//需要HOOK的地址
DWORD hookAddr = winBaseAddr + offsetAddr;
//组装数据
BYTE jmpData[HOOK_LEN] = { 0 };
//表示汇编jmp
jmpData[0] = 0xE9;
//要跳转的地址-HOOK地址-5
*(DWORD*)&jmpData[1] = (DWORD)funcAddr - hookAddr - HOOK_LEN;
//获取自己进程的句柄
HANDLE mHandle = OpenProcess(PROCESS_ALL_ACCESS, NULL, GetCurrentProcessId());
//备份HOOK地址的数据
if (ReadProcessMemory(mHandle, (LPCVOID)hookAddr, backData, HOOK_LEN, NULL) == 0) {
MessageBox(NULL, "读取内存失败", "错误", 0);
return;
}
//往指定地址写入数据
if (WriteProcessMemory(mHandle, (LPVOID)hookAddr, jmpData, HOOK_LEN, NULL) == 0) {
MessageBox(NULL, "写入内存失败", "错误", 0);
return;
}
写入数据没出现 jmp
变成 call xxxxxxxxxxxxxxxxxx