C++ 接收函数

Question

我正在从我的服务器 (C++) 中挂接一些函数。我想 Hook 某些功能，以便能够转储数据包，一些客户端发送(连接/断开包)。我已经连接了函数 recv/recvfrom 和 WSARecv/WSARecvFrom。只有 WSARecvFrom 函数被调用(多次)，但仅在服务器启动时调用。我必须挂接哪些功能才能查找远程机器的连接/断开连接包？我注意到，在服务器上播放时，4 个接收函数从未被调用!为什么？

例子:

typedef int (WINAPI *def_recv)(SOCKET s, char* buf, int len, int flags);
def_recv Real_recv;
int WINAPI custom_recv(SOCKET s, char* buf, int len, int flags) {
    Log("recv ...");
    return Real_recv(s, buf, len, flags);
}
Real_recv = (def_recv)DetourFunction((PBYTE)(DWORD)GetProcAddress(GetModuleHandleA("ws2_32.dll"), "recv"),(PBYTE)&custom_recv);

Answer 1

来自 an answer of mine :

There are a lot of different functions used with sockets. Maybe the plugin is not using the function named recv. Off the top of my head I can think of recvfrom, recvmsg, WSARecv, WSARecvFrom, WSARecvMsg, ReadFile, ReadFileEx.

Then, the plugin could be doing requests with overlapped I/O (possibly complicated by completion routines or completion ports), in which case the data isn't stored during the e.g. ReadFile function call but at some later time. Hooking those would be considerably more challenging.