Hook inet_addr or connect 实现ip转向

以前通常用修改hosts文件的方法,实现验证地址修改,但直接使用ip或dns查询代码的软件,修改hosts是无效的。
通过调试,发现某个软件请求验证前调用了inet_addr转换ip地址,通过hook inet_addr函数,实现了ip替换,网络验证转为本地验证。

unit APIHook;

interface

uses
SysUtils,
Windows, WinSock;

type

TSockProc =function (cp: PChar): DWord; stdcall;

PJmpCode = ^TJmpCode;
TJmpCode = packed record
JmpCode: BYTE;
Address: TSockProc;
MovEAX: Array [0..2] of BYTE;
end;

procedure HookAPI;
procedure UnHookAPI;

var
Oldinet_addr: TSockProc;
JmpCode: TJmpCode;
OldProc: array [0..1] of TJmpCode;
Addinet_addr: pointer; //API地址
TmpJmp: TJmpCode;
ProcessHandle: THandle;
implementation

{---------------------------------------}
{函数功能:inet_addr函数的HOOK
{函数参数:同inet_addr
{函数返回值:DWord
{---------------------------------------}

function Myinet_addr(cp: PChar): DWord; stdcall;
begin
if cp= '121.14.34.50' then //原验证地址
begin

cp:=pchar('127.0.0.1'); //替换ip

end;

WriteProcessMemory(ProcessHandle, Addinet_addr, @OldProc[0], 8, dwSize);
Result := Oldinet_addr(cp);
JmpCode.Address := @Myinet_addr;
WriteProcessMemory(ProcessHandle, Addinet_addr, @JmpCode, 8, dwSize);
end;

{------------------------------------}
{过程功能:HookAPI
{过程参数:无
{------------------------------------}
procedure HookAPI;
var
DLLModule: THandle;
dwSize: cardinal;
begin
ProcessHandle := GetCurrentProcess;
DLLModule := LoadLibrary('ws2_32.dll');
Addinet_addr := GetProcAddress(DLLModule, 'inet_addr'); //取得API地址
JmpCode.JmpCode := $B8;
JmpCode.MovEAX[0] := $FF;
JmpCode.MovEAX[1] := $E0;
JmpCode.MovEAX[2] := 0;
ReadProcessMemory(ProcessHandle, Addinet_addr, @OldProc[0], 8, dwSize);
JmpCode.Address := @Myinet_addr;
WriteProcessMemory(ProcessHandle, Addinet_addr, @JmpCode, 8, dwSize); //修改inet_addr入口
Oldinet_addr := Addinet_addr;
end;

{------------------------------------}
{过程功能:取消HOOKAPI
{过程参数:无
{------------------------------------}
procedure UnHookAPI;
var
dwSize: Cardinal;
begin
WriteProcessMemory(ProcessHandle, Addinet_addr, @OldProc[0], 8, dwSize);
end;

end.

调用

procedure TForm1.Button1Click(Sender: TObject);
var
ModuleHandle: THandle;
TmpWndHandle: THandle;
begin
TmpWndHandle := FindWindow(pchar('WindowsForms10.Window.8.app.0.378734a'), nil); //目标程序窗口
if not isWindow(TmpWndHandle) then
begin
MessageBox(self.Handle, '没有找到窗口', '!!!', MB_OK);
exit;
end;
ModuleHandle := LoadLibrary('Hook.dll');
@InstallHook := GetProcAddress(ModuleHandle, 'InstallHook');
@UnHook := GetProcAddress(ModuleHandle, 'UnHook');
if InstallHook(TmpWndHandle) then
ShowMessage('Hook OK');
end;

也可以hook connect函数实现ip转向

function MyConnect(s:TSocket;var sa:TSockAddr;len:integer):integer;stdcall;
var dwSize: cardinal;
begin
if sa.sin_port=htons(6666) then //符合条件,处理
begin
sa.sin_addr.S_addr:=Inet_addr('127.0.0.1'); //这儿连接转向
end;
WriteProcessMemory(ProcessHandle, NewConn, @OldConnProc, 8, dwSize);
Result:=OldConn(s,sa,len);
JmpConnCode.Address:=@MyConnect;
WriteProcessMemory(ProcessHandle, NewConn, @JmpConnCode, 8, dwSize);
end;

