[英]How to make FastCodePatch work in Delphi XE2 Win64 platform?
Unit FastCodePatch.pas在Win32平台上運行。 Delphi XE2支持Win64平台,任何想法如何讓FastCodePatch在Win64平台上運行?
unit FastcodePatch;
interface
function FastcodeGetAddress(AStub: Pointer): Pointer;
procedure FastcodeAddressPatch(const ASource, ADestination: Pointer);
implementation
uses
Windows;
type
PJump = ^TJump;
TJump = packed record
OpCode: Byte;
Distance: Pointer;
end;
function FastcodeGetAddress(AStub: Pointer): Pointer;
begin
if PBYTE(AStub)^ = $E8 then
begin
Inc(Integer(AStub));
Result := Pointer(Integer(AStub) + SizeOf(Pointer) + PInteger(AStub)^);
end
else
Result := nil;
end;
procedure FastcodeAddressPatch(const ASource, ADestination: Pointer);
const
Size = SizeOf(TJump);
var
NewJump: PJump;
OldProtect: Cardinal;
begin
if VirtualProtect(ASource, Size, PAGE_EXECUTE_READWRITE, OldProtect) then
begin
NewJump := PJump(ASource);
NewJump.OpCode := $E9;
NewJump.Distance := Pointer(Integer(ADestination) - Integer(ASource) - 5);
FlushInstructionCache(GetCurrentProcess, ASource, SizeOf(TJump));
VirtualProtect(ASource, Size, OldProtect, @OldProtect);
end;
end;
end.
Ville Krumlinde提供的解決方案不適用於64位封裝。 它僅適用於Standalone .exe應用程序。
對於FastcodeAddressPatch函數,當我嘗試時,此版本可以在32位和64位上運行。 關鍵是將“指針”更改為“整數”,因為英特爾相對跳轉指令($ E9)在64位模式下仍然使用32位偏移。
type
PJump = ^TJump;
TJump = packed record
OpCode: Byte;
Distance: integer;
end;
procedure FastcodeAddressPatch(const ASource, ADestination: Pointer);
const
Size = SizeOf(TJump);
var
NewJump: PJump;
OldProtect: Cardinal;
begin
if VirtualProtect(ASource, Size, PAGE_EXECUTE_READWRITE, OldProtect) then
begin
NewJump := PJump(ASource);
NewJump.OpCode := $E9;
NewJump.Distance := NativeInt(ADestination) - NativeInt(ASource) - Size;
FlushInstructionCache(GetCurrentProcess, ASource, SizeOf(TJump));
VirtualProtect(ASource, Size, OldProtect, @OldProtect);
end;
end;
procedure Test;
begin
MessageBox(0,'Original','',0);
end;
procedure NewTest;
begin
MessageBox(0,'Patched','',0);
end;
procedure TForm5.FormCreate(Sender: TObject);
begin
FastcodeAddressPatch(@Test,@NewTest);
Test;
end;
我不確定其他功能是做什么的,但我猜它應該是這樣的:
function FastcodeGetAddress(AStub: Pointer): Pointer;
begin
if PBYTE(AStub)^ = $E8 then
begin
Inc(NativeInt(AStub));
Result := Pointer(NativeInt(AStub) + SizeOf(integer) + PInteger(AStub)^);
end
else
Result := nil;
end;
以下代碼適用於Win32 - 獨立和包,Win64 - 獨立和包:
type
TNativeUInt = {$if CompilerVersion < 23}Cardinal{$else}NativeUInt{$ifend};
PJump = ^TJump;
TJump = packed record
OpCode: Byte;
Distance: integer;
end;
function GetActualAddr(Proc: Pointer): Pointer;
type
PAbsoluteIndirectJmp = ^TAbsoluteIndirectJmp;
TAbsoluteIndirectJmp = packed record
OpCode: Word; //$FF25(Jmp, FF /4)
Addr: Cardinal;
end;
var J: PAbsoluteIndirectJmp;
begin
J := PAbsoluteIndirectJmp(Proc);
if (J.OpCode = $25FF) then
{$ifdef Win32}Result := PPointer(J.Addr)^{$endif}
{$ifdef Win64}Result := PPointer(TNativeUInt(Proc) + J.Addr + 6{Instruction Size})^{$endif}
else
Result := Proc;
end;
procedure FastcodeAddressPatch(const ASource, ADestination: Pointer);
const
Size = SizeOf(TJump);
var
NewJump: PJump;
OldProtect: Cardinal;
P: Pointer;
begin
P := GetActualAddr(ASource);
if VirtualProtect(P, Size, PAGE_EXECUTE_READWRITE, OldProtect) then
begin
NewJump := PJump(P);
NewJump.OpCode := $E9;
NewJump.Distance := TNativeUInt(ADestination) - TNativeUInt(P) - Size;
FlushInstructionCache(GetCurrentProcess, P, SizeOf(TJump));
VirtualProtect(P, Size, OldProtect, @OldProtect);
end;
end;
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.