锘??xml version="1.0" encoding="utf-8" standalone="yes"?> 涓轟簡鎻愰珮紼嬪簭鐨勫彲璇繪с佸彲閲嶇敤鎬х瓑錛岄愭笎鍑虹幇浜嗗皢紼嬪簭寮鍙戜腑緇忓父鐢ㄥ埌鐨勭浉鍚岀殑鍔熻兘錛屾瘮濡傛暟瀛﹀嚱鏁拌繍綆椼佸瓧絎︿覆鎿嶄綔絳夛紝鐙珛鍑烘潵緙栧啓鎴愬嚱鏁幫紝鐒跺悗鎸夌収鐩鎬簰鍏崇郴鎴栧簲鐢ㄩ鍩熸眹闆嗗湪鐩稿悓鐨勬枃浠墮噷錛岃繖浜涙枃浠舵瀯鎴愪簡鍑芥暟搴?/span>銆?/span> 鍑芥暟搴撴槸涓縐嶅淇℃伅鐨勫皝瑁咃紝灝嗗父鐢ㄧ殑鍑芥暟灝佽璧鋒潵錛屼漢浠笉蹇呯煡閬撳浣曞疄鐜板畠浠傚彧闇瑕佷簡瑙e浣曡皟鐢ㄥ畠浠嵆鍙傚嚱鏁板簱鍙互琚涓簲鐢ㄧ▼搴忓叡浜紝鍦ㄥ叿浣撶紪紼嬬幆澧冧腑錛屼竴鑸兘鏈変竴涓ご鏂囦歡鐩鎬即錛屽湪榪欎釜澶存枃浠朵腑浠ユ爣鍑嗙殑鏂瑰紡瀹氫箟浜嗗簱涓瘡涓嚱鏁扮殑鎺ュ彛錛屾牴鎹繖浜涙帴鍙e艦寮忓彲浠ュ湪紼嬪簭涓殑浠諱綍鍦版柟璋冪敤鎵闇鐨勫嚱鏁般?/span> 鐢變簬鍑芥暟銆佸簱銆佹ā鍧楃瓑涓緋誨垪姒傚康鍜屾妧鏈殑鍑虹幇錛岀▼搴忚璁¢愭笎鍙樻垚濡傚浘鎵紺虹殑椋庢牸銆傜▼搴忚鍒嗚В鎴愪竴涓釜鍑芥暟妯″潡錛屽叾涓棦鏈夌郴緇熷嚱鏁幫紝涔熸湁鐢ㄦ埛瀹氫箟鐨勫嚱鏁般傞氳繃瀵瑰嚱鏁扮殑璋冪敤錛岀▼搴忕殑榪愯閫愭琚睍寮銆?/span>闃呰紼嬪簭鏃訛紝鐢變簬姣忎竴鍧楃殑鍔熻兘鐩稿鐙珛錛屽洜姝ゅ紼嬪簭緇撴瀯鐨勭悊瑙g浉瀵瑰鏄擄紝鍦ㄤ竴瀹氱▼搴︿笂緙撹В浜嗙▼搴忎唬鐮佸彲璇繪у拰鍙噸鐢ㄤ歡鐨勭煕鐩撅紝浣嗗茍鏈交搴曡В鍐崇煕鐩俱傞殢鐫璁$畻鏈虹▼搴忕殑瑙勬ā瓚婃潵瓚婂ぇ錛岃繖涓棶棰樺彉寰楁洿鍔犲皷閿愶紝浜庢槸鍑虹幇浜嗗彟涓縐嶇紪紼嬮鏍?/span>鈥斺?/font>緇撴瀯鍖栫▼搴忚璁?/span>銆?/span> 鍦ㄧ粨鏋勫寲紼嬪簭璁捐涓紝浠諱綍紼嬪簭孌電殑緙栧啓閮藉熀浜?/span>3縐嶇粨鏋勶細鍒嗘敮緇撴瀯銆佸驚鐜粨鏋勫拰欏哄簭緇撴瀯銆?