您好，欢迎来到家居就！
主题：求高手指点迷津！谢谢您了！(阅读：2215 回复：21)
本帖地址：求高手指点迷津！！【c#吧】_百度贴吧
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&签到排名：今日本吧第个签到，本吧因你更精彩，明天继续来努力！
本吧签到人数：0成为超级会员，使用一键签到本月漏签0次！成为超级会员，赠送8张补签卡连续签到：天&&累计签到：天超级会员单次开通12个月以上，赠送连续签到卡3张
关注：107,490贴子：
求高手指点迷津！！收藏
public class APIHOOK
#region Api声明
[DllImport("Kernel32.dll", EntryPoint = "GetModuleHandleA", CharSet = CharSet.Ansi)]
static extern IntPtr GetModuleHandle(
string lpModuleName
[DllImport("Kernel32.dll")]
static extern bool VirtualProtect(
IntPtr lpAddress,
int dwSize,
int flNewProtect,
ref int lpflOldProtect
[DllImport("Kernel32.dll", EntryPoint = "lstrcpynA", CharSet = CharSet.Ansi)]
static extern IntPtr lstrcpyn(
byte[] lpString1,
byte[] lpString2,
int iMaxLength
[DllImport("Kernel32.dll")]
static extern IntPtr GetProcAddress(
IntPtr hModule,
string lpProcName
[DllImport("Kernel32.dll")]
static extern bool FreeLibrary(
IntPtr hModule
#endregion
#region 常量定义表
const int PAGE_EXECUTE_READWRITE = 0x40;
#endregion
#region 变量表
public IntPtr ProcA
public int a=0;
int lpflOldProtect = 0;
public byte[] OldEntry = new byte[5];
public byte[] NewEntry = new byte[5];
IntPtr OldA
public string bufftext = "";
#endregion
public APIHOOK() { }
public APIHOOK(string ModuleName, string ProcName, IntPtr lpAddress)
Install(ModuleName, ProcName, lpAddress);
public bool Install(string ModuleName, string ProcName, IntPtr lpAddress)
IntPtr hModule = GetModuleHandle(ModuleName); //取模块句柄
if (hModule == IntPtr.Zero)
ProcAddress = GetProcAddress(hModule, ProcName); //取入口地址
if (ProcAddress == IntPtr.Zero)
if (!VirtualProtect(ProcAddress, 5, PAGE_EXECUTE_READWRITE, ref lpflOldProtect)) //修改内存属性
Marshal.Copy(ProcAddress, OldEntry, 0, 5); //读取前5字节
NewEntry = AddBytes(new byte[1] { 233 }, BitConverter.GetBytes((Int32)((Int32)lpAddress - (Int32)ProcAddress - 5))); //计算新入口跳转
Marshal.Copy(NewEntry, 0, ProcAddress, 5); //写入前5字节
OldEntry = AddBytes(OldEntry, new byte[5] { 233, 0, 0, 0, 0 });
OldAddress = lstrcpyn(OldEntry, OldEntry, 0); //取变量指针
Marshal.Copy(BitConverter.GetBytes((double)((Int32)ProcAddress - (Int32)OldAddress - 5)), 0, (IntPtr)(OldAddress.ToInt32() + 6), 4); //保存JMP
FreeLibrary(hModule); //释放模块句柄
public void Suspend()
Marshal.Copy(OldEntry, 0, ProcAddress, 5);
public void Continue()
Marshal.Copy(NewEntry, 0, ProcAddress, 5);
public bool Uninstall()
if (ProcAddress == IntPtr.Zero)
Marshal.Copy(OldEntry, 0, ProcAddress, 5);
ProcAddress = IntPtr.Z
static byte[] AddBytes(byte[] a, byte[] b)
ArrayList retArray = new ArrayList();
for (int i = 0; i & a.L i++)
retArray.Add(a[i]);
for (int i = 0; i & b.L i++)
retArray.Add(b[i]);
return (byte[])retArray.ToArray(typeof(byte));
这是我从网上找的APIHook类。我用这个HOOK
send时，hook没什么问题，但是我hook
recv时怎么就总得不到数据哪？
public delegate int sendCallback(int s, IntPtr buf, int len, int flag);
public delegate int recvCallback(int s, IntPtr buf, int len, int flag);
APIHOOK send_Hook = new APIHOOK();
APIHOOK recv_Hook = new APIHOOK();
private void checkBox1_CheckedChanged(object sender, EventArgs e)
if (checkBox1.Checked == true)
send_Hook.Install("ws2_32.dll", "send", Marshal.GetFunctionPointerForDelegate(new sendCallback(sendProc);
private void checkBox2_CheckedChanged(object sender, EventArgs e)
if (checkBox2.Checked == true)
recv_Hook.Install("ws2_32.dll", "recv", Marshal.GetFunctionPointerForDelegate(new recvCallback(recvProc);
public int recvProc(int s, IntPtr buf, int len, int flag)
数据处理。。。。。。。。。。。。。省略
int sendProc(int s, IntPtr buf, int len, int flag)
数据处理。。。。。。。。。。。。。省略
}我在处理recvProc时等不到数据，这是什么原因?而sendProc却一点问题都没有。在recvProc理下断点，也断不下，难道是recv函数的转调不对吗？请高手指点！！！！！！！！！！！！！！！！！！
c#培训选择达内的理由1,企业级开发环境2,项目实战教学3,c#课程可选4,金牌讲师授课5,周末/业余班任选.c#培训首选达内--美国上市公司!
为什么我换了一台机器，在Hook
recv 时却能得到数据，而用现在这台机器却得到不到数据哪？我现在这台机器只能hook到send，hook不到recv。换一台机器却都能hook到，这是为什么？求高手解答。
登录百度帐号推荐应用}