[英]How to write to out structure's field with Deviare?
I can use Deviare to hook and intercept GetLocalTime
function, but how can I change field's value of its out
parameter, ie edit wYear
in SYSTEMTIME
? 我可以使用Deviare挂钩并拦截GetLocalTime
函数,但是如何更改字段out
参数的值,即在SYSTEMTIME
编辑wYear
呢? Few snippets I could find use NktHookCallInfo.Result
, unfortunately it's a void function and direct assignment to Field(0).Value
does nothing. 我能找到的NktHookCallInfo.Result
片段很少使用NktHookCallInfo.Result
,不幸的是它是一个void函数,直接分配给Field(0).Value
没有作用。
CreateHook("kernel32.dll!GetLocalTime", (int)eNktHookFlags.flgOnlyPostCall);
private static void OnFunctionCalled(NktHook hook, NktProcess process, NktHookCallInfo info)
{
NktParamsEnum param = info.Params();
NktParam value = param.First().Evaluate();
for (int i = 0; i < 8; i++)
{
NktParam field = value.Field(i);
Console.WriteLine("{0} {1} {2}", field.Name, field.TypeName, field.Value);
}
}
void WINAPI GetLocalTime(
_Out_ LPSYSTEMTIME lpSystemTime
);
typedef struct _SYSTEMTIME {
WORD wYear;
WORD wMonth;
WORD wDayOfWeek;
WORD wDay;
WORD wHour;
WORD wMinute;
WORD wSecond;
WORD wMilliseconds;
} SYSTEMTIME, *PSYSTEMTIME;
基于评论的答案是:使用UShortVal
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.