Do not use ReadProcessMemory

230130-hookgamesendto/src/inlinehook.cpp

@@ -12,27 +12,20 @@
 #ifdef _CPU_X64
 static void *FindModuleTextBlankAlign(HMODULE hmodule)
 {
-    HANDLE curproc = GetCurrentProcess();
     BYTE *p = (BYTE *)hmodule;
-    IMAGE_DOS_HEADER dosh;
-    ReadProcessMemory(curproc, p, &dosh, sizeof(dosh), NULL); // 读取dos头
-    p += dosh.e_lfanew + 4; // PE信息偏移量
-    IMAGE_FILE_HEADER exeh;
-    ReadProcessMemory(curproc, p, &exeh, sizeof(exeh), NULL); // 读取PE信息
-    p += sizeof(exeh) + exeh.SizeOfOptionalHeader; // 跳过可选头
-    for (int i = 0; i < exeh.NumberOfSections; i++) {
-        IMAGE_SECTION_HEADER sech;
-        ReadProcessMemory(curproc, p, &sech, sizeof(sech), NULL); // 读取区段头
-        if (memcmp(sech.Name, ".text", 5) == 0) { // 是否.text段
-            BYTE *offset = (BYTE *)hmodule + sech.VirtualAddress + sech.Misc.VirtualSize; // 计算空白区域偏移量
+    p += ((IMAGE_DOS_HEADER *)p)->e_lfanew + 4; // 根据DOS头获取PE信息偏移量
+    p += sizeof(IMAGE_FILE_HEADER) + ((IMAGE_FILE_HEADER *)p)->SizeOfOptionalHeader; // 跳过可选头
+    WORD sections = ((IMAGE_FILE_HEADER *)p)->NumberOfSections; // 获取区段长度
+    for (int i = 0; i < sections; i++) {
+        IMAGE_SECTION_HEADER *psec = (IMAGE_SECTION_HEADER *)p;
+        p += sizeof(IMAGE_SECTION_HEADER);
+        if (memcmp(psec->Name, ".text", 5) == 0) { // 是否.text段
+            BYTE *offset = (BYTE *)hmodule + psec->VirtualAddress + psec->Misc.VirtualSize; // 计算空白区域偏移量
             offset += 16 - (INT_PTR)offset % 16; // 对齐16字节
-            long long buf[2];
-            ReadProcessMemory(curproc, offset, &buf, 16, NULL);
-            while (buf[0] != 0 || buf[1] != 0) {
-                offset += 16;
-                ReadProcessMemory(curproc, offset, &buf, 16, NULL);
-            }
-            return offset;
+            long long *buf = (long long *)offset;
+            while (buf[0] != 0 || buf[1] != 0) // 找到一块全是0的区域
+                buf += 16;
+            return (void *)buf;
         }
     }
     return 0;
@@ -78,7 +71,7 @@ InlineHook::InlineHook(HMODULE hmodule, const char *name, void *fake_func, int e
     // 写入真正的跳转代码到空白区域
     WriteProcessMemory(GetCurrentProcess(), blank, &blank_jump, 14, NULL);
     // 保存原来的入口代码
-    ReadProcessMemory(GetCurrentProcess(), func_ptr, old_entry, entry_len, NULL);
+    memcpy(old_entry, func_ptr, entry_len);
     ptr64.ptr = (BYTE *)func_ptr + entry_len;
     // 设置新的跳转代码
     BYTE *new_jump = (BYTE *)old_entry + entry_len;
@@ -94,7 +87,7 @@ InlineHook::InlineHook(HMODULE hmodule, const char *name, void *fake_func, int e
 #ifdef _CPU_X86
     hook_entry[0] = 0xE9; // 跳转代码
     *(long *)&hook_entry[1] = (BYTE *)fake_func - (BYTE *)func_ptr - 5; // 直接到hook的代码
-    ReadProcessMemory(GetCurrentProcess(), func_ptr, old_entry, entry_len, NULL); // 保存入口
+    memcpy(old_entry, func_ptr, entry_len); // 保存入口
     BYTE *new_jump = (BYTE *)old_entry + entry_len;
     *new_jump = 0xE9; // 跳回去的代码
     *(long *)(new_jump + 1) = (BYTE *)func_ptr + entry_len - new_jump - 5;