (void *)pRecv, (void *)dwOldBytes[1], sizeof(DWORD)*2, &dwSize )
*(DWORD *)( btNewBytes1 ) = (DWORD)new_recv
::WriteProcessMemory( INVALID_HANDLE_value, (void *)pRecv, (void *)btNewBytes, sizeof(DWORD)*2, &dwSize )

Lib = LoadLibrary( "user32.dll )
GetMessage = (GETMESSAGE)GetProcAddress( hLib, "GetMessageA )
::ReadProcessMemory( INVALID_HANDLE_value, (void *)pGetMessage, (void *)dwOldBytes[2], sizeof(DWORD)*2, &dwSize )
*(DWORD *)( btNewBytes1 ) = (DWORD)new_GetMessage
::WriteProcessMemory( INVALID_HANDLE_value, (void *)pGetMessage, (void *)btNewBytes, sizeof(DWORD)*2, &dwSize )

Debug = ::CreateFile( "C:Trace.log, GENERIC_WRITE, 0, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0 )
};
};

if( hOldHook != NULL );
{;
return CallNextHookEx( hOldHook, nCode, wParam, lParam )
};

return 0
};

上面的钩子函数,只有第一次运行时有用,就是把三个函数的首8字节修改一下(实际上只需要7个) 。btNewBytes中的指令实际就是;

推荐阅读