/span>紼嬪簭鍏鋒湁鏄庢樉鐨勬ā鍧楀寲鐗瑰緛錛屾瘡涓▼搴忔ā鍧楀叿鏈夋儫涓鐨勫嚭鍙e拰鍏ュ彛璇彞銆傜粨鏋勫寲紼嬪簭鐨勭粨鏋勭畝鍗曟竻鏅幫紝妯″潡鍖栧己錛屾弿榪版柟寮忚創榪戜漢浠範鎯殑鎺ㄧ悊寮忔濈淮鏂瑰紡銆傚洜姝ゅ彲璇繪у己錛屽湪杞歡閲嶇敤鎬с佽蔣浠剁淮鎶ょ瓑鏂歸潰閮芥湁鎵榪涙錛屽湪澶у瀷杞歡寮鍙戝挨鍏舵槸澶у瀷縐戝涓庡伐紼嬭繍綆楄蔣浠剁殑寮鍙戜腑鍙戞尌浜嗛噸瑕佷綔鐢ㄣ傚洜姝ゅ埌鐩墠涓烘錛屼粛鏈夎澶氬簲鐢ㄧ▼搴忕殑寮鍙戦噰鐢ㄧ粨鏋勫寲紼嬪簭璁捐鎶鏈拰鏂規硶銆傚嵆浣垮湪鐩墠嫻佽鐨勯潰鍚戝璞¤蔣浠跺紑鍙戜腑涔熶笉鑳藉畬鍏ㄨ劚紱葷粨鏋勫寲紼嬪簭璁捐銆?/span> 闈㈠悜瀵硅薄鐨勭▼搴忓焦璁℃柟娉曟槸紼嬪簭璁捐鐨勪竴縐嶆柊鏂規硶銆傛墍鏈夐潰鍚戝璞$殑紼嬪簭璁捐璇█涓鑸兘鍚湁涓変釜鏂歸潰鐨勮娉曟満鍒訛紝鍗沖璞″拰綾匯佸鎬佹с佺戶鎵挎с?/span> 1錛庡璞″拰綾?/span> 瀵硅薄鐨勬蹇點佸師鐞嗗拰鏂規硶鏄潰鍚戝璞$殑鐞嗗簭璁捐璇█鏅曢噸瑕佺殑鐗瑰緛銆傚璞℃槸鐢ㄦ埛瀹氫箟鐨勭被鍨嬶紙縐頒負綾伙級鐨勫彉閲忋備竴涓璞℃槸鏃㈠寘鍚暟鎹張鍖呭悎鎿嶄綔璇ユ暟鎹殑浠g爜錛堝嚱鏁幫級鐨勯昏緫瀹炰綋銆傚璞′腑鐨勮繖浜涙暟鎹拰鍑芥暟縐頒負瀵硅薄鐨勬垚鍛橈紝鍗蟲垚鍛樻暟鎹拰鎴愬憳鍑芥暟銆傚璞′腑鐨勬垚鍛樺垎涓哄叕鏈夌殑鍜岀鏈夌殑銆?span>鍏湁鎴愬憳鏄璞′笌澶栫晫鐨勬帴鍙g晫闈€傚鐣屽彧鑳介氳繃璋冪敤璁塊棶涓涓璞$殑鍏湁鎴愬憳鏉ュ疄鐜拌瀵硅薄鐨勫姛鑳姐傜鏈夋垚鍛樹綋鐜頒竴涓璞$殑緇勭粐褰㈠紡鍜屽姛鑳界殑瀹炵幇緇嗚妭銆傚鐣屾棤娉曞縐佹湁鎴愬憳榪涜鎿嶄綔銆?/span>綾誨璞℃寜鐓ц鑼冭繘琛屾搷浣滐紝灝嗘弿榪板瑙備簨鐗╃殑鏁版嵁琛ㄨ揪鍙婂鏁版嵁鐨勬搷浣滃鐞嗗皝瑁呭湪涓璧鳳紝鎴愬姛鍦板疄鐜頒簡闈㈠悜瀵硅薄鐨勭▼搴忚璁°傚綋鐢ㄦ埛瀹氫箟浜嗕竴涓被綾誨瀷鍚庯紝灝卞彲浠ュ湪璇ョ被鍨嬬殑鍚嶄笅瀹氫箟鍙橀噺錛堝嵆瀵硅薄錛変簡銆?span>綾繪槸緇撴瀯浣撶被鍨嬬殑鎵╁厖銆?