Question

我试图绕过具有大量DLL的应用程序::DrawText()（和其他绘制文本函数），其中一些也使用这些函数。

我原以为如果我使用DetourFindFunction()绕过主函数，这将捕获所有DLL中所有函数的所有情况，这样我可以解决this question，因为有文本显示在窗口。

不幸的是，CDHtmalDialog以某种方式绕道而行，或者正在使用其他功能在窗口上绘制文字。

如果有人确认我是否会这样做：

int (WINAPI *pDrawTextExW)(
  _In_    HDC              hdc,
  _Inout_ LPWSTR           lpchText,
  _In_    int              cchText,
  _Inout_ LPRECT           lprc,
  _In_    UINT             dwDTFormat,
  _In_    LPDRAWTEXTPARAMS lpDTParams
  ) = 0;

int WINAPI MyDrawTextExW(
  _In_    HDC              hdc,
  _Inout_ LPWSTR           lpchText,
  _In_    int              cchText,
  _Inout_ LPRECT           lprc,
  _In_    UINT             dwDTFormat,
  _In_    LPDRAWTEXTPARAMS lpDTParams
)
{
  return (*pDrawTextExW)(hdc, lpchText, cchText, lprc, dwDTFormat, lpDTParams);
}

CCalcDrillDownDlg::CCalcDrillDownDlg(/* bunch of parameters */, CWnd *pParent)
    : CDHtmlDialog(CCalcDrillDownDlg::IDD, 0, pParent)
{
  DetourTransactionBegin();
  DetourUpdateThread(GetCurrentThread());
  pDrawTextExW = decltype(pDrawTextExW)(DetourFindFunction("user32.dll", "DrawTextExW"));
  DetourAttach(&(PVOID&)pDrawTextExW, MyDrawTextExW);
  if (DetourTransactionCommit() == NO_ERROR)
    OutputDebugString("DrawTextExW() detoured successfully\n");

对DrawTextA，DrawTextW，DrawTextExA，DrawTextExW中的每一个CDHtmlDialog，如果DrawTextExW()使用其中一个函数来绘制文本，则会绕道而行吗？也许有人会知道那个班级如何在窗口的DC上输出文字？

我注意到的一件有趣的事情是OK正在绕道而行，试图在一个实际上没有显示在窗口上的按钮上打印> cv32.dll!MyDrawTextExW(HDC__ * hdc=0x940111a2, wchar_t * lpchText=0x04925128, int cchText=2, tagRECT * lprc=0x012eb314, unsigned int dwDTFormat=1048613, tagDRAWTEXTPARAMS * lpDTParams=0x00000000) Line 4186 C++ uxtheme.dll!CTextDraw::DrawTextW() Unknown uxtheme.dll!DrawThemeText() Unknown comctl32.dll!Button_DrawThemed() Unknown comctl32.dll!Button_DrawPush() Unknown comctl32.dll!Button_PaintImpl() Unknown comctl32.dll!Button_WndProc() Unknown user32.dll!__InternalCallWinProc@20() Unknown user32.dll!UserCallWinProcCheckWow() Unknown user32.dll!DispatchClientMessage() Unknown user32.dll!___fnDWORD@4() Unknown ntdll.dll!_KiUserCallbackDispatcher@12() Unknown user32.dll!_DispatchMessageA@4() Unknown mfc120d.dll!AfxInternalPumpMessage() Line 181 C++ mfc120d.dll!CWinThread::PumpMessage() Line 900 C++ mfc120d.dll!AfxPumpMessage() Line 190 C++ mfc120d.dll!CWnd::RunModalLoop(unsigned long dwFlags=4) Line 4644 C++ mfc120d.dll!CWnd::CreateRunDlgIndirect(const DLGTEMPLATE * lpDialogTemplate=0x7216cc28, CWnd * pParentWnd=0x012ecd60, HINSTANCE__ * hInst=0x6f730000) Line 470 C++ mfc120d.dll!CDialog::DoModal() Line 633 C++文本。不确定那是什么。

using (StreamReader file = File.OpenText(filename))
{
   try
   {
      //first up convert to bson
      var jsonSampleData = file.ReadToEnd();

      //var bsonSampleData = BsonDocument.Parse(jsonSampleData); 
      //this would be for a single BSOnDocument

      var bsonSampleData = BsonSerializer.Deserialize<BsonArray>(jsonSampleData);
       var x = bsonSampleData.ToList();

       List<ThePlan> lst = new List<ThePlan>();

       foreach (var doc in x)
       {
          var t = BsonSerializer.Deserialize<ThePlan>(doc.AsBsonDocument);
          lst.Add(t);
       }

    }
    catch (Exception ex)
    {
       throw;
    }

如何绕道一个函数的主实例？

0 个答案: