Question

我正在玩一些弯路和功能挂钩，我遇到了以下代码的奇怪问题：

基本上发生的事情是DetourTransactionCommit（）都成功了，但实际上只挂了recv（）函数，而发送不是，如

OutputDebugStringA（“已发送数据包！”）;

永远不会触发

#include "stdafx.h"
#include "stdio.h"
#include "WinInet.h"
#include "tchar.h"
#include "windows.h"
#include "detours.h"
#include <Winsock2.h>
#include <WS2tcpip.h>
#include <crtdbg.h>

#pragma comment(lib, "detours.lib")
#pragma comment(lib, "WinInet.lib")
#pragma comment(lib, "ws2_32.lib")

int (WINAPI *pSend)(SOCKET s, const char* buf, int len, int flags) = send;
int WINAPI MySend(SOCKET s, const char* buf, int len, int flags);

int (WINAPI *pRecv)(SOCKET s, char* buf, int len, int flags) = recv;
int WINAPI MyRecv(SOCKET s, char* buf, int len, int flags);


BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    LONG errore;

    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:

        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)pSend, MySend);
        if (DetourTransactionCommit() == NO_ERROR) {
            OutputDebugStringA("Send function hooked successfully");
        }
        else{
            OutputDebugStringA("Failed to hook Send function");
        }

        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)pRecv, MyRecv);
        if (DetourTransactionCommit() == NO_ERROR) {
            OutputDebugStringA("Recv function hooked successfully");
        }
        else{
            OutputDebugStringA("Failed to hook Recv function");
        }

    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }

    return TRUE;
}

int WINAPI MySend(SOCKET s, const char* buf, int len, int flags) {
    OutputDebugStringA("Sent packet!");
    return pSend(s, buf, len, flags);
}

int WINAPI MyRecv(SOCKET s, char* buf, int len, int flags) {
    OutputDebugStringA("Received packet!");
    return pRecv(s, buf, len, flags);
}

更新：显然，该函数的问题与我试图将DLL注入的过程有关。看起来试图在Internet Explorer 11 x86中挂起send（）失败的原因我仍然需要弄清楚。我尝试使用winsock2（putty）将完全相同的DLL注入另一个程序，并且该函数被正确连接。

也许有人知道发生这种情况的原因？

Answer 1

正如Ben Voigt指出的那样，显然send（）并未在Internet Explorer 11中调用。我尝试过挂钩WSASend()，但它确实有效。

编辑的工作资讯是如下：

    #include "stdafx.h"
    #include "stdio.h"
    #include "WinInet.h"
    #include "tchar.h"
    #include "windows.h"
    #include "detours.h"
    #include <Winsock2.h>
    #include <WS2tcpip.h>
    #include <crtdbg.h>

    #pragma comment(lib, "detours.lib")
    #pragma comment(lib, "WinInet.lib")
    #pragma comment(lib, "ws2_32.lib")

int(WINAPI *pWSASend) (
    SOCKET s, 
    LPWSABUF lpBuffers, 
    DWORD dwBufferCount, 
    LPDWORD lpNumberOfBytesSent, 
    DWORD dwFlags, 
    LPWSAOVERLAPPED lpOverlapped, 
    LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine) = WSASend;

int WINAPI MyWSASend(
    SOCKET s,
    LPWSABUF lpBuffers,
    DWORD dwBufferCount,
    LPDWORD lpNumberOfBytesSent,
    DWORD dwFlags,
    LPWSAOVERLAPPED lpOverlapped,
    LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine);


int (WINAPI *pRecv)(SOCKET s, char* buf, int len, int flags) = recv;
int WINAPI MyRecv(SOCKET s, char* buf, int len, int flags);


BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    LONG errore;

    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:

        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)pWSASend, MyWSASend);
        if (DetourTransactionCommit() == NO_ERROR) {
            OutputDebugStringA("Send function hooked successfully");
        }
        else{
            OutputDebugStringA("Failed to hook Send function");
        }

        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)pRecv, MyRecv);
        if (DetourTransactionCommit() == NO_ERROR) {
            OutputDebugStringA("Recv function hooked successfully");
        }
        else{
            OutputDebugStringA("Failed to hook Recv function");
        }

    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }

    return TRUE;
}

int WINAPI MyWSASend(
    SOCKET s,
    LPWSABUF lpBuffers,
    DWORD dwBufferCount,
    LPDWORD lpNumberOfBytesSent,
    DWORD dwFlags,
    LPWSAOVERLAPPED lpOverlapped,
    LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine)
{
    OutputDebugStringA("Packet Sent!");
    return (pWSASend)(s, lpBuffers, dwBufferCount, lpNumberOfBytesSent, dwFlags, lpOverlapped, lpCompletionRoutine);
};
int WINAPI MyRecv(SOCKET s, char* buf, int len, int flags) {
    OutputDebugStringA("Received packet!");
    return pRecv(s, buf, len, flags);
}

函数钩子只挂钩recv（）而不是使用绕道发送（）

1 个答案: