2.C语言在Windows中使用Hook抓包
C语言在Windows中使用Hook抓包
- 使用C语言写服务端与客户端程序。
- 使用C语言写动态链接库实现抓包功能。
- 将动态链接库注入到客户端程序中。
- 此时客户端发送消息会被抓取。
1.使用C语言写服务端与客户端程序。
LinServer.c1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80// LinServer.c
int main() {
int serverSocket, clientSocket;
struct sockaddr_in server, client;
socklen_t clientSize;
char buffer[1024];
int recvSize;
// 创建 socket
serverSocket = socket(AF_INET, SOCK_STREAM, 0);
if (serverSocket < 0) {
perror("Could not create socket");
return 1;
}
// 设置服务器信息
server.sin_family = AF_INET;
server.sin_addr.s_addr = INADDR_ANY; // 监听所有可用的接口
server.sin_port = htons(SERVER_PORT); // 服务器端口
// 绑定 socket
if (bind(serverSocket, (struct sockaddr*)&server, sizeof(server)) < 0) {
perror("Bind failed");
close(serverSocket);
return 1;
}
// 开始监听
if (listen(serverSocket, 3) < 0) {
perror("Listen failed");
close(serverSocket);
return 1;
}
printf("Waiting for incoming connections...\n");
clientSize = sizeof(client);
// 循环接受连接
while (1) {
// 接受连接
clientSocket = accept(serverSocket, (struct sockaddr*)&client, &clientSize);
if (clientSocket < 0) {
perror("Accept failed");
close(serverSocket);
return 1;
}
char clientIP[INET_ADDRSTRLEN]; // 用于存储客户端 IP 地址
inet_ntop(AF_INET, &client.sin_addr, clientIP, sizeof(clientIP)); // 使用 inet_ntop
printf("Connection accepted from %s:%d\n", clientIP, ntohs(client.sin_port));
// 接收消息
while ((recvSize = recv(clientSocket, buffer, sizeof(buffer) - 1, 0)) > 0) {
buffer[recvSize] = '\0'; // 添加字符串结束符
printf("Received message: %s\n", buffer);
}
if (recvSize < 0) {
perror("Receive failed");
}
// 关闭客户端 socket
close(clientSocket);
printf("Client disconnected.\n");
}
// 关闭服务器 socket
close(serverSocket);
return 0;
}WinClient.c1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81//WinClient.c
int main() {
WSADATA wsaData;
SOCKET sock;
struct sockaddr_in server;
char message[1024];
int sendResult;
// 初始化 Winsock
if (WSAStartup(MAKEWORD(2, 2), &wsaData) != 0) {
printf("Failed to initialize Winsock. Error Code: %d\n", WSAGetLastError());
return 1;
}
// 创建 socket
sock = socket(AF_INET, SOCK_STREAM, 0);
if (sock == INVALID_SOCKET) {
printf("Could not create socket. Error Code: %d\n", WSAGetLastError());
WSACleanup();
return 1;
}
// 设置服务器信息
server.sin_family = AF_INET;
server.sin_port = htons(SERVER_PORT); // 服务器端口
// 使用 inet_pton 将 IP 地址转换为网络字节顺序
if (inet_pton(AF_INET, SERVER_IP, &server.sin_addr) <= 0) {
printf("Invalid address/ Address not supported \n");
closesocket(sock);
WSACleanup();
return 1;
}
// 连接到服务器
if (connect(sock, (struct sockaddr*)&server, sizeof(server)) < 0) {
printf("Connection failed. Error Code: %d\n", WSAGetLastError());
closesocket(sock);
WSACleanup();
return 1;
}
// 发送多条消息
while (1) {
printf("Enter message (type 'exit' to quit): ");
fgets(message, sizeof(message), stdin);
message[strcspn(message, "\n")] = 0; // 去掉换行符
// 检查是否退出
if (strcmp(message, "exit") == 0) {
break;
}
// 发送消息
sendResult = send(sock, message, strlen(message), 0);
if (sendResult == SOCKET_ERROR) {
printf("Send failed. Error Code: %d\n", WSAGetLastError());
break;
}
else {
printf("Message sent: %s\n", message);
}
}
// 关闭 socket
closesocket(sock);
WSACleanup();
return 0;
}在Linux中编译并运行
LinServer与Windows中运行
WinClien.exe
2. 使用C语言写动态链接库实现抓包功能。
- 使用VCPKG安装detours库。
- 在vs2022中新建DLL项目。
- 编写DLL项目代码。
- 编译DLL项目得到文件Capture.dll。
1.使用VCPKG安装detours库。
1 | .\vcpkg.exe install detours:x86-windows |
3. 编写DLL项目代码。
主要代码：
1 | // dllmain.cpp : Defines the entry point for the DLL application. |
3. 将Capture.dll注入进程WinClien.exe中。
C语言写一个注入器代码
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74//Inject.c
// 根据进程名获取PID
DWORD GetProcessIdByName(const TCHAR* processName) {
PROCESSENTRY32 pe32;
pe32.dwSize = sizeof(PROCESSENTRY32);
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (Process32First(hSnapshot, &pe32)) {
do {
if (_tcscmp(pe32.szExeFile, processName) == 0) {
CloseHandle(hSnapshot);
return pe32.th32ProcessID;
}
} while (Process32Next(hSnapshot, &pe32));
}
CloseHandle(hSnapshot);
return 0;
}
// 注入DLL到目标进程
BOOL InjectDLL(DWORD pid, const TCHAR* dllPath) {
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
if (!hProcess) return FALSE;
// 在目标进程中分配内存
LPVOID pRemoteMem = VirtualAllocEx(hProcess, NULL, (_tcslen(dllPath) + 1) * sizeof(TCHAR), MEM_COMMIT, PAGE_READWRITE);
if (!pRemoteMem) {
CloseHandle(hProcess);
return FALSE;
}
// 写入DLL路径
WriteProcessMemory(hProcess, pRemoteMem, dllPath, (_tcslen(dllPath) + 1) * sizeof(TCHAR), NULL);
// 调用LoadLibrary加载DLL
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0,
(LPTHREAD_START_ROUTINE)LoadLibrary, pRemoteMem, 0, NULL);
if (!hThread) {
VirtualFreeEx(hProcess, pRemoteMem, 0, MEM_RELEASE);
CloseHandle(hProcess);
return FALSE;
}
WaitForSingleObject(hThread, INFINITE);
VirtualFreeEx(hProcess, pRemoteMem, 0, MEM_RELEASE);
CloseHandle(hThread);
CloseHandle(hProcess);
return TRUE;
}
int main() {
const TCHAR* targetProcess = TEXT("WinClient.exe"); // 目标进程名
const TCHAR* dllPath = TEXT("D:\\test\\CC++\\C+Windows+Pragrma\\C+Socks+demo\\Debug\\capture.dll"); // DLL路径
//const TCHAR* dllPath = TEXT("D:\\test\\CC++\\C+Windows+Pragrma\\C+Socks+demo\\x64\\Debug\\capture.dll"); // DLL路径
DWORD pid = GetProcessIdByName(targetProcess);
if (pid == 0) {
_tprintf(TEXT("Process not found!\n"));
return 1;
}
if (InjectDLL(pid, dllPath)) {
_tprintf(TEXT("DLL injected successfully!\n"));
}
else {
_tprintf(TEXT("Injection failed!\n"));
}
return 0;
}编译运行
Inject.exe。
All articles in this blog are licensed under CC BY-NC-SA 4.0 unless stating additionally.