函数指针-DInput8.dll挂钩代码的参数用途

Function pointer - purpose of argument for DInput8.dll hook code

本文关键字：参数 代码 指针 -DInput8 dll 函数      更新时间：2023-10-16

我一直在试图弄清楚DirectInput8挂钩项目中一个参数的用途。我在这里生成一些开源代码。为了简洁起见，我只发布了几个函数。

ULONG oldCreateDevice;
HRESULT WINAPI xCreateDevice(DWORD d1, DWORD d2, DWORD d3, DWORD d4)
{
    HRESULT hr = ((HRESULT(WINAPI*)(DWORD,DWORD,DWORD,DWORD))oldCreateDevice)(d1,d2,d3,d4);
    // hook only if keyboard requested
    if(*(DWORD*)d2 != GUID_SysKeyboard)
        return hr;
    DWORD dwKeybTable = *(DWORD*)(*(DWORD*)d3);
    DWORD oldprot;
    VirtualProtect((LPVOID)dwKeybTable, 0x2C, PAGE_EXECUTE_READWRITE, &oldprot);
    // already hooked?
    if((DWORD)xGetDeviceState == *((DWORD*)(dwKeybTable+0x24))) goto ex1;
    // hook it!
    oldGetDeviceState = *((DWORD*)(dwKeybTable+0x24));
    *((DWORD*)(dwKeybTable+0x24)) = (DWORD)xGetDeviceState;
ex1:
    // already hooked?
    if((DWORD)xGetDeviceData == *((DWORD*)(dwKeybTable+0x28))) goto ex2;
    // hook it!
    oldGetDeviceData = *((DWORD*)(dwKeybTable+0x28));
    *((DWORD*)(dwKeybTable+0x28)) = (DWORD)xGetDeviceData;
ex2:
    return hr;
}

ULONG oldDirectInput8Create;
HRESULT WINAPI xDirectInput8Create(HINSTANCE hinst, DWORD dwVersion, REFIID riidltf, VOID **ppvOut, LPUNKNOWN punkOuter)
{
    HRESULT ret = ((HRESULT(WINAPI*)(HINSTANCE,DWORD,REFIID,VOID**,LPUNKNOWN))oldDirectInput8Create)(hinst,dwVersion,riidltf,ppvOut,punkOuter);
    DWORD dwFuncTable = (DWORD)*((DWORD*)*ppvOut);
    DWORD oldprot;
    VirtualProtect((LPVOID)dwFuncTable, 0x10, PAGE_EXECUTE_READWRITE, &oldprot);
    //already hooked?
    if((DWORD)xCreateDevice == *((DWORD*)(dwFuncTable + 0x0C))) goto ex;
    //hook it
    oldCreateDevice = *((DWORD*)(dwFuncTable + 0x0C));
    *((DWORD*)(dwFuncTable + 0x0C)) = (DWORD)xCreateDevice;
ex:
    return ret;
}

DWORD WINAPI RemoteMain(LPVOID lpParam)
{
    LoadLibrary("user32.dll");
    LoadLibrary("advapi32.dll");
    Splice_Init();
    Splice((ULONG)GetProcAddress(LoadLibrary("dinput8.dll"),"DirectInput8Create"), xDirectInput8Create, &oldDirectInput8Create);
    ThreadControl(FALSE); // resume all
    return 0;
}

正如您可能注意到的那样，代码正在用重定向的（挂钩的）函数替换函数。我的问题是xCreateDevice函数中的第一个参数根据我所了解的文档，对于DirectInput8，CreateDevice函数占用了3个参数。但我不确定为什么在这里使用4个参数。它是否指向原来的"oldCreateDevice"？还是别的什么？

我希望有人能指导我。感谢

它是一个接口（类）非静态方法，所以第一个参数是this指针（指向类实例的指针）。

这个（维基百科）

此（MSDN）

相关文章：