如何获取ConnectEx（）指针

Question

我使用MS弯路，我希望得到ConnectEx（）指针，但负荷运行时，如何让指针与MS走弯路使用？

Answer 1

ConnectEx()不是导出的DLL函数。每ConnectEx()文档：

注意为ConnectEx功能的函数指针必须在运行时通过调用与SIO_GET_EXTENSION_FUNCTION_POINTER操作码WSAIoctl函数指定获得。传递给WSAIoctl函数的输入缓冲区必须包含WSAID_CONNECTEX，这是一个全局唯一标识符（GUID），其值标识ConnectEx扩展函数。成功时，WSAIoctl函数返回的输出包含指向ConnectEx函数的指针。 在Mswsock.h头文件中定义。

例如：

#include <winsock2.h> // Must be included before Mswsock.h 
#include <mswsock.h> 

#pragma comment(lib, "ws2_32.lib") 

... 

LPFN_CONNECTEX GetConnectExPtr(SOCKET s) 
{ 
    LPFN_CONNECTEX lpConnectEx = NULL; 
    GUID guid = WSAID_CONNECTEX; 
    DWORD dwNumBytes = 0; 
    WSAIoctl(s, SIO_GET_EXTENSION_FUNCTION_POINTER, &guid, sizeof(guid), &lpConnectEx, sizeof(lpConnectEx), &dwNumBytes, NULL, NULL); 
    return lpConnectEx; 
} 

一旦你有一个指针ConnectEx()，你可以绕路了。根据MSDetours的版本，您正在使用，您可以：

使用DetourFunction()：

#include <winsock2.h> // Must be included before Mswsock.h 
#include <mswsock.h> 
#include <detours.h> 

#pragma comment(lib, "ws2_32.lib") 
#pragma comment(lib, "detours.lib") 

... 

LPFN_CONNECTEX Real_ConnectEx = NULL; 
LPFN_CONNECTEX Trampoline_ConnectEx = NULL; 

BOOL WINAPI MyConnectEx(SOCKET s, const struct sockaddr *name, int namelen, PVOID lpSendBuffer, DWORD dwSendDataLength, LPDWORD lpdwBytesSent, LPOVERLAPPED lpOverlapped) 
{ 
    // do something... 
    return Trampoline_ConnectEx(s, name, namelen, lpSendBuffer, dwSendDataLength, lpdwBytesSent, lpOverlapped); 
} 

... 

SOCKET s = ...; 
Real_ConnectEx = GetConnectExPtr(s); 
if (Real_ConnectEx) 
{ 
    Trampoline_ConnectEx = (LPFN_CONNECTEX) DetourFunction((PBYTE)Real_ConnectEx, (PBYTE)MyConnectEx); 
} 

... 

if (Trampoline_ConnectEx) 
    DetourRemoveTrampoline(Trampoline_ConnectEx); 

使用DetourAttach/Ex()：

#include <winsock2.h> // Must be included before Mswsock.h 
#include <mswsock.h> 
#include <detours.h> 

#pragma comment(lib, "ws2_32.lib") 
#pragma comment(lib, "detours.lib") 
#pragma comment(lib, "detoured.lib") 

... 

LPFN_CONNECTEX Real_ConnectEx = NULL; 
LPFN_CONNECTEX Trampoline_ConnectEx = NULL; 

BOOL WINAPI MyConnectEx(SOCKET s, const struct sockaddr *name, int namelen, PVOID lpSendBuffer, DWORD dwSendDataLength, LPDWORD lpdwBytesSent, LPOVERLAPPED lpOverlapped) 
{ 
    // do something... 
    return Trampoline_ConnectEx(s, name, namelen, lpSendBuffer, dwSendDataLength, lpdwBytesSent, lpOverlapped); 
} 

... 

SOCKET s = ...; 
Real_ConnectEx = GetConnectExPtr(s); 
if (Real_ConnectEx) 
{ 
    DetourTransactionBegin(); 
    DetourUpdateThread(GetCurrentThread()); 

    // using DetourAttach()... 
    Trampoline_ConnectEx = Real_ConnectEx; 
    DetourAttach((PVOID*)&Trampoline_ConnectEx, MyConnectEx); 

    // using DetourAttachEx()... 
    // DetourAttachEx(&Real_ConnectEx, MyConnectEx, (PDETOUR_TRAMPOLINE*)&Trampoline_ConnectEx, NULL, NULL); 

    DetourTransactionCommit(); 
} 

... 

if ((Real_ConnectEx) && (Trampoline_ConnectEx)) 
{  
    DetourTransactionBegin(); 
    DetourUpdateThread(GetCurrentThread()); 

    // if using DetourAttach()... 
    DetourDetach((PVOID*)&Trampoline_ConnectEx, MyConnectEx); 

    // if using DetourAttachEx()... 
    // DetourDetach((PVOID*)&Real_ConnectEx, MyConnectEx); 

    DetourTransactionCommit(); 
}