首页
社区
课程
招聘
问答 CTF 排行榜 知识库 工具下载 峰会 看雪商城 证书查询
  1. 社区
  2. 编程技术
    3. 发新帖
[求助]Delphi Hook inet_addr 为何无效
发表于: 2012-8-31 09:37 7322

[求助]Delphi Hook inet_addr 为何无效

Meiam 活跃值
2012-8-31 09:37
7322
用了 HookApiLib + LDE32 那里写错了。希望达人指点

unit Hook;

interface

uses
  Windows, HookApiLib, WinSock, SysUtils;

type
  Tconnect = function(s: TSocket; var name: TSockAddr; namelen: Integer): Integer; stdcall;

  function HookOn: Boolean; stdcall; export;
  function HookOff: Boolean; stdcall; export;

var
  ConnectNextHook: Tconnect;

implementation


function IPtoStr(IP: DWORD): string;
begin
  result := IntToStr((IP and $000000FF) shr 0) + '.';
  result := result + IntToStr((IP and $0000FF00) shr 8) + '.';
  result := result + IntToStr((IP and $00FF0000) shr 16) + '.';
  result := result + IntToStr((IP and $FF000000) shr 24);
end;

function ConnectHookProc(s: TSocket; var name: TSockAddr; namelen: Integer): Integer; stdcall;
begin
  if name.sin_port = htons(80) then
  begin
    name.sin_addr.S_addr := inet_addr('127.0.0.1');
  end;
  Result := ConnectNextHook(s, name, namelen);
end;

function HookOn: Boolean; stdcall; export;
begin
  @ConnectNextHook := HookCode(GetProcAddress(LoadLibrary('ws2_32.dll'), 'inet_addr'), @ConnectHookProc);
end;

function HookOff: Boolean; stdcall; export;
begin
  UnHookCode(@ConnectNextHook);
end;

end.

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)

上传的附件：
收藏
免费 ・0
支持
分享
最新回复 (2)
Meiam
雪    币： 196
活跃值： (10)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
2 楼
这个也无效。郁闷

unit APIHook;

interface

uses
  SysUtils,
  Windows, WinSock,idWinSock2;

type
  int=integer;
  lpfn_WSACONNECT = function ( const s : TSocket; const name : PSockAddr; const namelen : Integer; lpCallerData,lpCalleeData : LPWSABUF; lpSQOS,lpGQOS : LPQOS ) : Integer; stdcall;


  PJmpCodeWSACONNECT = ^TJmpCodeWSACONNECT;
  TJmpCodeWSACONNECT = packed record
    JmpCode: BYTE;
    Address: lpfn_WSACONNECT;
    MovEAX: Array [0..2] of BYTE;
  end;

  //--------------------函数声明---------------------------
  procedure HookAPI;
  procedure UnHookAPI;

var
  OldWSAConnect: lpfn_WSACONNECT;      //原来的API地址
  JmpCodeWSACONNECT: TJmpCodeWSACONNECT;
  OldProcWSACONNECT:TJmpCodeWSACONNECT;
  AddWSAConnect: pointer;
  ProcessHandle: THandle;
implementation


{---------------------------------------}
{函数功能:Recv函数的HOOK
{函数参数:同Recv
{函数返回值:integer
{---------------------------------------}
function MyWSAConnect( const s : TSocket; const name : PSockAddr; const namelen : Integer; lpCallerData,lpCalleeData : LPWSABUF; lpSQOS,lpGQOS : LPQOS ) : Integer; stdcall;
var
  dwSize: cardinal;
  port:word;
begin
  WriteProcessMemory(ProcessHandle, AddWSAConnect, @OldProcWSAConnect, 8, dwSize);
  port:=ntohs(name^.sin_port);
  if (port=80) then
  begin
    ShowMessage('OK');
    name^.sin_addr.S_addr:=inet_Addr('127.0.0.1');
  end;
  Result := OldWSAConnect(S,name, namelen, lpCallerData,lpCalleeData, lpSQOS,lpGQOS );
  JmpCodeWSACONNECT.Address := @MyWSAConnect;
  WriteProcessMemory(ProcessHandle, AddWSAConnect, @JmpCodeWSAConnect, 8, dwSize);
end;

{------------------------------------}
{过程功能:HookAPI
{过程参数:无
{------------------------------------}
procedure HookAPI;
var
  DLLModule: THandle;
  dwSize: cardinal;
begin
  ProcessHandle := GetCurrentProcess;
  DLLModule := LoadLibrary('ws2_32.dll');
  AddWSAConnect := GetProcAddress(DLLModule, 'WSAConnect');
  ShowMessage('Hooked');

  JmpCodeWSACONNECT.JmpCode := $B8;
  JmpCodeWSACONNECT.MovEAX[0] := $FF;
  JmpCodeWSACONNECT.MovEAX[1] := $E0;
  JmpCodeWSACONNECT.MovEAX[2] := 0;

  ReadProcessMemory(ProcessHandle, AddWSAConnect, @OldProcWSACONNECT, 8, dwSize);
  JmpCodeWSACONNECT.Address := @MyWSAConnect;
  WriteProcessMemory(ProcessHandle, AddWSAConnect, @JmpCodeWSACONNECT, 8, dwSize);   //修改WSAConnect入口

  OldWSAConnect := AddWSAConnect;
end;

{------------------------------------}
{过程功能:取消HOOKAPI
{过程参数:无
{------------------------------------}
procedure UnHookAPI;
var
  dwSize: Cardinal;
begin
  WriteProcessMemory(ProcessHandle, AddWSAConnect, @OldProcWSAConnect, 8, dwSize);
end;

end.
2012-8-31 12:19
0
红色神话
雪    币： 89
活跃值： (274)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
3 楼
function ConnectHookProc(s: TSocket; var name: TSockAddr; namelen: Integer): Integer; stdcall;
定义的Connect怎么可能有效
2012-9-19 09:35
0
游客
登录 | 注册 方可回帖
回帖 表情 雪币赚取及消费
高级回复
返回
//