关于进程间复制socket句柄遇到的问题!

[shines77]

我的代码如下:

SOCKET targetSocket, sockets;
HANDLE hSocket = NULL;
HANDLE hTargetProcesss = NULL;

targetSocket = ....;

hTargetProcesss = OpenProcess(PROCESS_DUP_HANDLE,
true,
g_dwTargetProcessId);

if (hTargetProcesss)
{
BOOL bSuccess = DuplicateHandle(hTargetProcesss,
(HANDLE)targetSocket,
GetCurrentProcess(),
&hSocket,
STANDARD_RIGHTS_REQUIRED, // 此处换为NULL, 最后一个参数
TRUE, // 用DUPLICATE_SAME_ACCESS都不行
0 /*DUPLICATE_SAME_ACCESS*/);

// 返回值为0, 复制不成功

CloseHandle(hTargetProcesss);
}

DWORD dwErr = GetLastError(); // 错误代码 ERROR_ACCESS_DENIED == 5,
// Access is denied.

sockets = (SOCKET)hSocket; // 总为0?? 复制失败

为什么会失败? 是不是socket句柄不是这么复制的, 那么该怎么使用? 请指教!

[shines77]

targetSocket是通过文件映射取得的,这个不会弄错,

前面的结果是Debug模式下得到的,经过在Release模式下输出LOG判断,是这里出了问题

大概是目标的进程对自身有保护吧, 我已经提升了调试权限

目标进程是某游戏可能HOOK了OpenProcess或有其他保护, 不得而知, 有懂的赐教
实在不行就去系统把所有的句柄枚举一遍, 不过那样效率太低了....

hTargetProcesss = OpenProcess(PROCESS_DUP_HANDLE, true, g_dwTargetProcessId);

//这里返回的是NULL, GetLastError 也是 5(Access is denied)

如果换成
hTargetProcesss = OpenProcess(PROCESS_ALL_ACCESS, true, g_dwTargetProcessId);
可以返回目标进程句柄, 但是DuplicateHandle返回值是0, 错误仍然为

DWORD dwErr = GetLastError(); // 错误代码 ERROR_ACCESS_DENIED == 5,
// Access is denied.

[shines77]

我这里的hTargetProcesss 就是hSourceProcessHandle, 我之所以叫
目标进程是相对于习惯来说的:-)

DuplicateHandle的意思是从Source -> 到Target, 这里的Target就是当前进程,也就是目的地

而我只是从我的习惯把他反过来了

权限我已经提升了, 没用

[shines77]

我拿其他的已知的进程ID和socket句柄测试过了, 可以复制到本地进程, 这是没有错的

而且可以获得socket的 IP和端口 等信息

就是我要转换的进程的不行:-)

[NowCan]

这么邪门？你试试FPort能不能正常工作。FPort的原理和你这个类似。

[shines77]

好家伙, FPort 干脆连这个进程都找不到!! 我FT, WPE Pro也是一样....

他们大概都没有用CreateToolhelp32Snapshot, Process32Next

[wsmagic]

老公，我帮你，这个我会，可简单了~~~~`那就是，我们不做它了，换个别地玩玩~~~~~~``：）

[shines77]

看不见,自己up一下

[shines77]

自己顶一下

[littlegang]

会不会你的STANDARD_RIGHTS_REQUIRED权限要求太高？
socket的话，你试过只是GENERIC_READ|GENERIC_WRITE可以吗

[shines77]

应该是OpenProcess被Hook的原因, 我复制了一个kernel32.dll, 然后LoadLibrary里面的OpenProcess, 就可以了

所以好的办法是去掉Hook,

[shines77]

晕，不该让女人看到这些贴。。。。

我还是放弃复制句柄了，另想办法

[shines77]

考虑再三, 还是在HOOK完了以后把socket的信息IP,端口转换好, 写到文件映射,
不用句柄复制了, 因为有些时候你在别的进程要复制的时候, 那个句柄可能可以关闭了,
这样导致有时候得不到想要的信息

谢谢大家, 散分

[sevencat]

我有个建议，可以HOOK一下ws2help.dll这个DLL函数，把你做的这个DLL直接放到你的游戏目录下面，然后基本上都能掌握了吧。
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <winsock2.h>
#include <WS2spi.h>

