Another way to modify an online SWF

This openness of this way has certain limitations, through the efforts can be overcome. It also has a certain superiority. Unlike previously used memory searches and local modifications, this approach can be modified not only locally, but also completely recompiled without the limitation of file size. By and large, this approach can replace a lot of things, not just SWF, which can be applied from the server. Of course, caching is a problem, as mentioned earlier, through hard work can be overcome. This approach is based on the hook of the network request and the file download API, and the two WININET.DLL API functions that hook the WebBrowser control of the process in the following example can achieve the purpose:

    <dllimport ("Wininet.dll", setlasterror:=true) > Public
    Shared Function internetreadfile (ByVal hfile as INTPTR, ByVal lpbuffer as INTPTR, ByVal dwnumberofbytestoread As Integer, ByRef lpdwnumberofbytesread as Integer) as Boole An
    End Function

And

    <dllimport ("Wininet.dll") > Public
    Shared Function HTTPOPENREQUESTW (hconnect as INTPTR, Szverb as INTPTR, Szuri as INTPTR, szhttpversion as IntPtr, szreferer as IntPtr, Accetptype as IntPtr, dwflags as Integer, dwcontext as INTP TR) as IntPtr
    End Function

In fact, HOOK InternetReadFile can achieve the goal. But there is a problem, from hfile it is difficult to identify which file is being downloaded, and the lpbuffer to identify the need for a lot of contrast. So, let's look at the source of hfile, which can be obtained by several APIs, and HttpOpenRequest is the one that WebBrowser uses. By hook you can get Szuri, which is the requested file, and the function return value is hfile this guy. So, hook these two APIs seems to be a good practice.

Then, let's analyze the implementation process: we know that after HOOK InternetReadFile, the API is called into our custom function, and in the custom function calls the real API to populate the array to which its incoming lpbuffer is pointing. Then the opportunity comes, if we identify a hfile, it happens to be the one we want to replace the requested file, then we do not invoke the real API and populate the Lbuffer ourselves to replace the requested file with a local file. And then the server and WebBrowser are still in the dark. Of course, before we actually implement it, we need to understand InternetReadFile's calling method, otherwise everything is empty talk. You can find some code to use this API on the Internet to see it, it is easy to get the conclusion that this API is called Loop until Lpdwnumberofbytesread is 0 and the return value is true. At this point, the previous read buffer content is put together, is the entire file.

So, when we replace, we don't have to worry about how many times to call, WebBrowser will keep calling, we write the data once per call, and mimic the other behavior of the API: set the number of bytes actually written, so until the data is fully written. At this point, the API will also be called, because we have always set Lpdwnumberofbytesread to write lpbuffer bytes, then there is no data to write, so the actual number of written data is 0, that is, Lpdwnumberofbytesread is 0 o'clock, The caller believes that the file transfer is complete. This is exactly the same idea that we use to write programs using this API.

Because I looked at Easyhook today, I used this third-party library as an exercise. If you want to complete the hook section yourself, you can refer to my Cnblogs blog. On x64, there is at least one of these two APIs that is not in front of 90, so if you do it yourself, simply use the Eat\iat HOOK. There are no such problems with direct use of easyhook or Microsoft libraries, although they are also used Inlinehook. Therefore, the following code is based on Easyhook, download the library before use and place Easyhook.dll,easyhook32.dll,easyhook64.dll into the program directory.

1. Hook HTTPOPENREQUESTW

Imports System.Runtime.InteropServices public Class hookhttpopenrequest <dllimport ("Wininet.dll") > Public  Shared Function HTTPOPENREQUESTW (hconnect as INTPTR, Szverb as IntPtr, Szuri as IntPtr, szhttpversion as INTPTR, Szreferer As INTPTR, Accetptype as IntPtr, dwflags as Integer, dwcontext as IntPtr) as IntPtr End Function Private Delegat E Function httpopenrequestdelegate (hconnect as INTPTR, Szverb as IntPtr, Szuri as IntPtr, szhttpversion as INTPTR, Szrefer Er as IntPtr, accetptype as IntPtr, dwflags as Integer, dwcontext as IntPtr) as IntPtr Private Shared Hook as Easyhook . Localhook = Nothing Friend Shared Sub Install () Using Hook If EasyHook.NativeAPI.GetModuleHandle (
            "Wininet.dll") = IntPtr.Zero then EasyHook.NativeAPI.LoadLibrary ("Wininet.dll") End If Hook = EasyHook.LocalHook.Create (EasyHook.LocalHook.GetProcAddress ("Wininet.dll", "HTTPOPENREQUESTW"), New Httpopenrequestdelegate (AddressOf Sendproc), nothing) hooks. Threadacl.setinclusiveacl (New Integer () {0}) End Using end Sub Friend Shared Sub UnInstall () usin G Hook If Hook IsNot Nothing Then hook.  Threadacl.setexclusiveacl (New Integer () {0}) End If end Using End Sub Private Shared Function Sendproc (Hconnect as INTPTR, Szverb as IntPtr, Szuri as IntPtr, szhttpversion as IntPtr, szreferer as INTPTR, Accetptype
        As INTPTR, dwflags as Integer, dwcontext as IntPtr) as IntPtr Dim uri as String = Marshal.ptrtostringuni (Szuri) Dim result as IntPtr = HTTPOPENREQUESTW (Hconnect, Szverb, Szuri, Szhttpversion, Szreferer, Accetptype, dwflags, Dwco ntext) If URI.
            Contains ("Bd_logo1_31bdc765.png") then ' distinguishes the image to be replaced by name.
 Hookinternetreadfile.cheatfilehandle = result end If Return result end Function End Class