/span>緇撴瀯浣撲腑寮曞叆鎴愬憳鍑芥暟騫惰瀹氫簡鍏惰闂拰緇ф壙鍘熷垯鍚庝究鎴愪簡綾匯?/span> 2錛庡鎬佹?/span> 闈㈠悜瀵硅薄鐨勭▼搴忚璁¤璦鏀寔“澶氭佹?/span>”錛屾妸涓涓帴鍙g敤浜庝竴綾繪椿鍔ㄣ傚嵆“涓涓帴鍙e縐嶇畻娉?/span>”銆傚叿浣撳疄鏂芥椂璇ラ夋嫨鍝竴涓畻娉曟槸鐢辯壒瀹氱殑璇硶鏈哄埗紜畾鐨勩?/span>C++緙栬瘧鏃跺拰榪愯鏃墮兘鏀寔澶氭佹с?span>緙栬瘧鏃剁殑澶氭佹т綋鐜板湪閲嶈澆鍑芥暟鍜岄噸杞借繍綆楃絳夋柟闈€傝繍琛屾椂鐨勫鎬佹т綋鐜板湪緇ф壙鍏崇郴鍙婅櫄鍑芥暟絳夋柟闈€?/span> 3錛庣戶鎵挎?/span> C++紼嬪簭涓紝鐢變竴涓被錛堢О涓哄熀綾伙級鍙互媧劇敓鍑烘柊綾伙紙縐頒負媧劇敓綾伙級銆傝繖縐嶆淳鐢熺殑璇硶鏈哄埗浣垮緱鏂扮被鐨勫嚭鐜拌交鏉捐嚜鐒訛紝浣垮緱涓涓鏉備簨鐗╁彲浠ヨ欏虹悊鎴愮珷鍦板綊緇撲負鐢遍愬眰媧劇敓鐨勫璞℃弿榪般?/span>“媧劇敓”浣垮緱紼嬪簭涓畾涔夌殑綾誨憟灞傛緇撴瀯銆傚浜庡瓙灞傜殑瀵瑰弬鏃㈠叿鏈夊叾鐖跺眰瀵硅薄鐨勫叡鎬э紟鍙堝叿鏈夎嚜韜殑鐗規с傜戶鎵挎ф槸涓涓被瀵硅薄鑾峰緱鍏跺熀綾誨璞$壒鎬х殑榪囩▼銆?/span>C++涓弗鏍煎湴瑙勫畾浜嗘淳鐢熺被瀵瑰叾鍩虹被鐨勭戶鎵垮師鍒欏拰璁塊棶鏉冮檺錛屼嬌寰楃▼搴忎腑瀵規暟鎹拰鍑芥暟鐨勮闂達紝闇鍦ㄥ鏃忓拰鏈嬪弸闂翠弗鏍煎尯鍒嗐?/span> 浜嬩歡椹卞姩鐨勭▼搴忚璁″疄闄呬笂鏄潰鍚戝璞$▼搴忚璁$殑涓涓簲鐢紝浣嗗畠鐩墠浠呴傜敤浜?/span>windows緋誨垪鎿嶄綔緋葷粺銆?/span>windows鐜涓殑搴旂敤紼嬪簭涓?/span>MS錛?/span>DOS鐜涓殑搴旂敤紼嬪簭榪愯鏈哄埗涓嶅悓銆佽璁$▼搴忕殑鏂瑰紡涔熶笉涓鏍楓?/span>windows紼嬪簭閲囩敤浜嬩歡椹卞姩鏈哄埗榪愯錛岃繖縐嶄簨浠墮┍鍔ㄧ▼搴忕敱浜嬩歡鐨勫彂鐢熶笌鍚︽潵鎺у埗錛岀郴緇熶腑姣忎釜瀵硅薄鐘舵佸壇鏀瑰彉閮芥槸浜嬩歡鍙戠敓鐨勫師鐢辨垨緇撴灉錛岃璁$▼搴忔椂闇浠ヤ竴縐嶉潪欏哄簭鏂瑰紡澶勭悊浜嬩歡錛屼笌欏哄簭鐨勩?span>榪囩▼椹卞姩鐨勪紶緇熺▼搴忚璁℃柟娉曡駿寮?