win下 mhook的使用

最新推荐文章于 2021-10-28 18:57:27 发布
最新推荐文章于 2021-10-28 18:57:27 发布
阅读量2.4k 收藏 1
点赞数
文章标签： python
原文链接：http://blog.51cto.com/haidragon/2362763
版权

地址：
https://github.com/haidragon/mhook
win下 mhook的使用
mhook.cpp

//Copyright (c) 2007-2008, Marton Anka
//
//Permission is hereby granted, free of charge, to any person obtaining a 
//copy of this software and associated documentation files (the "Software"), 
//to deal in the Software without restriction, including without limitation 
//the rights to use, copy, modify, merge, publish, distribute, sublicense, 
//and/or sell copies of the Software, and to permit persons to whom the 
//Software is furnished to do so, subject to the following conditions:
//
//The above copyright notice and this permission notice shall be included 
//in all copies or substantial portions of the Software.
//
//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 
//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 
//FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 
//THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 
//LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
//FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS 
//IN THE SOFTWARE.

#include <windows.h>
#include <tlhelp32.h>
#include <stdio.h>
#include "mhook.h"
#include "../disasm-lib/disasm.h"

//=========================================================================
#ifndef cntof
#define cntof(a) (sizeof(a)/sizeof(a[0]))
#endif

//=========================================================================
#ifndef GOOD_HANDLE
#define GOOD_HANDLE(a) ((a!=INVALID_HANDLE_VALUE)&&(a!=NULL))
#endif

//=========================================================================
#ifndef gle
#define gle GetLastError
#endif

//=========================================================================
#ifndef ODPRINTF

#ifdef _DEBUG
#define ODPRINTF(a) odprintf a
#else
#define ODPRINTF(a)
#endif

inline void __cdecl odprintf(PCSTR format, ...) {
    va_list args;
    va_start(args, format);
    int len = _vscprintf(format, args);
    if (len > 0) {
        len += (1 + 2);
        PSTR buf = (PSTR) malloc(len);
        if (buf) {
            len = vsprintf_s(buf, len, format, args);
            if (len > 0) {
                while (len && isspace(buf[len-1])) len--;
                buf[len++] = '\r';
                buf[len++] = '\n';
                buf[len] = 0;
                OutputDebugStringA(buf);
            }
            free(buf);
        }
        va_end(args);
    }
}

inline void __cdecl odprintf(PCWSTR format, ...) {
    va_list args;
    va_start(args, format);
    int len = _vscwprintf(format, args);
    if (len > 0) {
        len += (1 + 2);
        PWSTR buf = (PWSTR) malloc(sizeof(WCHAR)*len);
        if (buf) {
            len = vswprintf_s(buf, len, format, args);
            if (len > 0) {
                while (len && iswspace(buf[len-1])) len--;
                buf[len++] = L'\r';
                buf[len++] = L'\n';
                buf[len] = 0;
                OutputDebugStringW(buf);
            }
            free(buf);
        }
        va_end(args);
    }
}

#endif //#ifndef ODPRINTF

//=========================================================================
#define MHOOKS_MAX_CODE_BYTES   32
#define MHOOKS_MAX_RIPS          4

//=========================================================================
// The trampoline structure - stores every bit of info about a hook
struct MHOOKS_TRAMPOLINE {
    PBYTE   pSystemFunction;                                // the original system function
    DWORD   cbOverwrittenCode;                              // number of bytes overwritten by the jump
    PBYTE   pHookFunction;                                  // the hook function that we provide
    BYTE    codeJumpToHookFunction[MHOOKS_MAX_CODE_BYTES];  // placeholder for code that jumps to the hook function
    BYTE    codeTrampoline[MHOOKS_MAX_CODE_BYTES];          // placeholder for code that holds the first few
                                                            //   bytes from the system function and a jump to the remainder
                                                            //   in the original location
    BYTE    codeUntouched[MHOOKS_MAX_CODE_BYTES];           // placeholder for unmodified original code
                                                            //   (we patch IP-relative addressing)
    MHOOKS_TRAMPOLINE* pPrevTrampoline;                     // When in the free list, thess are pointers to the prev and next entry.
    MHOOKS_TRAMPOLINE* pNextTrampoline;                     // When not in the free list, this is a pointer to the prev and next trampoline in use.
};

//=========================================================================
// The patch data structures - store info about rip-relative instructions
// during hook placement
struct MHOOKS_RIPINFO
{
    DWORD   dwOffset;
    S64     nDisplacement;
};

struct MHOOKS_PATCHDATA
{
    S64             nLimitUp;
    S64             nLimitDown;
    DWORD           nRipCnt;
    MHOOKS_RIPINFO  rips[MHOOKS_MAX_RIPS];
};

//=========================================================================
// Global vars
static BOOL g_bVarsInitialized = FALSE;
static CRITICAL_SECTION g_cs;
static MHOOKS_TRAMPOLINE* g_pHooks = NULL;
static MHOOKS_TRAMPOLINE* g_pFreeList = NULL;
static DWORD g_nHooksInUse = 0;
static HANDLE* g_hThreadHandles = NULL;
static DWORD g_nThreadHandles = 0;
#define MHOOK_JMPSIZE 5
#define MHOOK_MINALLOCSIZE 4096

//=========================================================================
// Toolhelp defintions so the functions can be dynamically bound to
typedef HANDLE (WINAPI * _CreateToolhelp32Snapshot)(
    DWORD dwFlags,     
    DWORD th32ProcessID  
    );

typedef BOOL (WINAPI * _Thread32First)(
                                       HANDLE hSnapshot,     
                                       LPTHREADENTRY32 lpte
                                       );

typedef BOOL (WINAPI * _Thread32Next)(
                                      HANDLE hSnapshot,  
                                      LPTHREADENTRY32 lpte
                                      );

//=========================================================================
// Bring in the toolhelp functions from kernel32
_CreateToolhelp32Snapshot fnCreateToolhelp32Snapshot = (_CreateToolhelp32Snapshot) GetProcAddress(GetModuleHandle(L"kernel32"), "CreateToolhelp32Snapshot");
_Thread32First fnThread32First = (_Thread32First) GetProcAddress(GetModuleHandle(L"kernel32"), "Thread32First");
_Thread32Next fnThread32Next = (_Thread32Next) GetProcAddress(GetModuleHandle(L"kernel32"), "Thread32Next");