#ifdef WS2HELP_EXPORTS
#define WS2HELP_API __declspec(dllexport)
#else
#define WS2HELP_API __declspec(dllimport)
#endif


void Init();
void Deinit();

struct WSHANDLE_CONTEXT
{
LONG RefCount; // Context reference count
HANDLE Handle; // Handle that corresponds to context
};
typedef WSHANDLE_CONTEXT *LPWSHANDLE_CONTEXT;

typedef int LPCONTEXT_TABLE;

typedef void *LPFN_CONTEXT_ENUMERATOR;

DWORD WINAPI WahCloseApcHelper(IN HANDLE HelperHandle);
DWORD WINAPI WahCloseHandleHelper(IN HANDLE HelperHandle);
DWORD WINAPI WahCloseNotificationHandleHelper(IN HANDLE HelperHandle);
DWORD WINAPI WahCloseSocketHandle(IN HANDLE HelperHandle,SOCKET s);
DWORD WINAPI WahCloseThread(IN HANDLE HelperHandle,IN LPWSATHREADID ThreadId);
DWORD WINAPI WahCompleteRequest(IN HANDLE HelperHandle,IN SOCKET s,IN LPWSAOVERLAPPED lpOverlapped,IN DWORD dwError,IN DWORD cbTransferred);
DWORD WINAPI WahCreateHandleContextTable(LPCONTEXT_TABLE FAR * Table);
DWORD WINAPI WahCreateNotificationHandle(IN HANDLE HelperHandle,OUT HANDLE *h);
DWORD WINAPI WahCreateSocketHandle(IN HANDLE HelperHandle,OUT SOCKET *s);
DWORD WINAPI WahDestroyHandleContextTable(LPCONTEXT_TABLE Table);
DWORD WINAPI WahDisableNonIFSHandleSupport (VOID);
DWORD WINAPI WahEnableNonIFSHandleSupport (VOID);
BOOL WINAPI WahEnumerateHandleContexts(LPCONTEXT_TABLE Table,LPFN_CONTEXT_ENUMERATOR Enumerator,LPVOID EnumCtx);
LPWSHANDLE_CONTEXT WINAPI WahInsertHandleContext(LPCONTEXT_TABLE Table,LPWSHANDLE_CONTEXT HContext);
DWORD WINAPI WahNotifyAllProcesses (IN HANDLE HelperHandle);
DWORD WINAPI WahOpenApcHelper(OUT LPHANDLE HelperHandle);
DWORD WINAPI WahOpenCurrentThread(IN HANDLE HelperHandle,OUT LPWSATHREADID ThreadId);
DWORD WINAPI WahOpenHandleHelper(OUT LPHANDLE HelperHandle);
DWORD WINAPI WahOpenNotificationHandleHelper(OUT LPHANDLE HelperHandle);
DWORD WINAPI WahQueueUserApc(IN HANDLE HelperHandle,IN LPWSATHREADID ThreadId,IN LPWSAUSERAPC ApcRoutine,IN ULONG_PTR ApcContext OPTIONAL);
LPWSHANDLE_CONTEXT WINAPI WahReferenceContextByHandle(LPCONTEXT_TABLE Table,HANDLE Handle);
DWORD WINAPI WahRemoveHandleContext(LPCONTEXT_TABLE Table,LPWSHANDLE_CONTEXT HContext);
DWORD WINAPI WahWaitForNotification(HANDLE HelperHandle,HANDLE h,LPWSAOVERLAPPED lpOverlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine);






