最近闲的无聊，在玩一款游戏，玩到60级的时候，发现里面的各种宝石刚需量很大，所以突然有个想法：如果能自己刷图就好了，但是我又想，一个号刷太慢了，多开也不行，这游戏太吃硬件了，开一个号感觉都要炸了。而且这游戏的辅助网上已经有卖的了，所以我有个大胆的想法，搞脱机的！
    既然要脱机，第一步就是要抓包。毫不犹豫，直接替换掉ws2_32.dll(其实是我根本不知道有什么好用的、可以指定进程、IP、端口、socket号来抓包的工具)。用Depends工具，把ws2_32.dll所有的导出函数，200多个，尼玛，一个一个实现那得到什么时候。我只需要截获socket、connect、send、recv、sendto、recvfrom等几个函数，所以写了个小工具，批量输出了一些代码，然后稍加改动：
  PS：我实现的是64位的
  
  1、重写ws2_32.dll
  
   1)函数指针声明（部分）：
   typedef unsigned int           SOCKET;
   
    extern FARPROC real_accept;
   
    typedef int (PASCAL FAR *Bind)(
      _In_ SOCKET s,
      _In_reads_bytes_(namelen) const struct sockaddr FAR * name,
      _In_ int namelen
     );
    extern Bind real_bind;
   
    typedef int
     (PASCAL FAR *CLOSESOCKET_FUNC)(
      _In_ SOCKET s
     );
   
    extern CLOSESOCKET_FUNC real_closesocket;
   
    typedef int
     (PASCAL FAR *Connect)(
      _In_ SOCKET s,
      _In_reads_bytes_(namelen) const struct sockaddr FAR * name,
      _In_ int namelen
     );
   
    extern Connect real_connect;
   
    typedef int (PASCAL FAR *Getpeername) (SOCKET s, struct sockaddr FAR *name,
                               int FAR * namelen);
    extern Getpeername real_getpeername;
   
    typedef int
     (PASCAL FAR *Getsockname)(
      _In_ SOCKET s,
      _Out_writes_bytes_to_(*namelen, *namelen) struct sockaddr FAR * name,
      _Inout_ int FAR * namelen
     );
   
    extern Getsockname real_getsockname;
   
    extern FARPROC real_getsockopt;
    typedef u_long (PASCAL FAR *HTONL_FUNC)(_In_ u_long hostlong);
   
    extern HTONL_FUNC real_htonl;
   
    typedef u_short (PASCAL FAR *HTONS_FUNC)( _In_ u_short hostshort);
   
    extern HTONS_FUNC real_htons;
   
    extern FARPROC real_ioctlsocket;
    extern FARPROC real_inet_addr;
    extern FARPROC real_inet_ntoa;
    extern FARPROC real_listen;
    extern FARPROC real_ntohl;
    extern FARPROC real_ntohs;
   2）从真实的ws2_32.dll中获取真实的函数地址（部分）：
   BOOL APIENTRY DllMain( HANDLE hModule,
                          DWORD  ul_reason_for_call,
                          LPVOID lpReserved
         )
   {
       switch (ul_reason_for_call)
    {
     case DLL_PROCESS_ATTACH:
    g_hMod = LoadLibrary(_T("real_ws2_32.dll"));
    real_accept = GetProcAddress(g_hMod, "accept");
    real_bind = (Bind)GetProcAddress(g_hMod, "bind");
    real_closesocket = (CLOSESOCKET_FUNC)GetProcAddress(g_hMod, "closesocket");
    real_connect = (Connect)GetProcAddress(g_hMod, "connect");
    real_getpeername = (Getpeername)GetProcAddress(g_hMod, "getpeername");
    real_getsockname = (Getsockname)GetProcAddress(g_hMod, "getsockname");
    real_getsockopt = GetProcAddress(g_hMod, "getsockopt");
    real_htonl = (HTONL_FUNC)GetProcAddress(g_hMod, "htonl");
    real_htons = (HTONS_FUNC)GetProcAddress(g_hMod, "htons");
    real_ioctlsocket = GetProcAddress(g_hMod, "ioctlsocket");
    real_inet_addr = GetProcAddress(g_hMod, "inet_addr");
    real_inet_ntoa = GetProcAddress(g_hMod, "inet_ntoa");
    real_listen = GetProcAddress(g_hMod, "listen");
    real_ntohl = GetProcAddress(g_hMod, "ntohl");
    real_ntohs = GetProcAddress(g_hMod, "ntohs");
    real_recv = (Recv)GetProcAddress(g_hMod, "recv");
    real_recvfrom = (Recvfrom)GetProcAddress(g_hMod, "recvfrom");
    real_select = GetProcAddress(g_hMod, "select");
    real_send = (Send)GetProcAddress(g_hMod, "send");
    real_sendto = (Sendto)GetProcAddress(g_hMod, "sendto");
    ......中间还有好多
    GetModuleFileNameA(NULL, name, 260);
    AnsiLower(name);
    if ((strstr(name, "某某某.exe"))  && g_pMsgTransmitor == nullptr)
    {
     g_bFuck = TRUE;
     //g_pMsgTransmitor = new CMsgTransmitor(); 后来发现在dll一加载的时候创建线程游戏程序会死掉，改在socket函数里了
     //g_pMsgTransmitor->Start();
    }
       