//=========================================================================
// Internal function:
//
// Remove the trampoline from the specified list, updating the head pointer
// if necessary.
//=========================================================================
static VOID ListRemove(MHOOKS_TRAMPOLINE** pListHead, MHOOKS_TRAMPOLINE* pNode) {
    if (pNode->pPrevTrampoline) {
        pNode->pPrevTrampoline->pNextTrampoline = pNode->pNextTrampoline;
    }

    if (pNode->pNextTrampoline) {
        pNode->pNextTrampoline->pPrevTrampoline = pNode->pPrevTrampoline;
    }

    if ((*pListHead) == pNode) {
        (*pListHead) = pNode->pNextTrampoline;
        assert((*pListHead)->pPrevTrampoline == NULL);
    }

    pNode->pPrevTrampoline = NULL;
    pNode->pNextTrampoline = NULL;
}

//=========================================================================
// Internal function:
//
// Prepend the trampoline from the specified list and update the head pointer.
//=========================================================================
static VOID ListPrepend(MHOOKS_TRAMPOLINE** pListHead, MHOOKS_TRAMPOLINE* pNode) {
    pNode->pPrevTrampoline = NULL;
    pNode->pNextTrampoline = (*pListHead);
    if ((*pListHead)) {
        (*pListHead)->pPrevTrampoline = pNode;
    }
    (*pListHead) = pNode;
}

//=========================================================================
static VOID EnterCritSec() {
    if (!g_bVarsInitialized) {
        InitializeCriticalSection(&g_cs);
        g_bVarsInitialized = TRUE;
    }
    EnterCriticalSection(&g_cs);
}

//=========================================================================
static VOID LeaveCritSec() {
    LeaveCriticalSection(&g_cs);
}

//=========================================================================
// Internal function:
// 
// Skip over jumps that lead to the real function. Gets around import
// jump tables, etc.
//=========================================================================
static PBYTE SkipJumps(PBYTE pbCode) {
    PBYTE pbOrgCode = pbCode;
#ifdef _M_IX86_X64
#ifdef _M_IX86
    //mov edi,edi: hot patch point
    if (pbCode[0] == 0x8b && pbCode[1] == 0xff)
        pbCode += 2;
    // push ebp; mov ebp, esp; pop ebp;
    // "collapsed" stackframe generated by MSVC
    if (pbCode[0] == 0x55 && pbCode[1] == 0x8b && pbCode[2] == 0xec && pbCode[3] == 0x5d)
        pbCode += 4;
#endif  
    if (pbCode[0] == 0xff && pbCode[1] == 0x25) {
#ifdef _M_IX86
        // on x86 we have an absolute pointer...
        PBYTE pbTarget = *(PBYTE *)&pbCode[2];
        // ... that shows us an absolute pointer.
        return SkipJumps(*(PBYTE *)pbTarget);
#elif defined _M_X64
        // on x64 we have a 32-bit offset...
        INT32 lOffset = *(INT32 *)&pbCode[2];
        // ... that shows us an absolute pointer
        return SkipJumps(*(PBYTE*)(pbCode + 6 + lOffset));
    } else if (pbCode[0] == 0x48 && pbCode[1] == 0xff && pbCode[2] == 0x25) {
        // or we can have the same with a REX prefix
        INT32 lOffset = *(INT32 *)&pbCode[3];
        // ... that shows us an absolute pointer
        return SkipJumps(*(PBYTE*)(pbCode + 7 + lOffset));
#endif
    } else if (pbCode[0] == 0xe9) {
        // here the behavior is identical, we have...
        // ...a 32-bit offset to the destination.
        return SkipJumps(pbCode + 5 + *(INT32 *)&pbCode[1]);
    } else if (pbCode[0] == 0xeb) {
        // and finally an 8-bit offset to the destination
        return SkipJumps(pbCode + 2 + *(CHAR *)&pbCode[1]);
    }
#else
#error unsupported platform
#endif
    return pbOrgCode;
}

//=========================================================================
// Internal function:
//
// Writes code at pbCode that jumps to pbJumpTo. Will attempt to do this
// in as few bytes as possible. Important on x64 where the long jump
// (0xff 0x25 ....) can take up 14 bytes.
//=========================================================================
static PBYTE EmitJump(PBYTE pbCode, PBYTE pbJumpTo) {
#ifdef _M_IX86_X64
    PBYTE pbJumpFrom = pbCode + 5;
    SIZE_T cbDiff = pbJumpFrom > pbJumpTo ? pbJumpFrom - pbJumpTo : pbJumpTo - pbJumpFrom;
    ODPRINTF((L"mhooks: EmitJump: Jumping from %p to %p, diff is %p", pbJumpFrom, pbJumpTo, cbDiff));
    if (cbDiff <= 0x7fff0000) {
        pbCode[0] = 0xe9;
        pbCode += 1;
        *((PDWORD)pbCode) = (DWORD)(DWORD_PTR)(pbJumpTo - pbJumpFrom);
        pbCode += sizeof(DWORD);
    } else {
        pbCode[0] = 0xff;
        pbCode[1] = 0x25;
        pbCode += 2;
#ifdef _M_IX86
        // on x86 we write an absolute address (just behind the instruction)
        *((PDWORD)pbCode) = (DWORD)(DWORD_PTR)(pbCode + sizeof(DWORD));
#elif defined _M_X64
        // on x64 we write the relative address of the same location
        *((PDWORD)pbCode) = (DWORD)0;
#endif
        pbCode += sizeof(DWORD);
        *((PDWORD_PTR)pbCode) = (DWORD_PTR)(pbJumpTo);
        pbCode += sizeof(DWORD_PTR);
    }
#else 
#error unsupported platform
#endif
    return pbCode;
}

//=========================================================================
// Internal function:
//
// Round down to the next multiple of rndDown
//=========================================================================
static size_t RoundDown(size_t addr, size_t rndDown)
{
    return (addr / rndDown) * rndDown;
}

//=========================================================================
// Internal function:
//
// Will attempt allocate a block of memory within the specified range, as 
// near as possible to the specified function.
//=========================================================================
static MHOOKS_TRAMPOLINE* BlockAlloc(PBYTE pSystemFunction, PBYTE pbLower, PBYTE pbUpper) {
    SYSTEM_INFO sSysInfo =  {0};
    ::GetSystemInfo(&sSysInfo);

    // Always allocate in bulk, in case the system actually has a smaller allocation granularity than MINALLOCSIZE.
    const ptrdiff_t cAllocSize = max(sSysInfo.dwAllocationGranularity, MHOOK_MINALLOCSIZE);

