MFC thunk技术模拟

1. //参考http://www.cnblogs.com/satng/archive/2010/12/30/2138833.html
2. #include<iostream>
   
3. using namespace std;
   
4. 
   
5. //thunk技术模拟
   
6. 
   
7. typedef void (*fun)(void*,int i);
   
8. 
   
9. class CFun;//类声明。
   
10. 
    
11. #pragma pack(push)
    
12. #pragma pack(1)
    
13. typedef struct Thunk{
    
14.     unsigned char call;
    
15.     int offset;
    
16.     fun pf;//函数指针。
    
17.     unsigned char code[5];
    
18.     CFun *ths;//this指针。
    
19.     unsigned char jmp;
    
20.     unsigned char ecx;
    
21. }Thunk;
    
22. #pragma pack(pop)
    
23. 
    
24. #define OFF(s,m)((unsigned int)&((s*)0)->m)//求结构体的偏移量，s为结构体的类型，m为结构体的数据成员。
    
25. 
    
26. class CFun{
    
27. public:
    
28.     CFun()
    
29.     {
    
30.         createThunk();
    
31.     }
    
32.     ~CFun()
    
33.     {
    
34.         delete thunk;
    
35.     }
    
36. public:
    
37.     void createThunk()
    
38.     {
    
39.         Thunk* tk=new Thunk;
    
40.         //call des
    
41.         tk->call=0xE8;//call
    
42.         tk->offset=OFF(Thunk,code[0])-OFF(Thunk,pf);//des
    
43. 
    
44.         tk->pf=CFun::funx;//函数地址。
    
45.         //pop ecx
    
46.         //等价于：
    
47.         //mov ecx,[esp]
    
48.         //sub esp,4
    
49.         tk->code[0]=0x59;//pop ecx
    
50.         //mov[esp+4],this
    
51.         tk->code[1]=0xc7;//mov
    
52.         tk->code[2]=0x44;//dword ptr
    
53.         //4[esp]
    
54.         tk->code[3]=0x24;//[esp]
    
55.         tk->code[4]=0x04;//+4
    
56.         tk->ths=this;//修改栈，设置this指针。
    
57. 
    
58.         //jmp[ecx]
    
59.         tk->jmp=0xFF;//jmp
    
60.         tk->ecx=0x21;//[ecx]
    
61. 
    
62.         thunk=(fun)tk;
    
63. 
    
64.         return ;
    
65.     }
    
66.     static void funx(void *pFun,int i)
    
67.     {
    
68.         CFun *pf=(CFun*)pFun;
    
69.         pf->print(i);
    
70.     }
    
71.     void print(int i)
    
72.     {
    
73.         cout<<"Recevie="<<i<<endl;
    
74.     }
    
75. 
    
76.     fun GetThunk()
    
77.     {
    
78.         return thunk;
    
79.     }
    
80. private:
    
81.     fun thunk;
    
82. };
    
83. 
    
84. int main()
    
85. {
    
86.     CFun cf;
    
87.     fun pf=cf.GetThunk();
    
88.     pf("Hello",123);
    
89.     return 0;
    
90. }