easyHOOK socket send recv
代码比较简单,就不做注释了。 包含一个sockethookinject.DLL 和sockethook.exe
有一点不清楚,
SetExclusiveACL可以添加当前线程的hook, 但是easyhook如何 detach dll 并且释放hook呢? 知道的大神麻烦告知一下。
public class SocketInterFace : MarshalByRefObject { public delegate void LogArgsHander(BufferStruct argsbuffer); public static event LogArgsHander logEvent; public void IsInstalled(Int32 InClientPID) { Console.WriteLine("FileMon has been installed in target {0}.\r\n", InClientPID); } public void OnRecv(byte[] RecvBuffer, int LoginIndex, int LoginIndexEx) { BufferStruct BufferArgs = new BufferStruct(); BufferArgs.Buffer = RecvBuffer; BufferArgs.BufferSize = RecvBuffer.Length; BufferArgs.ObjectType = "recv"; OnLog(BufferArgs); } public void OnSend(byte[] RecvBuffer, int LoginIndex, int LoginIndexEx) { BufferStruct BufferArgs = new BufferStruct(); BufferArgs.Buffer = RecvBuffer; BufferArgs.BufferSize = RecvBuffer.Length; BufferArgs.ObjectType = "send"; OnLog(BufferArgs); } public void OnLog(string BufferArgs) { Console.WriteLine(BufferArgs); } public void OnLog(BufferStruct buf) { if (logEvent!=null) { logEvent(buf); } } public struct BufferStruct { /// <summary> /// Socket指针 /// </summary> public IntPtr sockHander; /// <summary> /// 封包数据 /// </summary> public byte[] Buffer; /// <summary> /// 封包大小 /// </summary> public int BufferSize; /// <summary> /// 封包动态序列 /// </summary> public int[] LoginIdent; /// <summary> /// send recv /// </summary> public string ObjectType; } }
public partial class Form1 : Form { public Form1() { InitializeComponent(); SocketInterFace.logEvent += new SocketInterFace.LogArgsHander(MainSend); if (!EasyHook.RemoteHooking.IsAdministrator) MessageBox.Show("请用管理员方式启动"); } public void MainSend(socketHook.SocketInterFace.BufferStruct buff) { Console.WriteLine(string.Format("长度:{0} 类型:{2}\r\n 内容:{1}", buff.BufferSize, byteToHexStr(buff.Buffer, buff.BufferSize),buff.ObjectType)); } public static string byteToHexStr(byte[] bytes, int byteLen) { string returnStr = ""; if (bytes != null) { for (int i = 0; i < byteLen; i++) { returnStr += bytes[i].ToString("X2"); } } return returnStr; } string ChannelName = null; private void button1_Click(object sender, EventArgs e) { try { EasyHook.Config.Register(".net远程注入组建", "socketHook.exe", "sockethookinject.dll"); } catch (Exception ex) { } int id=Process.GetProcessesByName("SupARC").First().Id; if (id != 0) { EasyHook.RemoteHooking.IpcCreateServer<SocketInterFace>(ref ChannelName, System.Runtime.Remoting.WellKnownObjectMode.SingleCall); EasyHook.RemoteHooking.Inject(id, "sockethookinject.dll", "sockethookinject.dll", ChannelName); } else { MessageBox.Show("ARC没有启动"); } } private void button2_Click(object sender, EventArgs e) { } }
public class Main : IEntryPoint { SocketInterFace Interface; Stack<String> Queue = new Stack<String>(); public Main(RemoteHooking.IContext InContext,string InChannelName) { Interface = RemoteHooking.IpcConnectClient<SocketInterFace>(InChannelName); Interface.OnLog("初始化HOOK成功"); } LocalHook RecvHook; LocalHook SendHook; int MyRecv(IntPtr socket, IntPtr buffer, int length, int flags) { int bytesCount = recv(socket, buffer, length, flags); if (bytesCount>0) { byte[] RecvBuffer = new byte[bytesCount]; Marshal.Copy(buffer, RecvBuffer, 0, RecvBuffer.Length); Interface.OnRecv(RecvBuffer, 0, 0); } return bytesCount; } int MySend(IntPtr socket, IntPtr buffer, int length, int flags) { int bytesCount = send(socket, buffer, length, flags); if (bytesCount > 0) { byte[] RecvBuffer = new byte[bytesCount]; Marshal.Copy(buffer, RecvBuffer, 0, RecvBuffer.Length); Interface.OnSend(RecvBuffer, 0, 0); } return bytesCount; } public void Run(RemoteHooking.IContext InContext,string InChannelName) { RecvHook = LocalHook.Create(LocalHook.GetProcAddress("WS2_32.dll", "recv"), new DRecv(MyRecv), this); SendHook = LocalHook.Create(LocalHook.GetProcAddress("WS2_32.dll", "send"), new DSend(MySend), this); SendHook.ThreadACL.SetExclusiveACL(new Int32[] { 0 }); RecvHook.ThreadACL.SetExclusiveACL(new Int32[] { 0 }); Interface.IsInstalled(RemoteHooking.GetCurrentProcessId()); dwProHwnd = OpenProcess(PROCESS_ALL_ACCESS, 0, RemoteHooking.GetCurrentProcessId()); //EasyHook.RemoteHooking.WakeUpProcess(); while (true) { Thread.Sleep(500); } } [DllImport("kernel32.dll", EntryPoint = "OpenProcess")] public static extern uint OpenProcess(uint dwDesiredAccess, int bInheritHandle, int dwProcessId); public const uint PROCESS_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xFFF); public const uint SYNCHRONIZE = 0x00100000; public const uint STANDARD_RIGHTS_REQUIRED = 0x000F0000; public uint dwProHwnd = 0; [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode, SetLastError = true)] delegate int DRecv(IntPtr socket, IntPtr buffer, int length, int flags); [DllImport("WS2_32.dll", CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)] static extern int recv(IntPtr socket, IntPtr buffer, int length, int flags); [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode, SetLastError = true)] delegate int DSend(IntPtr socket, IntPtr buffer, int length, int flags); [DllImport("WS2_32.dll", CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)] static extern int send(IntPtr socket, IntPtr buffer, int length, int flags); }