代码如下
// hfhf.cpp : Defines the entry point for the DLL application.
//#include "stdafx.h"
#include "hfhf.h"
BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
run();
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
} void run()
{
HMODULE h2=GetModuleHandle("hfhf");
DWORD dddd=(DWORD)GetProcAddress(h2,"change");//这里不能获得自己的实际地址。为什么??
//别问为什么要获得,,拜托,我需要实际地址,不是AIT表的地址
if(dddd==NULL)
::MessageBox(NULL,"error","",0);}
void change()
{
int a=0;
return;}
// hfhf.cpp : Defines the entry point for the DLL application.
//#include "stdafx.h"
#include "hfhf.h"
BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
run();
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
} void run()
{
HMODULE h2=GetModuleHandle("hfhf");
DWORD dddd=(DWORD)GetProcAddress(h2,"change");//这里不能获得自己的实际地址。为什么??
//别问为什么要获得,,拜托,我需要实际地址,不是AIT表的地址
if(dddd==NULL)
::MessageBox(NULL,"error","",0);}
void change()
{
int a=0;
return;}
而且你不用如此获取地址,函数名就是地址
DWORD dddd=(DWORD)change;
就上面一句就行了,非要用什么GetProcAddress
DWORD dddd=(DWORD)change;
这样得到的是IAT的函数地址
我要的是从push ebp
mov ebp,esp
这个地址。。谢谢类