此帖子是根据老孙(者行孙)http://hi.baidu.com/myvfp/的基础上改写的.
参与者:猫猫(ydks_qz ) ,本人
此例子可以作为VFP编写回调函数,舍去fll ,dll的例子 .因为还不完事 .测试有问题的可以在这帖子后续反馈.
以下的代码简介:
给本地进程设置键盘钩子 .通过钩子可以改善VFP的编辑器,智能感知等等作用...
二进制代码反汇编结果如下:
- Assembly code
55 PUSH EBP8BEC MOV EBP,ESP81EC 60000000 SUB ESP,608B45 08 MOV EAX,DWORD PTR SS:[EBP+8]50 PUSH EAXB8 8806D401 MOV EAX,1D4068850 PUSH EAX8D45 A0 LEA EAX,DWORD PTR SS:[EBP-60]50 PUSH EAXB8 C8F9C077 MOV EAX,msvcrt.swprintfFFD0 CALL EAX83C4 0C ADD ESP,0C8D45 A0 LEA EAX,DWORD PTR SS:[EBP-60]50 PUSH EAXB8 C24B0F77 MOV EAX,770F4BC2FFD0 CALL EAX8945 F0 MOV DWORD PTR SS:[EBP-10],EAX50 PUSH EAXB8 341B0A01 MOV EAX,10A1B3450 PUSH EAX8B00 MOV EAX,DWORD PTR DS:[EAX]05 84000000 ADD EAX,84FF10 CALL DWORD PTR DS:[EAX]83F8 00 CMP EAX,0B8 50480F77 MOV EAX,770F4850FFD0 CALL EAXB8 00000000 MOV EAX,08BE5 MOV ESP,EBP5D POP EBPC2 0800 RETN 8
*-- 参考资料
*-- http://zhidao.baidu.com/question/30896105
*-- http://hi.baidu.com/myvfp/blog/item/a2160551c1e0a12342a75b9f
*-- http://zbc01.gjjblog.com/archives/721247/
Declare Long LoadLibrary In "Kernel32.dll" ;
String lpszLibFile
Declare Long FreeLibrary In "Kernel32.dll" ;
Long hLibModule
Declare Long GetProcAddress In "Kernel32.dll" ;
Long hModule, String lpProcName
Declare Long GetProcessHeap In "Kernel32.dll"
Declare Long HeapCreate In "Kernel32.dll" ;
Long flOptions, Long dwInitialSize, Long dwMaximumSize
Declare Long HeapDestroy In "Kernel32.dll" ;
Long hHeap
Declare Long HeapAlloc In "Kernel32.dll" ;
Long hHeap, Long dwFlags, Long dwBytes
Declare Long HeapFree In "Kernel32.dll" ;
Long hHeap, Long dwFlags, Long dwBytes
Local lcHookCmd, lpHookCmd, lhHeap, lhModule
Local lpSwprintf, lpSysAlloc, lpSysFree
Local lcHookBinCode, lpHookAddress
lcHookCmd = StrConv("KeyHook(%d, %d, %d)" + Chr(0), 5)
* lhHeap = GetProcessHeap()
lhHeap = HeapCreate(0, 512*8, 512*8)
lpHookCmd = HeapAlloc(m.lhHeap, 0, Len(m.lcHookCmd))
Sys(2600, m.lpHookCmd, Len(m.lcHookCmd), m.lcHookCmd)
lhModule = LoadLibrary("msvcrt")
lpSwprintf = GetProcAddress(m.lhModule, "swprintf")
FreeLibrary(m.lhModule)
lhModule = LoadLibrary("oleaut32")
lpSysAlloc = GetProcAddress(m.lhModule, "SysAllocString" )
lpSysFree = GetProcAddress(m.lhModule, "SysFreeString")
FreeLibrary(m.lhModule)
lcHookBinCode ;
= 0h55 ; && PUSH EBP
+ 0h8BEC ; && MOV EBP,ESP
+ 0h81EC60000000 ; && SUB ESP,00000080h
+ 0h8B4508 ; && MOV EAX,[EBP+08h]
+ 0h50 ; && PUSH EAX
+ 0hB8 + BinToC(m.lpHookCmd, "4rs") ; && MOV EAX,[lpHookCmd]
+ 0h50 ; && PUSH EAX
+ 0h8D45A0 ; && LEA EAX,[EBP-60h]
+ 0h50 ; && PUSH EAX
+ 0hB8 + BinToC(m.lpSwprintf, "4rs") ; && MOV EAX,[lpSwprintf]
+ 0hFFD0 ; && CALL EAX
+ 0h83C40C ; && ADD ESP,0Ch -- 调用 swfprintf 需要自动恢复堆栈指针
+ 0h8D45A0 ; && LEA EAX,[EBP-60h]
+ 0h50 ; && PUSH EAX
+ 0hB8 + BinToC(m.lpSysAlloc, "4rs") ; && MOV EAX,[lpSysAlloc]
+ 0hFFD0 ; && CALL EAX
+ 0h8945F0 ; && MOV [EBP-10h],EAX