AxibugRedirector/AxibugInject/Main.cs

using ClassLibrary1;
using EasyHook;
using System;
using System.Collections;
using System.Collections.Generic;
using System.Net.Sockets;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;
using System.Windows.Forms;
using static AxibugInject.ws2_32;


namespace AxibugInject
{

    [Serializable]
    public class HookParameter
    {
        public string Msg { get; set; }
        public int HostProcessId { get; set; }
        public string RedirectorArrs { get; set; }
    }

    public class Main : IEntryPoint
    {
        public LocalHook GetHostByNameHook = null;
        public LocalHook GetHostByAddrHook = null;
        public LocalHook gethostnameHook = null;
        public LocalHook connectHook = null;
        public LocalHook WSAConnectHook = null;

        public static Dictionary<string, string> mDictHostToIP = new Dictionary<string, string>();
        public Main(
            RemoteHooking.IContext context,
            string channelName
            , HookParameter parameter
            )
        {
            
            
            string[] RedirectorArrs = parameter.RedirectorArrs.Split('|');
            try
            {
                for(int i = 0;i < RedirectorArrs.Length;i++)
                {
                    string line = RedirectorArrs[i].Trim();
                    if (string.IsNullOrEmpty(line))
                        continue;
                    string[] arr = RedirectorArrs[i].Trim().Split(':');
                    if (arr.Length < 2)
                        continue;
                    mDictHostToIP[arr[0].Trim()] = arr[1].Trim();
                }
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.ToString());
            }

            MessageBox.Show(parameter.Msg + ",并加载:" + mDictHostToIP.Count + "个重定向配置", "Hooked");
        }

        public void Run(
            RemoteHooking.IContext context,
            string channelName
            , HookParameter parameter
            )
        {
            try
            {
                ConsoleShow.Log($"Hook函数ws2_32.dll->gethostbyname");
                GetHostByNameHook = LocalHook.Create(
                    LocalHook.GetProcAddress("ws2_32.dll", "gethostbyname"),
                    new DGetHostByName(GetHostByName_Hooked),
                    this);
                GetHostByNameHook.ThreadACL.SetExclusiveACL(new int[1]);

                ConsoleShow.Log($"Hook函数ws2_32.dll->gethostbyaddr");
                GetHostByAddrHook = LocalHook.Create(
                    LocalHook.GetProcAddress("ws2_32.dll", "gethostbyaddr"),
                    new Dgethostbyaddr(gethostbyaddr_Hooked),
                    this);
                GetHostByAddrHook.ThreadACL.SetExclusiveACL(new int[1]);

                ConsoleShow.Log($"Hook函数ws2_32.dll->gethostname");
                gethostnameHook = LocalHook.Create(
                    LocalHook.GetProcAddress("ws2_32.dll", "gethostname"),
                    new Dgethostname(gethostname_Hooked),
                    this);
                gethostnameHook.ThreadACL.SetExclusiveACL(new int[1]);

                ConsoleShow.Log($"Hook函数ws2_32.dll->connect");
                connectHook = LocalHook.Create(
                    LocalHook.GetProcAddress("ws2_32.dll", "connect"),
                    new Dconnect(connect_Hooked),
                    this);
                connectHook.ThreadACL.SetExclusiveACL(new int[1]);


                ConsoleShow.Log($"Hook函数ws2_32.dll->WSAConnect");
                WSAConnectHook = LocalHook.Create(
                    LocalHook.GetProcAddress("ws2_32.dll", "WSAConnect"),
                    new DWSAConnect(WSAConnect_Hooked),
                    this);
                WSAConnectHook.ThreadACL.SetExclusiveACL(new int[1]);
                
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message);
                return;
            }

            try
            {
                while (true)
                {
                    Thread.Sleep(10);
                }
            }
            catch
            {

            }
        }

        #region gethostbyname

        [DllImport("ws2_32.dll", EntryPoint = "gethostbyname", CharSet = CharSet.Ansi)]
        public static extern IntPtr gethostbyname(String name);

        [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Ansi)]
        delegate IntPtr DGetHostByName(String name);
        static IntPtr GetHostByName_Hooked(
            String name)
        {
            try
            {
                ConsoleShow.Log($"gethostbyname[调用]name->{name}");
                Main This = (Main)HookRuntimeInfo.Callback;
                if (mDictHostToIP.ContainsKey(name.ToLower()))
                {
                    ConsoleShow.Log($"gethostbyname[访问并重定向]{name}->{mDictHostToIP[name]}");
                    name = mDictHostToIP[name.ToLower()];
                }
                else
                {
                    ConsoleShow.Log("gethostbyname[访问]：" + name);
                }
            }
            catch
            {
            }

            // call original API...
            return gethostbyname(
                name);
        }
        #endregion