    MHOOKS_TRAMPOLINE* pRetVal = NULL;
    PBYTE pModuleGuess = (PBYTE) RoundDown((size_t)pSystemFunction, cAllocSize);
    int loopCount = 0;
    for (PBYTE pbAlloc = pModuleGuess; pbLower < pbAlloc && pbAlloc < pbUpper; ++loopCount) {
        // determine current state
        MEMORY_BASIC_INFORMATION mbi;
        ODPRINTF((L"mhooks: BlockAlloc: Looking at address %p", pbAlloc));
        if (!VirtualQuery(pbAlloc, &mbi, sizeof(mbi)))
            break;
        // free & large enough?
        if (mbi.State == MEM_FREE && mbi.RegionSize >= (unsigned)cAllocSize) {
            // and then try to allocate it
            pRetVal = (MHOOKS_TRAMPOLINE*) VirtualAlloc(pbAlloc, cAllocSize, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
            if (pRetVal) {
                size_t trampolineCount = cAllocSize / sizeof(MHOOKS_TRAMPOLINE);
                ODPRINTF((L"mhooks: BlockAlloc: Allocated block at %p as %d trampolines", pRetVal, trampolineCount));

                pRetVal[0].pPrevTrampoline = NULL;
                pRetVal[0].pNextTrampoline = &pRetVal[1];

                // prepare them by having them point down the line at the next entry.
                for (size_t s = 1; s < trampolineCount; ++s) {
                    pRetVal[s].pPrevTrampoline = &pRetVal[s - 1];
                    pRetVal[s].pNextTrampoline = &pRetVal[s + 1];
                }

                // last entry points to the current head of the free list
                pRetVal[trampolineCount - 1].pNextTrampoline = g_pFreeList;
                break;
            }
        }

        // This is a spiral, should be -1, 1, -2, 2, -3, 3, etc. (* cAllocSize)
        ptrdiff_t bytesToOffset = (cAllocSize * (loopCount + 1) * ((loopCount % 2 == 0) ? -1 : 1));
        pbAlloc = pbAlloc + bytesToOffset;
    }

    return pRetVal;
}

//=========================================================================
// Internal function:
//
// Will try to allocate a big block of memory inside the required range. 
//=========================================================================
static MHOOKS_TRAMPOLINE* FindTrampolineInRange(PBYTE pLower, PBYTE pUpper) {
    if (!g_pFreeList) {
        return NULL;
    }

    // This is a standard free list, except we're doubly linked to deal with soem return shenanigans.
    MHOOKS_TRAMPOLINE* curEntry = g_pFreeList;
    while (curEntry) {
        if ((MHOOKS_TRAMPOLINE*) pLower < curEntry && curEntry < (MHOOKS_TRAMPOLINE*) pUpper) {
            ListRemove(&g_pFreeList, curEntry);

            return curEntry;
        }

        curEntry = curEntry->pNextTrampoline;
    }

    return NULL;
}

//=========================================================================
// Internal function:
//
// Will try to allocate the trampoline structure within 2 gigabytes of
// the target function. 
//=========================================================================
static MHOOKS_TRAMPOLINE* TrampolineAlloc(PBYTE pSystemFunction, S64 nLimitUp, S64 nLimitDown) {

    MHOOKS_TRAMPOLINE* pTrampoline = NULL;

    // determine lower and upper bounds for the allocation locations.
    // in the basic scenario this is +/- 2GB but IP-relative instructions
    // found in the original code may require a smaller window.
    PBYTE pLower = pSystemFunction + nLimitUp;
    pLower = pLower < (PBYTE)(DWORD_PTR)0x0000000080000000 ? 
                        (PBYTE)(0x1) : (PBYTE)(pLower - (PBYTE)0x7fff0000);
    PBYTE pUpper = pSystemFunction + nLimitDown;
    pUpper = pUpper < (PBYTE)(DWORD_PTR)0xffffffff80000000 ? 
        (PBYTE)(pUpper + (DWORD_PTR)0x7ff80000) : (PBYTE)(DWORD_PTR)0xfffffffffff80000;
    ODPRINTF((L"mhooks: TrampolineAlloc: Allocating for %p between %p and %p", pSystemFunction, pLower, pUpper));

    // try to find a trampoline in the specified range
    pTrampoline = FindTrampolineInRange(pLower, pUpper);
    if (!pTrampoline) {
        // if it we can't find it, then we need to allocate a new block and 
        // try again. Just fail if that doesn't work 
        g_pFreeList = BlockAlloc(pSystemFunction, pLower, pUpper);
        pTrampoline = FindTrampolineInRange(pLower, pUpper);
    }

    // found and allocated a trampoline?
    if (pTrampoline) {
        ListPrepend(&g_pHooks, pTrampoline);
    }

    return pTrampoline;
}

//=========================================================================
// Internal function:
//
// Return the internal trampoline structure that belongs to a hooked function.
//=========================================================================
static MHOOKS_TRAMPOLINE* TrampolineGet(PBYTE pHookedFunction) {
    MHOOKS_TRAMPOLINE* pCurrent = g_pHooks;

    while (pCurrent) {
        if (pCurrent->pHookFunction == pHookedFunction) {
            return pCurrent;
        }

        pCurrent = pCurrent->pNextTrampoline;
    }

    return NULL;
}

//=========================================================================
// Internal function:
//
// Free a trampoline structure.
//=========================================================================
static VOID TrampolineFree(MHOOKS_TRAMPOLINE* pTrampoline, BOOL bNeverUsed) {
    ListRemove(&g_pHooks, pTrampoline);

    // If a thread could feasinbly have some of our trampoline code 
    // on its stack and we yank the region from underneath it then it will
    // surely crash upon returning. So instead of freeing the 
    // memory we just let it leak. Ugly, but safe.
    if (bNeverUsed) {
        ListPrepend(&g_pFreeList, pTrampoline);
    }

