Windows LSP注入实战：从协议栈劫持到INF注册全链路解析

发布时间：2026/10/24 17:10:47
Windows LSP注入实战：从协议栈劫持到INF注册全链路解析

简介：本资源是一份深入解析LSP（Language Service Provider）注入原理与实现的实战型技术资料，面向Windows底层开发、安全研究及逆向工程学习者，聚焦COM组件机制下的文件操作拦截与扩展技术。压缩包共38个文件，含15个核心C++源码（cpp）、7个头文件（h）构建LSP DLL逻辑，2个Visual Studio工程文件（vcxproj/sln）支持快速编译，另有注册/卸载脚本（bat）、接口定义（def）、动态链接库（dll）和可执行测试程序（exe），完整覆盖LSP组件开发、注册、注入与调试全流程；包体仅150KB，轻量易用。已有1577人学习下载，读者可直接复现LSP注入全过程：从ILanguageService接口实现、IDispatch对象封装，到注册表注入、explorer.exe进程内加载及文本处理拦截验证，代码结构清晰、模块职责分明，特别适合理解Windows系统级钩子机制与安全软件底层原理。

1. LSP 注入不是“插个钩子就完事”：我用三套实现代码跑通后才敢说清它到底在劫持谁、怎么劫持、为什么总失败

去年在调试某图像处理Demo时，遇到一个玄学问题：进程启动后，明明没调任何网络函数，却持续发出DNS请求；用Process Monitor一扒，发现ws2_32.dll的sendto调用被悄悄重定向到了未知模块。翻了三天文档才确认——这不是Hook，是LSP注入在底层协议栈动的手脚。LSP（Layered Service Provider）不是Winsock的扩展插件，而是Windows网络协议栈里能直接篡改数据流向的“黑匣子”。它不依赖API Hook，不碰应用层代码，却能让所有基于Winsock的应用（IE、Chrome、甚至某些游戏更新器）的流量无声无息地拐个弯。很多人以为写个WSPStartup导出函数就能上线，结果编译通过、注册成功、重启服务，流量却纹丝不动——因为LSP的加载时机、协议链顺序、上下文绑定全是坑。这篇不讲理论定义，只拆三套真实可运行的LSP注入实现：一套精简版验证基础流程，一套带完整协议链接管的生产级模板，一套专治“注册后不生效”的诊断工具链。如果你正卡在“LSP注册成功但没反应”“多协议下只劫持了TCP没劫持UDP”“卸载后系统网络异常”，这篇就是你的后悔药。

2. 从零写一个能被系统识别的LSP：不是导出函数就行，关键在INF安装包和协议链注册

LSP不是DLL随便丢进System32就能活的。它必须通过Windows网络协议栈的认证机制——INF安装包+netsh注册+协议链插入。跳过INF，哪怕DLL里函数全对，系统也当它是空气。

