简体   繁体   English

如何用Deviare写出结构领域?

[英]How to write to out structure's field with Deviare?

I can use Deviare to hook and intercept GetLocalTime function, but how can I change field's value of its out parameter, ie edit wYear in SYSTEMTIME ? 我可以使用Deviare挂钩并拦截GetLocalTime函数,但是如何更改字段out参数的值,即在SYSTEMTIME编辑wYear呢? Few snippets I could find use NktHookCallInfo.Result , unfortunately it's a void function and direct assignment to Field(0).Value does nothing. 我能找到的NktHookCallInfo.Result片段很少使用NktHookCallInfo.Result ,不幸的是它是一个void函数,直接分配给Field(0).Value没有作用。

CreateHook("kernel32.dll!GetLocalTime", (int)eNktHookFlags.flgOnlyPostCall);

private static void OnFunctionCalled(NktHook hook, NktProcess process, NktHookCallInfo info)
{
    NktParamsEnum param = info.Params();
    NktParam value = param.First().Evaluate();

    for (int i = 0; i < 8; i++)
    {
        NktParam field = value.Field(i);
        Console.WriteLine("{0} {1} {2}", field.Name, field.TypeName, field.Value);
    }
}

void WINAPI GetLocalTime(
  _Out_ LPSYSTEMTIME lpSystemTime
);

typedef struct _SYSTEMTIME {
  WORD wYear;
  WORD wMonth;
  WORD wDayOfWeek;
  WORD wDay;
  WORD wHour;
  WORD wMinute;
  WORD wSecond;
  WORD wMilliseconds;
} SYSTEMTIME, *PSYSTEMTIME;

基于评论的答案是:使用UShortVal

声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM