如何在Windows中挂钩TCP堆栈来嗅探和修改数据包？

using System;
using System.IO;
using System.Net;
using System.Net.Sockets;
using System.Runtime.InteropServices;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Win32.SafeHandles;

namespace WfpExample
{
    class Program
    {
        static void Main(string[] args)
        {
            // 注册回调函数
            var filter = new FWPM_CALLOUT0
            {
                calloutKey = Guid.NewGuid(),
                displayData = new FWPM_DISPLAY_DATA0
                {
                    name = "Example Callout"
                },
                flags = FWPM_CALLOUT_FLAG.FWPM_CALLOUT_FLAG_PERSISTENT,
                providerKey = Guid.Empty,
                applicableLayer = FWPM_LAYER.FWPM_LAYER_ALE_AUTH_CONNECT_V4
            };

            var filterHandle = IntPtr.Zero;
            var filterEnumHandle = IntPtr.Zero;
            var sessionHandle = IntPtr.Zero;

            try
            {
                // 创建会话
                var session = new FWPM_SESSION0
                {
                    flags = FWPM_SESSION_FLAG.FWPM_SESSION_FLAG_DYNAMIC
                };

                var sessionHandle = IntPtr.Zero;
                var result = FwpmEngineOpen0(ref session, out sessionHandle);
                if (result != 0)
                {
                    throw new Win32Exception(result);
                }

                // 添加回调函数
                result = FwpmCalloutAdd0(sessionHandle, ref filter, out filterHandle);
                if (result != 0)
                {
                    throw new Win32Exception(result);
                }

                // 枚举回调函数
                result = FwpmCalloutCreateEnumHandle0(sessionHandle, ref filterEnumHandle);
                if (result != 0)
                {
                    throw new Win32Exception(result);
                }

                // 启动网络监听
                var socket = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.IP);
                socket.Bind(new IPEndPoint(IPAddress.Any, 0));

                var buffer = new byte[4096];
                while (true)
                {
                    var received = socket.Receive(buffer);
                    var packet = new IPPacket(buffer, received);

                    // 在这里嗅探和修改数据包

                    socket.Send(packet.GetBytes());
                }
            }
            catch (Exception ex)
            {
                Console.WriteLine(ex);
            }
            finally
            {
                // 删除回调函数
                if (filterHandle != IntPtr.Zero)
                {
                    FwpmCalloutDeleteById0(sessionHandle, filter.calloutKey);
                }

                // 关闭会话
                if (sessionHandle != IntPtr.Zero)
                {
                    FwpmEngineClose0(sessionHandle);
                }
            }
        }

        [DllImport("Fwpuclnt.dll", SetLastError = true, CharSet = CharSet.Auto)]
        public static extern int FwpmEngineOpen0(ref FWPM_SESSION0 session, out IntPtr sessionHandle);

        [DllImport("Fwpuclnt.dll", SetLastError = true, CharSet = CharSet.Auto)]
        public static extern int FwpmEngineClose0(IntPtr sessionHandle);

        [DllImport("Fwpuclnt.dll", SetLastError = true, CharSet = CharSet.Auto)]
        public static extern int FwpmCalloutAdd0(IntPtr sessionHandle, ref FWPM_CALLOUT0 callout, out IntPtr calloutHandle);

        [DllImport("Fwpuclnt.dll", SetLastError = true, CharSet = CharSet.Auto)]
        public static extern int FwpmCalloutDeleteById0(IntPtr sessionHandle, Guid calloutKey);

        [DllImport("Fwpuclnt.dll", SetLastError = true, CharSet = CharSet.Auto)]
        public static extern int FwpmCalloutCreateEnumHandle0(IntPtr sessionHandle, ref IntPtr enumHandle, out IntPtr enumHandle);
    }
}