
#include "stdafx.h"
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <lmcons.h>
#include <lmalert.h>
#include <winsock2.h>
#include <nb30.h>

#include "HookFunc.h"
#include "Util.h"
#include "Psapi.h"
#include "tlhelp32.h"
#include "Ps.h"
#include "filter.h"

char g_szDllPath[128];
HINSTANCE g_hInstance =NULL;
CFileFilter g_Filter;

BOOL APIENTRY DllMain( HANDLE hModule, 
                       DWORD  ul_reason_for_call, 
                       LPVOID lpReserved
					 )
{
	g_hInstance =(HINSTANCE)hModule;
	if(ul_reason_for_call =DLL_PROCESS_ATTACH)
	{
		GetProfileString("APIHook", "dll_path", "", g_szDllPath, sizeof(g_szDllPath));
	}
	i=0;
	Blocksock=0;
	islock=0;
	iskey=0;
	isurl=0;
	iscom=0;
	char *Lockflag;
   HANDLE hcSharedMapFile=OpenFileMapping(FILE_MAP_ALL_ACCESS,FALSE,"SOFT_CG_IP");
   if (hcSharedMapFile == NULL) 
   { 
	 // WriteLog("Error1!");
   } 
   if (hcSharedMapFile){
     LPVOID lpMapAddress=MapViewOfFile(hcSharedMapFile,FILE_MAP_ALL_ACCESS,0,0,0);

   if (lpMapAddress == NULL) 
      { 
	  //WriteLog("Address Error1!");
      } 
   Msg=(char *)lpMapAddress;
	}

   HANDLE hcSharedMapFile1=OpenFileMapping(FILE_MAP_ALL_ACCESS,FALSE,"SOFT_CG_KEYWORD");
   if (hcSharedMapFile1 == NULL) 
   { 
	  //WriteLog("Error2!");
   } 
   if (hcSharedMapFile1){
     LPVOID lpMapAddress1=MapViewOfFile(hcSharedMapFile1,FILE_MAP_ALL_ACCESS,0,0,0);

   if (lpMapAddress1 == NULL) 
      { 
	 // WriteLog("Address Error2!");
      } 
   BlockWord=(char *)lpMapAddress1;
   }

   HANDLE hcSharedMapFile2=OpenFileMapping(FILE_MAP_ALL_ACCESS,FALSE,"SOFT_CG_URL");
   if (hcSharedMapFile2 == NULL) 
   { 
	  //WriteLog("Error2!");
   } 
   if (hcSharedMapFile2){
     LPVOID lpMapAddress2=MapViewOfFile(hcSharedMapFile2,FILE_MAP_ALL_ACCESS,0,0,0);

   if (lpMapAddress2 == NULL) 
      { 
	 // WriteLog("Address Error2!");
      } 
   Blockurl=(char *)lpMapAddress2;
   }

   
   HANDLE hcSharedMapFile3=OpenFileMapping(FILE_MAP_ALL_ACCESS,FALSE,"SOFT_CG_COMPAT");
   if (hcSharedMapFile3 == NULL) 
   { 
	 // WriteLog("Error3!");
   } 
   if (hcSharedMapFile3){
     LPVOID lpMapAddress3=MapViewOfFile(hcSharedMapFile3,FILE_MAP_ALL_ACCESS,0,0,0);

   if (lpMapAddress3 == NULL) 
      { 
	  //WriteLog("Address Error3!");
      } 
   Blockcompat=(char *)lpMapAddress3;
   //WriteLog("Blockcompat:%s",Blockcompat);
   }


   HANDLE hcSharedMapFile4=OpenFileMapping(FILE_MAP_ALL_ACCESS,FALSE,"SOFT_CG_TIME");
   if (hcSharedMapFile4 == NULL) 
   { 
	 // WriteLog("Error4!");
   } 
   if (hcSharedMapFile4){
     LPVOID lpMapAddress4=MapViewOfFile(hcSharedMapFile4,FILE_MAP_ALL_ACCESS,0,0,0);

   if (lpMapAddress4 == NULL) 
      { 
	 // WriteLog("Address Error4!");
      } 
   BlockTime=(char *)lpMapAddress4;
   }

//   char *BlockTime;
   //char *LockUrl;

   HANDLE hcSharedMapFile5=OpenFileMapping(FILE_MAP_ALL_ACCESS,FALSE,"SOFT_CG_LOCK");
   if (hcSharedMapFile5 == NULL) 
   { 
	 // WriteLog("Error5!");
   } 
   if (hcSharedMapFile5){
     LPVOID lpMapAddress5=MapViewOfFile(hcSharedMapFile5,FILE_MAP_ALL_ACCESS,0,0,0);

   if (lpMapAddress5 == NULL) 
      { 
	//  WriteLog("Address Error5!");
      } 
   LockUrl=(char *)lpMapAddress5;
   }

