http://prntscr.com/2ctnoz

我正在 Hook WSAsend 函数并转储数据包。 ASCII 转储有效，但 HEX 转储有时会显示您在屏幕上看到的内容(FFFFFFDD)，知道为什么吗？

代码:

int WINAPI myWSASend(SOCKET s, LPWSABUF lpBuffers, DWORD dwBufferCount, LPDWORD lpNumberOfBytesSent, DWORD dwFlags, LPWSAOVERLAPPED lpOverlapped, LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine)
{   
    //Packet Log
    if (bLogPacketS == TRUE)
    {
        for (unsigned int i = 0; i < lpBuffers->len; i = i + 8)
        {
            printf("%02X %02X %02X %02X %02X %02X %02X %02X\t\t%c %c %c %c %c %c %c %c\n",
                  (unsigned int)lpBuffers->buf[i], (unsigned int)lpBuffers->buf[i+1], (unsigned int)lpBuffers->buf[i+2],
                  (unsigned int)lpBuffers->buf[i+3], (unsigned int)lpBuffers->buf[i+4], (unsigned int)lpBuffers->buf[i+5],
                  (unsigned int)lpBuffers->buf[i+6], (unsigned int)lpBuffers->buf[i+7],
                  (drawable((unsigned int)lpBuffers->buf[i])) ? (unsigned int)lpBuffers->buf[i] : '.',
                  (drawable((unsigned int)lpBuffers->buf[i+1])) ? (unsigned int)lpBuffers->buf[i+1] : '.',
                  (drawable((unsigned int)lpBuffers->buf[i+2])) ? (unsigned int)lpBuffers->buf[i+2] : '.',
                  (drawable((unsigned int)lpBuffers->buf[i+3])) ? (unsigned int)lpBuffers->buf[i+3] : '.',
                  (drawable((unsigned int)lpBuffers->buf[i+4])) ? (unsigned int)lpBuffers->buf[i+4] : '.',
                  (drawable((unsigned int)lpBuffers->buf[i+5])) ? (unsigned int)lpBuffers->buf[i+5] : '.',
                  (drawable((unsigned int)lpBuffers->buf[i+6])) ? (unsigned int)lpBuffers->buf[i+6] : '.',
                  (drawable((unsigned int)lpBuffers->buf[i+7])) ? (unsigned int)lpBuffers->buf[i+7] : '.');
        }
        printf("\n\n");
    }
    return (oWSASend)(s, lpBuffers, dwBufferCount, lpNumberOfBytesSent, dwFlags, lpOverlapped, lpCompletionRoutine);
}

bool drawable(unsigned int value)
{
    if (value > 32 && value < 127)
        return true;
    else
        return false;
}

最佳答案

您正在转换为错误的类型。

您只想更改符号，但您也将每个字节扩展为一个四字节的字。在存在有符号到无符号的转换(以及由此产生的负值回绕)的情况下，这会导致非常高的值。

lpBuffers->buf[i] 的每个“元素”都是一个 char，但您正在转换为 unsigned int。如果您的 char 在您的系统上签名，则 0xDD 超出类型范围的顶部，因此它环绕到 -35。然后将其转换为 unsigned int 结果为 0xFFFFFFDD。

printf 说明符 %02X 不会截断它。

假设您希望将所有字节解释为unsigned，以获得完整的0x00→0xFF 范围。我个人会转换为 unsigned char(而不是 unsigned int)，其中 0xDD 的值为 221.

在下面的代码中，我还对您的循环条件进行了安全调整。

for (unsigned int i = 0; i < lpBuffers->len-8; i = i + 8)
//                                         ^^
{
    printf(
        "%02X %02X %02X %02X %02X %02X %02X %02X"
          "\t\t%c %c %c %c %c %c %c %c\n",

        static_cast<unsigned char>(lpBuffers->buf[i]),
        static_cast<unsigned char>(lpBuffers->buf[i+1]),
        static_cast<unsigned char>(lpBuffers->buf[i+2]),
        static_cast<unsigned char>(lpBuffers->buf[i+3]),
        static_cast<unsigned char>(lpBuffers->buf[i+4]),
        static_cast<unsigned char>(lpBuffers->buf[i+5]),
        static_cast<unsigned char>(lpBuffers->buf[i+6]),
        static_cast<unsigned char>(lpBuffers->buf[i+7]),
        (drawable(lpBuffers->buf[i]))   ? static_cast<unsigned char>(lpBuffers->buf[i])   : '.',
        (drawable(lpBuffers->buf[i+1])) ? static_cast<unsigned char>(lpBuffers->buf[i+1]) : '.',
        (drawable(lpBuffers->buf[i+2])) ? static_cast<unsigned char>(lpBuffers->buf[i+2]) : '.',
        (drawable(lpBuffers->buf[i+3])) ? static_cast<unsigned char>(lpBuffers->buf[i+3]) : '.',
        (drawable(lpBuffers->buf[i+4])) ? static_cast<unsigned char>(lpBuffers->buf[i+4]) : '.',
        (drawable(lpBuffers->buf[i+5])) ? static_cast<unsigned char>(lpBuffers->buf[i+5]) : '.',
        (drawable(lpBuffers->buf[i+6])) ? static_cast<unsigned char>(lpBuffers->buf[i+6]) : '.',
        (drawable(lpBuffers->buf[i+7])) ? static_cast<unsigned char>(lpBuffers->buf[i+7]) : '.'
    );
}

关于WSAsend 数据包的 C++ 奇怪十六进制转储，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/20718738/