typedef DWORD (WINAPI *t_WahCloseApcHelper)(HANDLE HelperHandle);
typedef DWORD (WINAPI *t_WahCloseHandleHelper)(HANDLE HelperHandle);
typedef DWORD (WINAPI *t_WahCloseNotificationHandleHelper)(IN HANDLE HelperHandle);
typedef DWORD (WINAPI *t_WahCloseSocketHandle)(IN HANDLE HelperHandle,SOCKET s);
typedef DWORD (WINAPI * t_WahCloseThread)(IN HANDLE HelperHandle,IN LPWSATHREADID ThreadId);
typedef DWORD (WINAPI * t_WahCompleteRequest)(IN HANDLE HelperHandle,IN SOCKET s,IN LPWSAOVERLAPPED lpOverlapped,IN DWORD dwError,IN DWORD cbTransferred);
typedef DWORD (WINAPI * t_WahCreateHandleContextTable)(LPCONTEXT_TABLE FAR * Table);
typedef DWORD (WINAPI * t_WahCreateNotificationHandle)(IN HANDLE HelperHandle,OUT HANDLE *h);
typedef DWORD (WINAPI * t_WahCreateSocketHandle)(IN HANDLE HelperHandle,OUT SOCKET *s);
typedef DWORD (WINAPI * t_WahDestroyHandleContextTable)(LPCONTEXT_TABLE Table);
typedef DWORD (WINAPI * t_WahDisableNonIFSHandleSupport)(VOID);
typedef DWORD (WINAPI * t_WahEnableNonIFSHandleSupport) (VOID);
typedef BOOL (WINAPI * t_WahEnumerateHandleContexts)(LPCONTEXT_TABLE Table,LPFN_CONTEXT_ENUMERATOR Enumerator,LPVOID EnumCtx);
typedef LPWSHANDLE_CONTEXT (WINAPI * t_WahInsertHandleContext)(LPCONTEXT_TABLE Table,LPWSHANDLE_CONTEXT HContext);
typedef DWORD (WINAPI * t_WahNotifyAllProcesses) (IN HANDLE HelperHandle);
typedef DWORD (WINAPI * t_WahOpenApcHelper)(OUT LPHANDLE HelperHandle);
typedef DWORD (WINAPI * t_WahOpenCurrentThread)(IN HANDLE HelperHandle,OUT LPWSATHREADID ThreadId);
typedef DWORD (WINAPI * t_WahOpenHandleHelper)(OUT LPHANDLE HelperHandle);
typedef DWORD (WINAPI * t_WahOpenNotificationHandleHelper)(OUT LPHANDLE HelperHandle);
typedef DWORD (WINAPI * t_WahQueueUserApc)(IN HANDLE HelperHandle,IN LPWSATHREADID ThreadId,IN LPWSAUSERAPC ApcRoutine,IN ULONG_PTR ApcContext OPTIONAL);
typedef LPWSHANDLE_CONTEXT (WINAPI * t_WahReferenceContextByHandle)(LPCONTEXT_TABLE Table,HANDLE Handle);
typedef DWORD (WINAPI * t_WahRemoveHandleContext)(LPCONTEXT_TABLE Table,LPWSHANDLE_CONTEXT HContext);
typedef DWORD (WINAPI * t_WahWaitForNotification)(HANDLE HelperHandle,HANDLE h,LPWSAOVERLAPPED lpOverlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine);

[sevencat]

#include "ws2help.h"
#include "log.h"

CLog g_Log("sc.txt");

BOOL APIENTRY DllMain( HANDLE hModule,DWORD ul_reason_for_call, LPVOID lpReserved)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
Init();
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
Deinit();
break;
}
return TRUE;
}

HMODULE g_ws2;

t_WahOpenApcHelper pWahOpenApcHelper;
t_WahCloseApcHelper pWahCloseApcHelper;
t_WahOpenCurrentThread pWahOpenCurrentThread;
t_WahCloseThread pWahCloseThread;
t_WahQueueUserApc pWahQueueUserApc;

t_WahOpenHandleHelper pWahOpenHandleHelper;
t_WahCloseHandleHelper pWahCloseHandleHelper;
t_WahCreateSocketHandle pWahCreateSocketHandle;
t_WahCloseSocketHandle pWahCloseSocketHandle;
t_WahCompleteRequest pWahCompleteRequest;
t_WahEnableNonIFSHandleSupport pWahEnableNonIFSHandleSupport;
t_WahDisableNonIFSHandleSupport pWahDisableNonIFSHandleSupport;

t_WahOpenNotificationHandleHelper pWahOpenNotificationHandleHelper;
t_WahCloseNotificationHandleHelper pWahCloseNotificationHandleHelper;
t_WahCreateNotificationHandle pWahCreateNotificationHandle;
t_WahWaitForNotification pWahWaitForNotification;
t_WahNotifyAllProcesses pWahNotifyAllProcesses;

t_WahCreateHandleContextTable pWahCreateHandleContextTable;
t_WahDestroyHandleContextTable pWahDestroyHandleContextTable;
t_WahReferenceContextByHandle pWahReferenceContextByHandle;
t_WahInsertHandleContext pWahInsertHandleContext;
t_WahRemoveHandleContext pWahRemoveHandleContext;
t_WahEnumerateHandleContexts pWahEnumerateHandleContexts;