    g_nHooksInUse--;
}

//=========================================================================
// Internal function:
//
// Suspend a given thread and try to make sure that its instruction
// pointer is not in the given range.
//=========================================================================
static HANDLE SuspendOneThread(DWORD dwThreadId, PBYTE pbCode, DWORD cbBytes) {
    // open the thread
    HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, dwThreadId);
    if (GOOD_HANDLE(hThread)) {
        // attempt suspension
        DWORD dwSuspendCount = SuspendThread(hThread);
        if (dwSuspendCount != -1) {
            // see where the IP is
            CONTEXT ctx;
            ctx.ContextFlags = CONTEXT_CONTROL;
            int nTries = 0;
            while (GetThreadContext(hThread, &ctx)) {
#ifdef _M_IX86
                PBYTE pIp = (PBYTE)(DWORD_PTR)ctx.Eip;
#elif defined _M_X64
                PBYTE pIp = (PBYTE)(DWORD_PTR)ctx.Rip;
#endif
                if (pIp >= pbCode && pIp < (pbCode + cbBytes)) {
                    if (nTries < 3) {
                        // oops - we should try to get the instruction pointer out of here. 
                        ODPRINTF((L"mhooks: SuspendOneThread: suspended thread %d - IP is at %p - IS COLLIDING WITH CODE", dwThreadId, pIp));
                        ResumeThread(hThread);
                        Sleep(100);
                        SuspendThread(hThread);
                        nTries++;
                    } else {
                        // we gave it all we could. (this will probably never 
                        // happen - unless the thread has already been suspended 
                        // to begin with)
                        ODPRINTF((L"mhooks: SuspendOneThread: suspended thread %d - IP is at %p - IS COLLIDING WITH CODE - CAN'T FIX", dwThreadId, pIp));
                        ResumeThread(hThread);
                        CloseHandle(hThread);
                        hThread = NULL;
                        break;
                    }
                } else {
                    // success, the IP is not conflicting
                    ODPRINTF((L"mhooks: SuspendOneThread: Successfully suspended thread %d - IP is at %p", dwThreadId, pIp));
                    break;
                }
            }
        } else {
            // couldn't suspend
            CloseHandle(hThread);
            hThread = NULL;
        }
    }
    return hThread;
}

//=========================================================================
// Internal function:
//
// Resumes all previously suspended threads in the current process.
//=========================================================================
static VOID ResumeOtherThreads() {
    // make sure things go as fast as possible
    INT nOriginalPriority = GetThreadPriority(GetCurrentThread());
    SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_TIME_CRITICAL);
    // go through our list
    for (DWORD i=0; i<g_nThreadHandles; i++) {
        // and resume & close thread handles
        ResumeThread(g_hThreadHandles[i]);
        CloseHandle(g_hThreadHandles[i]);
    }
    // clean up
    free(g_hThreadHandles);
    g_hThreadHandles = NULL;
    g_nThreadHandles = 0;
    SetThreadPriority(GetCurrentThread(), nOriginalPriority);
}

//=========================================================================
// Internal function:
//
// Suspend all threads in this process while trying to make sure that their 
// instruction pointer is not in the given range.
//=========================================================================
static BOOL SuspendOtherThreads(PBYTE pbCode, DWORD cbBytes) {
    BOOL bRet = FALSE;
    // make sure we're the most important thread in the process
    INT nOriginalPriority = GetThreadPriority(GetCurrentThread());
    SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_TIME_CRITICAL);
    // get a view of the threads in the system
    HANDLE hSnap = fnCreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, GetCurrentProcessId());
    if (GOOD_HANDLE(hSnap)) {
        THREADENTRY32 te;
        te.dwSize = sizeof(te);
        // count threads in this process (except for ourselves)
        DWORD nThreadsInProcess = 0;
        if (fnThread32First(hSnap, &te)) {
            do {
                if (te.th32OwnerProcessID == GetCurrentProcessId()) {
                    if (te.th32ThreadID != GetCurrentThreadId()) {
                        nThreadsInProcess++;
                    }
                }
                te.dwSize = sizeof(te);
            } while(fnThread32Next(hSnap, &te));
        }
        ODPRINTF((L"mhooks: SuspendOtherThreads: counted %d other threads", nThreadsInProcess));
        if (nThreadsInProcess) {
            // alloc buffer for the handles we really suspended
            g_hThreadHandles = (HANDLE*)malloc(nThreadsInProcess*sizeof(HANDLE));
            if (g_hThreadHandles) {
                ZeroMemory(g_hThreadHandles, nThreadsInProcess*sizeof(HANDLE));
                DWORD nCurrentThread = 0;
                BOOL bFailed = FALSE;
                te.dwSize = sizeof(te);
                // go through every thread
                if (fnThread32First(hSnap, &te)) {
                    do {
                        if (te.th32OwnerProcessID == GetCurrentProcessId()) {
                            if (te.th32ThreadID != GetCurrentThreadId()) {
                                // attempt to suspend it
                                g_hThreadHandles[nCurrentThread] = SuspendOneThread(te.th32ThreadID, pbCode, cbBytes);
                                if (GOOD_HANDLE(g_hThreadHandles[nCurrentThread])) {
                                    ODPRINTF((L"mhooks: SuspendOtherThreads: successfully suspended %d", te.th32ThreadID));
                                    nCurrentThread++;
                                } else {
                                    ODPRINTF((L"mhooks: SuspendOtherThreads: error while suspending thread %d: %d", te.th32ThreadID, gle()));
                                    // TODO: this might not be the wisest choice
                                    // but we can choose to ignore failures on
                                    // thread suspension. It's pretty unlikely that
                                    // we'll fail - and even if we do, the chances
                                    // of a thread's IP being in the wrong place
                                    // is pretty small.
                                    // bFailed = TRUE;
                                }
                            }
                        }
                        te.dwSize = sizeof(te);
                    } while(fnThread32Next(hSnap, &te) && !bFailed);
                }
                g_nThreadHandles = nCurrentThread;
                bRet = !bFailed;
            }
        }
        CloseHandle(hSnap);
        //TODO: we might want to have another pass to make sure all threads
        // in the current process (including those that might have been
        // created since we took the original snapshot) have been 
        // suspended.
    } else {
        ODPRINTF((L"mhooks: SuspendOtherThreads: can't CreateToolhelp32Snapshot: %d", gle()));
    }
    SetThreadPriority(GetCurrentThread(), nOriginalPriority);
    if (!bRet) {
        ODPRINTF((L"mhooks: SuspendOtherThreads: Had a problem (or not running multithreaded), resuming all threads."));
        ResumeOtherThreads();
    }
    return bRet;
}

//=========================================================================
// if IP-relative addressing has been detected, fix up the code so the
// offset points to the original location
static void FixupIPRelativeAddressing(PBYTE pbNew, PBYTE pbOriginal, MHOOKS_PATCHDATA* pdata)
{
#if defined _M_X64
    S64 diff = pbNew - pbOriginal;
    for (DWORD i = 0; i < pdata->nRipCnt; i++) {
        DWORD dwNewDisplacement = (DWORD)(pdata->rips[i].nDisplacement - diff);
        ODPRINTF((L"mhooks: fixing up RIP instruction operand for code at 0x%p: "
            L"old displacement: 0x%8.8x, new displacement: 0x%8.8x", 
            pbNew + pdata->rips[i].dwOffset, 
            (DWORD)pdata->rips[i].nDisplacement, 
            dwNewDisplacement));
        *(PDWORD)(pbNew + pdata->rips[i].dwOffset) = dwNewDisplacement;
    }
#endif
}