   3）需要截获的函数：
    SOCKET PASCAL FAR socket(
     _In_ int af,
     _In_ int type,
     _In_ int protocol
     )
    {
     if (g_bFuck && g_pSopRulerManager == NULL)
     {  
      //创建过滤规则管理器，过滤管理是用的共享内存，在消息查看程序中创建共享内存，并设置过滤条件
      g_pSopRulerManager = new CStopRulerManager();
      if (g_pSopRulerManager->OpenMap())
      {
       //创建消息转发器，消息转发器会创建一个socket连接，连接到我的消息查看程序，并管理一个消息队列
       //并创建两个线程，一个线程轮询消息队列，，将消息发送到消息查看程序，一个线程读取消息查看程序发来的指令，比如过滤掉一些Ip,端口
       g_pMsgTransmitor = new CMsgTransmitor();
       g_pMsgTransmitor->Start();
      }  
     }
    
     //调用真正的socket函数
     SOCKET s =  real_socket(af, type, protocol);
     
     //原本我想用getsockname,getpeername来获取套接字的本地和远程IP、端口信息，后来发现该调用会导致recv失败，0x2733错误，
     //后来采用这个方法：自己管理一个套接字队列，包含了套接字与IP、端口的对应信息，分别在bind和connect时候将本地地址、远程地址保存起来
     //要发送给消息查看程序的时候一并处理
     if (s > 0) g_socketManager.Add(s, NULL, NULL); //向套接字管理器中添加一个套接字
     
     //将这条事件压进消息队列
     if (g_pMsgTransmitor) g_pMsgTransmitor->PushCreateSocketMsg(s, type, protocol);
     
     return s;
    }
    
    int PASCAL FAR bind(
     _In_ SOCKET s,
     _In_reads_bytes_(namelen) const struct sockaddr FAR * name,
     _In_ int namelen
    )
    {
     int rt = 0;
    
     rt = real_bind(s, name, namelen);
     if (g_bFuck && rt == 0 )
     {
      g_socketManager.Add(s, (struct sockaddr_in*)name, NULL); //设置套接字本地地址
     }
     return rt;
    }
    
    int PASCAL FAR closesocket(SOCKET s)
   {
    int ret = real_closesocket(s);
   
    g_socketManager.Delete(s); //删除一个套接字
   
    if (g_pMsgTransmitor != nullptr)
    {
     g_pMsgTransmitor->PushCloseSocketMsg(s);
    }
    return ret;
   }
   
