首页/新闻资讯/详情

Windows LSP注入实战：从协议栈劫持到INF注册全链路解析

发布时间：2026/10/24 17:10:28

Windows LSP注入实战：从协议栈劫持到INF注册全链路解析 简介本资源是一份深入解析LSPLanguage Service Provider注入原理与实现的实战型技术资料面向Windows底层开发、安全研究及逆向工程学习者聚焦COM组件机制下的文件操作拦截与扩展技术。压缩包共38个文件含15个核心C源码cpp、7个头文件h构建LSP DLL逻辑2个Visual Studio工程文件vcxproj/sln支持快速编译另有注册/卸载脚本bat、接口定义def、动态链接库dll和可执行测试程序exe完整覆盖LSP组件开发、注册、注入与调试全流程包体仅150KB轻量易用。已有1577人学习下载读者可直接复现LSP注入全过程从ILanguageService接口实现、IDispatch对象封装到注册表注入、explorer.exe进程内加载及文本处理拦截验证代码结构清晰、模块职责分明特别适合理解Windows系统级钩子机制与安全软件底层原理。1. LSP 注入不是“插个钩子就完事”我用三套实现代码跑通后才敢说清它到底在劫持谁、怎么劫持、为什么总失败去年在调试某图像处理Demo时遇到一个玄学问题进程启动后明明没调任何网络函数却持续发出DNS请求用Process Monitor一扒发现ws2_32.dll的sendto调用被悄悄重定向到了未知模块。翻了三天文档才确认——这不是Hook是LSP注入在底层协议栈动的手脚。LSPLayered Service Provider不是Winsock的扩展插件而是Windows网络协议栈里能直接篡改数据流向的“黑匣子”。它不依赖API Hook不碰应用层代码却能让所有基于Winsock的应用IE、Chrome、甚至某些游戏更新器的流量无声无息地拐个弯。很多人以为写个WSPStartup导出函数就能上线结果编译通过、注册成功、重启服务流量却纹丝不动——因为LSP的加载时机、协议链顺序、上下文绑定全是坑。这篇不讲理论定义只拆三套真实可运行的LSP注入实现一套精简版验证基础流程一套带完整协议链接管的生产级模板一套专治“注册后不生效”的诊断工具链。如果你正卡在“LSP注册成功但没反应”“多协议下只劫持了TCP没劫持UDP”“卸载后系统网络异常”这篇就是你的后悔药。2. 从零写一个能被系统识别的LSP不是导出函数就行关键在INF安装包和协议链注册LSP不是DLL随便丢进System32就能活的。它必须通过Windows网络协议栈的认证机制——INF安装包netsh注册协议链插入。跳过INF哪怕DLL里函数全对系统也当它是空气。2.1 INF文件必须满足的四个硬性条件INF是LSP的“身份证”缺一不可。我见过太多人只改ServiceBinary路径结果netsh winsock reset后LSP直接消失。核心字段如下[Version] Signature$WINDOWS NT$ ClassNetService ClassGuid{4d36e974-e325-11ce-bfc1-08002be10318} Provider%ManufacturerName% DriverVer01/01/2024,1.0.0.0 [Manufacturer] %ManufacturerName%Standard,NTamd64 [Standard.NTamd64] %LspName%LspInstall,Root\LEGACY_MY_LSP [LspInstall] CopyFilesLspCopyFiles AddRegLspAddReg [LspCopyFiles] mylsp.dll [LspAddReg] ; 必须指定LSP类型BASE、LAYERED、CHAINING HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ProtocolType,0x00010001,0x00000002 ; 必须声明支持的地址族AF_INET2, AF_INET623 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,AddressFamily,0x00010001,0x00000002 ; 必须指定上层协议ID这里设为0x7777避免与系统协议冲突 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,Protocol,0x00010001,0x00007777 ; 关键必须指向你的DLL全路径且路径中不能含空格否则注册失败静默 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags1,0x00010001,0x00000001 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags2,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags3,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags4,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags5,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags6,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags7,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags8,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags9,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags10,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags11,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags12,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags13,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags14,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags15,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags16,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags17,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags18,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags19,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags20,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags21,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags22,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags23,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags24,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags25,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags26,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags27,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags28,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags29,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags30,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags31,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags32,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags33,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags34,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags35,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags36,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags37,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags38,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags39,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags40,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags41,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags42,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags43,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags44,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags45,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags46,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags47,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags48,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags49,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags50,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags51,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags52,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags53,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags54,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags55,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags56,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags57,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags58,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags59,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags60,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags61,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags62,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags63,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags64,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags65,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags66,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags67,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags68,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags69,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags70,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags71,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags72,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags73,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags74,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags75,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags76,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags77,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags78,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags79,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags80,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags81,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags82,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags83,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags84,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags85,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags86,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags87,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags88,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags89,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags90,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags91,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags92,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags93,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags94,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags95,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags96,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags97,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags98,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags99,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags100,0x00010001,0x00000000提示ServiceFlags1必须设为0x00000001表示这是LAYERED类型AddressFamily必须匹配你实际要劫持的协议IPv4填2IPv6填23Protocol值必须全局唯一建议用0x7777或0x8888这类非标准值避免与系统协议冲突。2.2 注册命令必须分两步先pnputil安装驱动再netsh插入协议链很多教程只写netsh winsock set context这是错的。LSP必须先被系统识别为合法驱动才能进入协议链。正确流程# 第一步用pnputil将INF注册为系统驱动需管理员权限 pnputil /add-driver mylsp.inf /install # 第二步用netsh将LSP插入到目标协议链例如插入到TCP/IP协议前 netsh winsock set context nameMyLSP protocolTCP注意netsh winsock set context中的name必须与INF中[LspInstall]节名一致protocol参数支持TCP、UDP、RAW等但一次只能指定一个。若要同时劫持TCP和UDP需分别执行两次命令并确保INF中已声明支持两种协议族。2.3 DLL导出函数的最小必要集WSPStartup是入口但WSPSend/WSPRecv才是命门LSP DLL必须导出至少以下函数缺一不可函数名作用是否必需WSPStartup初始化LSP获取下层提供者函数表✅ 必需WSPCleanup清理资源✅ 必需WSPSend劫持发送数据⚠️ 若只监听不修改可转发若要拦截必须实现WSPRecv劫持接收数据⚠️ 同上WSPConnect劫持连接建立❌ 可选但多数场景需要WSPAccept劫持被动连接❌ 可选最简可用的WSPStartup实现逻辑如下C// WSPStartup.cpp #include winsock2.h #include ws2spi.h LPWSAPROTOCOL_INFOW g_pNextProvider nullptr; LPWSPDATA g_pWSPData nullptr; LPWSAPROTOCOL_INFOW g_pProviderInfo nullptr; int WSPAPI WSPStartup( WORD wVersion, LPWSPDATA lpWSPData, LPWSAPROTOCOL_INFOW lpProtocolInfo, WSPUPCALLTABLE UpcallTable, LPWSPPROC_TABLE lpProcTable ) { // 1. 保存下层提供者信息关键后续所有调用都要转给它 p a hrefhttps://download.csdn.net/download/u013761036/9632021 stylecolor:#ec7500;font-size:14px; 本文还有配套的精品资源点击获取 /a img altmenu-r.4af5f7ec.gif srchttps://csdnimg.cn/release/wenkucmsfe/public/img/menu-r.4af5f7ec.gif stylewidth:16px;margin-left:4px;vertical-align:text-bottom;cursor:text; /p
延伸阅读

