inlinehook的地址问题
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 | int fun1(pList target) // Install Hook{ if(setup == TRUE) setupList(); if (target == null) return 1; if (target->Hooked == TRUE) return 2; if (checkOption(*target) != 0) if (checkOption(*target) != -6 && checkOption(*target) != -1 && checkOption(*target) != -2) return checkOption(*target); byte ownShellCode[length] = { '\x00' },origin[length]; // shellcode target->shellcode = ownShellCode;cAddr("MessageBoxW", user32) dword SaveNew = 0; memcpy(ownShellCode, shellcode,length); memcpy(ownShellCode + stepAddr, target->NewFuncAddress, addrlength); if (VirtualProtect(target->HookAddress, length, PAGE_EXECUTE_READWRITE, &target->backuppage) != TRUE)return 3; memcpy(origin, target->HookAddress, length); memcpy(target->HookAddress, ownShellCode, length); if (VirtualProtect(target->HookAddress, length, target->backuppage, &SaveNew) != TRUE) return 4; target->origincode = origin; target->Hooked = TRUE; return 0;} |
如上，这个是我写的inlinehook函数
是采用
1 2 3 4 | push raxmov rax,xx xx xx xx xx xxjmp raxpop rax |
的方式跳转的
但是最后的测试出问题了 
可以看到我这里的东西已经copy进去了，但是最后会异常
我看了很久实在没啥办法了，求大佬解惑
收藏
2条回答
Bad_Dream
2022-11-8
回复
已采纳
mb_vidsvvxq
2022-11-6
回复
Bad_Dream:
x64有这种方法的 我接触到的一种改变寄存器的是 mov rax,xx xx xx xx xx xx jmp rax
回复
2022-11-6
回答
采纳榜
21
10
10
4
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
