easyHOOK socket send recv

代码比较简单，就不做注释了。  包含一个sockethookinject.DLL 和sockethook.exe

有一点不清楚，

SetExclusiveACL可以添加当前线程的hook，  但是easyhook如何 detach dll 并且释放hook呢？  知道的大神麻烦告知一下。

    public class SocketInterFace : MarshalByRefObject
    {

        public delegate void LogArgsHander(BufferStruct argsbuffer);
        public static event LogArgsHander logEvent;

        public void IsInstalled(Int32 InClientPID)
        {
            Console.WriteLine("FileMon has been installed in target {0}.\r\n", InClientPID);
        }

        public void OnRecv(byte[] RecvBuffer, int LoginIndex, int LoginIndexEx)
        {
            BufferStruct BufferArgs = new BufferStruct();
            BufferArgs.Buffer = RecvBuffer;
            BufferArgs.BufferSize = RecvBuffer.Length;
            BufferArgs.ObjectType = "recv";
            OnLog(BufferArgs);
        }

        public void OnSend(byte[] RecvBuffer, int LoginIndex, int LoginIndexEx)
        {
            BufferStruct BufferArgs = new BufferStruct();
            BufferArgs.Buffer = RecvBuffer;
            BufferArgs.BufferSize = RecvBuffer.Length;
            BufferArgs.ObjectType = "send";
            OnLog(BufferArgs);
        }

        public void OnLog(string BufferArgs) { Console.WriteLine(BufferArgs); }

        public void OnLog(BufferStruct buf)
        {
            if (logEvent!=null)
            {
                logEvent(buf);
            }
        }

        public struct BufferStruct
        {
            /// <summary>
            /// Socket指针
            /// </summary>
            public IntPtr sockHander;
            /// <summary>
            /// 封包数据
            /// </summary>
            public byte[] Buffer;
            /// <summary>
            /// 封包大小
            /// </summary>
            public int BufferSize;
            /// <summary>
            /// 封包动态序列
            /// </summary>
            public int[] LoginIdent;
            /// <summary>
            /// send recv
            /// </summary>
            public string ObjectType;
        }
    }

    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
            SocketInterFace.logEvent += new SocketInterFace.LogArgsHander(MainSend);
            if (!EasyHook.RemoteHooking.IsAdministrator)
                MessageBox.Show("请用管理员方式启动");
        }

        public void MainSend(socketHook.SocketInterFace.BufferStruct buff)
        {
            Console.WriteLine(string.Format("长度:{0} 类型:{2}\r\n 内容:{1}", buff.BufferSize, byteToHexStr(buff.Buffer, buff.BufferSize),buff.ObjectType));
        }

        public static string byteToHexStr(byte[] bytes, int byteLen)
        {
            string returnStr = "";
            if (bytes != null)
            {
                for (int i = 0; i < byteLen; i++)
                {
                    returnStr += bytes[i].ToString("X2");
                }
            }
            return returnStr;
        }
        string ChannelName = null;
        private void button1_Click(object sender, EventArgs e)
        {
            try
            {
                EasyHook.Config.Register(".net远程注入组建", "socketHook.exe", "sockethookinject.dll");
            }
            catch (Exception ex)
            {
            }
            int id=Process.GetProcessesByName("SupARC").First().Id;
            if (id != 0) {
            EasyHook.RemoteHooking.IpcCreateServer<SocketInterFace>(ref ChannelName, System.Runtime.Remoting.WellKnownObjectMode.SingleCall);
            EasyHook.RemoteHooking.Inject(id, "sockethookinject.dll", "sockethookinject.dll", ChannelName);
            }
            else
            {
                MessageBox.Show("ARC没有启动");
            }
        }

        private void button2_Click(object sender, EventArgs e)
        {

        }
    }

public class Main : IEntryPoint
    {
        SocketInterFace Interface;
        Stack<String> Queue = new Stack<String>();

        public Main(RemoteHooking.IContext InContext,string InChannelName)
        {
            Interface = RemoteHooking.IpcConnectClient<SocketInterFace>(InChannelName);
            Interface.OnLog("初始化HOOK成功");
        }
        LocalHook RecvHook;
        LocalHook SendHook;

       int MyRecv(IntPtr socket, IntPtr buffer, int length, int flags)
        {
            int bytesCount = recv(socket, buffer, length, flags);
            if (bytesCount>0)
            {
                byte[] RecvBuffer = new byte[bytesCount];
                Marshal.Copy(buffer, RecvBuffer, 0, RecvBuffer.Length);
                Interface.OnRecv(RecvBuffer, 0, 0);
            }
            return bytesCount;
        }
       int MySend(IntPtr socket, IntPtr buffer, int length, int flags)
       {
           int bytesCount = send(socket, buffer, length, flags);
           if (bytesCount > 0)
           {
               byte[] RecvBuffer = new byte[bytesCount];
               Marshal.Copy(buffer, RecvBuffer, 0, RecvBuffer.Length);
               Interface.OnSend(RecvBuffer, 0, 0);
           }
           return bytesCount;
       }
        public void Run(RemoteHooking.IContext InContext,string InChannelName)
        {
            RecvHook = LocalHook.Create(LocalHook.GetProcAddress("WS2_32.dll", "recv"), new DRecv(MyRecv), this);
            SendHook = LocalHook.Create(LocalHook.GetProcAddress("WS2_32.dll", "send"), new DSend(MySend), this);

            SendHook.ThreadACL.SetExclusiveACL(new Int32[] { 0 });
            RecvHook.ThreadACL.SetExclusiveACL(new Int32[] { 0 });

            Interface.IsInstalled(RemoteHooking.GetCurrentProcessId());
            dwProHwnd = OpenProcess(PROCESS_ALL_ACCESS, 0, RemoteHooking.GetCurrentProcessId());
            //EasyHook.RemoteHooking.WakeUpProcess();
            while (true) { Thread.Sleep(500); }

        }

        [DllImport("kernel32.dll", EntryPoint = "OpenProcess")]
        public static extern uint OpenProcess(uint dwDesiredAccess, int bInheritHandle, int dwProcessId);
        public const uint PROCESS_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xFFF);
        public const uint SYNCHRONIZE = 0x00100000;
        public const uint STANDARD_RIGHTS_REQUIRED = 0x000F0000;
        public uint dwProHwnd = 0;
        [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode, SetLastError = true)]
        delegate int DRecv(IntPtr socket, IntPtr buffer, int length, int flags);

        [DllImport("WS2_32.dll", CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        static extern int recv(IntPtr socket, IntPtr buffer, int length, int flags);

        [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode, SetLastError = true)]
        delegate int DSend(IntPtr socket, IntPtr buffer, int length, int flags);

        [DllImport("WS2_32.dll", CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        static extern int send(IntPtr socket, IntPtr buffer, int length, int flags);
    }