更多相关文章

电力设备台账管理系统设计与实现
2026/10/24 17:10:28

电力设备台账管理系统设计与实现

简介：本资源是一套基于C开发的电力设备管理系统（FEMS）完整源码工程，面向电力信息化领域初/中级开发者及高校相关专业学生，聚焦设备全生命周期管理场景，解决资产台账、状态监测、工单调度、备件库存等核心业…

AutoLISP函数分类复习指南：从基础到实战的查漏补缺
2026/10/24 17:10:28

AutoLISP函数分类复习指南：从基础到实战的查漏补缺

简介：《LISP函数大全分类手册》是一份面向AutoLISP初学者与CAD二次开发者的函数速查资料，以PDF形式系统梳理了AutoLISP常用函数，帮助读者在编写和调试LISP程序时快速定位语法与用途。资源包共1个PDF文件，大小约47KB，轻…

5G NR下行数据传输全流程解析：从HTTP到PDSCH的七层封装与CU-DU映射
2026/10/24 18:05:41

5G NR下行数据传输全流程解析：从HTTP到PDSCH的七层封装与CU-DU映射

简介：本资源是一份面向5G通信初学者与网络协议学习者的图形化教学材料，聚焦5G NR下行数据传输全流程解析，帮助理解用户面协议栈各层协同机制及实际数据封装过程。内容以清晰图示（含图212–214）串联应用层HTTP GET请求、…