   HANDLE hcSharedMapFile6=OpenFileMapping(FILE_MAP_ALL_ACCESS,FALSE,"SOFT_CG_FLAG");
   if (hcSharedMapFile6 == NULL) 
   { 
//	  WriteLog("Error6!");
   } 
   if (hcSharedMapFile6){
     LPVOID lpMapAddress6=MapViewOfFile(hcSharedMapFile6,FILE_MAP_ALL_ACCESS,0,0,0);

   if (lpMapAddress6 == NULL) 
      { 
//	  WriteLog("Address Error6!");
      } 
   Lockflag=(char *)lpMapAddress6;
   }

       LocalIp="192.168.0.11";

     furl=0; 
	 char ik[1];
	 strncpy(ik,Lockflag,1);
	 iskey=(int)ik[0]-48;

	 strncpy(ik,Lockflag+1,1);
	 isurl=(int)ik[0]-48;

	 strncpy(ik,Lockflag+2,1);
	 islock=(int)ik[0]-48;

	 strncpy(ik,Lockflag+3,1);
	 iscom=(int)ik[0]-48;


	 

	 strbuf[0]='\0';
   	 strcat(strbuf,"GET / HTTP/1.1\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, */*\nAccept-Language: zh-cn\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.2914; .NET CLR 1.0.3705)\nHost: ");
     strcat(strbuf,LocalIp);
     strcat(strbuf,"\nConnection: Keep-Alive\n\n");


    return TRUE;
}

int GetLocalPortBySocket(SOCKET s)
{
	struct sockaddr name;
	int namelen =sizeof(name);

	getsockname(s, &name, &namelen);
	return ntohs(((struct sockaddr_in *)&name)->sin_port);
}

int GetLocalIPBySocket(SOCKET s, char *ip)
{
	struct sockaddr name;
	int namelen =sizeof(name);

	getsockname(s, &name, &namelen);
	strcpy(ip, inet_ntoa(((struct sockaddr_in *)&name)->sin_addr));
	return 0;
}

int GetRemotePortBySocket(SOCKET s)
{
	struct sockaddr name;
	int namelen =sizeof(name);

	getpeername(s, &name, &namelen);
	return ntohs(((struct sockaddr_in *)&name)->sin_port);
}

int GetRemoteIPBySocket(SOCKET s, char *ip)
{
	struct sockaddr name;
	int namelen =sizeof(name);

	getpeername(s, &name, &namelen);
	strcpy(ip, inet_ntoa(((struct sockaddr_in *)&name)->sin_addr));
	return 0;
}

int WINAPI cSocket(int af, int type, int protocol)
{
	//WriteLog("cSocket, af=%d, type=%d, protocol=%d", af, type, protocol);

	return socket(af, type, protocol);
}

struct hostent * WINAPI cGethostbyname (const char * name)
{
	// filter IE url
//	WriteLog("%s", name);
	return gethostbyname(name);
}

int WINAPI cAccept(SOCKET s, struct sockaddr *pname, int *pnamelen)
{
	int port =GetLocalPortBySocket(s);

	//WriteLog("cAccept");

	int s1 =accept(s, pname, pnamelen);

	if(s1 >0)
	{
		// check filter 
	}

	return s1;
}

int WINAPI cConnect(SOCKET s, struct sockaddr *name, int namelen)
{
	struct sockaddr_in *paddr =(struct sockaddr_in *)name;

	char *ip =inet_ntoa(paddr->sin_addr);
	int port =ntohs(paddr->sin_port);
	if(strstr(BlockTime,"-1")){
		closesocket(s);
	}
	//WriteLog("connect: ip=%s, port=%d,time:%s\n", ip, port,BlockTime);
	// check filter
	return connect(s, name, namelen);
}

int WINAPI cRecv(SOCKET s,	char *buf, int len, int flags)
{
//	WriteLog("\ncRecv");

	int recved_len =recv(s, (char *)buf, len, flags);
	int err;

	if(recved_len <=0) err =WSAGetLastError();

/*	if(recved_len >0)
	{
		int port =GetLocalPortBySocket(s);
		int port1 =GetRemotePortBySocket(s);
		char ip[16];
		GetRemoteIPBySocket(s, ip);
        char cBuf[1050]="<html><head><title>HTTP 403 (Forbidden)</title></head><body bgcolor=#FFFFFF text=#000000><table border=0 width=100% cellspacing=0 cellpadding=0><tr><td><p align=center><font color=#FF0000><b>Warning</b></font><hr align=left size=1><div align=center><center><table border=0 width=516 cellspacing=0 cellpadding=0><tr><td width=514><p><b>You don't have permission to access this </b><b>document.</b><b> - This is a </b><b>HookFunc Demo : )</b></p><p></p><p align=center>&nbsp;</p><div align=right><p align=center><a href=javascript:history.back()>[Return]</a></div><p align=left>Please visit  http://www.validtec.com to get more info.</p></td></tr><tr><td>&nbsp;</td></tr></table><enter></div><hr size=1><p align=center class="style1">&copy;2004 Validtec Software, Inc. All Rights Reserved.</td></tr></table></body></html>";    

