//头文件(TestClass.h)
#ifndef CTESTCLASS_H_H_H_H
#define CTESTCLASS_H_H_H_H
#include <windows.h>
class CTestClass //虚函数没列出来,但这个类有虚函数,否则代码会有变动
{
public:
int WINAPI Create();
CTestClass();
private:
LRESULT CALLBACK MainFunc(UINT uMsg,WPARAM wParam,LPARAM lParam);
public:
HWND m_hWnd; //如果窗口句柄不是第一个数据成员,代码会有变动
....
};
#endif
//源文件(TestClass.cpp)
#include "TestClass.h"
...
typedef LRESULT (CALLBACK CTestClass::*FUNCADDR)(UINT,WPARAM,LPARAM);
int WINAPI CTestClass::Create()
{
m_pCode=new BYTE[25]; //构造一个用机器骂直接写的函数让系统回调,
m_pCode[0]=0x50; //然后传递this指针并跳到成员函数中
m_pCode[1]=0x51;
m_pCode[2]=0xB9;
DWORD This=(DWORD)this;
memcpy(&m_pCode[3],&This,4);
BYTE Code[13]={0x8B,0x44,0x24,0xC,0x89,0x41,0x4,0x89,0x4C,0x24,0xC,0x59,0x58};
memcpy(&m_pCode[7],&Code,13);
m_pCode[20]=0xE9;
FUNCADDR FuncAddr=&CGameFrame::MainFunc;
DWORD dwFuncAddr;
_asm
{
push eax
mov eax,FuncAddr
mov dwFuncAddr,eax
pop eax
}
dwFuncAddr=dwFuncAddr-(DWORD)m_pCode-20-5;
memcpy(&m_pCode[21],&dwFuncAddr,4);
m_wc.lpfnWndProc=(WNDPROC)m_pCode;
::RegisterClass(&m_wc);
.......
}
LRESULT CALLBACK CTestClass::MainFunc(UINT uMsg, WPARAM wParam, LPARAM lParam)
{
return ::DefWindowProc(this->m_hWnd,uMsg,wParam,lParam);
}