zoukankan      html  css  js  c++  java
  • 使用fastcall 代替汇编hook thiscall

    利用fastcall中ecx edx传递的特性,解决了ecx需要内嵌汇编才能实现hook thiscall函数的问题。

    #include <stdio.h>
    #include <stdlib.h>
    #include <Windows.h>
    #include <string>
    #include "mhook-lib/mhook.h"
    
    class A
    {
    private:
        int m_data;
        char* m_sz[20];
    
    public:
        int setMsg(const char* pstr, int data)
        {
            if (pstr != NULL && *(char*)pstr != '')
            {
                memcpy(m_sz, pstr, 20);
            }
    
            m_data = data;
    
            return 0;
        }
    
    
        void showMsg()
        {
            if (m_sz[0] != '')
            {
                printf("%s,%d
    ", m_sz,m_data);
            }
        }
    
    
    };
    
    
    
    typedef int (__thiscall A::* TYPE_Ptr)(const char* pstr, int data);
    
    
    typedef int (__fastcall * TYPE_setMsgPtr)(void* pthis,  void* notUsed, const char*, int);
    
    TYPE_setMsgPtr pNew;
    
    
    int __fastcall HookSetMsg(void * pThis ,void * notUsed, const char* pstr, int data)
    {
    
        printf("hook new function
    ");
        return pNew(pThis, notUsed, pstr, data);
    }
    
    
    
    
    TYPE_setMsgPtr pfnSetMsg = NULL;
    
    //实现hook thiscall 的方法,不需要用naked汇编
    int main(int argc, char **argv)
    {
        A* theA = new A();
        theA->setMsg("hello A!", 12);
        
        theA->showMsg();
    
        TYPE_Ptr px = &A::setMsg;
        int x = *(int*)&px;
    
        //printf("%p,%p
    ", px, x);
    
        pNew = (TYPE_setMsgPtr)x;
        Mhook_SetHook((PVOID*)&pNew, HookSetMsg);
    
        theA->setMsg("hello B!", 14);
        theA->showMsg();
    
        theA->setMsg("hello C!", 1);
        theA->showMsg();
    
        return 0;
    }

    仅列出关键代码,其他不展示了,不懂的留言。

  • 相关阅读:
    Misc1
    PXE
    VCL
    pacman usage
    .vimrc的配置
    Windows Server 2012 R2
    Windows 入门杂乱无章版
    VS Code Plugins And Configuration
    「Poetize5」GF弹钢琴
    「Poetize4」上帝造题的七分钟2
  • 原文地址:https://www.cnblogs.com/Fightingbirds/p/10649970.html
Copyright © 2011-2022 走看看