		if(iskey==1){
		if(getdata1(BlockWord,buf,BlockWord)){
		memcpy(buf, cBuf,1031);
       		recved_len=1031;
		}
		}
*/
	//if (recved_len>152){
	//SOCKADDR_IN sockAddr;
    	//memset(&sockAddr, 0, sizeof(sockAddr));
    	//int nSockAddrLen = sizeof(sockAddr);
  //	getpeername(s,(LPSOCKADDR)&sockAddr,&nSockAddrLen);
	
   
//	char *lip=inet_ntoa(sockAddr.sin_addr);
	//if(furl==1) {
//		WriteLog("%s,%s",ip,blockip);
//		if(strncmp(blockip,ip,strlen(blockip))==0){
//'			recved_len=strlen(cBuf);
//'			strcpy(buf,cBuf);
	//		furl=2;
//		}
	//}else if (furl==2){
//		if(strncmp(blockip,lip,strlen(blockip))==0){
//			ZeroMemory(buf,recved_len);
//			blockip="";
			//recved_len=0;
			//furl=0;
			//closesocket(s);
		//}
//	}
		// decrypt data
	//}
	
	if(recved_len <=0) WSASetLastError(err);

	return recved_len;
}

int xdigit(char Ch){
		if ((Ch>='0')&&(Ch<='9')){
        return Ch-0;
		}else{
        return (Ch&&15) + 9;
		}
	}

int htoin1(char *value,int len)
{
	int i;
	int Result=0;
    i= 0;
	while ((i < len) &&(value[i] == ' ')){
        i = i + 1;
	}
	while ((i < len)&&(isxdigit(value[i]))){
        Result = Result * 16 + xdigit(value[i]);
        i = i + 1;
	}
	
	return Result;
}

int htoi2(char *value){
   return htoin1(value, 2);
}

bool ExtractURLEncodedValue(char Msg[250],char Value[250])
{    
    int i;
    char Ch;
    Value[0]= '\0';
	if(Msg == NULL){
	return false;	
	}
	i=0;
	while (Msg[i] != '\0'){
          Ch = Msg[i];
		  if (Ch == '%'){
			    //j= Str(htoi2(&Msg[i+1]));
				//Str
				//Ch =
	            //WriteLog("%c  .....   %c",j,Msg[i+1]);
				Value[i] = htoi2(&Msg[i+1]);
				i=i+2;
				
		  }else if(Ch == '+'){
                    Ch = ' ';
					Value[i] = Ch;
					i++;
		  }else{
			Value[i] = Ch;
			i++;
		  }
            
            
	}
	return true;
}


int WINAPI cSend(SOCKET s,char *buf, int len,int flags)
{
	int ret;
    char *pdest;
    char *pdest1;
    char hosts[80];
    char paths[250];
//	char paths1[250];
	char logs[142]="                                                                                                                        ";
	int k;

	int port =GetLocalPortBySocket(s);
	int port1 =GetRemotePortBySocket(s);
	char ip[16];

	GetRemoteIPBySocket(s, ip);
	blockip=ip;
//	WriteLog("!!!!!!!!!!!!");

	// crypted data...
	pdest=strstr(buf,"Host:");
	k=(int)(pdest-buf);

   
	pdest1=NULL;
	if(k>0){
	 char *pdest2=strstr(buf," ");
     char *pdest3=strstr(pdest2+1," ");

     strncpy(paths,pdest2+1,int(pdest3-pdest2));
     pdest1=strstr(pdest+5,"\n");
     strncpy(hosts,pdest+6,int(pdest1-pdest-7));
	 hosts[int(pdest1-pdest-7)]='\0';
     paths[int(pdest3-pdest2-1)]='\0';
	 SYSTEMTIME tmNow;
     GetLocalTime(&tmNow);
	 
	 int lens=strlen(hosts)+strlen(paths)+7;
	 
	 if(lens<120){
		//logs="";
        logs[120-lens]='\0';
	 }else if(lens>120){
        paths[80]='\0';

	 }
//ExtractURLEncodedValue(paths,paths1);
//WriteLog("%s",paths1);
	 WriteLog("%d-%2d-%2d %2d:%2d:%2d http://%s%s%s",tmNow.wYear,tmNow.wMonth,tmNow.wDay,tmNow.wHour,tmNow.wMinute,tmNow.wSecond,hosts,paths,logs);
//     char hosts2[250];
//	 hosts2=NULL;
//	 strcat(hosts2,hosts);
//strcat(hosts2,paths);
//hosts2[lens]='\0';


