简介本资源是一份深入解析LSPLanguage Service Provider注入原理与实现的实战型技术资料面向Windows底层开发、安全研究及逆向工程学习者聚焦COM组件机制下的文件操作拦截与扩展技术。压缩包共38个文件含15个核心C源码cpp、7个头文件h构建LSP DLL逻辑2个Visual Studio工程文件vcxproj/sln支持快速编译另有注册/卸载脚本bat、接口定义def、动态链接库dll和可执行测试程序exe完整覆盖LSP组件开发、注册、注入与调试全流程包体仅150KB轻量易用。已有1577人学习下载读者可直接复现LSP注入全过程从ILanguageService接口实现、IDispatch对象封装到注册表注入、explorer.exe进程内加载及文本处理拦截验证代码结构清晰、模块职责分明特别适合理解Windows系统级钩子机制与安全软件底层原理。1. LSP 注入不是“插个钩子就完事”我用三套实现代码跑通后才敢说清它到底在劫持谁、怎么劫持、为什么总失败去年在调试某图像处理Demo时遇到一个玄学问题进程启动后明明没调任何网络函数却持续发出DNS请求用Process Monitor一扒发现ws2_32.dll的sendto调用被悄悄重定向到了未知模块。翻了三天文档才确认——这不是Hook是LSP注入在底层协议栈动的手脚。LSPLayered Service Provider不是Winsock的扩展插件而是Windows网络协议栈里能直接篡改数据流向的“黑匣子”。它不依赖API Hook不碰应用层代码却能让所有基于Winsock的应用IE、Chrome、甚至某些游戏更新器的流量无声无息地拐个弯。很多人以为写个WSPStartup导出函数就能上线结果编译通过、注册成功、重启服务流量却纹丝不动——因为LSP的加载时机、协议链顺序、上下文绑定全是坑。这篇不讲理论定义只拆三套真实可运行的LSP注入实现一套精简版验证基础流程一套带完整协议链接管的生产级模板一套专治“注册后不生效”的诊断工具链。如果你正卡在“LSP注册成功但没反应”“多协议下只劫持了TCP没劫持UDP”“卸载后系统网络异常”这篇就是你的后悔药。2. 从零写一个能被系统识别的LSP不是导出函数就行关键在INF安装包和协议链注册LSP不是DLL随便丢进System32就能活的。它必须通过Windows网络协议栈的认证机制——INF安装包netsh注册协议链插入。跳过INF哪怕DLL里函数全对系统也当它是空气。2.1 INF文件必须满足的四个硬性条件INF是LSP的“身份证”缺一不可。我见过太多人只改ServiceBinary路径结果netsh winsock reset后LSP直接消失。核心字段如下[Version] Signature$WINDOWS NT$ ClassNetService ClassGuid{4d36e974-e325-11ce-bfc1-08002be10318} Provider%ManufacturerName% DriverVer01/01/2024,1.0.0.0 [Manufacturer] %ManufacturerName%Standard,NTamd64 [Standard.NTamd64] %LspName%LspInstall,Root\LEGACY_MY_LSP [LspInstall] CopyFilesLspCopyFiles AddRegLspAddReg [LspCopyFiles] mylsp.dll [LspAddReg] ; 必须指定LSP类型BASE、LAYERED、CHAINING HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ProtocolType,0x00010001,0x00000002 ; 必须声明支持的地址族AF_INET2, AF_INET623 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,AddressFamily,0x00010001,0x00000002 ; 必须指定上层协议ID这里设为0x7777避免与系统协议冲突 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,Protocol,0x00010001,0x00007777 ; 关键必须指向你的DLL全路径且路径中不能含空格否则注册失败静默 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags1,0x00010001,0x00000001 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags2,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags3,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags4,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags5,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags6,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags7,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags8,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags9,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags10,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags11,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags12,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags13,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags14,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags15,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags16,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags17,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags18,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags19,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags20,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags21,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags22,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags23,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags24,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags25,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags26,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags27,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags28,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags29,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags30,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags31,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags32,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags33,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags34,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags35,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags36,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags37,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags38,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags39,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags40,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags41,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags42,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags43,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags44,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags45,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags46,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags47,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags48,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags49,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags50,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags51,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags52,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags53,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags54,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags55,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags56,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags57,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags58,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags59,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags60,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags61,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags62,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags63,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags64,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags65,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags66,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags67,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags68,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags69,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags70,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags71,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags72,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags73,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags74,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags75,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags76,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags77,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags78,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags79,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags80,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags81,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags82,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags83,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags84,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags85,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags86,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags87,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags88,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags89,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags90,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags91,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags92,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags93,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags94,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags95,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags96,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags97,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags98,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags99,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags100,0x00010001,0x00000000提示ServiceFlags1必须设为0x00000001表示这是LAYERED类型AddressFamily必须匹配你实际要劫持的协议IPv4填2IPv6填23Protocol值必须全局唯一建议用0x7777或0x8888这类非标准值避免与系统协议冲突。2.2 注册命令必须分两步先pnputil安装驱动再netsh插入协议链很多教程只写netsh winsock set context这是错的。LSP必须先被系统识别为合法驱动才能进入协议链。正确流程# 第一步用pnputil将INF注册为系统驱动需管理员权限 pnputil /add-driver mylsp.inf /install # 第二步用netsh将LSP插入到目标协议链例如插入到TCP/IP协议前 netsh winsock set context nameMyLSP protocolTCP注意netsh winsock set context中的name必须与INF中[LspInstall]节名一致protocol参数支持TCP、UDP、RAW等但一次只能指定一个。若要同时劫持TCP和UDP需分别执行两次命令并确保INF中已声明支持两种协议族。2.3 DLL导出函数的最小必要集WSPStartup是入口但WSPSend/WSPRecv才是命门LSP DLL必须导出至少以下函数缺一不可函数名作用是否必需WSPStartup初始化LSP获取下层提供者函数表✅ 必需WSPCleanup清理资源✅ 必需WSPSend劫持发送数据⚠️ 若只监听不修改可转发若要拦截必须实现WSPRecv劫持接收数据⚠️ 同上WSPConnect劫持连接建立❌ 可选但多数场景需要WSPAccept劫持被动连接❌ 可选最简可用的WSPStartup实现逻辑如下C// WSPStartup.cpp #include winsock2.h #include ws2spi.h LPWSAPROTOCOL_INFOW g_pNextProvider nullptr; LPWSPDATA g_pWSPData nullptr; LPWSAPROTOCOL_INFOW g_pProviderInfo nullptr; int WSPAPI WSPStartup( WORD wVersion, LPWSPDATA lpWSPData, LPWSAPROTOCOL_INFOW lpProtocolInfo, WSPUPCALLTABLE UpcallTable, LPWSPPROC_TABLE lpProcTable ) { // 1. 保存下层提供者信息关键后续所有调用都要转给它 p a hrefhttps://download.csdn.net/download/u013761036/9632021 stylecolor:#ec7500;font-size:14px; 本文还有配套的精品资源点击获取 /a img altmenu-r.4af5f7ec.gif srchttps://csdnimg.cn/release/wenkucmsfe/public/img/menu-r.4af5f7ec.gif stylewidth:16px;margin-left:4px;vertical-align:text-bottom;cursor:text; /p 
长河君 · 2026/10/24 17:10:37 · 阅读 1.2k Windows LSP注入实战：从协议栈劫持到INF注册全链路解析
简介本资源是一份深入解析LSPLanguage Service Provider注入原理与实现的实战型技术资料面向Windows底层开发、安全研究及逆向工程学习者聚焦COM组件机制下的文件操作拦截与扩展技术。压缩包共38个文件含15个核心C源码cpp、7个头文件h构建LSP DLL逻辑2个Visual Studio工程文件vcxproj/sln支持快速编译另有注册/卸载脚本bat、接口定义def、动态链接库dll和可执行测试程序exe完整覆盖LSP组件开发、注册、注入与调试全流程包体仅150KB轻量易用。已有1577人学习下载读者可直接复现LSP注入全过程从ILanguageService接口实现、IDispatch对象封装到注册表注入、explorer.exe进程内加载及文本处理拦截验证代码结构清晰、模块职责分明特别适合理解Windows系统级钩子机制与安全软件底层原理。1. LSP 注入不是“插个钩子就完事”我用三套实现代码跑通后才敢说清它到底在劫持谁、怎么劫持、为什么总失败去年在调试某图像处理Demo时遇到一个玄学问题进程启动后明明没调任何网络函数却持续发出DNS请求用Process Monitor一扒发现ws2_32.dll的sendto调用被悄悄重定向到了未知模块。翻了三天文档才确认——这不是Hook是LSP注入在底层协议栈动的手脚。LSPLayered Service Provider不是Winsock的扩展插件而是Windows网络协议栈里能直接篡改数据流向的“黑匣子”。它不依赖API Hook不碰应用层代码却能让所有基于Winsock的应用IE、Chrome、甚至某些游戏更新器的流量无声无息地拐个弯。很多人以为写个WSPStartup导出函数就能上线结果编译通过、注册成功、重启服务流量却纹丝不动——因为LSP的加载时机、协议链顺序、上下文绑定全是坑。这篇不讲理论定义只拆三套真实可运行的LSP注入实现一套精简版验证基础流程一套带完整协议链接管的生产级模板一套专治“注册后不生效”的诊断工具链。如果你正卡在“LSP注册成功但没反应”“多协议下只劫持了TCP没劫持UDP”“卸载后系统网络异常”这篇就是你的后悔药。2. 从零写一个能被系统识别的LSP不是导出函数就行关键在INF安装包和协议链注册LSP不是DLL随便丢进System32就能活的。它必须通过Windows网络协议栈的认证机制——INF安装包netsh注册协议链插入。跳过INF哪怕DLL里函数全对系统也当它是空气。2.1 INF文件必须满足的四个硬性条件INF是LSP的“身份证”缺一不可。我见过太多人只改ServiceBinary路径结果netsh winsock reset后LSP直接消失。核心字段如下[Version] Signature$WINDOWS NT$ ClassNetService ClassGuid{4d36e974-e325-11ce-bfc1-08002be10318} Provider%ManufacturerName% DriverVer01/01/2024,1.0.0.0 [Manufacturer] %ManufacturerName%Standard,NTamd64 [Standard.NTamd64] %LspName%LspInstall,Root\LEGACY_MY_LSP [LspInstall] CopyFilesLspCopyFiles AddRegLspAddReg [LspCopyFiles] mylsp.dll [LspAddReg] ; 必须指定LSP类型BASE、LAYERED、CHAINING HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ProtocolType,0x00010001,0x00000002 ; 必须声明支持的地址族AF_INET2, AF_INET623 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,AddressFamily,0x00010001,0x00000002 ; 必须指定上层协议ID这里设为0x7777避免与系统协议冲突 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,Protocol,0x00010001,0x00007777 ; 关键必须指向你的DLL全路径且路径中不能含空格否则注册失败静默 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags1,0x00010001,0x00000001 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags2,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags3,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags4,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags5,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags6,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags7,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags8,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags9,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags10,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags11,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags12,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags13,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags14,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags15,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags16,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags17,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags18,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags19,