技术交流邮件(1)

//API hook 替换的函数
int WINAPI RecvMonitor(SOCKET s, char* buf, int len, int flags)
{
    ++g_nThread;
    int iRet = RealRecv(s, buf, len, flags);
    --g_nThread;
 
    // 一些分析代码
    // …
 
    return iRet;
}
 
//UnHook时会导致DLL卸载
case DLL_PROCESS_DETACH:
{
    if (g_bMonitor)
    {
        // 用临界区防止新开启了其他的send或recv线程
        EnterCriticalSection(&g_cs);
        // 这里检查g_nThread的值, 实际情况是, 如果为0, 则不会崩溃, 如果不为0, 则会崩溃. 
        // 但是如果等待g_nThread为0, 却不会成功, 并且IE会一直无响应
        for (;;)
        {
            if (g_nThread == 0)
                break;
        }
 
        // 将API hook还原, 即IE会直接进入RealRecv, 而不再进入RecvMonitor.
        UnMonitorSocket();
 
        LeaveCriticalSection(&g_cs);
    }
}

class CLock
{
public:
    CLock(void)
    {
        m_refcnt = 0;
        m_hEvent = ::CreateEvent(...);
    }
    ~CLock(void)
    {
        ::CloseHandle(m_hEvent);
    }
    void Enter(void)
    {
        if (0 == m_refcnt)
            ::ResetEvent(m_hEvent);
        ++m_refcnt;
    }
    void Leave(void)
    {
        –m_refcnt;
        if (0 == m_refcnt)
            ::SetEvent(m_hEvent);
    }
    void Wait(void)
    {
        ::WaitForSingleObject(m_hEvent, INFINITE);
    }
private:
    int m_refcnt;
    HANDLE m_hEvent;
};