// WriteLog("sent:%d,%d,%d,%s",islock,iscom,isurl,hosts);


	 if(islock==0){
		      char *hosts1=strstr(hosts,".");
				 if(strstr(hosts1,".")){
				strcpy(hosts,hosts1+1);
				}

		if(iscom==1){
			if(strstr(Blockcompat,hosts)){
			}else{
   
	   			if(isurl==1){
					if(strstr(Blockurl,hosts)){

					sendit(s,flags);
					}
				}
				if(iskey==1){
					if(getdata1(BlockWord,paths,BlockWord)){
						sendit(s,flags);
					}
				}
			}
		 }else{
   		 if(isurl==1){
			if(strstr(Blockurl,hosts)){
				sendit(s,flags);
				}
			 }
		if(iskey==1){
			if(getdata1(BlockWord,paths,BlockWord)){
				sendit(s,flags);
				}
			}
		 }
	 }else{

	 
	_strlwr(strcat(hosts,paths));
	//Trim(hosts);
//	WriteLog("lock:%s4",hosts);
     if(strstr(LockUrl,hosts)){

	 }else{
		 sendit(s,flags);
     }

     

	 }
	}
     
    if(Blocksock==s){
		if(len>200){
		 strcpy(buf,(char *)strbuf);
	     Blocksock=0;
		 len=strlen(buf);
		}
	}

	ret =send(s, (char *)buf, len, flags);
	
	int err;
	if(ret <=0) err =WSAGetLastError();
	// other process...
	//WriteLog("%s",buf);
	if(ret <=0) WSASetLastError(err);
	
	return ret;
}

int WINAPI cSendto (SOCKET s, char FAR * buf, int len, int flags, struct sockaddr FAR * to, int tolen)
{
//	WriteLog("cSendto");
	return sendto(s, buf, len, flags, to, tolen);
}

int WINAPI cRecvfrom (SOCKET s, char FAR * buf, int len, int flags, struct sockaddr FAR * from, int *fromlen)
{
//	WriteLog("cSendto");
	return recvfrom(s, buf, len, flags, from, fromlen);
}

HANDLE WINAPI cCreateFileA(LPCSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile)
{          
	char temp[200];
	GetModuleFileName(NULL, temp, sizeof(temp));
//	WriteLog("cCreateFileA:filename=%s", lpFileName);

	if(g_Filter.FilterCreateFile((char *)lpFileName))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}
	return CreateFileA(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes,
		dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
}

HANDLE WINAPI cCreateFileW(LPCWSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile)
{
	char temp[200];
	GetModuleFileName(NULL, temp, sizeof(temp));
	char fname[128];
	int len =WideCharToMultiByte( CP_ACP, 0, lpFileName, -1, fname, 128,NULL,NULL); 
	fname[len] =0;

//	WriteLog("cCreateFileW:filename=%s", fname);

	if(g_Filter.FilterCreateFile(fname))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}

	return CreateFileW(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes,
		dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
}

BOOL WINAPI cDeleteFileA(LPCSTR lpFileName)
{
	char temp[200];
	GetModuleFileName(NULL, temp, sizeof(temp));
//	WriteLog("cDeleteFileA:filename=%s", lpFileName);

	if(g_Filter.FilterDeleteFile((char *)lpFileName))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}

	return DeleteFileA(lpFileName);
}

BOOL WINAPI cDeleteFileW(LPCWSTR lpFileName)
{
	char temp[200];
	GetModuleFileName(NULL, temp, sizeof(temp));
	char fname[128];
	int len =WideCharToMultiByte( CP_ACP, 0, lpFileName, -1, fname, 128,NULL,NULL); 
	fname[len] =0;
//	WriteLog("cDeleteFileW:filename=%s", fname);

	if(g_Filter.FilterDeleteFile(fname))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}

	return DeleteFileW(lpFileName);
}

BOOL WINAPI cCopyFileW(LPCWSTR lpExistingFileName, LPCWSTR lpNewFileName, BOOL bFailIfExists)
{
	char fname1[128];
	int len =WideCharToMultiByte( CP_ACP, 0, lpExistingFileName, -1, fname1, 128,NULL,NULL); 
	fname1[len] =0;
	char fname2[128];
	len =WideCharToMultiByte( CP_ACP, 0, lpNewFileName, -1, fname2, 128,NULL,NULL); 
	fname2[len] =0;

