前兩天看Intel網(wǎng)站上貼了一篇關(guān)于設(shè)置HOOK的文章，講到在多核CPU上，由于執(zhí)行代碼可能存在CPU CACHE里，因此當(dāng)更改了函數(shù)起始6字節(jié)后，CPU CACHE里的對應(yīng)內(nèi)容并沒有被修改，所以需要調(diào)用 FlushInstructionCache（） 函數(shù)來更新CACHE。

更新后的代碼如下，增加的代碼以粗體標(biāo)出了。

/**?通過地址來設(shè)置某個函數(shù)的鉤子函數(shù)

?@param?HANDLE hApiHook - 由ApiHook_Init()函數(shù)生成的句柄?
?@param?DWORD dwSrcFuncAddr - 源函數(shù)地址?
?@param?DWORD dwNewFuncAddr - 鉤子函數(shù)地址?
?@return?INT (by default) - -1表示失敗，>=0表示在hook數(shù)組中的序號?
*/
INT ApiHook_SetByAddr(HANDLE hApiHook, DWORD dwSrcFuncAddr, DWORD dwNewFuncAddr)
{
?DWORD?dwOldProtect;
?DWORD?dwNewProtect;
?DWORD?? lpSrcFunc;
??? DWORD?? lppNewFunc;
??? UINT???? i;
?INT??nAlreadyFlag = 0;

?APIHOOK??*pApiHook = (APIHOOK *)hApiHook;
?if ( NULL == hApiHook )
?{
??return -1;
?}

?lpSrcFunc = dwSrcFuncAddr;
??? /* 查找是否已被設(shè)置了鉤子 */
?for ( i = 0; i < pApiHook->uMaxFunctions; i++ )
?{
??if ( pApiHook->pHookData[i].dwSrcFuncAddr == lpSrcFunc )
??{
???/* 如果已經(jīng)被設(shè)置了鉤子，僅僅改變. */
???nAlreadyFlag = 1;
???break;
??}

?}
?/* 如果沒有設(shè)置源函數(shù)的鉤子函數(shù)，在表中找出一個可供記錄的位置. */
?if ( i == pApiHook->uMaxFunctions )
?{
??for ( i = 0; i < pApiHook->uMaxFunctions; i++ )
??{
???if (pApiHook->pHookData[i].wFlag == 0 )
???{
????break;
???}
??}??
??if ( i == pApiHook->uMaxFunctions )
??{
???return -1;
??}
?}

??? /* 將新的鉤子函數(shù)地址記錄到表中 */
?pApiHook->pHookData[i].dwNewFuncAddr = dwNewFuncAddr;
?
?/* 以下這段代碼將源函數(shù)頭部6個字節(jié)保存到表中 */
?lppNewFunc = (DWORD)(&(pApiHook->pHookData[i].dwNewFuncAddr) );

?if ( !nAlreadyFlag )
?{
??/* 將源函數(shù)起始處6個字節(jié)保存到 byHeaderCode.中 */
??????? memcpy( pApiHook->pHookData[i].byHeaderCode, (const void *)lpSrcFunc, 6);
?}

??? /* 以下這段代碼將源函數(shù)首部6個字節(jié)改成為一條跳轉(zhuǎn)到新函數(shù)地址的指令 */
??? if ( VirtualProtect( (LPVOID)lpSrcFunc,
???????????????????????? 6,
???????????????????????? PAGE_EXECUTE_READWRITE,
???????????????????????? &dwOldProtect ) == 0 )
??? {
??????? /*
???????? * Failure.
???????? */
??????? return -1;
??? }
?
??? *(unsigned char *)lpSrcFunc = (unsigned char)0xff;
??? *(((unsigned char *)lpSrcFunc)+1) = (unsigned char)0x25;

??? memcpy( (void *)(lpSrcFunc+2),
??????????? (const void *)&lppNewFunc,
??????????? 4 );??????????????????????????? /* address? */

??? if ( VirtualProtect( (LPVOID)lpSrcFunc,
???????????????????????? 6,
???????????????????????? dwOldProtect,
?????? &dwNewProtect) == 0 ) {
??????? /*
???????? * Failure.
???????? */
??????? return -1;
??? };

?pApiHook->pHookData[i].wFlag = 1;
?pApiHook->pHookData[i].dwSrcFuncAddr = lpSrcFunc;

?/* 使用以下FlushInstructionCache調(diào)用來支持多核CPU上的CACAHE的更新，
? * 上面的代碼只更改了內(nèi)存里的地址，沒有更改CPU CACHE里的對應(yīng)內(nèi)容。
? */
?FlushInstructionCache(GetCurrentProcess(), NULL, NULL);

?return (INT)i;
}

?

Trackback: http://tb.blog.csdn.net/TrackBack.aspx?PostId=1209218