   int
   PASCAL FAR connect(
    _In_ SOCKET s,
    _In_reads_bytes_(namelen) const struct sockaddr FAR * name,
    _In_ int namelen
    )
   {
    int  rt = real_connect(s, name, namelen);
    if (s > 0) g_socketManager.Add(s, NULL, (struct sockaddr_in*)name); //设置套接字远程地址
   
    if(g_pMsgTransmitor) g_pMsgTransmitor->PushConnectMsg(s, (struct sockaddr_in *)name);
    
    return rt;
   }
    
    4）不需要截获的函数（部分），由于vs2015不支持嵌套汇编，所以研究半天，直接用纯汇编加asm文件：
    .code
   
    real_accept PROTO C : vararg ;这句是声明有一个函数/过程real_accept在别处已经定义了
    accept PROC
     jmp qword ptr [real_accept] ;一开始，我直接用jmp real_accept,调试发现跳不对，的查看原始ws2_32.dll汇编代码后，发现它的跳转是这样的，改过来之后就成功了
    accept ENDP
    
    ;real_bind PROTO C : vararg
    ;bind PROC
    ; jmp qword ptr [real_bind]
    ;bind ENDP
    
    ;real_closesocket PROTO C : vararg
    ;closesocket PROC
    ; jmp qword ptr [real_closesocket]
    ;closesocket ENDP
    
    ;real_connect PROTO C : vararg
    ;connect PROC
    ; jmp qword ptr [real_connect]
    ;connect ENDP
    
    real_getpeername PROTO C : vararg
    getpeername PROC
     jmp qword ptr [real_getpeername]
    getpeername ENDP
    
    real_getsockname PROTO C : vararg
    getsockname PROC
     jmp qword ptr [real_getsockname]
    getsockname ENDP
    
    real_getsockopt PROTO C : vararg
    getsockopt PROC
     jmp qword ptr [real_getsockopt]
    getsockopt ENDP
    
    real_htonl PROTO C : vararg
    htonl PROC
     jmp qword ptr [real_htonl]
    htonl ENDP
     
    5）消息转发：
    
    //工作线程
    void CMsgTransmitor::_WorkThread()
   {
    static unsigned int timetickt = 0;
    
    //printf("工作线程启动成功!");
    while (WAIT_TIMEOUT == WaitForSingleObject(m_hWorkEndEvent, 20) && m_bRun)
    {
     ++timetickt;
   
     if (timetickt % 500 == 0)
     {
      SendHeart();
      //保持连接  
      if (!m_bConnected  && m_bRun)
      {
       if (!_ConnectToServer())
       {
        ClearMsg();
       }
      }
      continue;
     }
    
     
     Msg_t * pMsg = _PopMsg();  
     while (pMsg) {
      _SendMsg(pMsg, pMsg->head.len);
      delete pMsg;
      pMsg = _PopMsg();
     }
     
     
    } 
   }
   
   BOOL CMsgTransmitor::_SendMsg(void *data, int len)
   { 
    return m_tcp.WriteBytes((char*)data, len);
   }
   
   void CMsgTransmitor::_PushMsg(Msg_t * pMsg)
   {
    EnterCriticalSection(&m_csSend);
    m_lstSend.push_back(pMsg);
    LeaveCriticalSection(&m_csSend);
   }
   
   Msg_t * CMsgTransmitor::_PopMsg()
   {
    Msg_t *pMsg = NULL;
    
    if (m_lstSend.size() > 0)
    {  
     MsgList::iterator it;
     EnterCriticalSection(&m_csSend);
     it = m_lstSend.begin();
     if (it != m_lstSend.end())
     {
      pMsg = *it;
      m_lstSend.erase(it);
     }
     LeaveCriticalSection(&m_csSend);
    }
    return pMsg;
   }
   
   void CMsgTransmitor::PushCreateSocketMsg(SOCKET s, int type, int protol)
   {
    if (m_bNeedToTransmit )
    {
     MsgCreateSocket_t *pMsg = new MsgCreateSocket_t(s, type, protol, GetLastError());
     //_SendMsg(&Msg, Msg.head.len);
     