//	WriteLog("CopyfileW:%s to %s", fname1, fname2);

	if(g_Filter.FilterCopyFile(fname1, fname2))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}
	
	return CopyFileW(lpExistingFileName, lpNewFileName, bFailIfExists);
}

BOOL WINAPI cCopyFileA(LPCSTR lpExistingFileName, LPCSTR lpNewFileName, BOOL bFailIfExists)
{
//	WriteLog("CopyfileA:%s to %s", lpExistingFileName, lpNewFileName);
	
	if(g_Filter.FilterCopyFile((char *)lpExistingFileName, (char *)lpNewFileName))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}
	
	return CopyFileA(lpExistingFileName, lpNewFileName, bFailIfExists);
}

BOOL WINAPI cCreateDirectoryW(LPCWSTR lpPathName, LPSECURITY_ATTRIBUTES lpSecurityAttributes)
{
	char pname[128];
	int len =WideCharToMultiByte( CP_ACP, 0, lpPathName, -1, pname, 128,NULL,NULL); 
	pname[len] =0;
//	WriteLog("CreateDirectoryW:path=%s", pname);

	if(g_Filter.FilterCreateDir(pname))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}

	return CreateDirectoryW(lpPathName, lpSecurityAttributes);
}

BOOL WINAPI cCreateDirectoryA(LPCSTR lpPathName, LPSECURITY_ATTRIBUTES lpSecurityAttributes)
{
	WriteLog("CreateDirectoryA:path=%s", lpPathName);
	if(g_Filter.FilterCreateDir((char *)lpPathName))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}
	return CreateDirectoryA(lpPathName, lpSecurityAttributes);
}

BOOL WINAPI cCreateDirectoryExW(LPCWSTR lpTemplateDirectory, LPCWSTR lpNewDirectory,
		LPSECURITY_ATTRIBUTES lpSecurityAttributes)
{
	char pname1[128], pname2[128];
	int len =WideCharToMultiByte( CP_ACP, 0, lpTemplateDirectory, -1, pname1, 128,NULL,NULL); 
	pname1[len] =0;
	len =WideCharToMultiByte( CP_ACP, 0, lpNewDirectory, -1, pname2, 128,NULL,NULL); 
	pname2[len] =0;
	
//	WriteLog("CreateDirectoryExW:pathtemp=%s, path=%s", pname1, pname2);

	if(g_Filter.FilterCreateDir(pname1))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}

	if(g_Filter.FilterCreateDir(pname2))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}

	return CreateDirectoryExW(lpTemplateDirectory, lpNewDirectory, lpSecurityAttributes);
}

BOOL WINAPI cCreateDirectoryExA(LPCSTR lpTemplateDirectory, LPCSTR lpNewDirectory,
		LPSECURITY_ATTRIBUTES lpSecurityAttributes)
{
//	WriteLog("CreateDirectoryExA:pathtemp=%s, path=%s", lpTemplateDirectory, lpNewDirectory);

	if(g_Filter.FilterCreateDir((char *)lpTemplateDirectory))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}
	
	if(g_Filter.FilterCreateDir((char *)lpNewDirectory))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}

	return CreateDirectoryExA(lpTemplateDirectory, lpNewDirectory, lpSecurityAttributes);
}

HANDLE WINAPI cFindFirstFileW(LPCWSTR lpFileName, LPWIN32_FIND_DATAW lpFindFileData)
{
	char fname[128];
	int len =WideCharToMultiByte( CP_ACP, 0, lpFileName, -1, fname, 128,NULL,NULL); 
	fname[len] =0;

//	WriteLog("FindFirstFileW:%s", fname);
	/*if(g_Filter.FilterOpenFile(lpFileName))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}*/
	return FindFirstFileW(lpFileName, lpFindFileData);
}

HANDLE WINAPI cFindFirstFileA(LPCSTR lpFileName, LPWIN32_FIND_DATA lpFindFileData)
{
	WriteLog("FindFirstFileA:%s", lpFileName);
	/*if(g_Filter.FilterFindFile(lpFileName))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}*/
	return FindFirstFileA(lpFileName, lpFindFileData);
}

BOOL WINAPI cMoveFileW(LPCWSTR lpExistingFileName, LPCWSTR lpNewFileName)
{
	char fname[128];
	int len =WideCharToMultiByte( CP_ACP, 0, lpExistingFileName, -1, fname, 128,NULL,NULL); 
	fname[len] =0;
	char fname1[128];
	len =WideCharToMultiByte( CP_ACP, 0, lpNewFileName, -1, fname1, 128,NULL,NULL); 
	fname1[len] =0;

//	WriteLog("MoveFileW:%s,%s", fname, fname1);

	if(g_Filter.FilterMoveFile(fname, fname1))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}

	return MoveFileW(lpExistingFileName, lpNewFileName);
}

BOOL WINAPI cMoveFileA(LPCSTR lpExistingFileName, LPCSTR lpNewFileName)
{
//	WriteLog("MoveFileA:%s,%s", lpExistingFileName, lpNewFileName);

	if(g_Filter.FilterMoveFile((char *)lpExistingFileName, (char *)lpNewFileName))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}

	return MoveFileA(lpExistingFileName, lpNewFileName);
}

BOOL WINAPI cMoveFileExW(LPCWSTR lpExistingFileName, LPCWSTR lpNewFileName, DWORD dwFlags)
{
	char fname[128];
	int len =WideCharToMultiByte( CP_ACP, 0, lpExistingFileName, -1, fname, 128,NULL,NULL); 
	fname[len] =0;
	char fname1[128];
	len =WideCharToMultiByte( CP_ACP, 0, lpNewFileName, -1, fname1, 128,NULL,NULL); 
	fname1[len] =0;