/span>銆?/span> 浜嬩歡涔熺О娑堟伅錛屽惈涔夋瘮杈冨箍娉涳紝甯歌鐨勪簨浠舵湁榧犳爣浜嬩歡(濡傛皯鏍囩Щ鍔ㄣ佸崟鍑匯佹帬榪囩獥鍙h竟鐣?/span>)銆侀敭鐩樹簨浠?/span>(濡傛寜閿殑鍘嬩笅涓庢嬀璧?/span>)絳夊縐嶃傚簲鐢ㄧ▼搴忚繍琛岀粡榪囦竴緋誨垪蹇呰鐨勫垵濮嬪寲鍚庯紝灝嗚繘鍏ョ瓑寰呯姸鎬侊紝絳夊緟鏈変簨浠跺彂鐢燂紝涓鏃︿簨浠跺嚭鐜幫紝紼嬪簭灝辮嬋媧誨茍榪涜鐩稿簲澶勭悊銆?/span> 浜嬩歡椹卞姩紼嬪簭璁捐鏄洿緇曠潃娑堟伅鐨勪駭鐢熶笌澶勭悊榪涜鐨勶紟娑堟伅鍙潵鑷▼搴忎腑鐨勬煇涓璞★紝涔熷彲鐢辯敤鎴楓?/span>wlndow s鎴栬繍琛岀潃鐨勫叾浠栧簲鐢ㄧ▼搴忎駭鐢熴傛瘡褰撲簨浠跺彂鐢熸椂錛?/span>Windows淇樿幏鏈夊叧浜嬩歡錛岀劧鍚庡皢娑堟伅鍒嗗埆杞彂鍒扮浉鍏沖簲鐢ㄧ▼搴忎腑鐨勬湁鍏沖璞★紝闇瑕佸娑堟伅浣滃嚭鍙嶅簲鐨勫璞″簲璇ユ彁渚涙秷鎭鐞嗗嚱鏁幫紝閫氳繃榪欎釜娑堟伅澶勭悊鍑芥暟瀹炵幇瀵硅薄鐨勪竴縐嶅姛鑳芥垨琛屼負銆傛墍浠ョ紪鍐欎簨浠墮┍鍔ㄧ▼搴忕殑澶ч儴鍒嗗伐浣滄槸涓哄悇涓璞?/span>(綾?/span>)娣誨姞鍚勭娑堟伅鐨勫鐞嗗嚱鏁?/span>銆傜敱浜庝竴涓璞″彲浠ユ槸娑堟伅鐨勬帴鏀惰咃紝鍚屾椂涔熷彲鑳芥槸娑堟伅鐨勫彂閫佽咃紝鎵鍙戦佺殑娑堟伅涓庢帴鏀跺埌鐨勬秷鎭篃鍙互鏄浉鍚岀殑娑堟伅錛岃屾湁浜涙秷鎭殑鍙戝嚭鏃墮棿鏄棤娉曢鐭ョ殑(姣斿鍏充簬閿洏鐨勬秷鎭?/span>)錛屽洜姝ゅ簲鐢ㄧ▼搴忕殑鎵ц欏哄簭鏄棤娉曢鐭ョ殑銆?/span> 閫昏緫寮忕▼搴忚璁$殑姒傚康鏉ヨ嚜閫昏緫寮忕▼搴忚璁¤璦Prolog榪欎竴鏇劇粡鍦ㄨ綆楁満棰嗗煙寮曡搗闇囧姩鐨勬棩鏈?/span>“絎簲浠?/span>”璁$畻鏈虹殑鍩烘湰緋葷粺璇█錛屽湪榪欑“絎簲浠?