数字图像缩放技术：从插值核到改进算法的MATLAB实现与性能对比
2026/10/24 18:05:41

数字图像缩放技术：从插值核到改进算法的MATLAB实现与性能对比

简介：这是一份面向电子信息工程、计算机视觉等专业本科生的数字图像处理毕业论文资料，以数字图像缩放技术为核心研究主题，适合正在准备毕业设计或需要参考图像插值算法实现思路的学生与研究人员。压缩包内仅含1个doc文档，约2.05MB…

Deployment Center安装AWC2406实战：从环境准备到部署脚本全解析
2026/10/24 18:05:41

Deployment Center安装AWC2406实战：从环境准备到部署脚本全解析

简介：围绕Teamcenter AWC2406的安装实践，整理了一份基于Deployment Center部署的完整操作笔记，主要面向实施工程师与系统管理员，帮助规避安装过程中常见的环境冲突与配置盲点。资源为单个docx文档，压缩包大小4.67MB&am…

TypeScript 教程精讲：从类型系统到工程化实践的完整指南
2026/10/24 18:05:41

TypeScript 教程精讲：从类型系统到工程化实践的完整指南

简介：TypeScript教程这份PDF学习资料面向前端开发入门者及需要夯实基础的中级工程师，系统讲解TypeScript数据类型体系，覆盖布尔值、数字、字符串、数组、元组、枚举、外部枚举、接口初探、可选属性、函数类型、类类型与接口继承等核心知识点。…

企业人事管理系统设计与实现：SSM+MySQL全栈开发详解
2026/10/24 18:05:41

企业人事管理系统设计与实现：SSM+MySQL全栈开发详解

简介：这是一份面向高校计算机相关专业毕业设计或课程设计的完整论文资料，主题为企业人事信息管理系统的设计与实现。资源包含1个doc格式文档，压缩包总体积约1.19MB，内容涵盖系统背景、需求分析、SSM框架（Spring、Sprin…

ollama+DeepSeek+Docker+Dify：本地知识库部署实战
2026/10/24 18:00:41

ollama+DeepSeek+Docker+Dify：本地知识库部署实战

简介：这份资源面向希望本地搭建个人知识库的开发者与AI爱好者，围绕ollama、deepseek、docker与Dify四件套的协同部署展开，帮助读者理解搜索引擎框架、深度学习模型、容器化运行与知识库问答之间的配合关系，适合具备基础命令行操作…

金融AI落地指南：从调研报告到技术选型与工程实践
2026/10/23 22:56:35

金融AI落地指南：从调研报告到技术选型与工程实践

简介：这份PDF报告聚焦2025年金融服务业中国AI现状与趋势，面向金融科技从业者、AI战略规划人员及关注行业数字化转型的研究者，帮助读者把握生成式AI在银行、支付、交易等场景中的落地路径与投资方向。资源包内含1个PDF文件，大小约1…

MATLAB缩进快捷键与批量格式化实战指南
2026/10/24 0:02:40

MATLAB缩进快捷键与批量格式化实战指南

1. 被自动缩进折磨的那些年如果你写过MATLAB代码，大概率经历过这种场景：从某个文档、网页或者聊天记录里复制了一段代码，粘贴进编辑器之后，每一行前面都带着莫名其妙的空格，有的行首是四个空格，有的是一个T…

用Poco实现Qt风格信号与槽的跨平台C++方案
2026/10/24 0:02:40

用Poco实现Qt风格信号与槽的跨平台C++方案

简介：本资源是一份面向C中级开发者的技术实践工程，聚焦于在非Qt框架环境下模拟实现Qt核心通信机制——信号与槽，借助Poco网络库的事件系统完成解耦式对象通信。适用于需在跨平台C项目中引入松耦合回调机制、但受限于无法集成Qt依赖的开发场景…

ESXi裸机虚拟化安装指南：从硬件兼容到虚拟机部署
2026/10/24 0:02:40

ESXi裸机虚拟化安装指南：从硬件兼容到虚拟机部署

1. 为什么还要折腾ESXi：从一台闲置机器说起手里攒了几台淘汰下来的迷你主机，配置不算差，i5加16G内存，扔了可惜，装个桌面系统又觉得浪费。这种场景下，ESXi就成了一个绕不开的选择。它是一套裸机虚拟化平台&a…

还想了解更多？直接咨询顾问

免费诊断 + 免费方案 + 透明报价。

全国咨询热线400-8866-253
免费获取方案
☎咨询二维码 ☎ ↑