//	WriteLog("MoveFileExW:%s,%s", fname, fname1);

	if(g_Filter.FilterMoveFile(fname, fname1))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}

	return MoveFileExW(lpExistingFileName, lpNewFileName, dwFlags);
}

BOOL WINAPI cMoveFileExA(LPCSTR lpExistingFileName, LPCSTR lpNewFileName, DWORD dwFlags)
{
//	WriteLog("MoveFileExA:%s,%s", lpExistingFileName, lpNewFileName);

	if(g_Filter.FilterMoveFile((char *)lpExistingFileName, (char *)lpNewFileName))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}

	return MoveFileExA(lpExistingFileName, lpNewFileName, dwFlags);
}

BOOL WINAPI cReadFile(HANDLE hFile, LPVOID lpBuffer, DWORD nNumberOfBytesToRead,
	LPDWORD lpNumberOfBytesRead, LPOVERLAPPED lpOverlapped)
{
//	WriteLog("ReadFile");

	char fname[200];
	GetFileNameByHandle(hFile, fname);
	if(g_Filter.FilterReadFile(fname))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return NULL;
	}

	return ReadFile(hFile, lpBuffer, nNumberOfBytesToRead, lpNumberOfBytesRead, lpOverlapped);
}

BOOL WINAPI cReadFileEx(HANDLE hFile, LPVOID lpBuffer, DWORD nNumberOfBytesToRead,
		LPOVERLAPPED lpOverlapped, LPOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine)
{
//	WriteLog("ReadFileEx");
	char fname[200];
	GetFileNameByHandle(hFile, fname);
	if(g_Filter.FilterReadFile(fname))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return false;
	}
	return ReadFileEx(hFile, lpBuffer, nNumberOfBytesToRead,
		lpOverlapped, lpCompletionRoutine);
}

BOOL WINAPI cSetCurrentDirectoryW(LPCWSTR lpPathName)
{
	char pname[128];
	int len =WideCharToMultiByte( CP_ACP, 0, lpPathName, -1, pname, 128,NULL,NULL); 
	pname[len] =0;
	
//	WriteLog("SetCurrentDirectoryW:%s", pname);

	if(g_Filter.FilterChDir(pname))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return false;
	}

	return SetCurrentDirectoryW(lpPathName);
}

BOOL WINAPI cSetCurrentDirectoryA(LPCSTR lpPathName)
{
//	WriteLog("SetCurrentDirectoryA:%s", lpPathName);

	if(g_Filter.FilterChDir((char *)lpPathName))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return false;
	}

	return SetCurrentDirectoryA(lpPathName);
}

BOOL WINAPI cWriteFile(HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite,
		LPDWORD lpNumberOfBytesWritten, LPOVERLAPPED lpOverlapped)
{
//	WriteLog("WriteFile");

	char fname[200];
	GetFileNameByHandle(hFile, fname);
	if(g_Filter.FilterWriteFile(fname))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return false;
	}

	return WriteFile(hFile, lpBuffer, nNumberOfBytesToWrite, lpNumberOfBytesWritten,
		lpOverlapped);
}

BOOL WINAPI cWriteFileEx(HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite,
		LPOVERLAPPED lpOverlapped, LPOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine)
{
//	WriteLog("WriteFileEx");

	char fname[200];
	GetFileNameByHandle(hFile, fname);
	if(g_Filter.FilterWriteFile(fname))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return false;
	}

	return WriteFileEx(hFile, lpBuffer, nNumberOfBytesToWrite, lpOverlapped, lpCompletionRoutine);
}
HINSTANCE WINAPI cLoadLibraryA(char *name)
{
	char fname[128];
	GetModuleFileName(NULL, fname, sizeof(fname));
	//WriteLog("%s,LoadLibraryA:%s", fname, name);
	return LoadLibraryA(name);
}

HINSTANCE WINAPI cLoadLibraryW(LPWSTR name)
{
	char fname[128];
	GetModuleFileName(NULL, fname, sizeof(fname));

	char aname[128];
	WideCharToMultiByte( CP_ACP, 0, name, -1, aname, 128,NULL,NULL); 
	//WriteLog("%s,LoadLibraryW:%s", fname, aname);

	return LoadLibraryW(name);
}

FARPROC WINAPI cGetProcAddress(HMODULE hMod, char *name)
{
	char fname[128];
	GetModuleFileName(NULL, fname, sizeof(fname));
	//if(strstr(fname, "APIHook") ==NULL)
	//	WriteLog("%s,GetProcAddress:%s", fname, name);
	return GetProcAddress(hMod, name);
}

int WINAPI cNetbios(PNCB pncb)
{
//	WriteLog("Netbios");

	return Netbios(pncb);
}

int WINAPI cNetAlertRaise(	LPWSTR event_name, LPVOID buf, DWORD buf_len)
{
//	WriteLog("cNetAlertRaise...");
	return NetAlertRaise(event_name, buf, buf_len);
}

int WINAPI cWSHOpenSocket(	int *family, int *type, int *protocol, LPWSTR device_name, LPVOID *context, LPDWORD event)
{
//	WriteLog("WSHOpenSocket:event=%d", *event);