### 回答1: C语言中,hook发包函数的核心代码如下所示: ```c #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #include <unistd.h> // 发送包的函数 void sendPacket(const char *ip, int port, const char *packetData, int packetSize) { int sockfd; struct sockaddr_in target; memset(&target, 0, sizeof(struct sockaddr_in)); // 创建socket if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { perror("Failed to create socket"); exit(1); } // 设置目标IP和端口 target.sin_family = AF_INET; target.sin_port = htons(port); if (inet_pton(AF_INET, ip, &(target.sin_addr)) <= 0) { perror("Invalid target IP"); exit(1); } // 连接到目标主机 if (connect(sockfd, (struct sockaddr *)&target, sizeof(target)) < 0) { perror("Failed to connect"); exit(1); } // 发送包 if (send(sockfd, packetData, packetSize, 0) < 0) { perror("Failed to send packet"); exit(1); } // 关闭socket close(sockfd); } int main() { const char *ip = "127.0.0.1"; // 目标IP int port = 8080; // 目标端口 const char *packet = "Hello, World!"; // 发送的包内容 int packetSize = strlen(packet); // 发送的包大小 sendPacket(ip, port, packet, packetSize); return 0; } ``` 以上是一个简单的hook发包函数的核心代码,其中使用了C语言的socket库函数来实现发送包的功能。首先创建一个socket,然后设置目标主机的IP和端口,接着连接到目标主机并发送包。最后关闭socket。这段代码可以根据实际需求进行修改和扩展,例如可以添加错误处理和多线程等功能。 ### 回答2: C hook发包函数的核心代码如下所示: ```c #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> int send_packet(char* target_ip, int target_port, char* packet_data, int packet_size) { int sockfd; struct sockaddr_in target_addr; // 创建socket sockfd = socket(AF_INET, SOCK_STREAM, 0); if (sockfd < 0) { printf("Error creating socket\n"); return -1; } // 设置目标地址 target_addr.sin_family = AF_INET; target_addr.sin_port = htons(target_port); target_addr.sin_addr.s_addr = inet_addr(target_ip); // 连接到目标主机 if (connect(sockfd, (struct sockaddr*)&target_addr, sizeof(target_addr)) < 0) { printf("Error connecting to target host\n"); close(sockfd); return -1; } // 发送数据包 if (send(sockfd, packet_data, packet_size, 0) < 0) { printf("Error sending packet\n"); close(sockfd); return -1; } // 关闭socket close(sockfd); return 0; } int main() { char* target_ip = "192.168.1.100"; // 目标IP地址 int target_port = 8080; // 目标端口号 char packet_data[] = "Hello, World!"; // 数据包内容 int packet_size = sizeof(packet_data); // 数据包大小 int result = send_packet(target_ip, target_port, packet_data, packet_size); if (result == 0) { printf("Packet sent successfully\n"); } else { printf("Failed to send packet\n"); } return 0; } ``` 以上是一个简单的C语言程序,通过创建socket,连接到目标主机,并发送指定的数据包。其中,`send_packet()` 函数是核心的发包函数,它接受目标主机的IP地址、端口号,以及数据包内容和大小作为参数,并返回发送结果。在 `main()` 函数中调用 `send_packet()` 函数来发送数据包。最后通过判断返回值来判断是否发送成功,并打印相应的信息。 ### 回答3: C hook 发包函数的核心代码如下: ```c #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/socket.h> #include <netinet/in.h> #include <netinet/ip.h> #include <netinet/ip_icmp.h> #define PACKETSIZE 64 // 计算校验和 unsigned short checksum(void *b, int len) { unsigned short *buf = b; unsigned int sum=0; unsigned short result; for ( sum = 0; len > 1; len -= 2 ) sum += *buf++; if ( len == 1 ) sum += *(unsigned char *)buf; sum = (sum >> 16) + (sum & 0xFFFF); sum += (sum >> 16); result = ~sum; return result; } // 发送ICMP Echo Request包 int send_icmp_packet(char *dst_ip) { int sockfd; struct sockaddr_in dest; struct icmp *icmp; char packet[PACKETSIZE]; // 创建原始套接字 sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP); if (sockfd < 0) { perror("socket creating failed"); return -1; } // IP头部设置 dest.sin_family = AF_INET; if (inet_pton(AF_INET, dst_ip, &(dest.sin_addr.s_addr)) <= 0) { perror("inet_pton error"); return -1; } // ICMP Echo Request设置 icmp = (struct icmp *)(packet); icmp->icmp_type = ICMP_ECHO; icmp->icmp_code = 0; icmp->icmp_id = htons(getpid()); icmp->icmp_seq = htons(1); memset(icmp->icmp_data, 0xa5, PACKETSIZE - sizeof(struct iphdr)); icmp->icmp_cksum = checksum(icmp, PACKETSIZE); // 发送 if (sendto(sockfd, packet, PACKETSIZE, 0, (struct sockaddr *)&dest, sizeof(dest)) < 0) { perror("sendto error"); return -1; } close(sockfd); return 0; } int main() { char dst_ip[] = "192.168.0.1"; send_icmp_packet(dst_ip); return 0; } ```
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值