//=========================================================================
// Examine the machine code at the target function's entry point, and
// skip bytes in a way that we'll always end on an instruction boundary.
// We also detect branches and subroutine calls (as well as returns)
// at which point disassembly must stop.
// Finally, detect and collect information on IP-relative instructions
// that we can patch.
static DWORD DisassembleAndSkip(PVOID pFunction, DWORD dwMinLen, MHOOKS_PATCHDATA* pdata) {
    DWORD dwRet = 0;
    pdata->nLimitDown = 0;
    pdata->nLimitUp = 0;
    pdata->nRipCnt = 0;
#ifdef _M_IX86
    ARCHITECTURE_TYPE arch = ARCH_X86;
#elif defined _M_X64
    ARCHITECTURE_TYPE arch = ARCH_X64;
#else
    #error unsupported platform
#endif
    DISASSEMBLER dis;
    if (InitDisassembler(&dis, arch)) {
        INSTRUCTION* pins = NULL;
        U8* pLoc = (U8*)pFunction;
        DWORD dwFlags = DISASM_DECODE | DISASM_DISASSEMBLE | DISASM_ALIGNOUTPUT;

        ODPRINTF((L"mhooks: DisassembleAndSkip: Disassembling %p", pLoc));
        while ( (dwRet < dwMinLen) && (pins = GetInstruction(&dis, (ULONG_PTR)pLoc, pLoc, dwFlags)) ) {
            ODPRINTF(("mhooks: DisassembleAndSkip: %p:(0x%2.2x) %s", pLoc, pins->Length, pins->String));
            if (pins->Type == ITYPE_RET     ) break;
            if (pins->Type == ITYPE_BRANCH  ) break;
            if (pins->Type == ITYPE_BRANCHCC) break;
            if (pins->Type == ITYPE_CALL    ) break;
            if (pins->Type == ITYPE_CALLCC  ) break;

            #if defined _M_X64
                BOOL bProce***ip = FALSE;
                // mov or lea to register from rip+imm32
                if ((pins->Type == ITYPE_MOV || pins->Type == ITYPE_LEA) && (pins->X86.Relative) && 
                    (pins->X86.OperandSize == 8) && (pins->OperandCount == 2) &&
                    (pins->Operands[1].Flags & OP_IPREL) && (pins->Operands[1].Register == AMD64_REG_RIP))
                {
                    // rip-addressing "mov reg, [rip+imm32]"
                    ODPRINTF((L"mhooks: DisassembleAndSkip: found OP_IPREL on operand %d with displacement 0x%x (in memory: 0x%x)", 1, pins->X86.Displacement, *(PDWORD)(pLoc+3)));
                    bProce***ip = TRUE;
                }
                // mov or lea to rip+imm32 from register
                else if ((pins->Type == ITYPE_MOV || pins->Type == ITYPE_LEA) && (pins->X86.Relative) && 
                    (pins->X86.OperandSize == 8) && (pins->OperandCount == 2) &&
                    (pins->Operands[0].Flags & OP_IPREL) && (pins->Operands[0].Register == AMD64_REG_RIP))
                {
                    // rip-addressing "mov [rip+imm32], reg"
                    ODPRINTF((L"mhooks: DisassembleAndSkip: found OP_IPREL on operand %d with displacement 0x%x (in memory: 0x%x)", 0, pins->X86.Displacement, *(PDWORD)(pLoc+3)));
                    bProce***ip = TRUE;
                }
                else if ( (pins->OperandCount >= 1) && (pins->Operands[0].Flags & OP_IPREL) )
                {
                    // unsupported rip-addressing
                    ODPRINTF((L"mhooks: DisassembleAndSkip: found unsupported OP_IPREL on operand %d", 0));
                    // dump instruction bytes to the debug output
                    for (DWORD i=0; i<pins->Length; i++) {
                        ODPRINTF((L"mhooks: DisassembleAndSkip: instr byte %2.2d: 0x%2.2x", i, pLoc[i]));
                    }
                    break;
                }
                else if ( (pins->OperandCount >= 2) && (pins->Operands[1].Flags & OP_IPREL) )
                {
                    // unsupported rip-addressing
                    ODPRINTF((L"mhooks: DisassembleAndSkip: found unsupported OP_IPREL on operand %d", 1));
                    // dump instruction bytes to the debug output
                    for (DWORD i=0; i<pins->Length; i++) {
                        ODPRINTF((L"mhooks: DisassembleAndSkip: instr byte %2.2d: 0x%2.2x", i, pLoc[i]));
                    }
                    break;
                }
                else if ( (pins->OperandCount >= 3) && (pins->Operands[2].Flags & OP_IPREL) )
                {
                    // unsupported rip-addressing
                    ODPRINTF((L"mhooks: DisassembleAndSkip: found unsupported OP_IPREL on operand %d", 2));
                    // dump instruction bytes to the debug output
                    for (DWORD i=0; i<pins->Length; i++) {
                        ODPRINTF((L"mhooks: DisassembleAndSkip: instr byte %2.2d: 0x%2.2x", i, pLoc[i]));
                    }
                    break;
                }
                // follow through with RIP-processing if needed
                if (bProce***ip) {
                    // calculate displacement relative to function start
                    S64 nAdjustedDisplacement = pins->X86.Displacement + (pLoc - (U8*)pFunction);
                    // store displacement values furthest from zero (both positive and negative)
                    if (nAdjustedDisplacement < pdata->nLimitDown)
                        pdata->nLimitDown = nAdjustedDisplacement;
                    if (nAdjustedDisplacement > pdata->nLimitUp)
                        pdata->nLimitUp = nAdjustedDisplacement;
                    // store patch info
                    if (pdata->nRipCnt < MHOOKS_MAX_RIPS) {
                        pdata->rips[pdata->nRipCnt].dwOffset = dwRet + 3;
                        pdata->rips[pdata->nRipCnt].nDisplacement = pins->X86.Displacement;
                        pdata->nRipCnt++;
                    } else {
                        // no room for patch info, stop disassembly
                        break;
                    }
                }
            #endif

