SPI拦截网络封包(DLL篇)

#include <ws2spi.h>
#include <windows.h>
#include <stdio.h>

#pragma comment(lib, "ws2_32.lib")
//
// 用来保存系统服务提供者路径信息的自定义注册表键值
//
#define REG_INSTALL_KEY "SYSTEM//CurrentControlSet//Services//WinSock2//MySPI"

//
// 全局变量，用来保存系统服务提供者30个服务函数指针
//
WSPPROC_TABLE NextProcTable;
char tempfile[256];
char winpath[256];

void GetRightEntryIdItem(IN WSAPROTOCOL_INFOW *pProtocolInfo,
      OUT TCHAR *sItem)
{
 if(pProtocolInfo->ProtocolChain.ChainLen <= 1)
 {
  sprintf(sItem, "%u", pProtocolInfo->dwCatalogEntryId);
 }
 else
 {
  sprintf(sItem, "%u", pProtocolInfo->ProtocolChain
   .ChainEntries[pProtocolInfo->ProtocolChain.ChainLen - 1]);
 }
}

BOOL GetHookProvider(IN WSAPROTOCOL_INFOW *pProtocolInfo,
      OUT TCHAR    *sPathName)
{
 TCHAR sItem[21];
 GetRightEntryIdItem(pProtocolInfo, sItem);

 HKEY hSubkey;
 DWORD ulDateLenth = MAX_PATH;
 TCHAR sTemp[MAX_PATH];

 if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, REG_INSTALL_KEY, 0, KEY_ALL_ACCESS, &hSubkey) != ERROR_SUCCESS)
  return FALSE;
 if (RegQueryValueEx(hSubkey, sItem, 0, NULL, (BYTE*)sTemp, &ulDateLenth) || ExpandEnvironmentStrings(sTemp, sPathName, ulDateLenth) == 0)
  return FALSE;
 if(sPathName[0] == '/0' && sTemp[0] != '/0')
  strcpy(sPathName, sTemp);
 RegCloseKey(hSubkey);

 return TRUE;
}

SOCKET WSPAPI WSPSocket(int  af,                              
      int  type,                            
      int  protocol,                        
      LPWSAPROTOCOL_INFOW lpProtocolInfo,  
      GROUP g,                             
      DWORD dwFlags,                       
      LPINT lpErrno)
{
 return NextProcTable.lpWSPSocket(af,
         type,
         protocol,
         lpProtocolInfo,
         g,
         dwFlags,
         lpErrno);
}

BOOL WINAPI DllMain(HINSTANCE hModule,
     DWORD  ul_reason_for_call,
     LPVOID  lpReserved)
{
 if(ul_reason_for_call == DLL_PROCESS_ATTACH)
 {
  
 }
 else if(ul_reason_for_call == DLL_PROCESS_DETACH)
 {
  
 }

 return TRUE;
}

int WSPAPI WSPStartup( WORD    wVersionRequested,
      LPWSPDATA   lpWSPData,
      LPWSAPROTOCOL_INFOW lpProtocolInfo,
      WSPUPCALLTABLE  upcallTable,
      LPWSPPROC_TABLE  lpProcTable)
{
 TCHAR    sLibraryPath[512];
    LPWSPSTARTUP        WSPStartupFunc      = NULL;
 HMODULE    hLibraryHandle  = NULL;
    INT                 ErrorCode           = 0;

 if (!GetHookProvider(lpProtocolInfo, sLibraryPath)
  || (hLibraryHandle = LoadLibrary(sLibraryPath)) == NULL
  || (WSPStartupFunc = (LPWSPSTARTUP)GetProcAddress(
        hLibraryHandle, "WSPStartup")) == NULL
  )
  return WSAEPROVIDERFAILEDINIT;

 if ((ErrorCode = WSPStartupFunc(wVersionRequested, lpWSPData, lpProtocolInfo, upcallTable, lpProcTable)) != ERROR_SUCCESS)
  return ErrorCode;
 
 NextProcTable = *lpProcTable;

 lpProcTable->lpWSPSocket = WSPSocket;

 return 0;
}