WINSOCK SPI的问题

[whn]

我想拦截TCP包，所以就用SPI技术
我写了一个SPI的DLL
dll中输出了WSPStartup,
WSPStartup最后我这样；
nextproctable=*lpproctable;
lpproctable->lpWSPSendTo=WSPSend;
然后我重写了WSPSend()。
(我正确的安装了该spi dll)
问题是：每当有tcp连接时候,WSPStartup都调用正常
但WSPSend()就没有被调用过为什么?

我是按照网上一篇SPI的文章提供的代码作的!

[blue_laser]

gz

[ljp940531]

我正确的安装了该spi dll?确定吗？
是不是每次启动程序第一次连网动作都调用了你的WSPStartup

[whn]

是的，我正确安装了spi dll,
而且我加了调试代码，每一次联网的动作WSPStartup都得到成功的调用！
那到底问题出在哪里呢？
我用了网上的ipfilter.dll(是拦截QQ数据报的),好像也不能拦截啊，也是WSPStartup被成功调用

[ljp940531]

#define REG_INSTALL_KEY \
_T("SYSTEM\\CurrentControlSet\\Services\\WinSock2\\Xstudio_Min_Winsock_Spi")

//
// 全局变量，用来保存系统服务提供者30个服务函数指针
//
WSPPROC_TABLE NextProcTable ;

void GetRightEntryIdItem(
IN WSAPROTOCOL_INFOW *pProtocolInfo,
OUT TCHAR *sItem
)
{
if(pProtocolInfo->ProtocolChain.ChainLen <= 1)
{
_stprintf(sItem, _T("%u"), pProtocolInfo->dwCatalogEntryId);
}
else
{
_stprintf(sItem, _T("%u"), pProtocolInfo->ProtocolChain
.ChainEntries[pProtocolInfo->ProtocolChain.ChainLen - 1]);
}
}

BOOL GetHookProvider(
IN WSAPROTOCOL_INFOW *pProtocolInfo,
OUT TCHAR *sPathName
)
{
TCHAR sItem[21];
GetRightEntryIdItem(pProtocolInfo, sItem);

HKEY hSubkey;
DWORD ulDateLenth = MAX_PATH;
TCHAR sTemp[MAX_PATH];

if (RegOpenKeyEx(HKEY_LOCAL_MACHINE
, REG_INSTALL_KEY, 0, KEY_ALL_ACCESS, &hSubkey) != ERROR_SUCCESS)
return FALSE;
if (RegQueryValueEx(hSubkey, sItem, 0, NULL, (BYTE*)sTemp, &ulDateLenth)
|| ExpandEnvironmentStrings(sTemp, sPathName, ulDateLenth) == 0)
return FALSE;
if(sPathName[0] == '\0' && sTemp[0] != '\0')
_tcscpy(sPathName, sTemp);
RegCloseKey(hSubkey);

return TRUE;
}

SOCKET WSPAPI WSPSocket(
int af,
int type,
int protocol,
LPWSAPROTOCOL_INFOW lpProtocolInfo,
GROUP g,
DWORD dwFlags,
LPINT lpErrno
)
{
OutputDebugString(_T("MinWinsockSpi.dll: WSPSocket ...\n"));
// MessageBox(0,"蛤！你上不了网了","哈哈",0);
//return 0;
return NextProcTable.lpWSPSocket(
af, type, protocol, lpProtocolInfo, g, dwFlags, lpErrno);
}

int WSPAPI WSPSend(
SOCKET s,
LPWSABUF lpBuffers,
DWORD dwBufferCount,
LPDWORD lpNumberOfBytesSent,
DWORD dwFlags,
LPWSAOVERLAPPED lpOverlapped,
LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine,
LPWSATHREADID lpThreadId,
LPINT lpErrno
)
{
MessageBox(0,"WSPSend","哈哈",0);
return 0;
//return NextProcTable.lpWSPSend(s,lpBuffers,dwBufferCount,lp .....
}


BOOL WINAPI DllMain(
HINSTANCE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
return TRUE;
}

int WSPAPI WSPStartup(
WORD wVersionRequested,
LPWSPDATA lpWSPData,
LPWSAPROTOCOL_INFOW lpProtocolInfo,
WSPUPCALLTABLE upcallTable,
LPWSPPROC_TABLE lpProcTable
)
{
OutputDebugString(_T("MinWinsockSpi.dll: WSPStartup...\n"));

TCHAR sLibraryPath[512];
LPWSPSTARTUP WSPStartupFunc = NULL;
HMODULE hLibraryHandle = NULL;
INT ErrorCode = 0;

if (!GetHookProvider(lpProtocolInfo, sLibraryPath)
|| (hLibraryHandle = LoadLibrary(sLibraryPath)) == NULL
|| (WSPStartupFunc = (LPWSPSTARTUP)GetProcAddress(
hLibraryHandle, "WSPStartup")) == NULL
)
return WSAEPROVIDERFAILEDINIT;

if ((ErrorCode = WSPStartupFunc(wVersionRequested, lpWSPData
, lpProtocolInfo, upcallTable, lpProcTable)) != ERROR_SUCCESS)
return ErrorCode;

NextProcTable = *lpProcTable;

lpProcTable->lpWSPSocket = WSPSocket;
lpProcTable->lpWSPSend = WSPSend;

return 0;
}

通过调试