        #region gethostname

        [DllImport("ws2_32.dll", SetLastError = true)]
        static extern int gethostname(StringBuilder name, int length);

        [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Ansi)]
        delegate int Dgethostname(StringBuilder name, int length);
        static int gethostname_Hooked(StringBuilder name, int length)
        {
            ConsoleShow.Log($"gethostname[调用]name->{name} length->{length}");
            // call original API...
            return gethostname(name, length);
        }
        #endregion

        #region gethostbyaddr

        [DllImport("ws2_32.dll", EntryPoint = "gethostbyaddr", CharSet = CharSet.Ansi)]
        public static extern IntPtr gethostbyaddr(String addr, int len,int type);

        [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Ansi)]
        delegate IntPtr Dgethostbyaddr(String addr, int len, int type);
        static IntPtr gethostbyaddr_Hooked(String addr, int len,int type)
        {
            ConsoleShow.Log($"gethostbyaddr[调用]addr->{addr} len->{len} type->{type}");
            try
            {
                Main This = (Main)HookRuntimeInfo.Callback;
                if (mDictHostToIP.ContainsKey(addr.ToLower()))
                {
                    ConsoleShow.Log($"gethostbyaddr[访问并重定向]{addr}->{mDictHostToIP[addr]}");
                    addr = mDictHostToIP[addr.ToLower()];
                }
                else
                {
                    ConsoleShow.Log("gethostbyaddr[访问]：" + addr);
                }
            }
            catch
            {
            }

            // call original API...
            return gethostbyaddr(addr, len, type);
        }
        #endregion


        #region connect
        [DllImport("ws2_32.dll")]
        public static extern int connect(IntPtr SocketHandle, ref sockaddr_in addr, int addrsize);

        [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Ansi)]
        delegate int Dconnect(IntPtr SocketHandle, ref sockaddr_in addr, int addrsize);
        static int connect_Hooked(IntPtr SocketHandle, ref sockaddr_in addr, int addrsize)
		{

			ConsoleShow.Log($"connect[调用]SocketHandle->{SocketHandle} addr->{addr} addrsize->{addrsize}");
			ConsoleShow.Log($"connect sockaddr_in 详情 :sin_family->{addr.sin_family} sin_addr->{SwapToIP(addr.sin_addr)} sin_port->{GetPort(addr.sin_port)}");

			// call original API...
			return connect(SocketHandle, ref addr, addrsize);
        }


        
		#endregion

		#region WSAConnect

		[DllImport("ws2_32.dll", SetLastError = true)]
        internal static extern SocketError WSAConnect(
IntPtr SocketHandle, ref sockaddr_in addr, int addrsize,
	[In] IntPtr lpCallerData,
    [Out] IntPtr lpCalleeData,
    [In] IntPtr lpSQOS,
    [In] IntPtr lpGQOS);

        [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Ansi)]
        delegate SocketError DWSAConnect(
IntPtr SocketHandle, ref sockaddr_in addr, int addrsize,
	[In] IntPtr lpCallerData,
	[Out] IntPtr lpCalleeData,
	[In] IntPtr lpSQOS,
	[In] IntPtr lpGQOS);

        static SocketError WSAConnect_Hooked(
IntPtr SocketHandle, ref sockaddr_in addr, int addrsize,
	[In] IntPtr lpCallerData,
	[Out] IntPtr lpCalleeData,
	[In] IntPtr lpSQOS,
	[In] IntPtr lpGQOS)
		{
			ConsoleShow.Log($"connect[调用]SocketHandle->{SocketHandle} addr->{addr} addrsize->{addrsize}");
			ConsoleShow.Log($"connect sockaddr_in 详情 :sin_family->{addr.sin_family} sin_addr->{SwapToIP(addr.sin_addr)} sin_port->{GetPort(addr.sin_port)}");

			return WSAConnect(SocketHandle, ref addr, addrsize, lpCallerData, lpCalleeData, lpSQOS, lpGQOS);
        }

		#endregion



		#region 工具

		static int GetPort(ushort Tbed)
		{
			if (Tbed < 256)
				return Tbed;

			byte gao = (byte)(Tbed >> 8);
			byte di = (byte)(Tbed & 0xff);

			ushort a = (ushort)(gao << 8);
			ushort b = (ushort)di;
			//ushort newBed = (ushort)(a | di);

			ushort newT = (ushort)(gao | di << 8);
			return newT;
		}

		public static string SwapToIP(uint value)
		{
			byte[] data = BitConverter.GetBytes(value);

			string result = "";
			//猜测
			for (int i = 0; i < data.Length; i++)
			{
				if (!string.IsNullOrEmpty(result))
					result += ".";
				result += data[i];
			}

			return result;
		}
		#endregion
	}
}