I captured the packets I'm sending out by "iptables -A OUTPUT -j
QUEUE"
And use C code with libipq to parse the packet structure, and change
every character into '!' as below:

ipq_packet_msg_t *m = ipq_get_packet(buf);
struct iphdr *iph = ((struct iphdr *)m->payload);
struct tcphdr *tcp = (struct tcphdr *)(m->payload + (iph->ihl << 2));
payload_offset = ((iph->ihl << 2) + (tcp->doff << 2));
payload_length = (unsigned int) ntohs(iph->tot_len) - ((iph->ihl << 2)
+ (tcp->doff << 2));
iphdr_size = (iph->ihl << 2);
tcphdr_size = (tcp->doff << 2);
port = ntohs(tcp->dest);
if (payload_length) {
int i;
for (i=0; i *(m->payload + payload_offset + i) = '!';
}

however, the packets sending out is still the original string, not the
one with all '!' string. what should I do to change the payload of the
tcp packet?

Thank you