ws_32.dll连接绕行钩没有连接失败

Question

我试图绕过ws_32.dll的连接功能.绕道工作,但在调用原始函数时出现问题.我使用一个相对未知的库来挂钩函数.它被称为WhiteMagic.它可以很好地与其他功能一起使用,而不是这个功能.

我在Internet Explorer上尝试过,我无法连接任何地方.如果我使用Thread.Sleep阻塞100毫秒,它的工作原理.

public static UIntPtr ConnectSocketDetoured(UIntPtr s, ref NativeSocks.sockaddr name, int namelen)
{
    Magic.Instance.Detours[DetouredConnectId].Remove();
    var retVal = ((NativeSocks.Dconnect)Magic.Instance.Detours[DetouredConnectId].TargetDelegate).Invoke(s, ref name, namelen);
    //var retVal = NativeSocks.connect(s, ref name, namelen); PINVOKE IMPORT DOESNT WORK TOO. 
    //IF I BLOCK HERE 100 MILLISECONDS THIS WORK.
    Magic.Instance.Detours[DetouredConnectId].Apply();

    return retVal;
}

[UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Ansi, SetLastError = false)]
public delegate UIntPtr Dconnect(UIntPtr s, ref sockaddr_in name, int namelen);

---

sockaddr_in Struct

    [StructLayoutAttribute(LayoutKind.Sequential, CharSet = CharSet.Ansi)]
    public struct sockaddr_in
    {
        public short sin_family;
        public ushort sin_port;
        public in_addr sin_addr;
        [MarshalAsAttribute(UnmanagedType.ByValTStr, SizeConst = 8)]
        public string sin_zero;
    }

    [StructLayoutAttribute(LayoutKind.Sequential)]
    public struct in_addr
    {
        public Anonymous1 S_un;
    }

    [StructLayoutAttribute(LayoutKind.Explicit)]
    public struct Anonymous1
    {
        [FieldOffsetAttribute(0)]
        public Anonymous2 S_un_b;

        [FieldOffsetAttribute(0)]
        public Anonymous3 S_un_w;

        [FieldOffsetAttribute(0)]
        public uint S_addr;
    }

    [StructLayoutAttribute(LayoutKind.Sequential)]
    public struct Anonymous2
    {
        public byte s_b1;
        public byte s_b2;
        public byte s_b3;
        public byte s_b4;
    }

    [StructLayoutAttribute(LayoutKind.Sequential)]
    public struct Anonymous3
    {
        public ushort s_w1;
        public ushort s_w2;
    }

我认为通过在删除钩子时阻塞绕行功能将导致WSAEWOULDBLOCK错误.因此,Internet浏览器在删除钩子时再次调用connect函数并调用原始工作函数.

WSAEWOULDBLOCK错误说明:

资源暂时不可用.从无法立即完成的非阻塞套接字上的操作返回此错误,例如当没有数据排队等待从套接字读取时的recv.这是一个非致命错误,应该稍后重试该操作.将WSAEWOULDBLOCK报告为在非阻塞SOCK_STREAM套接字上调用connect的结果是正常的,因为必须经过一段时间才能建立连接.

Answer 1

假设您正在使用此 WhiteMagic 库：http://www.gamedeception.net/threads/17994-C-WhiteMagic-Injected-NET-Helper-Library

每个 Detour 都有一个方法“CallOriginal”。尝试调用它，而不是删除/重新应用您的绕道。