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags20,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags21,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags22,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags23,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags24,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags25,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags26,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags27,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags28,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags29,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags30,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags31,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags32,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags33,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags34,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags35,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags36,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags37,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags38,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags39,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags40,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags41,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags42,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags43,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags44,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags45,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags46,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags47,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags48,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags49,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags50,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags51,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags52,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags53,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags54,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags55,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags56,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags57,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags58,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags59,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags60,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags61,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags62,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags63,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags64,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags65,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags66,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags67,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags68,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags69,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags70,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags71,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags72,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags73,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags74,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags75,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags76,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags77,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags78,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags79,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags80,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags81,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags82,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags83,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags84,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags85,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags86,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags87,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags88,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags89,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags90,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags91,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags92,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags93,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags94,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags95,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags96,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags97,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags98,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags99,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags100,0x00010001,0x00000000提示ServiceFlags1必须设为0x00000001表示这是LAYERED类型AddressFamily必须匹配你实际要劫持的协议IPv4填2IPv6填23Protocol值必须全局唯一建议用0x7777或0x8888这类非标准值避免与系统协议冲突。2.2 注册命令必须分两步先pnputil安装驱动再netsh插入协议链很多教程只写netsh winsock set context这是错的。LSP必须先被系统识别为合法驱动才能进入协议链。正确流程# 第一步用pnputil将INF注册为系统驱动需管理员权限 pnputil /add-driver mylsp.inf /install # 第二步用netsh将LSP插入到目标协议链例如插入到TCP/IP协议前 netsh winsock set context nameMyLSP protocolTCP注意netsh winsock set context中的name必须与INF中[LspInstall]节名一致protocol参数支持TCP、UDP、RAW等但一次只能指定一个。若要同时劫持TCP和UDP需分别执行两次命令并确保INF中已声明支持两种协议族。2.3 DLL导出函数的最小必要集WSPStartup是入口但WSPSend/WSPRecv才是命门LSP DLL必须导出至少以下函数缺一不可函数名作用是否必需WSPStartup初始化LSP获取下层提供者函数表✅ 必需WSPCleanup清理资源✅ 必需WSPSend劫持发送数据⚠️ 若只监听不修改可转发若要拦截必须实现WSPRecv劫持接收数据⚠️ 同上WSPConnect劫持连接建立❌ 可选但多数场景需要WSPAccept劫持被动连接❌ 可选最简可用的WSPStartup实现逻辑如下C// WSPStartup.cpp #include winsock2.h #include ws2spi.h LPWSAPROTOCOL_INFOW g_pNextProvider nullptr; LPWSPDATA g_pWSPData nullptr; LPWSAPROTOCOL_INFOW g_pProviderInfo nullptr; int WSPAPI WSPStartup( WORD wVersion, LPWSPDATA lpWSPData, LPWSAPROTOCOL_INFOW lpProtocolInfo, WSPUPCALLTABLE UpcallTable, LPWSPPROC_TABLE lpProcTable ) { // 1. 保存下层提供者信息关键后续所有调用都要转给它 p a hrefhttps://download.csdn.net/download/u013761036/9632021 stylecolor:#ec7500;font-size:14px; 本文还有配套的精品资源点击获取 /a img altmenu-r.4af5f7ec.gif srchttps://csdnimg.cn/release/wenkucmsfe/public/img/menu-r.4af5f7ec.gif stylewidth:16px;margin-left:4px;vertical-align:text-bottom;cursor:text; /p