subject_43611.htm

vc

<p>
序号：43611 发表者：阿蝌 发表日期：2003-06-12 15:17:29
<br>主题：关于钩子和dll的简单问题&gt;&gt;&gt;&gt;&gt;&gt;
<br>内容：一个全局钩子（在dll中），当其钩住了另一个进程时，这个dll是否会加载到这另一个进程的用户分区中（windows2000）,还是只保留在原来的调用其的dll中？<BR>9x的情况我也不太清楚，请各位指教？
<br><a href="javascript:history.go(-1)">返回上页</a><br><a href=http://www.copathway.com/cndevforum/>访问论坛</a></p>
<hr size=1>
<blockquote><p>
回复者：阿蝌 回复日期：2003-06-12 17:37:49
<br>内容：顶
<br>
<a href="javascript:history.go(-1)">返回上页</a><br><a href=http://www.copathway.com/cndevforum/>访问论坛</a></p></blockquote>
<hr size=1>
<blockquote><p>
回复者：崔东辉 回复日期：2003-06-12 21:03:12
<br>内容：特地跑来谢谢你！<BR>
<br>
<a href="javascript:history.go(-1)">返回上页</a><br><a href=http://www.copathway.com/cndevforum/>访问论坛</a></p></blockquote>
<hr size=1>
<blockquote><p>
回复者：Neil Gan 回复日期：2003-06-13 05:04:57
<br>内容：A process can only execute codes loaded into its address space, so, the hook dll will be loaded into the destination process.<BR>
<br>
<a href="javascript:history.go(-1)">返回上页</a><br><a href=http://www.copathway.com/cndevforum/>访问论坛</a></p></blockquote>
<hr size=1>
<blockquote><p>
回复者：阿蝌 回复日期：2003-06-13 09:36:55
<br>内容：All the Shared Dll( like Kernel32.dll or some hook dlls )are loaded into each processes ,they may have same logic address(or not),but actually in the physics memory there is only one copy of the dll.<BR>Am I right?<BR>英文没有4级，写的不对多多包含
<br>
<a href="javascript:history.go(-1)">返回上页</a><br><a href=http://www.copathway.com/cndevforum/>访问论坛</a></p></blockquote>
<hr size=1>
<blockquote><p>
回复者：Neil Gan 回复日期：2003-06-13 11:09:15
<br>内容：NT/9x maps the dll in address as Copy-on-write pages.<BR><BR>If it is mapped to the same address (to the default address indicated in the .dll file) for every process, no process needs to write to the code pages, so, there is only one copy of code in memory. but every process has its own data segments, except the share segments.<BR><BR>and, if it is mapped to different address, NT/9x need to write to the code pages to modify every absolute address access instructions(jmp,call,etc.), so there are more than one copy in memory.(not physics memory, virtual memory)<BR><BR>for kernel32.dll, Jeffrey Richter said it is always mapped to the same address for every process.
<br>
<a href="javascript:history.go(-1)">返回上页</a><br><a href=http://www.copathway.com/cndevforum/>访问论坛</a></p></blockquote>
<hr size=1>
<blockquote><p>
回复者：阿蝌 回复日期：2003-06-13 11:53:57
<br>内容：能不能把Jeffrey Richter 的书寄到我邮箱,谢了
<br>
<a href="javascript:history.go(-1)">返回上页</a><br><a href=http://www.copathway.com/cndevforum/>访问论坛</a></p></blockquote>
<hr size=1>
<blockquote><p>
<font color=red>答案被接受</font><br>回复者：Neil Gan 回复日期：2003-06-13 12:04:26
<br>内容：文件太大，你找个FTP我帮你传吧
<br>
<a href="javascript:history.go(-1)">返回上页</a><br><a href=http://www.copathway.com/cndevforum/>访问论坛</a></p></blockquote>
<hr size=1>
<blockquote><p>
回复者：阿蝌 回复日期：2003-06-13 12:06:45
<br>内容：Copy-on-write pages.<BR>是什么东东?
<br>
<a href="javascript:history.go(-1)">返回上页</a><br><a href=http://www.copathway.com/cndevforum/>访问论坛</a></p></blockquote>
<hr size=1>
<blockquote><p>
回复者：阿蝌 回复日期：2003-06-13 14:31:10
<br>内容：能不能把书名告诉我，我有他的一本windows核心编程（是他写的吧），但是是中文版的
<br>
<a href="javascript:history.go(-1)">返回上页</a><br><a href=http://www.copathway.com/cndevforum/>访问论坛</a></p></blockquote>
<hr size=1>
<blockquote><p>
回复者：ArthurTu 回复日期：2003-06-13 14:45:27
<br>内容：就是这本书啦。
<br>
<a href="javascript:history.go(-1)">返回上页</a><br><a href=http://www.copathway.com/cndevforum/>访问论坛</a></p></blockquote>