windows api hook 或上述 prochook64 截取 the original function call 連 call parameters (即 passing data),你可以在此時查看、修改、儲存該資料內容,例如 Prochook64/64BitHookDLL/64BitHookDLL.cpp (hook dll),留意 comment- BOOL WINAPI ShadowTextOutW(HDC textdc, int x, int y, LPCWSTR lptext, int cb) // TextOutW 嘅 string buffer
- {
- char szText[MAXTEXTOUT] = NULLSTR;
- int iLenText = 0;
- BOOL bRet = FALSE;
- BOOL bUsed = FALSE;
- // write text buffer
- iLenText = WideCharToMultiByte(CP_THREAD_ACP, WC_NO_BEST_FIT_CHARS, [color=Blue]lptext[/color], cb, szText, MAXTEXTOUT, "*", &bUsed);
- WriteToTextBuffer((LPCSTR)szText, (UINT)iLenText);
- // pass on call to real function
- UnhookFunction((PHOOKREC)&_hrTextOutW);
- bRet = TextOutW(textdc, x, y, lptext, cb); // 不作修改,原封傳回 the original TextOutW
- HookFunction((PHOOKREC)&_hrTextOutW);
- return bRet;
- }
複製代碼 |