unit APIHook;
interface
usesSysUtils,Dialogs,Windows, WinSock, Classes;type//要HOOK的API函数定义TSockProc = function(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall;PJmpCode = ^TJmpCode;TJmpCode = packed recordJmpCode: BYTE;Address: TSockProc;MovEAX: array[0..2] of BYTE;end;//--------------------函数声明---------------------------
procedure HookAPI;
procedure UnHookAPI;varFLoad: TStringList;
function recvout(var Rbuf; RLen: Integer): Integer;
varOldSend, OldRecv: TSockProc; //原来的API地址
  JmpCode: TJmpCode;OldProc: array[0..1] of TJmpCode;AddSend, AddRecv: pointer; //API地址
  TmpJmp: TJmpCode;ProcessHandle: THandle;gLastTime: THandle;gCookie: string;gOldCook: string='';implementationfunction GetStrEx(sSrc, sStart, sEnd: string): string;
varnPos1, nPos2: Integer;sStr: string;
beginResult := '';nPos1 := Pos(sStart, sSrc);if nPos1 = 0 then Exit;sStr := Copy(sSrc, nPos1+length(sStart), Length(sSrc)-nPos1);nPos1 := Pos(sEnd, sStr);if nPos1>0 thenResult := Copy(sStr, 1, nPos1-1)elseResult := sStr;
end;function recvout(var Rbuf; RLen: Integer): Integer;
varbuf1: pchar;i: integer;ss: string;
begin// OutputDebugString(PChar('************:'));buf1 := @Rbuf;ss := buf1;//OutputDebugString(PChar('当前:'+ss));//取cookiegCookie := GetStrEx(ss, 'Cookie:', 'Host:');if Pos('t=', gCookie)>0 thenbeginif GetTickCount-gLastTime > 30*1000 thenbegingLastTime := GetTickCount;OutputDebugString(PChar('Cookie:'+gCookie));if gCookie <> gOldCook thenbegingOldCook := gCookie;OutputDebugString(PChar('保存Cookie文件:'+ExtractFilePath(ParamStr(0))+'cook.txt'));FLoad.Clear;FLoad.Add(gCookie);FLoad.SaveToFile(ExtractFilePath(ParamStr(0))+'cook.txt');end;end;end;
end;
{---------------------------------------}
{函数功能:Send函数的HOOK
{函数参数:同Send
{函数返回值:integer
{---------------------------------------}function MySend(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall;
vardwSize: cardinal;
begin//这儿进行发送的数据处理// MessageBeep(1000); //简单的响一声
  recvout(Buf, len);//调用直正的Send函数WriteProcessMemory(ProcessHandle, AddSend, @OldProc[0], 8, dwSize);Result := OldSend(S, Buf, len, flags);JmpCode.Address := @MySend;WriteProcessMemory(ProcessHandle, AddSend, @JmpCode, 8, dwSize);
end;
{---------------------------------------}
{函数功能:Recv函数的HOOK
{函数参数:同Recv
{函数返回值:integer
{---------------------------------------}function MyRecv(s: TSocket; var Buf; len, flags: Integer): Integer; stdcall;
vardwSize: cardinal;
begin//这儿进行接收的数据处理// MessageBeep(1000); //简单的响一声//调用直正的Recv函数WriteProcessMemory(ProcessHandle, AddRecv, @OldProc[1], 8, dwSize);Result := OldRecv(S, Buf, len, flags);JmpCode.Address := @MyRecv;WriteProcessMemory(ProcessHandle, AddRecv, @JmpCode, 8, dwSize);
end;
{------------------------------------}
{过程功能:HookAPI
{过程参数:无
{------------------------------------}procedure HookAPI;
varDLLModule: THandle;dwSize: cardinal;
beginProcessHandle := GetCurrentProcess;DLLModule := LoadLibrary('ws2_32.dll');AddSend := GetProcAddress(DLLModule, 'send'); //取得API地址// AddRecv := GetProcAddress(DLLModule, 'recv');JmpCode.JmpCode := $B8;JmpCode.MovEAX[0] := $FF;JmpCode.MovEAX[1] := $E0;JmpCode.MovEAX[2] := 0;ReadProcessMemory(ProcessHandle, AddSend, @OldProc[0], 8, dwSize);JmpCode.Address := @MySend;WriteProcessMemory(ProcessHandle, AddSend, @JmpCode, 8, dwSize); //修改Send入口// ReadProcessMemory(ProcessHandle, AddRecv, @OldProc[1], 8, dwSize);//JmpCode.Address := @MyRecv;// WriteProcessMemory(ProcessHandle, AddRecv, @JmpCode, 8, dwSize); //修改Recv入口OldSend := AddSend;// OldRecv := AddRecv;
FLoad := TStringList.Create();gLastTime := 0;
end;
{------------------------------------}
{过程功能:取消HOOKAPI
{过程参数:无
{------------------------------------}procedure UnHookAPI;
vardwSize: Cardinal;
beginif FLoad <> nil thenFLoad.Free;WriteProcessMemory(ProcessHandle, AddSend, @OldProc[0], 8, dwSize);
//  WriteProcessMemory(ProcessHandle, AddRecv, @OldProc[1], 8, dwSize);
end;
end.