用线程监视这个变量是否变化, 是否变化到需要调用其他函数!_beginthreadex(..., threadFunc,...); static unsigned int threadFunc(void * params) { if ( 你要监视的变量== "给定的某个值") { call the other function.} }
//可以将该变量所在的内存设置为PAGE_GUARD属性(区域第一次被访问时进入一个STATUS_GUARD_PAGE异常,这个标志要和其他保护标志合并使用,表明区域被第一次访问的权限) int x=0; int y=0; void main() { DWORD protect; VirtualProtect(&x,sizeof(x),PAGE_READWRITE|PAGE_GUARD,&protect); try{ x=100; } catch(...){printf("x is first changed. x=%d\n",x);} try{ y=100; } catch(...){printf("y is changed. y=%d\n",y);} printf("before second change,x=%d\n",x); try{ x=100; } catch(...){printf("x is second changed. x=%d\n",x);} printf("after second change,x=%d\n",x);} 运行结果: x is first changed. x=0 before second change,x=0 after second change,x=100
是否变化到需要调用其他函数!_beginthreadex(..., threadFunc,...);
static unsigned int threadFunc(void * params)
{
if ( 你要监视的变量== "给定的某个值")
{ call the other function.}
}
int x=0;
int y=0;
void main()
{
DWORD protect;
VirtualProtect(&x,sizeof(x),PAGE_READWRITE|PAGE_GUARD,&protect); try{
x=100;
}
catch(...){printf("x is first changed. x=%d\n",x);} try{
y=100;
}
catch(...){printf("y is changed. y=%d\n",y);} printf("before second change,x=%d\n",x);
try{
x=100;
}
catch(...){printf("x is second changed. x=%d\n",x);}
printf("after second change,x=%d\n",x);}
运行结果:
x is first changed. x=0
before second change,x=0
after second change,x=100
然后HOOK进对方程序,用SetUnhandledExceptionFilter注册一个末处理异常的处理函数,在里面判断传递来的异常是否是PAGE_GUARD,于是就可以记录下来或者发消息给你的程序。