The network data packet blocking other programs in Delphi

Sometimes we need to intercept the network data that other applications send and receive. For example, to the HTTP headers sent by the analysis, get the requested address, etc. we can use some tools such as WPE and sniffer to achieve this. But tools are limited, and to achieve more powerful functionality, Let's do it ourselves.

There are three ways to block network data packets, one is to set the NIC to promiscuous mode, this time you can monitor all the packets on the LAN, the second is the hook target process to send and receive the API function, the third method is to implement a broker's DLL. Here we use the Hook API method, This is easy to implement and will not get a lot of useless data (such as the first method will monitor all network data).

The following is a simplified version of the API hook, the principle is to use the message hook to inject the DLL code into the target process, and then use GetProcAddress to get the API function entry address, the function entry site to the definition of the function entry, so that the API function of the corresponding parameters , after processing, then change back to the Real API function entry address and call it.

HOOK. DLL's code:

Library Hook;
Uses
Sysutils,
Windows
Messages,
Apihook in "Apihook.pas";
Type
PData = ^tdata;
Tdata = Record
Hook:thandle;
Hooked:boolean;
End
Var
Dlldata:pdata;
{------------------------------------}
{Procedure name: HookProc
{Procedure function: Hook process
{Process parameters: Ncode, WParam, LPARAM message phase
{Off parameter
{------------------------------------}
Procedure HookProc (ncode, WParam, Lparam:longword); stdcall;
Begin
If not dlldata^. Hooked Then
Begin
Hookapi;
dlldata^. Hooked: = True;
End
Call Next Hook
CallNextHookEx (dlldata^. Hooks, ncode, WParam, LParam);
End
{------------------------------------}
{Function Name: Installhook
{function function: Install hook on specified window
{function parameter: Swindow: window to install hook
{return value: Success returns TRUE, Failure returns false
{------------------------------------}
function Installhook (Swindow:longword): Boolean;stdcall;
Var
Threadid:longword;
Begin
Result: = False;
dlldata^. Hook: = 0;
ThreadID: = GetWindowThreadProcessId (Swindow, nil);
Hook up to the specified window
dlldata^. Hook: = SetWindowsHookEx (Wh_getmessage, @HookProc, hinstance, ThreadID);
If dlldata^. Hook > 0 Then
Result: = True//Success Hook
Else
Exit
End
{------------------------------------}
{Procedure name: Unhook
{procedure function: Uninstall hook
{Procedure parameters: None
{------------------------------------}
Procedure Unhook;stdcall;
Begin
Unhookapi;
Uninstall Hook
UnhookWindowsHookEx (dlldata^. Hook);
End
{------------------------------------}
{Procedure name: DLL Entry function
{Procedure function: DLL initialization, release, etc.
{Procedure parameter: DLL state
{------------------------------------}
Procedure Mydllhandler (Reason:integer);
Var
Fhandle:longword;
Begin
Case Reason of
Dll_process_attach:
Begin//Create a file map to implement global variables in the DLL
Fhandle: = createfilemapping ($FFFFFFFF, Nil, page_readwrite, 0, $ffff, "Mydlldata");
If Fhandle = 0 Then
If GetLastError = Error_already_exists Then
Begin
Fhandle: = openfilemapping (file_map_all_access, False, "Mydlldata");
If Fhandle = 0 then Exit;
End Else Exit;
Dlldata: = MapViewOfFile (Fhandle, file_map_all_access, 0, 0, 0);
If dlldata = Nil Then
CloseHandle (Fhandle);
End
Dll_process_detach:
Begin
If assigned (dlldata) then
Begin
UnmapViewOfFile (dlldata);
Dlldata: = nil;
End
End
End
End
{$R *.res}
Exports
Installhook, Unhook, HookProc;
Begin
Dllproc: = @MyDLLHandler;
Mydllhandler (Dll_process_attach);
dlldata^. Hooked: = False;
End.
----------------------------------------------------------------------------------------
Code for Apihook.pas:
Unit Apihook;
Interface
Uses
Sysutils,
Windows, WinSock;
Type
The API function definition to hook
Tsockproc = function (s:tsocket; var Buf; Len, Flags:integer): Integer; stdcall;
Pjmpcode = ^tjmpcode;
Tjmpcode = Packed record
Jmpcode:byte;
Address:tsockproc;
Moveax:array [0..2] of BYTE;
End