/span>”璁$畻鏈轟腑錛?/span>Prolog鐨勫湴浣嶇浉褰撲簬褰撳墠璁$畻鏈轟腑鐨勬満鍣ㄨ璦銆?/span> Prolog涓昏搴旂敤鍦ㄤ漢宸ユ櫤鑳介鍩?/span>錛屽湪鑷劧璇█澶勭悊銆佹暟鎹簱鏌ヨ銆佺畻娉曟弿榪扮瓑鏂歸潰閮芥湁搴旂敤錛?span>灝ゅ叾閫備簬浣滀負涓撳緋葷粺鐨勫紑鍙戝伐鍏楓?/span> Prolog鏄竴縐嶉檲榪板紡璇█錛屽畠涓嶆槸涓縐嶄弗鏍肩殑閫氱敤紼嬪簭璁捐璇█錛屼嬌鐢?/span>Prolog緙栧啓紼嬪簭涓嶉渶瑕佹弿榪板叿浣撶殑瑙i榪囩▼銆佸彧闇緇撳嚭涓浜涘繀瑕佺殑浜嬪疄鍜岃鍒欙紝榪欎簺瑙勫垯鏄В鍐抽棶棰樻柟娉曠殑瑙勮寖璇存槑錛屾牴鎹繖浜涜鍒欏拰浜嬪疄錛庤綆楁満鍒╃敤娓瘝閫昏緫錛岄氳繃婕旂粠鎺ㄧ悊寰楀埌姹傝В闂鐨勬墽琛屽簭鍒椼?/span> 涓涓湁瀹為檯搴旂敤鐨勫茍琛岀畻娉曪紝鏈緇堟昏鍦ㄥ茍琛屾満涓婂疄鐜幫紝涓烘棣栧厛灝辮灝嗗茍琛岀畻娉曡漿鍖栦負騫惰紼嬪簭錛屾榪囩▼灝辨槸鎵璋撶殑騫惰紼嬪簭璁捐(Parallel Program)銆傚畠瑕佹眰綆楁硶璁捐鑰呫佺郴緇熺粨鏋勫笀鍜岃蔣浠跺伐浣滆呭箍娉涢綣佺殑浜や簰銆傚洜涓鴻璁″茍琛岀▼搴忔秹鍙婂埌鐨勭煡璇嗛潰杈冨箍錛屼富瑕佸寘鎷搷浣滅郴緇熶腑鐨勬湁鍏崇煡璇嗗拰浼樺寲緙栬瘧鏂歸潰鐨勭煡璇嗐傛搷浣滅郴緇熷唴瀹歸潪甯鎬赴瀵岋紝騫惰紼嬪簭涓渶鍩烘湰鐨勮綆楄绱犲浠誨姟銆佽繘紼嬨佺嚎紼嬬瓑鍩烘湰姒傚康銆佸悓姝ユ満鍒跺拰閫氫俊鎿嶄綔絳夈?/span> 鐩墠騫惰紼嬪簭璁捐鐨勭姸鍐墊槸錛?/span>鈶?/span>騫惰杞歡鐨勫彂灞曡惤鍚庝簬騫惰紜歡錛?/span>鈶?/span>鍜屼覆琛岀郴緇熶笌搴旂敤杞歡鐩告瘮錛岀幇浠婄殑騫惰緋葷粺涓庡簲鐢ㄨ蔣浠剁敋灝戜笖涓嶆垚鐔燂紱鈶?/span>騫惰杞歡鐨勭己涔忔槸鍙戝睍騫惰璁$畻鐨勪富瑕侀殰紕嶏紱鈶?/span>涓嶅垢鐨勬槸錛岃繖縐嶇姸鎬佷技涔庝粛鍦ㄧ戶緇潃銆傜┒鍏跺師鍥犳槸騫惰紼嬪簭璁捐榪滄瘮涓茶紼嬪簭璁捐澶嶆潅錛?