	HMODULE hMod=GetModuleHandle("WSHTcpip.dll");
	if(hMod ==NULL) return -1;
	WSHOPENSOCKET WSHOpenSocket =(WSHOPENSOCKET)GetProcAddress(hMod, "WSHOpenSocket");
	if(WSHOpenSocket ==NULL) return -1;

	return WSHOpenSocket(family, type, protocol, device_name, context,event);
}

int WINAPI cWSHOpenSocket2(int *family, int *type, int *protocol, int group, int flags, LPWSTR device_name, LPVOID *context, LPDWORD event)
{
//	WriteLog("WSHOpenSocket2");

	HMODULE hMod=GetModuleHandle("WSHTcpip.dll");
	if(hMod ==NULL) return -1;
	WSHOPENSOCKET2 WSHOpenSocket2 =(WSHOPENSOCKET2)GetProcAddress(hMod, "WSHOpenSocket2");
	if(WSHOpenSocket2 ==NULL) return -1;

	return WSHOpenSocket2(family, type, protocol, group, flags, device_name, context,event);
}

int WINAPI cWSHNotify(	PVOID context, int sock, HANDLE ao, HANDLE co, DWORD event)
{
	
	HMODULE hMod=GetModuleHandle("WSHTcpip.dll");
	if(hMod ==NULL) return -1;
	WSHNOTIFY WSHNotify =(WSHNOTIFY)GetProcAddress(hMod, "WSHNotify");

//	WriteLog("cWSHNotify:event=%d", event);

	return WSHNotify(context, sock, ao, co, event);
}

// test hookprocess
int WINAPI cExitProcess(int exit_code)
{
	char mod_name[128];

//	WriteLog("cExitProcess:exit_code=%d", exit_code);
	GetModuleFileName(NULL, mod_name, sizeof(mod_name));
	if(!strstr(mod_name, "hookprocess"))
	{
		ExitProcess(exit_code);
	}
	return 0;
}
long WINAPI cOpenProcessProcess(long dwDesiredAccess, long bInheritHandle,long dwProcessId)
{
return -1;
}



DWORD WINAPI cCreateProcessW(
	LPCWSTR lpApplicationName,
	LPWSTR lpCommandLine, 
	LPSECURITY_ATTRIBUTES lpProcessAttributes,
	LPSECURITY_ATTRIBUTES lpThreadAttributes,
	BOOL bInheritHandles,
	DWORD dwCreationFlags,
	LPVOID lpEnvironment,
	LPCWSTR lpCurrentDirectory,
	LPSTARTUPINFOW lpStartupInfo,
	LPPROCESS_INFORMATION lpProcessInformation
)
{
	char cmd[600];
	int len =WideCharToMultiByte( CP_ACP, 0, lpCommandLine, -1, cmd, sizeof(cmd),NULL,NULL); 
	cmd[len] =0;

	//WriteLog("CreateProcessW :cmd=%s", cmd);

	if(g_Filter.FilterExecute(cmd))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return false;
	}

	BOOL ifsuccess = CreateProcessW(lpApplicationName,
		lpCommandLine, lpProcessAttributes,
		lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment,
		lpCurrentDirectory, lpStartupInfo, lpProcessInformation);
	DWORD err =GetLastError();
	SetLastError(err);
	return (DWORD)ifsuccess;
}

DWORD WINAPI cCreateProcessA(
	LPCSTR lpApplicationName,
	LPSTR lpCommandLine, 
	LPSECURITY_ATTRIBUTES lpProcessAttributes,
	LPSECURITY_ATTRIBUTES lpThreadAttributes,
	BOOL bInheritHandles,
	DWORD dwCreationFlags,
	LPVOID lpEnvironment,
	LPCSTR lpCurrentDirectory,
	LPSTARTUPINFO lpStartupInfo,
	LPPROCESS_INFORMATION lpProcessInformation
)
{
	if(g_Filter.FilterExecute(lpCommandLine))
	{
		SetLastError(ERROR_NOT_AUTHENTICATED);
		return false;
	}

	BOOL ifsuccess = CreateProcessA(lpApplicationName,
		lpCommandLine, lpProcessAttributes,
		lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment,
		lpCurrentDirectory, lpStartupInfo, lpProcessInformation);
	DWORD err =GetLastError();
	WriteLog("CreateProcessA %s", lpCommandLine);
	SetLastError(err);
	return (DWORD)ifsuccess;
}

