inlinehook的地址問題
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 | int fun1(pList target) // Install Hook{ if(setup == TRUE) setupList(); if (target == null) return 1; if (target->Hooked == TRUE) return 2; if (checkOption(*target) != 0) if (checkOption(*target) != -6 && checkOption(*target) != -1 && checkOption(*target) != -2) return checkOption(*target); byte ownShellCode[length] = { '\x00' },origin[length]; // shellcode target->shellcode = ownShellCode;cAddr("MessageBoxW", user32) dword SaveNew = 0; memcpy(ownShellCode, shellcode,length); memcpy(ownShellCode + stepAddr, target->NewFuncAddress, addrlength); if (VirtualProtect(target->HookAddress, length, PAGE_EXECUTE_READWRITE, &target->backuppage) != TRUE)return 3; memcpy(origin, target->HookAddress, length); memcpy(target->HookAddress, ownShellCode, length); if (VirtualProtect(target->HookAddress, length, target->backuppage, &SaveNew) != TRUE) return 4; target->origincode = origin; target->Hooked = TRUE; return 0;} |
如上，這個(gè)是我寫的inlinehook函數(shù)
是采用
1 2 3 4 | push raxmov rax,xx xx xx xx xx xxjmp raxpop rax |
的方式跳轉(zhuǎn)的
但是最后的測(cè)試出問題了 
可以看到我這里的東西已經(jīng)copy進(jìn)去了，但是最后會(huì)異常
我看了很久實(shí)在沒啥辦法了，求大佬解惑
收藏
2條回答
Bad_Dream
2022-11-8
回復(fù)
已采納
mb_vidsvvxq
2022-11-6
回復(fù)
Bad_Dream:
x64有這種方法的 我接觸到的一種改變寄存器的是 mov rax,xx xx xx xx xx xx jmp rax
回復(fù)
2022-11-6
我的問答
領(lǐng)取收益
采納榜
21
10
8
4
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
