📄 csdn_文档中心_深入解析钩子和动态链接库（上）.htm
字号:
</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">注意，巧合地话，这些页出现在同样的虚拟地址上。</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">
</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">如果你同时调试你的进程和进程</SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">A</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">，如果你看在共有的数据段中的</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">
</SPAN><SPAN lang=EN-US
style="COLOR: #990000; FONT-FAMILY: 'Courier New'; FONT-SIZE: 12pt; mso-font-kerning: 0pt">&something
</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">，同时看在进程中</SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">A</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">总同样的</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">
</SPAN><SPAN lang=EN-US
style="COLOR: #990000; FONT-FAMILY: 'Courier New'; FONT-SIZE: 12pt; mso-font-kerning: 0pt">&something</SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">
</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">，你会看到同样的数据，甚至于在同样的地址。</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">
</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">如果你使用调试器去改变，或看到程序改变了</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">
</SPAN><SPAN lang=EN-US
style="COLOR: #990000; FONT-FAMILY: 'Courier New'; FONT-SIZE: 12pt; mso-font-kerning: 0pt">&something
</SPAN><SPAN
style="COLOR: #990000; FONT-FAMILY: 宋体; FONT-SIZE: 12pt; mso-ascii-font-family: 'Courier New'; mso-hansi-font-family: 'Courier New'; mso-bidi-font-family: 'Courier New'; mso-font-kerning: 0pt">的值</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">，你可能转到另一进程，检查它，看看在那里出现的新值。</SPAN>
<P></P>
<P align=left class=MsoNormal
style="MARGIN: 0cm 0cm 0pt; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan"><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt"></SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt"><o:p></o:p></SPAN> </P>
<P align=left class=MsoNormal
style="MARGIN: 0cm 0cm 0pt; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan"><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt"> </SPAN></P>
<P align=left class=MsoNormal
style="MARGIN: 0cm 0cm 0pt; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan"><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">
看一看在进程</SPAN><SPAN lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">B</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">会发生什么</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">
</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">。</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">
</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">当事件在进程中</SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">B</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">中被钩</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">
</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">，</SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">DLL
</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">被映射。代码被调迁入到进程中</SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">B</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">中另外的一个地址。如果你调试进程中</SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">B
</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">，观看在共有的区域的</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">
</SPAN><SPAN lang=EN-US
style="COLOR: #990000; FONT-FAMILY: 'Courier New'; FONT-SIZE: 12pt; mso-font-kerning: 0pt">&something</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">，你会发现</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">
</SPAN><SPAN lang=EN-US
style="COLOR: #990000; FONT-FAMILY: 'Courier New'; FONT-SIZE: 12pt; mso-font-kerning: 0pt">&something</SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">
</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">的<I>地址</I>是不同的，但</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">
</SPAN><SPAN lang=EN-US
style="COLOR: #990000; FONT-FAMILY: 'Courier New'; FONT-SIZE: 12pt; mso-font-kerning: 0pt">&something
</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">的<I>内容</I>会是同样</SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">;
</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">在你的进程中或进程</SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">A</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">中对</SPAN><SPAN
lang=EN-US
style="COLOR: #990000; FONT-FAMILY: 'Courier New'; FONT-SIZE: 12pt; mso-font-kerning: 0pt">&something</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">的<I>内容做的改变</I>立刻就能在进程</SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">B</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">中看见，即使进程</SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">B</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">是在另外的一个地址看见的。<I>这是在同样的物理内存地点</I></SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">.<o:p></o:p></SPAN></P>
<P align=left class=MsoNormal
style="MARGIN: 0cm 0cm 0pt; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan"><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">当我提到巧合时，</SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">"</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">巧合</SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">"
</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">是指被策划</SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">;
</SPAN><SPAN lang=EN-US><FONT size=3>Windows</FONT></SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">总是试图将</SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">DLL</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">映射入同样的虚拟地址，</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">
</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">它试图，但它很少成功。</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">
</SPAN></P>
<P align=left class=MsoNormal
style="MARGIN: 0cm 0cm 0pt; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan"><SPAN
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt"><SPAN
lang=EN-US><o:p></o:p></SPAN></SPAN> </P>
<P align=left class=MsoNormal
style="MARGIN: 0cm 0cm 0pt; TEXT-ALIGN: left; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-pagination: widow-orphan"><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">
这就意味着，在在</SPAN><SPAN lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">DLL</SPAN><SPAN
style="COLOR: black; FONT-FAMILY: 宋体; FONT-SIZE: 10pt; mso-ascii-font-family: Verdana; mso-hansi-font-family: Verdana; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">中存放了一个指向回调函数的指针，在实际运行进程</SPAN><SPAN
lang=EN-US
style="COLOR: black; FONT-FAMILY: Verdana; FONT-SIZE: 10pt; mso-bidi-font-family: 宋体; mso-font-kerning: 0pt">A
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -