Question

所以我有WSASend绕道而行，当然可以调用它让一切正常工作，但有些数据包（在我分析之后）我想阻止被发送，所以我不能调用原来的功能。无论我返回什么，调用代码似乎都知道出了问题。

当一切正常时，WSASend应该返回0。具有讽刺意味的是，如果我在尝试阻止时只返回0，则调用代码似乎在等待某些东西，使所有连接延迟并最终关闭。

代码：

int WINAPI myWSASend(SOCKET s, LPWSABUF lpBuffers, DWORD dwBufferCount, LPDWORD lpNumberOfBytesSent, DWORD dwFlags, LPWSAOVERLAPPED lpOverlapped, LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine)
{
    if(lpBuffers->buf[2] == 0x66 && lpBuffers->buf[3] == 0x78)
    {
        FILE *fp = fopen("party_sploit.txt", "a");
        fprintf(fp, "0x7866 catched! len: %lu\n", lpBuffers->len);
        for (unsigned int i = 0; i < lpBuffers->len-8; i = i + 8)
        {
            fprintf(fp,
                "%02X %02X %02X %02X %02X %02X %02X %02X"
                  "\t\t%c %c %c %c %c %c %c %c\n",

                static_cast<unsigned char>(lpBuffers->buf[i]),
                static_cast<unsigned char>(lpBuffers->buf[i+1]),
                static_cast<unsigned char>(lpBuffers->buf[i+2]),
                static_cast<unsigned char>(lpBuffers->buf[i+3]),
                static_cast<unsigned char>(lpBuffers->buf[i+4]),
                static_cast<unsigned char>(lpBuffers->buf[i+5]),
                static_cast<unsigned char>(lpBuffers->buf[i+6]),
                static_cast<unsigned char>(lpBuffers->buf[i+7]),
                (drawable(lpBuffers->buf[i]))   ? static_cast<unsigned char>(lpBuffers->buf[i])   : '.',
                (drawable(lpBuffers->buf[i+1])) ? static_cast<unsigned char>(lpBuffers->buf[i+1]) : '.',
                (drawable(lpBuffers->buf[i+2])) ? static_cast<unsigned char>(lpBuffers->buf[i+2]) : '.',
                (drawable(lpBuffers->buf[i+3])) ? static_cast<unsigned char>(lpBuffers->buf[i+3]) : '.',
                (drawable(lpBuffers->buf[i+4])) ? static_cast<unsigned char>(lpBuffers->buf[i+4]) : '.',
                (drawable(lpBuffers->buf[i+5])) ? static_cast<unsigned char>(lpBuffers->buf[i+5]) : '.',
                (drawable(lpBuffers->buf[i+6])) ? static_cast<unsigned char>(lpBuffers->buf[i+6]) : '.',
                (drawable(lpBuffers->buf[i+7])) ? static_cast<unsigned char>(lpBuffers->buf[i+7]) : '.'
            );
        }
        fprintf(fp, "\n-------------------------------------------------------------------\n");
        fclose(fp);
        if(lpBuffers->len < 26)
        {
            lpNumberOfBytesSent = (LPDWORD)lpBuffers->len;
            return 0;
        }
        else
        {
            return (oWSASend)(s, lpBuffers, dwBufferCount, lpNumberOfBytesSent, dwFlags, lpOverlapped, lpCompletionRoutine);
        }
    }
    else
    {
        //No filtered packet recieved, proceed
        return (oWSASend)(s, lpBuffers, dwBufferCount, lpNumberOfBytesSent, dwFlags, lpOverlapped, lpCompletionRoutine);
    }
}

Answer 1

答案其实很简单......我忘了取消引用字节数发送指针，出于安全原因我还添加了一个if-not-null

if(lpBuffers->len != NULL && lpBuffers->len < 26)
{
    *lpNumberOfBytesSent = lpBuffers->len;
    return 0;
}
else
{
    return (oWSASend)(s, lpBuffers, dwBufferCount, lpNumberOfBytesSent, dwFlags, lpOverlapped, lpCompletionRoutine);
}

在绕道的WSASend中阻塞数据包

1 个答案: