修改http请求文件为本地文件的一种方法hookInternetReadFile和HttpOpenRequest

1、修改 http 请求文件为本地文件的一种方法： hookInternetReadFile 和 HttpOpenRequest今天没事的时候学了一下easyhook来h ook本进程API,确实很简单就能hook。然后想到 这个问题：替换webbrowser请求的文件为本地文 件。有什么用就不说了，都懂。因为没有用API写过ht tp方面的东西，所以先hook了几个函数，其中 InternetReadFile是 webbrowser 用来获取文件的，而文件句柄可以来源于i nternetopenurl 和HttpOpenRequest 等API,挨个下一下钩子就知道用 的是 HttpOpenRe

2、quest 。当然，获取方法是多种多样的， 也可以用x64dbg等调试工具。确定下来hook这两 个可以达成目标就可以了：1、从HttpOpenRequest知道要下载的是哪个文件，过滤 需要替换的那个。2、HttpOpenRequest的返回值就是打开文件句柄了，在 InternetReadFile 中识别这个句柄就可以。3、在给InternetReadFile 的自定义例程中，对需要替换的 文件进行替换。接下来，让我们考虑一下替换的流程：webbrow ser调用InternetReadFile 的时候，先到达我们的自定义 例程，然后由我们调用API函数 InternetReadFile

3、，于是 我们可以在自定义函数中把相应文件句柄的数据请求吃掉 把我们的数据写入缓冲区，而后直接返回不掉用API。 对于我们不关心的文件句柄调用API。查看 InternetReadFile 的 API 声明：<DllImport(wininet.dll, SetLastError:=True)>Public Shared Function InternetReadFile(ByVal hFileAs IntPtr, ByVal lpBuffer As IntPtr, ByVal dwNumberOfBytesToRead As Integer, ByRef lpdwNumberOfB

4、ytesRead As Integer) As BooleanEnd Function可以知道，第一个参数是 HttpOpenRequest 返回的文件句 柄,lpbuffer是接收数据的缓冲区,dwnumb erofbytestoread是期望读取的字节数，即 缓冲区大小,lpdwnumberofbytesrea d是实际写入缓冲区的字节数。返回值表示函数调用是否成 功。所以，当lpdwnumberofbytesrea d为0且函数返回值为true时，达到文件结尾一一函数调用成功却没有数据写入，说明数据写完了。于是，在我们的自定义例程中也需要遵守该约定当写入数据时返回实际写入的数据大小，写完

5、数据后再次被调用时返回0并进行清理。首先，来看一下比较简单的一个hook:Imports System.Runtime.InteropServicesImports System.TextPublic Class HookHttpOpenRequest<DllImport(wininet.dll)>Public Shared FunctionHttpOpenRequestW(hConnect As IntPtr, szVerb As IntPtr, szURI As IntPtr, szHttpVersion As IntPtr, szReferer As IntPtr, acce

6、tpType As IntPtr, dwflags As Integer, dwcontext As IntPtr) As IntPtrEnd FunctionPrivate Delegate Function HttpOpenRequestDelegate(hConnect As IntPtr, szVerb As IntPtr, szURI As IntPtr, szHttpVersion As IntPtr, szReferer As IntPtr, accetpType As IntPtr, dwflags As Integer, dwcontext As IntPtr) As Int

7、PtrPrivate Shared hook As EasyHook.LocalHook =NothingFriend Shared Sub Install()Using hookIfEasyHook.NativeAPI.GetModuleHandle(wininet.dll) =IntPtr.Zero ThenEasyHook.NativeAPI.LoadLibrary(wininet.dll)End Ifhook =EasyHook.LocalHook.Create(EasyHook.LocalHook.GetPr ocAddress(wininet.dll, HttpOpenReques

8、tW), New HttpOpenRequestDelegate(AddressOf sendProc), Nothing)hook.ThreadACL.SetInclusiveACL(NewInteger() 0)End UsingEnd SubFriend Shared Sub UnInstall()Using hookIf hook IsNot Nothing Then hook.ThreadACL.SetExclusiveACL(NewInteger() 0)End IfEnd UsingEnd SubPrivate Shared Function sendProc(hConnect

9、As IntPtr, szVerb As IntPtr, szURI As IntPtr, szHttpVersion As IntPtr, szReferer As IntPtr, accetpType As IntPtr, dwflags As Integer, dwcontext As IntPtr) As IntPtrDim uri As String =Marshal.PtrToStringUni(szURI)Dim result As IntPtr = HttpOpenRequestW(hConnect, szVerb, szURI, szHttpVersion, szRefere

10、r, accetpType, dwflags, dwcontext)If uri.Contains(/56896-20170216102630488-270057596.jpg ) Then 根据名称区分要替换的图片 .HookInternetReadFile.CheatFileHandle =resultEnd IfReturn resultEndFunction End Classeasyhook用起来确实比较简单，首先是注入过程，因为 webbrowser 对wininte.dl 1 的力口 载是请求第一个页面时，所以可能导致这个DLL不在进程 空间，那么先加载它。之后的hook非常易懂

11、(函数名我 没有修改，复制粘贴的之前写的sendhook)，唯一需要注意的是实际hook的过程调用的是ThreadACL.SetlnclusiveACL , unhook类似。在自定 义函数中，首先调用API，得到句柄，然后根据要替换的 名称来确定是否启动给 lnternetReadFile 的自定义例程。而 后，看一下对数据的处理过程：lmports System.lOlmports System.Runtime.lnteropServicesPublic Class HooklnternetReadFile<Dlllmport(wininet.dll, SetLastError:=T

12、rue)>Public Shared Function lnternetReadFile(ByVal hFileAs lntPtr, ByVal lpBuffer As lntPtr, ByVal dwNumberOfBytesToRead As lnteger, ByRef lpdwNumberOfBytesRead As lnteger) As BooleanEnd FunctionPrivate Delegate Function InternetReadFileDelegate(ByVal hFile As IntPtr, ByVal lpBuffer As IntPtr, By

13、Val dwNumberOfBytesToRead As Integer, ByRef lpdwNumberOfBytesRead As Integer) As BooleanPrivate Shared hook As EasyHook.LocalHook =NothingFriend Shared CheatFileHandle As IntPtr = IntPtr.Zero 要替换的文件的句柄， 来源于 HttpOpenRequest 的返回值Friend Shared CheatFile() As Byte =File.ReadAllBytes(My.Application.Info.

14、DirectoryPath & abc.jpg)用于替换的文件Private Shared curcnt As Integer = 0Friend Shared Sub Install()Using hookIfEasyHook.NativeAPI.GetModuleHandle(wininet.dll) = IntPtr.Zero ThenEasyHook.NativeAPI.LoadLibrary(wininet.dll)End Ifhook =EasyHook.LocalHook.Create(EasyHook.LocalHook.GetPr ocAddress(wininet.

15、dll, InternetReadFile), New InternetReadFileDelegate(AddressOf sendProc), Nothing)hook.ThreadACL.SetInclusiveACL(NewInteger() 0)End UsingEnd SubFriend Shared Sub UnInstall()Using hookIf hook IsNot Nothing Thenhook.ThreadACL.SetExclusiveACL(NewInteger() 0)End IfEnd UsingEnd SubPrivate Shared Function

16、 sendProc(ByVal hFile As IntPtr, ByVal lpBuffer As IntPtr, ByVal dwNumberOfBytesToRead As Integer, ByRef lpdwNumberOfBytesRead As Integer) As BooleanIf hFile = CheatFileHandle ThenIf curcnt = CheatFile.Length Then CheatFileHandle = IntPtr.Zero curcnt = 0 lpdwNumberOfBytesRead = 0ElseIf curcnt + dwNu

17、mberOfBytesToRead<= CheatFile.Length Then lpdwNumberOfBytesRead = dwNumberOfBytesToReadMarshal.Copy(CheatFile, curcnt, lpBuffer, lpdwNumberOfBytesRead)curcnt +=dwNumberOfBytesToReadElse lpdwNumberOfBytesRead =CheatFile.Length - curcntMarshal.Copy(CheatFile, curcnt, lpBuffer, lpdwNumberOfBytesRead

18、)curcnt = CheatFile.LengthEnd IfEnd IfReturn TrueElseReturn InternetReadFile(hFile, lpBuffer, dwNumberOfBytesToRead, lpdwNumberOfBytesRead) End IfEnd FunctionEnd Class因为是一个基本结构范例，所以偷懒直接用了参数，这里应 该有错误处理过程才行hook的过程和前面一致，只是 在自定义函数中处理把自定义数据写入缓冲区然后返回了。 具体的API过程没有跟踪，所以不知道不调用InternetReadFile 这个API会不会有内存泄漏之类的什么 问题，如果需要调用也非常简单：在恰当的时机循环读取一 次就可以了。最后是窗体代码：Public Class Form1Private Sub Form1_Load(sender As Object, e AsEventArgs) Handles MyBase.Loadwb.Navigate( 201702/56896-20170216102630488-2700