1.DLL lib
LIBRARY
"
XXX.DLL
"
EXPORTS
Initialize @ 1 PRIVATE
EXPORTS
Initialize @ 1 PRIVATE
void
__stdcall Initialize(
int
nParam1,
int
nParam2,
int
nParam3
=
0
)
... {
......
}
... {
......
}
2. 宿主程序
typedef
long
(WINAPI
*
InitializeProc)(
int
nParam1,
int
nParam2)
InitializeProc pfnInitialize
=
(InitializeProc )GetProcAddress(hInstance,
"
Initialize
"
);
if (m_pfnInitialize )
pfnInitialize ( 1 , 2 );
if (m_pfnInitialize )
pfnInitialize ( 1 , 2 );
===============
当callInitialize函数时按照stdcall压栈顺序,先把2,1,return addr 压入栈中,而实际上Initialize会把return addr当作第三个参数nParam3,一旦函数执行完毕,会把错误的地址作为return addr引起程序crash