            dwRet += pins->Length;
            pLoc  += pins->Length;
        }

        CloseDisassembler(&dis);
    }

    return dwRet;
}

//=========================================================================
BOOL Mhook_SetHook(PVOID *ppSystemFunction, PVOID pHookFunction) {
    MHOOKS_TRAMPOLINE* pTrampoline = NULL;
    PVOID pSystemFunction = *ppSystemFunction;
    // ensure thread-safety
    EnterCritSec();
    ODPRINTF((L"mhooks: Mhook_SetHook: Started on the job: %p / %p", pSystemFunction, pHookFunction));
    // find the real functions (jump over jump tables, if any)
    pSystemFunction = SkipJumps((PBYTE)pSystemFunction);
    pHookFunction   = SkipJumps((PBYTE)pHookFunction);
    ODPRINTF((L"mhooks: Mhook_SetHook: Started on the job: %p / %p", pSystemFunction, pHookFunction));
    // figure out the length of the overwrite zone
    MHOOKS_PATCHDATA patchdata = {0};
    DWORD dwInstructionLength = DisassembleAndSkip(pSystemFunction, MHOOK_JMPSIZE, &patchdata);
    if (dwInstructionLength >= MHOOK_JMPSIZE) {
        ODPRINTF((L"mhooks: Mhook_SetHook: disassembly signals %d bytes", dwInstructionLength));
        // suspend every other thread in this process, and make sure their IP 
        // is not in the code we're about to overwrite.
        SuspendOtherThreads((PBYTE)pSystemFunction, dwInstructionLength);
        // allocate a trampoline structure (TODO: it is pretty wasteful to get
        // VirtualAlloc to grab chunks of memory smaller than 100 bytes)
        pTrampoline = TrampolineAlloc((PBYTE)pSystemFunction, patchdata.nLimitUp, patchdata.nLimitDown);
        if (pTrampoline) {
            ODPRINTF((L"mhooks: Mhook_SetHook: allocated structure at %p", pTrampoline));
            DWORD dwOldProtectSystemFunction = 0;
            DWORD dwOldProtectTrampolineFunction = 0;
            // set the system function to PAGE_EXECUTE_READWRITE
            if (VirtualProtect(pSystemFunction, dwInstructionLength, PAGE_EXECUTE_READWRITE, &dwOldProtectSystemFunction)) {
                ODPRINTF((L"mhooks: Mhook_SetHook: readwrite set on system function"));
                // mark our trampoline buffer to PAGE_EXECUTE_READWRITE
                if (VirtualProtect(pTrampoline, sizeof(MHOOKS_TRAMPOLINE), PAGE_EXECUTE_READWRITE, &dwOldProtectTrampolineFunction)) {
                    ODPRINTF((L"mhooks: Mhook_SetHook: readwrite set on trampoline structure"));

                    // create our trampoline function
                    PBYTE pbCode = pTrampoline->codeTrampoline;
                    // save original code..
                    for (DWORD i = 0; i<dwInstructionLength; i++) {
                        pTrampoline->codeUntouched[i] = pbCode[i] = ((PBYTE)pSystemFunction)[i];
                    }
                    pbCode += dwInstructionLength;
                    // plus a jump to the continuation in the original location
                    pbCode = EmitJump(pbCode, ((PBYTE)pSystemFunction) + dwInstructionLength);
                    ODPRINTF((L"mhooks: Mhook_SetHook: updated the trampoline"));

                    // fix up any IP-relative addressing in the code
                    FixupIPRelativeAddressing(pTrampoline->codeTrampoline, (PBYTE)pSystemFunction, &patchdata);

                    DWORD_PTR dwDistance = (PBYTE)pHookFunction < (PBYTE)pSystemFunction ? 
                        (PBYTE)pSystemFunction - (PBYTE)pHookFunction : (PBYTE)pHookFunction - (PBYTE)pSystemFunction;
                    if (dwDistance > 0x7fff0000) {
                        // create a stub that jumps to the replacement function.
                        // we need this because jumping from the API to the hook directly 
                        // will be a long jump, which is 14 bytes on x64, and we want to 
                        // avoid that - the API may or may not have room for such stuff. 
                        // (remember, we only have 5 bytes guaranteed in the API.)
                        // on the other hand we do have room, and the trampoline will always be
                        // within +/- 2GB of the API, so we do the long jump in there. 
                        // the API will jump to the "reverse trampoline" which
                        // will jump to the user's hook code.
                        pbCode = pTrampoline->codeJumpToHookFunction;
                        pbCode = EmitJump(pbCode, (PBYTE)pHookFunction);
                        ODPRINTF((L"mhooks: Mhook_SetHook: created reverse trampoline"));
                        FlushInstructionCache(GetCurrentProcess(), pTrampoline->codeJumpToHookFunction, 
                            pbCode - pTrampoline->codeJumpToHookFunction);

                        // update the API itself
                        pbCode = (PBYTE)pSystemFunction;
                        pbCode = EmitJump(pbCode, pTrampoline->codeJumpToHookFunction);
                    } else {
                        // the jump will be at most 5 bytes so we can do it directly
                        // update the API itself
                        pbCode = (PBYTE)pSystemFunction;
                        pbCode = EmitJump(pbCode, (PBYTE)pHookFunction);
                    }

                    // update data members
                    pTrampoline->cbOverwrittenCode = dwInstructionLength;
                    pTrampoline->pSystemFunction = (PBYTE)pSystemFunction;
                    pTrampoline->pHookFunction = (PBYTE)pHookFunction;

                    // flush instruction cache and restore original protection
                    FlushInstructionCache(GetCurrentProcess(), pTrampoline->codeTrampoline, dwInstructionLength);
                    VirtualProtect(pTrampoline, sizeof(MHOOKS_TRAMPOLINE), dwOldProtectTrampolineFunction, &dwOldProtectTrampolineFunction);
                } else {
                    ODPRINTF((L"mhooks: Mhook_SetHook: failed VirtualProtect 2: %d", gle()));
                }
                // flush instruction cache and restore original protection
                FlushInstructionCache(GetCurrentProcess(), pSystemFunction, dwInstructionLength);
                VirtualProtect(pSystemFunction, dwInstructionLength, dwOldProtectSystemFunction, &dwOldProtectSystemFunction);
            } else {
                ODPRINTF((L"mhooks: Mhook_SetHook: failed VirtualProtect 1: %d", gle()));
            }
            if (pTrampoline->pSystemFunction) {
                // this is what the application will use as the entry point
                // to the "original" unhooked function.
                *ppSystemFunction = pTrampoline->codeTrampoline;
                ODPRINTF((L"mhooks: Mhook_SetHook: Hooked the function!"));
            } else {
                // if we failed discard the trampoline (forcing VirtualFree)
                TrampolineFree(pTrampoline, TRUE);
                pTrampoline = NULL;
            }
        }
        // resume everybody else
        ResumeOtherThreads();
    } else {
        ODPRINTF((L"mhooks: disassembly signals %d bytes (unacceptable)", dwInstructionLength));
    }
    LeaveCritSec();
    return (pTrampoline != NULL);
}

//=========================================================================
BOOL Mhook_Unhook(PVOID *ppHookedFunction) {
    ODPRINTF((L"mhooks: Mhook_Unhook: %p", *ppHookedFunction));
    BOOL bRet = FALSE;
    EnterCritSec();
    // get the trampoline structure that corresponds to our function
    MHOOKS_TRAMPOLINE* pTrampoline = TrampolineGet((PBYTE)*ppHookedFunction);
    if (pTrampoline) {
        // make sure nobody's executing code where we're about to overwrite a few bytes
        SuspendOtherThreads(pTrampoline->pSystemFunction, pTrampoline->cbOverwrittenCode);
        ODPRINTF((L"mhooks: Mhook_Unhook: found struct at %p", pTrampoline));
        DWORD dwOldProtectSystemFunction = 0;
        // make memory writable
        if (VirtualProtect(pTrampoline->pSystemFunction, pTrampoline->cbOverwrittenCode, PAGE_EXECUTE_READWRITE, &dwOldProtectSystemFunction)) {
            ODPRINTF((L"mhooks: Mhook_Unhook: readwrite set on system function"));
            PBYTE pbCode = (PBYTE)pTrampoline->pSystemFunction;
            for (DWORD i = 0; i<pTrampoline->cbOverwrittenCode; i++) {
                pbCode[i] = pTrampoline->codeUntouched[i];
            }
            // flush instruction cache and make memory unwritable
            FlushInstructionCache(GetCurrentProcess(), pTrampoline->pSystemFunction, pTrampoline->cbOverwrittenCode);
            VirtualProtect(pTrampoline->pSystemFunction, pTrampoline->cbOverwrittenCode, dwOldProtectSystemFunction, &dwOldProtectSystemFunction);
            // return the original function pointer
            *ppHookedFunction = pTrampoline->pSystemFunction;
            bRet = TRUE;
            ODPRINTF((L"mhooks: Mhook_Unhook: sysfunc: %p", *ppHookedFunction));
            // free the trampoline while not really discarding it from memory
            TrampolineFree(pTrampoline, FALSE);
            ODPRINTF((L"mhooks: Mhook_Unhook: unhook successful"));
        } else {
            ODPRINTF((L"mhooks: Mhook_Unhook: failed VirtualProtect 1: %d", gle()));
        }
        // make the other guys runnable
        ResumeOtherThreads();
    }
    LeaveCritSec();
    return bRet;
}