This is very simple, there is nothing to say. Oh yes, the name of the replacement function does not care, the code is in the project another class Sendhook.vb inside copied, forgot to rename. Then there is another:

2. Hook InternetReadFile

Imports System.IO Imports System.Runtime.InteropServices Public Class hookinternetreadfile <dllimport ("Wininet.dll ", setlasterror:=true) > Public Shared Function internetreadfile (ByVal hfile as INTPTR, ByVal lpbuffer as IntPtr, by Val dwnumberofbytestoread As Integer, ByRef lpdwnumberofbytesread as Integer) as Boolean End Function Private Del Egate Function internetreadfiledelegate (ByVal hfile as INTPTR, ByVal lpbuffer as INTPTR, ByVal Dwnumberofbytestoread as in Teger, ByRef Lpdwnumberofbytesread as Integer) as Boolean Private Shared hook as Easyhook.localhook = Nothing Fri
    End Shared Cheatfilehandle as IntPtr = IntPtr.Zero ' Handle to the file to be replaced, derived from the return value of HttpOpenRequest.
    Friend Shared cheatfile () as Byte = File.readallbytes (My.Application.Info.DirectoryPath & "\abc.jpg") ' File for replacement Private Shared curcnt as Integer = 0 Friend shared Sub Install () Using Hook If Easyhook.nativeapi .
   GetModuleHandle ("Wininet.dll") = IntPtr.Zero Then             EasyHook.NativeAPI.LoadLibrary ("Wininet.dll") End If hook = EasyHook.LocalHook.Create (EasyHook.LocalHook.GetProcAddress ("Wininet.dll", "InternetReadFile"), New internetreadfiledelegate (AddressOf Sendproc), nothing) hooks. Threadacl.setinclusiveacl (New Integer () {0}) End Using end Sub Friend Shared Sub UnInstall () usin G Hook If Hook IsNot Nothing Then hook.  Threadacl.setexclusiveacl (New Integer () {0}) End If end Using End Sub Private Shared Function Sendproc (ByVal hfile as INTPTR, ByVal lpbuffer as INTPTR, ByVal Dwnumberofbytestoread as Integer, ByRef lpdwnumberofbytes                   
                Read as Integer) as Boolean if hfile = Cheatfilehandle Then If curcnt = Cheatfile.length Then Cheatfilehandle = IntPtr.Zero curcnt = 0 Lpdwnumberofbytesread           = 0 Else                                 
                If curcnt + dwnumberofbytestoread <= Cheatfile.length Then Lpdwnumberofbytesread = Dwnumberofbytestoread Marshal.Copy (                                  
                Cheatfile, curcnt, lpbuffer, lpdwnumberofbytesread) curcnt + = Dwnumberofbytestoread                                                                 
                    Else Lpdwnumberofbytesread = cheatfile.length-curcnt marshal.copy (cheatfile, curcnt, L                                        
                Pbuffer, lpdwnumberofbytesread) curcnt = Cheatfile.length End If End If return True Else Return internetreadfile (hfile, L
 Pbuffer, Dwnumberofbytestoread, lpdwnumberofbytesread) End If end Function End Class

As a demo, you also need a form:

Public Class Form1

    Private Sub form1_load (sender as Object, e as EventArgs) Handles mybase.load
        WB. Navigate ("http://images2015.cnblogs.com/blog/56896/201702/56896-20170216102630488-270057596.jpg")
    End Sub

    Private Sub Butref_click (sender as Object, e as EventArgs) Handles Butref.click
        WB. Refresh ()
    End Sub

    Private Sub chkcheat_checkedchanged (sender as Object, e as EventArgs) Handles chkcheat.checkedchanged
        If chkcheat.checked then
            hookhttpopenrequest.install ()
            Hookinternetreadfile.install ()
        Else
            hookhttpopenrequest.uninstall ()
            Hookinternetreadfile.uninstall ()
        end If
    end Sub

End Class

Each name can be named, the specific will not say. What, this is a more fun toy bar.