寻道xd 2016-01-02 01:47 采纳率: 0%
浏览 1503

关于看雪论坛Hook类中一段代码的疑惑

PHOOKENVIRONMENT __stdcall InstallHookApi(PCHAR DllName,PCHAR ApiName,PVOID HookProc)
{
HMODULE DllHandle;
PVOID ApiEntry;
int ReplaceCodeSize;
DWORD oldpro;
DWORD SizeOfStub;
DWORD delta;
DWORD RetSize =0;

PHOOKENVIRONMENT pHookEnv;

if (HookProc == NULL)
{
    return NULL;
}

DllHandle = GetModuleHandleA(DllName);
if (DllHandle == NULL)
    DllHandle = LoadLibraryA(DllName);
if (DllHandle == NULL)
    return NULL;

ApiEntry = GetProcAddress(DllHandle,ApiName);
if (ApiEntry == NULL) return NULL;

ReplaceCodeSize = GetOpCodeSize((BYTE*)ApiEntry);

while (ReplaceCodeSize < 5)
    ReplaceCodeSize += GetOpCodeSize((BYTE*)((DWORD)ApiEntry + (DWORD)ReplaceCodeSize));

if (ReplaceCodeSize > 16) return NULL;

SizeOfStub = GetEndAddr()-(DWORD)&pEnv;

pHookEnv = (PHOOKENVIRONMENT)VirtualAlloc(NULL,SizeOfStub,MEM_COMMIT,PAGE_READWRITE);
if(!pHookEnv){
    return NULL;
}
memset((void*)&pEnv,0x90,sizeof(pEnv));
CopyMemory(pHookEnv,(PVOID)&pEnv,SizeOfStub);
CopyMemory((void*)pHookEnv,(void*)&pEnv,sizeof(pEnv.savebytes));
CopyMemory(pHookEnv->savebytes,ApiEntry,ReplaceCodeSize);

pHookEnv->OrgApiAddr = ApiEntry;
pHookEnv->SizeOfReplaceCode = ReplaceCodeSize;

pHookEnv->jmptoapi[0]=0xE9;
*(DWORD*)(&pHookEnv->jmptoapi[1]) = (DWORD)ApiEntry + ReplaceCodeSize - ((DWORD)pHookEnv->jmptoapi + 5);

//patch api
if (!VirtualProtect(ApiEntry,ReplaceCodeSize,PAGE_EXECUTE_READWRITE,&oldpro))
    return FALSE;

delta = (DWORD)pHookEnv - (DWORD)&pEnv;

*(DWORD*)(&JMPGate[1]) = ((DWORD)NewStub + delta) - ((DWORD)ApiEntry + 5);

WriteProcessMemory(GetCurrentProcess(), ApiEntry, JMPGate, sizeof(JMPGate),&RetSize);

if (!VirtualProtect(ApiEntry,ReplaceCodeSize,oldpro,&oldpro))
    return FALSE;

//写入变量
*(DWORD*)((DWORD)NewStub + delta + 3) = (DWORD)HookProc - ((DWORD)NewStub + delta + 3 + 4);

return pHookEnv;

}
在这一句SizeOfStub = GetEndAddr()-(DWORD)&pEnv;
我得到的SizeOfStub总是一个负值,我想问问该句的作用是什么?

  • 写回答

1条回答 默认 最新

  • qq_33593819 2016-01-02 01:56
    关注

    这 好像是个函数代码

    评论

报告相同问题?

悬赏问题

  • ¥20 SQL server表计算问题
  • ¥15 C# P/Invoke的效率问题
  • ¥20 thinkphp适配人大金仓问题
  • ¥20 Oracle替换.dbf文件后无法连接,如何解决?(相关搜索:数据库|死循环)
  • ¥15 数据库数据成问号了,前台查询正常,数据库查询是?号
  • ¥15 算法使用了tf-idf,用手肘图确定k值确定不了,第四轮廓系数又太小才有0.006088746097507285,如何解决?(相关搜索:数据处理)
  • ¥15 彩灯控制电路,会的加我QQ1482956179
  • ¥200 相机拍直接转存到电脑上 立拍立穿无线局域网传
  • ¥15 (关键词-电路设计)
  • ¥15 如何解决MIPS计算是否溢出