我现在已经反对这一段时间了。除了这个案例之外,我一直在成功使用Microsoft Detours。
我试图从Kernel32.dll挂钩WINBASEAPI DWORD WINAPI GetTickCount(VOID);
。 DetourAttach总是返回ERROR_INVALID_BLOCK。
来自文档:
ERROR_INVALID_BLOCK
The function referenced is too small to be detoured.
我已经看到很多其他人成功地将这个功能与Detours挂钩但是我无法得到它。绕道后我不在乎调用原来的功能。
我在Windows 7 x64上使用Detours Express 3.0和32位应用程序。
有人有什么想法吗?
完整代码:
#include <windows.h>
#include <stdio.h>
#include "include\detours.h"
#pragma comment( lib, "detours.lib" )
BOOL(WINAPI *Orig_QueryPerformanceCounter)(LARGE_INTEGER *lpPerformanceCount) = QueryPerformanceCounter;
BOOL WINAPI New_QueryPerformanceCounter(LARGE_INTEGER *lpPerformanceCount) {
printf("QueryPerformanceCounter()\n");
return 0;
}
DWORD(WINAPI * Orig_GetTickCount)() = GetTickCount;
DWORD WINAPI New_GetTickCount() {
printf("GetTickCount()\n");
return 0;
}
BOOL WINAPI DllMain(HINSTANCE, DWORD dwReason, LPVOID) {
switch (dwReason) {
case DLL_PROCESS_ATTACH:
{
LONG error = DetourTransactionBegin();
if (error != NO_ERROR) {
printf("DetourTransactionBegin failed with error: %d.\n", error);
return FALSE;
}
error = DetourUpdateThread(::GetCurrentThread());
if (error != NO_ERROR) {
printf("DetourUpdateThread failed with error: %d.\n", error);
return FALSE;
}
//DetourSetIgnoreTooSmall(TRUE); // Doesn't help
// Works fine
error = DetourAttach(&(PVOID &)Orig_QueryPerformanceCounter, New_QueryPerformanceCounter);
if (error != NO_ERROR) {
printf("DetourAttach QueryPerformanceCounter failed with error: %d.\n", error);
return FALSE;
}
// Fails here, with error = 9
error = DetourAttach(&(PVOID &)Orig_GetTickCount, New_GetTickCount);
if (error != NO_ERROR) {
printf("DetourAttach GetTickCount failed with error: %d.\n", error);
return FALSE;
}
error = DetourTransactionCommit();
if (error != NO_ERROR) {
printf("DetourTransactionCommit failed with error: %d.\n", error);
return FALSE;
}
break;
}
case DLL_PROCESS_DETACH:
{
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourDetach(&(PVOID &)Orig_QueryPerformanceCounter, New_QueryPerformanceCounter);
DetourDetach(&(PVOID &)Orig_GetTickCount, New_GetTickCount);
DetourTransactionCommit();
break;
}
}
return TRUE;
}