提交 27e2f0aa 编写于 作者: Peacoor Zomboss's avatar Peacoor Zomboss

Use better code for inlinehook

上级 2a71e0a8
......@@ -2,27 +2,35 @@
#include "inlinehook.h"
#include "platform.h"
#ifdef _CPU_X64
#define HOOK_PATCH_MAX 18
#endif
#ifdef _CPU_X86
#define HOOK_PATCH_MAX 27
#endif
#ifdef _CPU_X64
static void *FindModuleTextBlankAlign(HMODULE hmodule)
{
HANDLE curproc = GetCurrentProcess();
BYTE *p = (BYTE *)hmodule;
IMAGE_DOS_HEADER dosh;
ReadProcessMemory(GetCurrentProcess(), p, &dosh, sizeof(dosh), NULL); // 读取dos头
ReadProcessMemory(curproc, p, &dosh, sizeof(dosh), NULL); // 读取dos头
p += dosh.e_lfanew + 4; // PE信息偏移量
IMAGE_FILE_HEADER exeh;
ReadProcessMemory(GetCurrentProcess(), p, &exeh, sizeof(exeh), NULL); // 读取PE信息
ReadProcessMemory(curproc, p, &exeh, sizeof(exeh), NULL); // 读取PE信息
p += sizeof(exeh) + exeh.SizeOfOptionalHeader; // 跳过可选头
for (int i = 0; i < exeh.NumberOfSections; i++) {
IMAGE_SECTION_HEADER sech;
ReadProcessMemory(GetCurrentProcess(), p, &sech, sizeof(sech), NULL); // 读取区段头
ReadProcessMemory(curproc, p, &sech, sizeof(sech), NULL); // 读取区段头
if (memcmp(sech.Name, ".text", 5) == 0) { // 是否.text段
BYTE *offset = (BYTE *)hmodule + sech.VirtualAddress + sech.Misc.VirtualSize; // 计算空白区域偏移量
offset += 16 - (INT_PTR)offset % 16; // 对齐16字节
long long buf[2];
ReadProcessMemory(GetCurrentProcess(), offset, &buf, 16, NULL);
ReadProcessMemory(curproc, offset, &buf, 16, NULL);
while (buf[0] != 0 || buf[1] != 0) {
offset += 16;
ReadProcessMemory(GetCurrentProcess(), offset, &buf, 16, NULL);
ReadProcessMemory(curproc, offset, &buf, 16, NULL);
}
return offset;
}
......@@ -37,8 +45,8 @@ InlineHook::InlineHook(HMODULE hmodule, const char *name, void *fake_func, int e
// 范围检查
if (entry_len < HOOK_JUMP_LEN)
entry_len = HOOK_JUMP_LEN;
if (entry_len > 27)
entry_len = 27;
if (entry_len > HOOK_PATCH_MAX)
entry_len = HOOK_PATCH_MAX;
// 允许func_ptr处最前面的5字节内存可读可写可执行
VirtualProtect(func_ptr, HOOK_JUMP_LEN, PAGE_EXECUTE_READWRITE, NULL);
// 使用VirtualAlloc申请内存,使其可读可写可执行
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册