|
void MakeJmpCode(LPBYTE lpbtCode, LPVOID lpCodePoint)
{
WORD wHiWord = HIWORD(lpCodePoint);
WORD wLoWord = LOWORD(lpCodePoint);
WORD wCs;
//use assembler code to get our segment address
_asm
{
push eax;
push cs;
pop eax;
mov wCs, ax;
pop eax;
};
*lpbtCode++ = 0xea; //jmp command code
*lpbtCode++ = LOBYTE(wLoWord);
*lpbtCode++ = HIBYTE(wLoWord);
*lpbtCode++ = LOBYTE(wHiWord);
*lpbtCode++ = HIBYTE(wHiWord);
*lpbtCode++ = LOBYTE(wCs);
*lpbtCode++ = HIBYTE(wCs);
}
采用这个函数将QQ中某个动态库的某个函数强行跳转到我的hook dll中的某个函数地址,假设为MyHookFun.
结果确实跳转过来了,但是在MyHookFun 中调用原来的函数(调用之前我将此函数还原了), 但是每次都在调用原函数时crash.
不知道是什么原因. 感觉是栈不平了.
望高手指点,不胜感激~~
|