3.ring0-__STDCALL inline HOOK 和 __declspec(naked) inline HOOK区别

两者差别

1.__STDCALL inline HOOK是针对整个函数的hook，好处是变量清楚,坏处时肯定只能在函数头hook

NTSTATUS __stdcall
NewNtQueryDirectoryFile(
						IN HANDLE FileHandle,
						IN HANDLE Event OPTIONAL,
												.......
					  )
{
return OldNtQueryDirectoryFile(FileHandle,\
									 Event,
									 ApcRoutine,
											 ........)

2.__declspec(naked) inline HOOK是针对函数局部的hook，好处是可以在任意处做hook，坏处是使用变量时只能用寄存器，看起来怪怪的

__declspec(naked) FASTCALL NewKiReadyThread()
{
	__asm
	{
		pushad
		pushfd
 
		push ecx //ETHREAD object 取出线程的入口地址
		call IsGameProtectModuleThread
		cmp eax,0
		jnz _ThreadRet
 
		popfd
		popad
		jmp [KiReadyThreadHookZone]
 
_ThreadRet:
		popfd
		popad
		ret
	}
}