     _PushMsg(pMsg);
    }
   }
   
   6）消息定义（部分）：
   typedef struct _MSG_HEAD
   {
    int flag;   //消息头标识
    unsigned int len; //消息体长度
    int   type; //消息类型
   }MsgHead_t;
   
   typedef struct _ST_MSG
   {
    MsgHead_t head;
   }Msg_t;
   
   typedef struct _SOCKET_INFO
   {
    unsigned int sock;
    int type;
    int protol;
    time_t tm;
    struct sockaddr_in localAddr;
    struct sockaddr_in remoteAddr;
    DWORD nError;   //错误码
    _SOCKET_INFO & operator=(const _SOCKET_INFO &info)
    {
     memcpy(this, &info, sizeof(_SOCKET_INFO));
     return *this;
    }
   }SocketInfo_t;
   
   
   typedef struct _MSG_CREAT_SOCKET :public _ST_MSG
   {
    SocketInfo_t socketInfo;
    _MSG_CREAT_SOCKET()
    {
     head.flag = MSG_FLAG;
     head.len = sizeof(*this);
     head.type = MsgType_CreateSocket;
   
     socketInfo.sock = -1;
     socketInfo.type = -1;
     socketInfo.protol = -1;
   
     ZeroMemory(&socketInfo.localAddr, sizeof(socketInfo.localAddr));
     ZeroMemory(&socketInfo.remoteAddr, sizeof(socketInfo.remoteAddr));
    }
   
    _MSG_CREAT_SOCKET(unsigned int s, int t, int p, DWORD nerr)
    {
     head.flag = MSG_FLAG;
     head.len = sizeof(*this);
     head.type = MsgType_CreateSocket;
     socketInfo.sock = s;
     socketInfo.type = t;
     socketInfo.protol = p;
     socketInfo.nError = nerr;
     socketInfo.tm = time(NULL);
   
     ZeroMemory(&socketInfo.localAddr, sizeof(socketInfo.localAddr));
     ZeroMemory(&socketInfo.remoteAddr, sizeof(socketInfo.remoteAddr));
     
    }
   }MsgCreateSocket_t;
   
   typedef struct _MSG_SEND :public _ST_MSG
   {
    SocketInfo_t socketInfo;
    int  nLenRequst;  //请求长度
    int  nLenCompleted; //完成长度 
    char  data[1];
   
   private:
    _MSG_SEND()
    {
   
    }
    void init(int len)
    {
     head.flag = MSG_FLAG;
     head.len = len;
     head.type = MsgType_Send;
    }
   public:
    static _MSG_SEND *Create(SOCKET s, void *pData, int lenToSend, int lenSended, DWORD nerr)
    {
     int msg_len = sizeof(_MSG_SEND) + lenToSend - 1;
     _MSG_SEND *pMsg = (_MSG_SEND*)new char[msg_len];
   
     if (pMsg != nullptr) {
      pMsg->init(msg_len);
      pMsg->nLenRequst = lenToSend;
      pMsg->nLenCompleted = lenSended;
      pMsg->socketInfo.sock = s;
      pMsg->socketInfo.nError = nerr;
      pMsg->socketInfo.tm = time(NULL);
   
      GetSocketManager().Get(s, &pMsg->socketInfo.localAddr, &pMsg->socketInfo.remoteAddr);
   
      memcpy_s(pMsg->data, lenToSend, pData, lenToSend);
      return pMsg;
     }
     return nullptr;
    }
   }MsgSend_t;
   
   7）消息查看程序就不说了，界面就是MFC dialog，通信是用的完成端口，主要用的以前项目的现在代码

  用深度工具制作U盘启动，进入PE系统，将原版ws2_32.dll（注意，system32下的为64位，也是我想要的，32位版本在wow64里面）改名为real_ws2_32.dll，然后将自己的重命名为ws2_32.dll放在system32目录下。
   效果就是这样：

下一楼接着追踪数据加密。