一个更为简单易用的THUNK类

    利用THUNK技术回调类成员函数，是一项前几年很热门的技术，网上的资料和示例代码也很多，但这些代码普遍存在一些差强人意的地方，要么缺乏通用性，需要针对不同的回调函数作调整，要么使用起来不方便，需要在应用代码里写上三、四行以上不相关（甚至有些莫名其妙）的代码或宏，不便于代码的阅读和维护。

    针对这些缺点，我编写了一个更为简单易用的使用THUNK技术的回调函数类，类代码和示例如下：

#include <windows.h> #include <stdio.h> #include<iomanip> #include <string.h> #include <tchar.h> class CThunkBase { private: BYTE m_ASMCODE[50]; int m_Var; public: CThunkBase() { m_Var = 1234; memset(&m_ASMCODE,0x90 ,51); //用nop填充代码块 m_ASMCODE[0] = 0x55; //push ebp *((WORD*)&m_ASMCODE[1]) = 0xec8b; //mov ebp,esp //从m_ASMCODE[3]开始为模拟函数运行代码，预留40字节 *((WORD*)&m_ASMCODE[43]) = 0xe58b; //mov esp,ebp m_ASMCODE[45] = 0x5d; //pop ebp *((DWORD*)&m_ASMCODE[46]) = 0xc3; //ret } virtual ~CThunkBase(){}; //虚析构函数 template <typename T> DWORD GetFuncAddr(T pfnProc) { int nArgs = 0,nOffset=0; char* pszTemp; const char* pszTypeName; DWORD lpFuncAddr; //如果指针为空，返回 if(pfnProc==NULL) return NULL; //获得函数类型及参数个数 pszTypeName= typeid(pfnProc).name(); //转换指定的函数指针 lpFuncAddr = *static_cast<DWORD*>(static_cast<void*>(&pfnProc) ); //如果不是类成员函数，直接返回原函数地址 if(!strstr(pszTypeName,(char*)"::")) return lpFuncAddr; //获得原函数的参数个数 pszTemp = strstr(strstr(pszTypeName,(char*)")")+1,(char*)"("); if( strcmp(pszTemp, (char*)"(void)") != 0 ) { pszTemp = strtok(pszTemp, (char*)","); while(pszTemp != NULL) { nArgs ++; pszTemp = strtok(NULL, (char*)","); } } //将原函数的参数逐一压入栈中，默认参数长度为4Bytes nOffset = 3; for(int i = 0; i < nArgs; i++) { *((WORD*)&m_ASMCODE[nOffset]) = 0x75ff; m_ASMCODE[nOffset + 2] = (nArgs-i)*4+4; //从右到左入栈 nOffset += 3; } //mov ecx, this m_ASMCODE[nOffset] = 0xb9; *((DWORD*)&m_ASMCODE[nOffset+1]) = (DWORD)this; nOffset += 5; if(!strstr(pszTypeName,(char*)"_thiscall")) //如果不为thiscall调用方式 { //push ecx,thiscall直接通过ecx寄存器传递this,stdcall则通过栈压入this m_ASMCODE[nOffset] = 0x51; nOffset ++; //修改返回方式ret为retn if(nArgs) { m_ASMCODE[46] = 0xc2; //retn *((DWORD*)&m_ASMCODE[47]) = 4*nArgs; //默认参数长度为4Bytes } } //call lpFuncAddr m_ASMCODE[nOffset] = 0xe8; *((DWORD*)&m_ASMCODE[nOffset+1]) = lpFuncAddr - (DWORD)&m_ASMCODE[nOffset] - 5; nOffset += 5; return (DWORD)&m_ASMCODE; } };  