//=========================================================================

转载于:https://blog.51cto.com/haidragon/2362763

weixin_33805743
关注
  • 0
    点赞
  • 踩
  • 1
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
mhook的用法_MHOOK的使用
weixin_39765325的博客
12-19 1763
之前写外挂都用的是网上的帖子HOOK目标程序的send和recv，然后采用WriteProcessMemory替换我们的函数和Windows API函数，不断的来回切换，这个其实数据密集的时候容易出错也不稳定，不提倡！并且代码输写很容易出错。这里我贴出我自己写过的HOOK库，用过攻城略地和大皇帝等等游戏，均通过测试，非常之稳定。把MHOOK封装成动态链接库，直接调用DLL文件进行HOOK目标函数，...
钩子技术HOOK使用教程
11-01
钩子函数实际上是一个处理消息的程序段，每当一个应用程序调用函数GetMessage或PeekMessage而恰有一个消息即将被处理时，系统调用钩子函数。也就是说,当特定的息发出，在没有到达目的窗口前，钩子函数先捕获消息，亦即钩子函数先获得控制权。这时钩子函数既可以加工处理该消息，也可以不作处理而继续传递消息，还可以强制结束消息传递。系统为每种类型的钩子维护一个钩子链，最近安装的钩子放在链的开始，而最先安装的钩子放在最后，也就是后加入的钩子先获得控制权。 Windows API函数SetWindowsHookEx用来安装钩子函数，这个函数的原型是HHOOK SetWindowsHookEx(int idHook,HOOKPROC lpfn,HINSTANCE hMod,DWORD dwThreadId),其中第一个参数是钩子的类型；第二个参数是钩子函数的地址；第三个参数是包含钩子函数的模块句柄；第四个参数指定监视的线程，如果指定确定的线程，即为线程钩子，如果指定为空，则为全局钩子。其中，全局钩子必须包含在DLL中，线程专用钩子可以包含在可执行文件中。得到控制权的钩子函数在完成对消息的处理后，如果想要该消息继续传递，那么它必须调用另一个API函数CallNextHookEx来传递它，钩子函数也可以通过直接返回0来丢弃该消息，以阻止消息的传递。
MHOOK的使用
翻肚鱼儿的博客
10-28 1257
// dllmain.cpp : 定义 DLL 应用程序的入口点。 #include "stdafx.h" #include "mhook-lib/mhook.h" #include <winsock2.h> //////////////封包函数////////////// typedefint(WINAPI *_send)(SOCKET s,constchar*buf,intlen,intflags); typedef...
mhook的用法_系统范围的钩子与MHook
weixin_39595310的博客
12-19 294
I have this project where I hook some Windows functions (GetOpenFileNameA, GetOpenFileNameW, GetSaveFileNameA, GetSaveFileNameW) with MHook library. This is the code I use to install the hooks.for(siz...
mhook支持库
07-24
5. **使用示例**：使用mhook通常涉及以下步骤：(1)包含mhook头文件；(2)定义要替换的函数以及替换函数；(3)安装钩子，将目标函数替换为自定义函数；(4)在适当的时候卸载钩子，恢复原始函数调用。 6. **注意事项**：...
基于mhook2.3修改库
11-24
在"基于mhook2.3修改库"中，作者可能对mhook的内部实现进行了优化，增强了其兼容性或解决了某些特定环境下的问题，例如在卸载引擎时遇到的崩溃问题。这可能是通过对mhook的源码进行分析，找出问题根源，并针对性地...
mhook-master.zip
09-11
"Hook"技术在编程中用于跟踪、修改或控制程序流程，MHook专注于动态函数钩子的实现，使得开发者可以在不修改原始代码的情况下，对目标函数进行拦截和替换。 【压缩包子文件的文件名称列表】"mhook-master" 表明这是...
mhook2.1 mhook库
01-25
mhook库是一个高效且实用的HOOK库，主要应用于Windows操作系统，支持32位（WIN32）和64位（WIN64）平台。在软件开发中，HOOK技术是一种非常重要的调试和插件机制，它允许开发者拦截和修改其他程序的函数调用行为，为...
mhook最新版下载 mhook-master mhook2.5 WindowsAPIHOOK 支持X86 X64 含Demo
09-06
mhook库是C++中的一个hook库,小巧健壮,内置反汇编引擎,能够根据实际情况动态调整hook方式。 支持X86 X64 含Demo VS2010,(但易语言不支持x64)(亲测火山PC可用x64!!) 接口简单，功能强大，支持32位和...里面包含使用示例
MHook-2.3_DllDemo-2.rar
05-07
mhook库的使用示例
mhook-2.3.zip
02-24
完全开源，支持x64 VS2010编过
mhook HOOK库 支持X86 X64 含Demo VS2010
03-19
mhook是一个免费的非常优秀的API HOOK库,我一直用它,现在分享给大家. mhook类似于微软的Detour库，优点是容易使用，支持X64位的CPU
mhook钩子库,包含静态lib版和源码版
04-01
mhook钩子库,包含静态lib版和源码版.
Mhook(lib for API hook)
08-24
API hook, much more exellent than Microsoft Detour.
mhook的用法_全局钩对Cwnd ::创建使用MHook
weixin_39753616的博客
12-29 101
I have been trying to hook to CWnd::Create method. I tried to hook using SetWindowsHookEx api. But this is not working consistently. So, I have followed the following blog http://www.codeproject.com/A...
HOOK示例
翔鹰的专栏
08-29 640
//file  LHook.cpp文件     将此文件生成动态链接库 #include #pragma  data_seg("MySec")     //设置MySec段 HWND g_hWnd = NULL; #pragma  data_seg() //设置MySec段为共享段 #pragma  comment(linker,"/section:MySec,RWS")
Mhook_SetHook函数流程
cx1990820的专栏
01-05 4029
Mhook_SetHook函数流程： 1.EnterCritSec 互斥进入关键Section 2.SkipJumps 查找 被HOOK函数 或者 HOOK函数的真实入口地址，通过判断函数地址前几个字节是为JMP,机器码为E9/FF25/EB E9+32位偏移 FF25+绝对地址 EB+8位偏移 3.DisassembleAndSkip 函数 在被H
mhook的用法_【资料】mhook支持库 小巧健壮的inline hook库
weixin_39593061的博客
12-19 539
本帖最后由 奋斗丶小Z 于 2015-12-21 08:40 编辑本支持库封装了mhook库2.4版本。mhook库是C++中的一个hook库，小巧健壮，内置反汇编引擎，能够根据实际情况动态调整hook方式。(同时支持x64 hook，但易语言不支持x64)mhook.fne 动态库为VC2013编译mhook_static.lib 静态库为VC6编译支持库先在VC2013下编写并编译，然后发现V...
dll文件反编译工具易语言
最新发布
06-23
### 回答1： Dll文件反编译工具易语言是一种功能强大、易于操作的反编译工具，它能够对Windows操作系统中的dll文件进行反汇编和反编译操作，提供源代码和汇编代码供用户参考和修改。 易语言作为一种高级脚本语言，具有操作简便、运行速度快的特点，能够快速实现对dll文件的反编译操作，使用户能够深入了解和学习dll文件的内部结构和行为规律。 该工具提供了丰富的功能，包括查看、编辑资源、查看dll文件中的字符串、函数列表、反汇编代码，甚至还能够直接生成反编译后的源代码和可执行文件。 值得一提的是，该工具还内置了mhook组件，可以直接对dll文件进行hook操作，实现对系统API的监视和拦截，是一款非常实用的安全工具。 总之，dll文件反编译工具易语言具有易于操作、功能丰富、高效实用等特点，可以满足用户反编译和研究dll文件的需求。 ### 回答2： dll文件反编译工具易语言是一款面向Windows系统的反编译工具。它可以将已经编译好的dll文件进行反编译操作，以便对这些dll文件进行修改和分析。 易语言是一种基于中文的编程语言，相对于其他编程语言而言，易语言更加容易学习和理解。因此，很多人使用易语言来进行反编译操作。 dll文件反编译工具易语言具有以下几个特点： 1.易于学习和使用。易语言作为一种基于中文的编程语言，它的语言结构简单明了，容易上手。 2.支持多种工程文件格式。不同的编译器生成的dll文件格式可能不同，易语言反编译工具支持多种工程文件格式，可以进行有效的反编译操作。 3.提供了丰富的反编译工具。除了反编译外，易语言反编译工具还可以进行函数跟踪、变量查看、汇编代码分析等多种操作，可以帮助程序员更好地进行修改和分析。 4.支持插件扩展。易语言反编译工具还支持插件扩展，允许用户自定义功能。 总之，dll文件反编译工具易语言是一款功能丰富、易于学习和使用的工具，可以帮助程序员更好地进行反编译操作，并进行程序分析和修改。 ### 回答3： DLL文件反编译工具易语言是一款可用于反汇编Windows操作系统中动态连接库文件(DLL)的工具，它是一种易于学习和使用的编程语言，可以通过这种语言轻松地进行反编译和编码操作。它具有精简的代码、直观的界面和丰富的帮助文档，使得用户能够迅速上手开始使用。 该工具的主要功能是将DLL文件中的机器码源代码反编译回可读性高的汇编代码和C/C++代码，并支持用户在编辑器中进行修改和调试，从而实现对DLL文件的修改和重新编译。这对于开发人员来说是非常有用的，因为它允许他们修改和定制原有的DLL文件，以满足特定的需求。同时，对于恶意分子来说，该工具也可能为他们提供一个有效的手段来对系统进行攻击和破坏。 考虑到这个工具可能对网络安全造成的潜在威胁，用户需要非常警惕并使用该工具进行良好的代码审查和使用，以确保代码的安全性和完整性。此外，对于开发人员而言，应该遵循所有软件开发最佳实践，只对可信来源的代码进行调试和修改，并保持对所有代码和文件的备份和保护。
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值