void Init()
{
g_Log.log(__FUNCTION__,"Enter...");
g_ws2=LoadLibrary("xws2help.dll");
pWahOpenApcHelper=(t_WahOpenApcHelper)GetProcAddress(g_ws2,"WahOpenApcHelper");
pWahCloseApcHelper=(t_WahCloseApcHelper)GetProcAddress(g_ws2,"WahCloseApcHelper");
pWahOpenCurrentThread=(t_WahOpenCurrentThread)GetProcAddress(g_ws2,"WahOpenCurrentThread");
pWahCloseThread=(t_WahCloseThread)GetProcAddress(g_ws2,"WahCloseThread");
pWahQueueUserApc=(t_WahQueueUserApc)GetProcAddress(g_ws2,"WahQueueUserApc");
pWahOpenHandleHelper=(t_WahOpenHandleHelper)GetProcAddress(g_ws2,"WahOpenHandleHelper");
pWahCloseHandleHelper=(t_WahCloseHandleHelper)GetProcAddress(g_ws2,"WahCloseHandleHelper");
pWahCreateSocketHandle=(t_WahCreateSocketHandle)GetProcAddress(g_ws2,"WahCreateSocketHandle");
pWahCloseSocketHandle=(t_WahCloseSocketHandle)GetProcAddress(g_ws2,"WahCloseSocketHandle");
pWahCompleteRequest=(t_WahCompleteRequest)GetProcAddress(g_ws2,"WahCompleteRequest");
pWahEnableNonIFSHandleSupport=(t_WahEnableNonIFSHandleSupport)GetProcAddress(g_ws2,"WahEnableNonIFSHandleSupport");
pWahDisableNonIFSHandleSupport=(t_WahDisableNonIFSHandleSupport)GetProcAddress(g_ws2,"WahDisableNonIFSHandleSupport");
pWahOpenNotificationHandleHelper=(t_WahOpenNotificationHandleHelper)GetProcAddress(g_ws2,"WahOpenNotificationHandleHelper");
pWahCloseNotificationHandleHelper=(t_WahCloseNotificationHandleHelper)GetProcAddress(g_ws2,"WahCloseNotificationHandleHelper");
pWahCreateNotificationHandle=(t_WahCreateNotificationHandle)GetProcAddress(g_ws2,"WahCreateNotificationHandle");
pWahWaitForNotification=(t_WahWaitForNotification)GetProcAddress(g_ws2,"WahWaitForNotification");
pWahNotifyAllProcesses=(t_WahNotifyAllProcesses)GetProcAddress(g_ws2,"WahNotifyAllProcesses");
pWahCreateHandleContextTable=(t_WahCreateHandleContextTable)GetProcAddress(g_ws2,"WahCreateHandleContextTable");
pWahDestroyHandleContextTable=(t_WahDestroyHandleContextTable)GetProcAddress(g_ws2,"WahDestroyHandleContextTable");
pWahReferenceContextByHandle=(t_WahReferenceContextByHandle)GetProcAddress(g_ws2,"WahReferenceContextByHandle");
pWahInsertHandleContext=(t_WahInsertHandleContext)GetProcAddress(g_ws2,"WahInsertHandleContext");
pWahRemoveHandleContext=(t_WahRemoveHandleContext)GetProcAddress(g_ws2,"WahRemoveHandleContext");
pWahEnumerateHandleContexts=(t_WahEnumerateHandleContexts)GetProcAddress(g_ws2,"WahEnumerateHandleContexts");
}

void Deinit()
{
FreeLibrary(g_ws2);
}


DWORD WINAPI WahCloseApcHelper(IN HANDLE HelperHandle)
{
return pWahCloseApcHelper(HelperHandle);
}

DWORD WINAPI WahCloseHandleHelper(IN HANDLE HelperHandle)
{
return pWahCloseApcHelper(HelperHandle);
}

DWORD WINAPI WahCloseNotificationHandleHelper(IN HANDLE HelperHandle)
{
return pWahCloseNotificationHandleHelper(HelperHandle);
}

DWORD WINAPI WahCloseSocketHandle(IN HANDLE HelperHandle,SOCKET s)
{
return pWahCloseSocketHandle(HelperHandle,s);
}

DWORD WINAPI WahCloseThread(IN HANDLE HelperHandle,IN LPWSATHREADID ThreadId)
{
return pWahCloseThread(HelperHandle,ThreadId);
}

DWORD WINAPI WahCompleteRequest(IN HANDLE HelperHandle,IN SOCKET s,IN LPWSAOVERLAPPED lpOverlapped,IN DWORD dwError,IN DWORD cbTransferred)
{
return pWahCompleteRequest(HelperHandle,s,lpOverlapped,dwError,cbTransferred);
}