    第一个应用实例：派生一个回调无参数类成员函数的定时器的类。

class CTimer : public CThunkBase { public: CTimer(){ m_uElapse = 20; m_TimerID = 30; }; ~CTimer() {}; void set(int uElapse){ m_uElapse = uElapse; }; void begin(){ m_TimerID = SetTimer(NULL,0,m_uElapse,(TIMERPROC)GetFuncAddr(&CTimer::CallBcak)); }; void end(){ KillTimer(NULL,m_TimerID); }; void WINAPI CallBcak(HWND hwnd, UINT uMsg, unsigned int idEvent, DWORD dwTime){ printf("/n CTimer::CallBcak,ID=%d, Elapse=%d/n",m_TimerID,m_uElapse); printf("hwnd=%x, nMsg=%d, idEvent=%d, dwTime=%d/n",hwnd, uMsg,idEvent,dwTime); }; private: int m_uElapse; int m_TimerID; }; int main() { CTimer* pTimer = new CTimer; pTimer->set(500); pTimer->begin(); MSG msg; BOOL bRet; while( (bRet = GetMessage( &msg, NULL, 0, 0 )) != 0) { if (bRet == -1) break; else { TranslateMessage(&msg); DispatchMessage(&msg); } } delete pTimer; return 0; }

 

    由此实例可以看出，读者在使用CThunkBase基类时，只需要两行语句，一是public CThunkBase，二是GetFuncAddr。是不是简单明了啊？

    然后，我们再来看一下基于CThunkBase派生的一个简单的窗口类及其调用实例：

class CWinSimple : public CThunkBase { public: CWinSimple(){ m_hInst = GetModuleHandle(NULL); _tcscpy(m_szClassName, TEXT("CWindowEx")); SetRect(&m_rcWindow, 0, 0, 100, 100); memset(&m_wcx, 0, sizeof(WNDCLASS)); m_wcx.style = CS_HREDRAW | CS_VREDRAW; m_wcx.lpfnWndProc = (WNDPROC)GetFuncAddr(&CWinSimple::WindowProc); m_wcx.hInstance = GetModuleHandle(NULL); m_wcx.hCursor = LoadCursor(NULL, IDC_ARROW); m_wcx.hbrBackground = (HBRUSH)(COLOR_BACKGROUND); m_wcx.lpszClassName = m_szClassName; RegisterClass(&m_wcx); } ~CWinSimple(){ if(m_hWnd != NULL) Destroy(); UnregisterClass(m_szClassName, m_hInst); } HWND Create(HWND hWndParent = NULL, LPRECT lpRect = NULL, LPCTSTR szWindowName = NULL) { if(m_hWnd != NULL) Destroy(); if(lpRect == NULL) lpRect = &m_rcWindow; m_hWnd = CreateWindow(m_szClassName, szWindowName, WS_OVERLAPPEDWINDOW, lpRect->left, lpRect->top, lpRect->right, lpRect->bottom, hWndParent, NULL, m_hInst, NULL); UpdateWindow(m_hWnd); ShowWindow(m_hWnd, SW_SHOW); return m_hWnd; } BOOL Destroy() { return DestroyWindow(m_hWnd); } protected: LRESULT CALLBACK WindowProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam) { HDC hDC; PAINTSTRUCT ps; TCHAR szString[] = TEXT("Hello,World!"); switch(message) { case WM_SIZE: GetWindowRect(m_hWnd, &m_rcWindow); GetClientRect(m_hWnd, &m_rcClient); break; case WM_PAINT: hDC = BeginPaint(m_hWnd, &ps); SetBkMode(hDC, TRANSPARENT); DrawText(hDC, szString, _tcslen(szString), &m_rcClient, DT_SINGLELINE | DT_CENTER | DT_VCENTER); EndPaint(m_hWnd, &ps); break; case WM_DESTROY: PostQuitMessage(0); break; } return DefWindowProc(hWnd, message, wParam, lParam); } private: HWND m_hWnd; HINSTANCE m_hInst; TCHAR m_szClassName[100]; WNDCLASS m_wcx; RECT m_rcWindow,m_rcClient; }; int main() { CWinSimple cwin; cwin.Create(); MSG msg; BOOL bRet; while( (bRet = GetMessage( &msg, NULL, 0, 0 )) != 0) { if (bRet == -1) break; else { TranslateMessage(&msg); DispatchMessage(&msg); } } return 0; }

 

    同第一个派生类一样，也只需要两行代码，public CThunkBase和GetFuncAddr。其实，在多重派生里CThunkBase运行结果依然正确。

    由于水平有很，代码中难免存在漏洞，欢迎指正。