Question

是否可以在C＃中读取所选进程的传出数据包？如果是的话，我应该使用什么API？提前谢谢。

Answer 1

我假设您正在尝试执行与 WireShark 或 Winsock数据包编辑器类似的操作。

简短的回答是否。绝对没有内置功能的命名空间或程序集。

很长的答案是是的，但你必须弄得有点脏。你很可能不得不将 C ++ DLL 注入“侦察”它的过程。但是，您可以通过 C＃连接此 DLL ，并将您的界面全部放在 .NET 中。

您的第一步是创建 C ++ DLL ，这只需要一些导出：

bool InitialzeHook()
{
  // TODO: Patch the Import Address Table (IAT) to overwrite
  //       the address of Winsock's send/recv functions
  //       with your SpySend/SpyRecv ones instead.
}

bool UninitializeHook()
{
  // TODO: Restore the Import Address Table (IAT) to the way you found it.
}

// This function will be called instead of Winsock's recv function once hooked.
int SpySend(SOCKET s, const char *buf, int len, int flags)
{
  // TODO: Do something with the data to be sent, like logging it.

  // Call the real Winsock send function.
  int numberOfBytesSent = send(s, buf, len, flags);

  // Return back to the calling process.
  return numberOfBytesSent;
}

// This function will be called instead of Winsock's recv function once hooked.
int SpyRecv(SOCKET s, char *buf, int len, int flags)
{
  // Call the real Winsock recv function to get the data.
  int numberOfBytesReceived = recv(s, buf, len, flags);

  // TODO: Do something with the received data, like logging it.

  // Return back to the calling process.
  return numberOfBytesReceived;
}

这一切中最困难的部分是修补导入地址表（IAT）的功能。有关如何遍历它并在其中查找函数导入的各种资源。 提示：您必须通过序数修补 Winsock 导入，而不是名称。

结帐Inside the Windows PE Format (Part 2)和C++ Code Example。

完成所有操作后，您必须将您所做的 DLL 注入目标进程。这是 C ++ 伪造的代码（在我的脑海中）：

// Get the target window handle (if you don't have the process ID handy).
HWND hWnd = FindWindowA(NULL, "Your Target Window Name");

// Get the process ID from the target window handle.
DWORD processId = 0;
DWORD threadId = GetWindowThreadProcessId(hWnd, &processId);

// Open the process for reading/writing memory.
DWORD accessFlags = PROCESS_VM_OPERATION | 
                    PROCESS_VM_READ | 
                    PROCESS_VM_WRITE | 
                    PROCESS_QUERY_INFORMATION;

HANDLE hProcess = OpenProcess(accessFlags, false, processId);

// Get the base address for Kernel32.dll (always the same for each process).
HMODULE hKernel32 = GetModuleHandleA("kernel32");

// Get the address of LoadLibraryA (always the same for each process).
DWORD loadLibraryAddr = GetProcAddress(hKernel32, "LoadLibraryA");

// Allocate some space in the remote process and write the library string to it.
LPVOID libraryNameBuffer = VirtualAllocEx(hProcess, NULL, 256, 
                                          MEM_COMMIT | MEM_RESERVE,
                                          PAGE_EXECUTE_READWRITE);

LPCSTR libraryName = L"MySpyLibrary.dll\0";
DWORD numberOfBytesWritten = 0;
BOOL writeResult = WriteProcessMemory(hProcess, libraryNameBuffer,
                                                (LPCVOID)libraryName,
                                                strlen(libraryName) + 1,
                                                &numberOfBytesWritten);

// Create a thread in the remote process, using LoadLibraryA as the procedure,
// and the parameter is the library name we just wrote to the remote process.
DWORD remoteThreadId = 0;
HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, 0,
                                          (LPTHREAD_START_ROUTINE)loadLibraryAddr,
                                          libraryNameBuffer,
                                          0, &remotThreadId);

// Wait for our thread to complete and get the exit code (which is the return value).
DWORD loadedLibraryAddr = 0;
BOOL waitResult = WaitForSingleObject(hRemoteThread, INFINITE); 
BOOL exitResult = GetExitCodeThread(hRemoteThread, &loadedLibraryAddr);

// TODO: Check that it was loaded properly
// if(lodadedLibraryAddr == NULL) { ... }

// Cleanup our loose ends here.
VirtualFreeEx(hProcess, libraryNameBuffer, 256, MEM_RELEASE);
CloseHandle(hRemoteThread);
CloseHandle(hProcess);

您可以通过 C＃平台调用（pInvoke）执行相同的操作。由您决定如何记录数据并将数据传回 C＃监控程序。您可以在 C＃中使用Named Pipes，NamedPipeClientStream等进程间通信。

然而，这将会做到这一点，美妙的部分是它几乎适用于任何程序。同样的技术可以应用于任何类型的嗅探，而不仅仅是 Winsock 。

Answer 2

当然你可以......但是只有当进程对它的监听器有一个“公共挂钩”时。否则，您将不得不创建一个嗅探器：调试可执行文件，查找套接字发送缓冲区的偏移量并将读取器挂钩。通过类似防火墙的应用程序更容易实现。

Answer 3

您可以使用TPL数据流来执行此操作。

读取所选进程的传出数据包

3 个答案: