Hooken der RecvFrom() Methode mittels uALLCollection

[C0pa]

Damit gehts - aber auch nur teilweise.

Delphi-Quellcode:

library hook;

uses
  SysUtils,
  Classes,
  Windows,
  uallHook,
  WinSock,
  Messages,
  Variants,
  WinSock2 in 'WinSock2.pas',
  IPC in 'IPC.pas';

{$R *.res}

type
  TsendMethod = function(s: TSocket; Buf : Pointer; Len, Flags: Integer): Integer; stdcall;
  TsendToMethod = function(s: TSocket; var Buf; len, flags: Integer; var addrto: TSockAddr;  tolen: Integer): Integer; stdcall;
  TrecvMethod = function(s: TSocket; Buf : Pointer; Len, Flags: Integer): Integer; stdcall;
  TrecvFromMethod = function(s: TSocket; var Buf; len, flags: Integer; var from: TSockAddr; var fromlen: Integer): Integer; stdcall;

var
  orgiSend, newSend          : TsendMethod;
  orgiRecv, newRecv          : TrecvMethod;
  orgiSendto, newSendTo      : TsendToMethod;
  orgiRecvFrom, newRecvFrom  : TrecvFromMethod;

procedure informMaster(func:Integer);
var
  data: TIPCData;
begin
  data.s := '';
  data.func := func;
  IPC.sendData(data);
end;

function callbackSend(s: TSocket; Buf : Pointer; Len, Flags: Integer): Integer; stdcall;
begin
  Result := newSend(s, Buf, Len, Flags);
  informMaster(1);
end;

function callbackSendTo(s: TSocket; var Buf; len, flags: Integer; var addrto: TSockAddr;  tolen: Integer): Integer; stdcall;  
begin
  Result := newSendTo(s, Buf, Len, Flags, addrto, tolen);
  informMaster(2);
end;


function callbackRecv(s: TSocket; Buf : Pointer; Len, Flags: Integer): Integer; stdcall;
begin
  Result := newRecv(s, Buf, Len, Flags);
  informMaster(3);
end;

function callbackRecvFrom(s: TSocket; var Buf; len, flags: Integer; var from: TSockAddr; var fromlen: Integer): Integer; stdcall;
begin
  Result := newRecvFrom(s, Buf, Len, Flags, from, fromlen);
  informMaster(4);
end;

procedure injectmain;
begin
  //MessageBox(0, 'Its me', '', 0);
  @orgiSend := GetProcAddress(LoadLibrary('ws2_32.dll'),'send');
  if not(HookCode(@orgiSend,@callbackSend,@newSend)) then
    MessageBox(0, 'Send()', 'Something went wrong!', 0);

  @orgiSendto := GetProcAddress(LoadLibrary('ws2_32.dll'),'sendto');
  if not(HookCode(@orgiSendto,@callbackSendto,@newSendTo)) then
    MessageBox(0, 'SendTo()', 'Something went wrong!', 0);

  @orgiRecv := GetProcAddress(LoadLibrary('ws2_32.dll'),'recv');
  if not(HookCode(@orgiRecv,@callbackRecv,@newRecv)) then
    MessageBox(0, 'Recv()', 'Something went wrong!', 0);

  @orgiRecvFrom := GetProcAddress(LoadLibrary('ws2_32.dll'),'recvfrom');
  if not(HookCode(@orgiRecvFrom,@callbackRecvFrom,@newRecvFrom)) then
    MessageBox(0, 'RecvFrom()', 'Something went wrong!', 0);
end;

procedure uninjectmain;
begin
  //MessageBox(0, 'Bye!', '', 0);
  UnhookCode(@newSend);
  UnhookCode(@newSendTo);
  UnhookCode(@newRecv);
  UnhookCode(@newRecvFrom);
end;


procedure dllmain(dwReason: integer);
begin
  case dwreason of
    DLL_PROCESS_ATTACH:
      injectmain;
    DLL_PROCESS_DETACH:
      uninjectmain;
  end;
end;

begin
  DLLProc := @DLLMain;
  DLLMain(1);
end.

Jetzt wird mir zwar angezeig, dass alles ausgeführt wurde, aber wenn ich die DLL Uninjecte stürtzt das Programm ab indem sich die DLL befand.