/span>鈶?/span>騫惰紼嬪簭璁捐涓嶄絾鍖呭惈浜嗕覆琛岀▼搴忚璁★紝闈笖榪樺寘鍚簡鏇村鐨勫瘜鏈夋寫鎴樻х殑闂錛?/span>鈶?/span>涓茶紼嬪簭璁捐浠呮湁涓涓櫘閬嶈鎺ュ彈鐨勫啹·璇轟緷鏇艱綆楁ā鍨嬶紝鑰屽茍琛岃綆楁ā鍨嬭櫧鏈夊ソ澶氾紝浣嗘病鏈変竴涓彲琚叡鍚岃鍙殑鍍忓啹·璇轟緷鏇奸偅鏍風殑浼樼妯″瀷錛?/span>鈶?/span>騫惰紼嬪簭璁捐瀵圭幆澧冨伐鍏?/span>(濡傜紪璇戙佹煡閿欑瓑)鐨勮姹傝繙姣斾覆琛岀▼搴忚璁″厛榪涘緱澶氾紱鈶?/span>涓茶紼嬪簭璁捐姣旇緝閫傚悎浜庤嚜鐒朵範鎯紝涓斾漢浠湪榪囧幓縐瘡浜嗗ぇ閲忕殑緙栫▼鐭ヨ瘑銆佺粡楠屽拰瀹濊吹鐨勮蔣浠惰儲瀵屻?/span> 鍫嗗拰鏍堢殑鐞嗚鐭ヨ瘑 綆浠?/p>
銆銆鏈枃灝嗚璁哄浣曟妸浠g爜娉ㄥ叆涓嶅悓鐨勮繘紼嬪湴鍧絀洪棿錛岀劧鍚庡湪璇ヨ繘紼嬬殑涓婁笅鏂囦腑鎵ц娉ㄥ叆鐨勪唬鐮併?鎴戜滑鍦ㄧ綉涓婂彲浠ユ煡鍒頒竴浜涚獥鍙?瀵嗙爜渚︽祴鐨勫簲鐢ㄤ緥瀛愶紝緗戜笂鐨勮繖浜涚▼搴忓ぇ澶氶兘渚濊禆 Windows 閽╁瓙鎶鏈潵瀹炵幇銆傛湰鏂囧皢璁ㄨ闄や簡浣跨敤 Windows 閽╁瓙鎶鏈互澶栫殑鍏跺畠鎶鏈潵瀹炵幇榪欎釜鍔熻兘銆傚鍥句竴鎵紺猴細 鍥句竴銆WinSpy 瀵嗙爜渚︽祴紼嬪簭 涓轟簡鎵懼埌瑙e喅闂鐨勬柟娉曘傞鍏堣鎴戜滑綆鍗曞洖欏句竴涓嬮棶棰樿儗鏅?br>銆銆瑕?#8220;璇誨彇”鏌愪釜鎺т歡鐨勫唴瀹光斺旀棤璁鴻繖涓帶浠舵槸鍚﹀睘浜庡綋鍓嶇殑搴旂敤紼嬪簭鈥斺旈氬父閮芥槸鍙戦?WM_GETTEXT 娑堟伅鏉ュ疄鐜般傝繖涓妧鏈篃鍚屾牱搴旂敤鍒扮紪杈戞帶浠訛紝浣嗘槸濡傛灉璇ョ紪杈戞帶浠跺睘浜庡彟澶栦竴涓繘紼嬪茍璁劇疆浜?ES_PASSWORD 寮忔牱錛岄偅涔堜笂闈㈣鐨勬柟娉曞氨琛屼笉閫氫簡銆傜敤 WM_GETTEXT 鏉ヨ幏鍙栨帶浠剁殑鍐呭鍙傜敤浜庤繘紼?#8220;鎷ユ湁”瀵嗙爜鎺т歡鐨勬儏鍐點傛墍浠ユ垜浠殑闂鍙樻垚浜嗗浣曞湪鍙﹀涓涓繘紼嬬殑鍦板潃絀洪棿鎵ц錛?/p>
