diff --git a/230130-hookgamesendto/src/inlinehook.cpp b/230130-hookgamesendto/src/inlinehook.cpp index 02bfa2afda78c2362243cc4cfd31fa4dc6672fd1..da0a5072e3f3525ad4d0ebe4f692e14a7236f4fe 100644 --- a/230130-hookgamesendto/src/inlinehook.cpp +++ b/230130-hookgamesendto/src/inlinehook.cpp @@ -12,27 +12,20 @@ #ifdef _CPU_X64 static void *FindModuleTextBlankAlign(HMODULE hmodule) { - HANDLE curproc = GetCurrentProcess(); BYTE *p = (BYTE *)hmodule; - IMAGE_DOS_HEADER dosh; - ReadProcessMemory(curproc, p, &dosh, sizeof(dosh), NULL); // 读取dos头 - p += dosh.e_lfanew + 4; // PE信息偏移量 - IMAGE_FILE_HEADER exeh; - ReadProcessMemory(curproc, p, &exeh, sizeof(exeh), NULL); // 读取PE信息 - p += sizeof(exeh) + exeh.SizeOfOptionalHeader; // 跳过可选头 - for (int i = 0; i < exeh.NumberOfSections; i++) { - IMAGE_SECTION_HEADER sech; - ReadProcessMemory(curproc, p, &sech, sizeof(sech), NULL); // 读取区段头 - if (memcmp(sech.Name, ".text", 5) == 0) { // 是否.text段 - BYTE *offset = (BYTE *)hmodule + sech.VirtualAddress + sech.Misc.VirtualSize; // 计算空白区域偏移量 + p += ((IMAGE_DOS_HEADER *)p)->e_lfanew + 4; // 根据DOS头获取PE信息偏移量 + p += sizeof(IMAGE_FILE_HEADER) + ((IMAGE_FILE_HEADER *)p)->SizeOfOptionalHeader; // 跳过可选头 + WORD sections = ((IMAGE_FILE_HEADER *)p)->NumberOfSections; // 获取区段长度 + for (int i = 0; i < sections; i++) { + IMAGE_SECTION_HEADER *psec = (IMAGE_SECTION_HEADER *)p; + p += sizeof(IMAGE_SECTION_HEADER); + if (memcmp(psec->Name, ".text", 5) == 0) { // 是否.text段 + BYTE *offset = (BYTE *)hmodule + psec->VirtualAddress + psec->Misc.VirtualSize; // 计算空白区域偏移量 offset += 16 - (INT_PTR)offset % 16; // 对齐16字节 - long long buf[2]; - ReadProcessMemory(curproc, offset, &buf, 16, NULL); - while (buf[0] != 0 || buf[1] != 0) { - offset += 16; - ReadProcessMemory(curproc, offset, &buf, 16, NULL); - } - return offset; + long long *buf = (long long *)offset; + while (buf[0] != 0 || buf[1] != 0) // 找到一块全是0的区域 + buf += 16; + return (void *)buf; } } return 0; @@ -78,7 +71,7 @@ InlineHook::InlineHook(HMODULE hmodule, const char *name, void *fake_func, int e // 写入真正的跳转代码到空白区域 WriteProcessMemory(GetCurrentProcess(), blank, &blank_jump, 14, NULL); // 保存原来的入口代码 - ReadProcessMemory(GetCurrentProcess(), func_ptr, old_entry, entry_len, NULL); + memcpy(old_entry, func_ptr, entry_len); ptr64.ptr = (BYTE *)func_ptr + entry_len; // 设置新的跳转代码 BYTE *new_jump = (BYTE *)old_entry + entry_len; @@ -94,7 +87,7 @@ InlineHook::InlineHook(HMODULE hmodule, const char *name, void *fake_func, int e #ifdef _CPU_X86 hook_entry[0] = 0xE9; // 跳转代码 *(long *)&hook_entry[1] = (BYTE *)fake_func - (BYTE *)func_ptr - 5; // 直接到hook的代码 - ReadProcessMemory(GetCurrentProcess(), func_ptr, old_entry, entry_len, NULL); // 保存入口 + memcpy(old_entry, func_ptr, entry_len); // 保存入口 BYTE *new_jump = (BYTE *)old_entry + entry_len; *new_jump = 0xE9; // 跳回去的代码 *(long *)(new_jump + 1) = (BYTE *)func_ptr + entry_len - new_jump - 5;