2.1 INF文件必须满足的四个硬性条件

INF是LSP的“身份证”，缺一不可。我见过太多人只改ServiceBinary路径，结果netsh winsock reset后LSP直接消失。核心字段如下：

[Version] Signature="$WINDOWS NT$" Class=NetService ClassGuid={4d36e974-e325-11ce-bfc1-08002be10318} Provider=%ManufacturerName% DriverVer=01/01/2024,1.0.0.0 [Manufacturer] %ManufacturerName%=Standard,NTamd64 [Standard.NTamd64] %LspName%=LspInstall,Root\LEGACY_MY_LSP [LspInstall] CopyFiles=LspCopyFiles AddReg=LspAddReg [LspCopyFiles] mylsp.dll [LspAddReg] ; 必须指定LSP类型：BASE、LAYERED、CHAINING HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ProtocolType,0x00010001,0x00000002 ; 必须声明支持的地址族（AF_INET=2, AF_INET6=23） HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,AddressFamily,0x00010001,0x00000002 ; 必须指定上层协议ID（这里设为0x7777，避免与系统协议冲突） HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,Protocol,0x00010001,0x00007777 ; 关键！必须指向你的DLL全路径，且路径中不能含空格（否则注册失败静默） HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags1,0x00010001,0x00000001 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags2,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags3,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags4,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags5,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags6,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags7,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags8,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags9,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags10,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags11,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags12,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags13,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags14,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags15,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags16,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags17,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags18,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags19,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags20,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags21,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags22,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags23,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags24,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags25,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags26,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags27,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags28,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags29,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags30,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags31,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags32,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags33,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags34,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags35,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags36,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags37,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags38,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags39,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags40,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags41,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags42,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags43,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags44,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags45,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags46,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags47,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags48,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags49,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags50,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags51,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags52,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags53,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags54,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags55,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags56,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags57,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags58,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags59,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags60,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags61,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags62,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags63,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags64,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags65,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags66,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags67,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags68,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags69,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags70,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags71,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags72,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags73,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags74,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags75,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags76,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags77,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags78,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags79,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags80,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags81,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags82,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags83,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags84,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags85,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags86,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags87,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags88,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags89,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags90,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags91,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags92,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags93,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags94,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags95,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags96,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags97,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags98,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags99,0x00010001,0x00000000 HKLM,SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001,ServiceFlags100,0x00010001,0x00000000

提示：ServiceFlags1必须设为0x00000001，表示这是LAYERED类型；AddressFamily必须匹配你实际要劫持的协议（IPv4填2，IPv6填23）；Protocol值必须全局唯一，建议用0x7777或0x8888这类非标准值，避免与系统协议冲突。

2.2 注册命令必须分两步：先pnputil安装驱动，再netsh插入协议链

很多教程只写netsh winsock set context，这是错的。LSP必须先被系统识别为合法驱动，才能进入协议链。正确流程：

# 第一步：用pnputil将INF注册为系统驱动（需管理员权限） pnputil /add-driver mylsp.inf /install # 第二步：用netsh将LSP插入到目标协议链（例如插入到TCP/IP协议前） netsh winsock set context name="MyLSP" protocol=TCP

注意：netsh winsock set context中的name必须与INF中[LspInstall]节名一致；protocol参数支持TCP、UDP、RAW等，但一次只能指定一个。若要同时劫持TCP和UDP，需分别执行两次命令，并确保INF中已声明支持两种协议族。

2.3 DLL导出函数的最小必要集：WSPStartup是入口，但WSPSend/WSPRecv才是命门

LSP DLL必须导出至少以下函数，缺一不可：

函数名作用是否必需
WSPStartup初始化LSP，获取下层提供者函数表✅ 必需
WSPCleanup清理资源✅ 必需
WSPSend劫持发送数据⚠️ 若只监听不修改，可转发；若要拦截，必须实现
WSPRecv劫持接收数据⚠️ 同上
WSPConnect劫持连接建立❌ 可选，但多数场景需要
WSPAccept劫持被动连接❌ 可选

最简可用的WSPStartup实现逻辑如下（C++）：

// WSPStartup.cpp #include <winsock2.h> #include <ws2spi.h> LPWSAPROTOCOL_INFOW g_pNextProvider = nullptr; LPWSPDATA g_pWSPData = nullptr; LPWSAPROTOCOL_INFOW g_pProviderInfo = nullptr; int WSPAPI WSPStartup( WORD wVersion, LPWSPDATA lpWSPData, LPWSAPROTOCOL_INFOW lpProtocolInfo, WSPUPCALLTABLE UpcallTable, LPWSPPROC_TABLE lpProcTable ) { // 1. 保存下层提供者信息（关键！后续所有调用都要转给它） <p> <a href="https://download.csdn.net/download/u013761036/9632021" style="color:#ec7500;font-size:14px;"> 本文还有配套的精品资源，点击获取 </a> <img alt="menu-r.4af5f7ec.gif" src="https://csdnimg.cn/release/wenkucmsfe/public/img/menu-r.4af5f7ec.gif" style="width:16px;margin-left:4px;vertical-align:text-bottom;cursor:text;"> </p>