tannerjin / antimshookfunction Goto Github PK

View Code? Open in Web Editor NEW

121.0 121.0 48.0 24 KB

AntiMSHookFunction (make MSHookFunction doesn't work)

License: MIT License

C 100.00%

antimshookfunction's People

Contributors

Stargazers

Watchers

antimshookfunction's Issues

请教个问题？

在有偏移的情况下，这段代码这样写，不是默认认为在新分配的虚拟地址上，原指令的偏移是region开始地址 +1，+5，+9 .......吗？如果原指令偏移是region+2,或region +3,这样写还合理吗？我在测试过程中出现的都是 // mshook do not handle pc offset没有偏移的情况。

           // mshook handle `pc` offset
            int max_buffer_instructions_count = 20;   // 8 ~ 18
            
            for (int i = 0; i<max_buffer_instructions_count; i++) {
                uint64_t* cur_instruction_addr = (uint64_t *)(region_address+i*4);
                if (MSHookARMCheck(cur_instruction_addr) && (*(cur_instruction_addr+1) == func_begin)) {
                    NSLog(@"8--------->>>002");
                    return (void *)region_address;
                }
            }

Recommend Projects