使用 detour 仅挂钩 recv() 而不是 send() 的函数答案

【问题标题】：Functions hooking only hooks recv() and not send() using detour使用 detour 仅挂钩 recv() 而不是 send() 的函数
【发布时间】：2014-06-21 20:32:59
【问题描述】：

我在玩一些弯路和函数挂钩，我对以下代码有一个奇怪的问题：

基本上发生的情况是 DetourTransactionCommit() 都成功了，但实际上只有 recv() 函数被钩住了，而 send 没有，因为

OutputDebugStringA("发送数据包！");

从不触发

#include "stdafx.h"
#include "stdio.h"
#include "WinInet.h"
#include "tchar.h"
#include "windows.h"
#include "detours.h"
#include <Winsock2.h>
#include <WS2tcpip.h>
#include <crtdbg.h>

#pragma comment(lib, "detours.lib")
#pragma comment(lib, "WinInet.lib")
#pragma comment(lib, "ws2_32.lib")

int (WINAPI *pSend)(SOCKET s, const char* buf, int len, int flags) = send;
int WINAPI MySend(SOCKET s, const char* buf, int len, int flags);

int (WINAPI *pRecv)(SOCKET s, char* buf, int len, int flags) = recv;
int WINAPI MyRecv(SOCKET s, char* buf, int len, int flags);


BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    LONG errore;

    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:

        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)pSend, MySend);
        if (DetourTransactionCommit() == NO_ERROR) {
            OutputDebugStringA("Send function hooked successfully");
        }
        else{
            OutputDebugStringA("Failed to hook Send function");
        }

        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)pRecv, MyRecv);
        if (DetourTransactionCommit() == NO_ERROR) {
            OutputDebugStringA("Recv function hooked successfully");
        }
        else{
            OutputDebugStringA("Failed to hook Recv function");
        }

    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }

    return TRUE;
}

int WINAPI MySend(SOCKET s, const char* buf, int len, int flags) {
    OutputDebugStringA("Sent packet!");
    return pSend(s, buf, len, flags);
}

int WINAPI MyRecv(SOCKET s, char* buf, int len, int flags) {
    OutputDebugStringA("Received packet!");
    return pRecv(s, buf, len, flags);
}

更新：显然，该函数的问题与我试图将 DLL 注入的进程有关。看起来尝试在 Internet Explorer 11 x86 中挂钩 send() 失败，原因我仍然需要弄清楚。我尝试使用 winsock2 (putty) 将完全相同的 DLL 注入另一个程序，并且该函数已正确挂钩。

也许有人知道发生这种情况的原因吗？

【问题讨论】：

也许钩子永远不会运行，因为send() 永远不会被调用？还有WSASend，WSASendMsg，...许多不同的方式写入套接字。
难道WSASend* 函数不会在后台调用send 吗？
很高兴看看你的迂回功能做了什么。
Ben 是对的，显然 Internet Explorer 11 从未调用过 send()，我尝试过挂钩 WSASend() 并成功挂钩。

标签： c winapi

【解决方案1】：

正如 Ben Voigt 所指出的，显然 send() 在 Internet Explorer 11 中没有被调用。我试过钩住WSASend()，它成功了。

编辑后的工作片段如下：

    #include "stdafx.h"
    #include "stdio.h"
    #include "WinInet.h"
    #include "tchar.h"
    #include "windows.h"
    #include "detours.h"
    #include <Winsock2.h>
    #include <WS2tcpip.h>
    #include <crtdbg.h>

    #pragma comment(lib, "detours.lib")
    #pragma comment(lib, "WinInet.lib")
    #pragma comment(lib, "ws2_32.lib")

int(WINAPI *pWSASend) (
    SOCKET s, 
    LPWSABUF lpBuffers, 
    DWORD dwBufferCount, 
    LPDWORD lpNumberOfBytesSent, 
    DWORD dwFlags, 
    LPWSAOVERLAPPED lpOverlapped, 
    LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine) = WSASend;

int WINAPI MyWSASend(
    SOCKET s,
    LPWSABUF lpBuffers,
    DWORD dwBufferCount,
    LPDWORD lpNumberOfBytesSent,
    DWORD dwFlags,
    LPWSAOVERLAPPED lpOverlapped,
    LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine);


int (WINAPI *pRecv)(SOCKET s, char* buf, int len, int flags) = recv;
int WINAPI MyRecv(SOCKET s, char* buf, int len, int flags);


BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    LONG errore;

    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:

        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)pWSASend, MyWSASend);
        if (DetourTransactionCommit() == NO_ERROR) {
            OutputDebugStringA("Send function hooked successfully");
        }
        else{
            OutputDebugStringA("Failed to hook Send function");
        }

        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)pRecv, MyRecv);
        if (DetourTransactionCommit() == NO_ERROR) {
            OutputDebugStringA("Recv function hooked successfully");
        }
        else{
            OutputDebugStringA("Failed to hook Recv function");
        }

    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }

    return TRUE;
}

int WINAPI MyWSASend(
    SOCKET s,
    LPWSABUF lpBuffers,
    DWORD dwBufferCount,
    LPDWORD lpNumberOfBytesSent,
    DWORD dwFlags,
    LPWSAOVERLAPPED lpOverlapped,
    LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine)
{
    OutputDebugStringA("Packet Sent!");
    return (pWSASend)(s, lpBuffers, dwBufferCount, lpNumberOfBytesSent, dwFlags, lpOverlapped, lpCompletionRoutine);
};
int WINAPI MyRecv(SOCKET s, char* buf, int len, int flags) {
    OutputDebugStringA("Received packet!");
    return pRecv(s, buf, len, flags);
}

【讨论】：