CAPIINFO c_api_info[] =
{
	{"KERNEL32.DLL", "CreateFileA(LPCTSTR, DWORD, DWORD,LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE)", "cCreateFileA"},
	{"KERNEL32.DLL", "CreateFileW(LPCWSTR, DWORD, DWORD,LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE)", "cCreateFileW"},
	{"KERNEL32.DLL", "ReadFile(HANDLE, LPVOID, DWORD, LPDWORD, LPOVERLAPPED)", "cReadFile"},
	{"KERNEL32.DLL", "ReadFileEx(HANDLE, LPVOID, DWORD,LPOVERLAPPED, LPOVERLAPPED_COMPLETION_ROUTINE)", "cReadFileEx"},
	{"KERNEL32.DLL", "WriteFile(HANDLE, LPCVOID, DWORD,LPDWORD, LPOVERLAPPED)", "cWriteFile"},
	{"KERNEL32.DLL", "WriteFileEx(HANDLE, LPCVOID,DWORD,LPOVERLAPPED,LPOVERLAPPED_COMPLETION_ROUTINE)", "cWriteFileEx"},
	{"KERNEL32.DLL", "MoveFileA(LPCSTR, LPCSTR)", "cMoveFileA"},
	{"KERNEL32.DLL", "MoveFileW(LPCWSTR, LPCWSTR)", "cMoveFileW"},
	{"KERNEL32.DLL", "MoveFileExA(LPCSTR, LPCSTR, DWORD)", "cMoveFileExA"},
	{"KERNEL32.DLL", "MoveFileExW(LPCWSTR, LPCWSTR, DWORD)", "cMoveFileExW"},
	{"KERNEL32.DLL", "DeleteFileA(LPCSTR)", "cDeleteFileA"},
	{"KERNEL32.DLL", "DeleteFileW(LPCWSTR)", "cDeleteFileW"},
	{"KERNEL32.DLL", "CopyFileA(LPCSTR, LPCSTR, BOOL)", "cCopyFileA"},
	{"KERNEL32.DLL", "CopyFileW(LPCWSTR, LPCWSTR, BOOL)", "cCopyFileW"},
	{"KERNEL32.DLL", "FindFirstFileA(LPCSTR, LPWIN32_FIND_DATA)", "cFindFirstFileA"},
	{"KERNEL32.DLL", "FindFirstFileW(LPCWSTR, LPWIN32_FIND_DATAW)", "cFindFirstFileW"},
	{"KERNEL32.DLL", "CreateDirectoryExA(LPCSTR, LPCSTR,LPSECURITY_ATTRIBUTES)", "cCreateDirectoryExA"},
	{"KERNEL32.DLL", "CreateDirectoryExW(LPCWSTR, LPCWSTR,LPSECURITY_ATTRIBUTES)", "cCreateDirectoryExW"},
	{"KERNEL32.DLL", "CreateDirectoryA(LPCSTR, LPSECURITY_ATTRIBUTES)", "cCreateDirectoryA"},
	{"KERNEL32.DLL", "CreateDirectoryW(LPCWSTR, LPSECURITY_ATTRIBUTES)", "cCreateDirectoryW"},
	{"KERNEL32.DLL", "SetCurrentDirectoryA(LPCSTR)", "cSetCurrentDirectoryA"},
	{"KERNEL32.DLL", "SetCurrentDirectoryW(LPCWSTR)", "cSetCurrentDirectoryW"},
	{"KERNEL32.DLL", "CreateProcessW(1,2,3,4,5,6,7,8,9,10)", "cCreateProcessW"},
	{"KERNEL32.DLL", "CreateProcessA(1,2,3,4,5,6,7,8,9,10)", "cCreateProcessA"},
//	{"KERNEL32.DLL", "OpenProcess(int,int,int)", "cOpenProcessProcess"},
	{"WSOCK32.DLL", "socket(a,b,c)", "cSocket"},
	{"WSOCK32.DLL", "accept(a,b,c)", "cAccept"},
	{"WSOCK32.DLL", "connect(SOCKET, struct sockaddr *, INT)", "cConnect"},
	{"WSOCK32.DLL", "recv(INT, char *, INT, INT)", "cRecv"},
	{"WSOCK32.DLL", "send(INT, char *, INT, INT)", "cSend"},
	{"WSOCK32.DLL", "sendto(INT, char *, INT, INT, struct sockaddr *, int)", "cSendto"},
	{"WSOCK32.DLL", "recvfrom(INT, char *, INT, INT, struct sockaddr *, int)", "cRecvfrom"},
	{"WSOCK32.DLL", "gethostbyname(char *)", "cGethostbyname"},
	{NULL,NULL,NULL}
};

CAPIINFO *GetCAPIINFO()
{
	return &c_api_info[0];
}