DWORD WINAPI WahCreateHandleContextTable(LPCONTEXT_TABLE FAR * Table)
{
g_Log.log(__FUNCTION__,"Created once");
return pWahCreateHandleContextTable(Table);
}

DWORD WINAPI WahCreateNotificationHandle(IN HANDLE HelperHandle,OUT HANDLE *h)
{
return pWahCreateNotificationHandle(HelperHandle,h);
}

DWORD WINAPI WahCreateSocketHandle(IN HANDLE HelperHandle,OUT SOCKET *s)
{
return pWahCreateSocketHandle(HelperHandle,s);
}

DWORD WINAPI WahDestroyHandleContextTable(LPCONTEXT_TABLE Table)
{
return pWahDestroyHandleContextTable(Table);
}

[sevencat]

DWORD WINAPI WahDisableNonIFSHandleSupport (VOID)
{
return pWahDisableNonIFSHandleSupport();
}

DWORD WINAPI WahEnableNonIFSHandleSupport (VOID)
{
return pWahEnableNonIFSHandleSupport();
}

BOOL WINAPI WahEnumerateHandleContexts(LPCONTEXT_TABLE Table,LPFN_CONTEXT_ENUMERATOR Enumerator,LPVOID EnumCtx)
{
return pWahEnumerateHandleContexts(Table,Enumerator,EnumCtx);
}

LPWSHANDLE_CONTEXT WINAPI WahInsertHandleContext(LPCONTEXT_TABLE Table,LPWSHANDLE_CONTEXT HContext)
{
return pWahInsertHandleContext(Table,HContext);
}

DWORD WINAPI WahNotifyAllProcesses (IN HANDLE HelperHandle)
{
return pWahNotifyAllProcesses(HelperHandle);
}

DWORD WINAPI WahOpenApcHelper(OUT LPHANDLE HelperHandle)
{
return pWahOpenApcHelper(HelperHandle);
}

DWORD WINAPI WahOpenCurrentThread(IN HANDLE HelperHandle,OUT LPWSATHREADID ThreadId)
{
return pWahOpenCurrentThread(HelperHandle,ThreadId);
}

DWORD WINAPI WahOpenHandleHelper(OUT LPHANDLE HelperHandle)
{
return pWahOpenHandleHelper(HelperHandle);
}

DWORD WINAPI WahOpenNotificationHandleHelper(OUT LPHANDLE HelperHandle)
{
return pWahOpenNotificationHandleHelper(HelperHandle);
}

DWORD WINAPI WahQueueUserApc(IN HANDLE HelperHandle,IN LPWSATHREADID ThreadId,IN LPWSAUSERAPC ApcRoutine,IN ULONG_PTR ApcContext OPTIONAL)
{
return pWahQueueUserApc(HelperHandle,ThreadId,ApcRoutine,ApcContext);
}

LPWSHANDLE_CONTEXT WINAPI WahReferenceContextByHandle(LPCONTEXT_TABLE Table,HANDLE Handle)
{
int table=(int)Table;
int hd=(int)Handle;
g_Log.log(__FUNCTION__,"table=%d,hd=%d",table,hd);
return pWahReferenceContextByHandle(Table,Handle);
}

DWORD WINAPI WahRemoveHandleContext(LPCONTEXT_TABLE Table,LPWSHANDLE_CONTEXT HContext)
{
return pWahRemoveHandleContext(Table,HContext);
}

DWORD WINAPI WahWaitForNotification(HANDLE HelperHandle,HANDLE h,LPWSAOVERLAPPED lpOverlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine)
{
return pWahWaitForNotification(HelperHandle,h,lpOverlapped,lpCompletionRoutine);
}

[sevencat]

然后这个游戏每调用一个SOCKET相关函数，都会进入这个DLL，只要他是链接到winsock2.dll的。

[九重霄]

gz

[shines77]

sevencat(七猫):
晕，现在的游戏那个还用winsock2.dll(应该是winsock.dll吧，即使wsock32.dll都少了)

我现在不是HOOK的问题，HOOK Socket API很容易搞定，问题可能是游戏HOOK了OpenProcess阻止别的进程打开游戏进程。

不过还是很谢谢贴这么长的东东，也许对其他人还是有点用的

[shines77]

更正一点 ws2help 应该是可以用在Windows Socket 2.0的

[sevencat]

就是ws2_32.dll，里面调用的这个DLL