閫氬父鏈変笁縐嶅彲鑳芥ф潵瑙e喅榪欎釜闂銆?/p>
絎竴閮ㄥ垎錛?Windows 閽╁瓙 鑼冧緥紼嬪簭鈥斺斿弬瑙丠ookSpy 鍜孒ookInjEx 銆銆Windows 閽╁瓙涓昏浣滅敤鏄洃鎺ф煇浜涚嚎紼嬬殑娑堟伅嫻併傞氬父鎴戜滑灝嗛挬瀛愬垎涓烘湰鍦伴挬瀛愬拰榪滅▼閽╁瓙浠ュ強緋葷粺綰ч挬瀛愶紝鏈湴閽╁瓙涓鑸洃鎺у睘浜庢湰榪涚▼鐨勭嚎紼嬬殑娑堟伅嫻侊紝榪滅▼閽╁瓙鏄嚎紼嬩笓鐢ㄧ殑錛岀敤浜庣洃鎺у睘浜庡彟澶栬繘紼嬬殑綰跨▼娑堟伅嫻併傜郴緇熺駭閽╁瓙鐩戞帶榪愯鍦ㄥ綋鍓嶇郴緇熶腑鐨勬墍鏈夌嚎紼嬬殑娑堟伅嫻併?br>銆銆濡傛灉閽╁瓙浣滅敤鐨勭嚎紼嬪睘浜庡彟澶栫殑榪涚▼錛岄偅涔堜綘鐨勯挬瀛愯繃紼嬪繀欏婚┗鐣欏湪鏌愪釜鍔ㄦ侀摼鎺ュ簱錛圖LL錛変腑銆傜劧鍚庣郴緇熸槧灝勫寘鍚挬瀛愯繃紼嬬殑DLL鍒伴挬瀛愪綔鐢ㄧ殑綰跨▼鐨勫湴鍧絀洪棿銆俉indows灝嗘槧灝勬暣涓?DLL錛岃屼笉浠呬粎鏄挬瀛愯繃紼嬨傝繖灝辨槸涓轟粈涔?Windows 閽╁瓙鑳借鐢ㄤ簬灝嗕唬鐮佹敞鍏ュ埌鍒殑榪涚▼鍦板潃絀洪棿鐨勫師鍥犮?br>銆銆鏈枃鎴戜笉鎵撶畻娑夊強閽╁瓙鐨勫叿浣撶粏鑺傦紙鍏充簬閽╁瓙鐨勭粏鑺傝鍙傝 MSDN 搴撲腑鐨?SetWindowHookEx API錛夛紝浣嗘垜鍦ㄦ瑕佺粰鍑轟袱涓緢鏈夌敤蹇冨緱錛屽湪鐩稿叧鏂囨。涓綘鏄壘涓嶅埌榪欎簺鍐呭鐨勶細 銆銆鐩墠鍙嬌鐢ㄤ簡閽╁瓙鏉ヤ粠澶勭悊榪滅▼榪涚▼涓璂LL鐨勬槧灝勫拰瑙i櫎鏄犲皠銆傚湪姝?#8220;浣滅敤浜庣嚎紼嬬殑”閽╁瓙瀵規ц兘娌℃湁褰卞搷銆?br>涓嬮潰鎴戜滑灝嗚璁哄彟澶栦竴縐嶆柟娉曪紝榪欎釜鏂規硶涓?LoadLibrary 鎶鏈殑涓嶅悓涔嬪鏄疍LL鐨勬槧灝勬満鍒朵笉浼氬共棰勭洰鏍囪繘紼嬨傜浉瀵筁oadLibrary 鎶鏈紝榪欓儴鍒嗘弿榪扮殑鏂規硶閫傜敤浜?WinNT鍜學in9x銆?br>銆銆浣嗘槸錛屼粈涔堟椂鍊欎嬌鐢ㄨ繖涓妧宸у憿錛熺瓟妗堟槸褰揇LL蹇呴』鍦ㄨ繙紼嬭繘紼嬩腑椹葷暀杈冮暱鏃墮棿錛堝嵆濡傛灉浣犲瓙綾誨寲鏌愪釜灞炰簬鍙﹀涓涓繘紼嬬殑鎺т歡鏃訛級浠ュ強浣犳兂灝藉彲鑳藉皯鐨勫共娑夌洰鏍囪繘紼嬫椂銆傛垜鍦?HookSpy 涓病鏈変嬌鐢ㄥ畠錛屽洜涓烘敞鍏LL 鐨勬椂闂村茍涓嶉暱鈥斺旀敞鍏ユ椂闂村彧瑕佽凍澶熷緱鍒板瘑鐮佸嵆鍙傛垜鎻愪緵浜嗗彟澶栦竴涓緥瀛愮▼搴忊斺擧ookInjEx鈥斺旀潵紺鴻寖銆侶ookInjEx 灝咲LL鏄犲皠鍒拌祫婧愮鐞嗗櫒“explorer.exe”錛屽茍浠庝腑/瑙i櫎褰卞皠錛屽畠瀛愮被鍖?#8220;寮濮?#8221;鎸夐挳錛屽茍浜ゆ崲榧犳爣宸﹀彸閿崟鍑?#8220;寮濮?#8221;鎸夐挳鐨勫姛鑳姐? HookSpy 鍜?HookInjEx 鐨勬簮浠g爜閮藉彲浠ヤ粠鏈枃鐨?a >涓嬭澆婧愪唬鐮?/font>涓幏寰椼?
絎簩閮ㄥ垎錛?a name=CreateRemoteThread_鍜宊LoadLibrary_鎶鏈?CreateRemoteThread 鍜?LoadLibrary 鎶鏈?/a>
鑼冧緥紼嬪簭鈥斺擫ibSpy
閫氬父錛屼換浣曡繘紼嬮兘鍙互閫氳繃 LoadLibrary API 鍔ㄦ佸姞杞紻LL銆備絾鏄紝濡備綍寮哄埗涓涓閮ㄨ繘紼嬭皟鐢ㄨ繖涓嚱鏁板憿錛熺瓟妗堟槸錛欳reateRemoteThread銆?br>棣栧厛錛岃鎴戜滑鐪嬩竴涓?LoadLibrary 鍜孎reeLibrary API 鐨勫0鏄庯細 鐜板湪灝嗗畠浠笌浼犻掑埌 CreateRemoteThread 鐨勭嚎紼嬩緥紼嬧斺擳hreadProc 鐨勫0鏄庤繘琛屾瘮杈冦?/p>
浣犲彲浠ョ湅鍒幫紝鎵鏈夊嚱鏁伴兘浣跨敤鐩稿悓鐨勮皟鐢ㄨ鑼冨茍閮芥帴鍙?32浣嶅弬鏁幫紝榪斿洖鍊肩殑澶у皬閮界浉鍚屻備篃灝辨槸璇達紝鎴戜滑鍙互浼犻掍竴涓寚閽堝埌LoadLibrary/FreeLibrary 浣滀負鍒?CreateRemoteThread 鐨勭嚎紼嬩緥紼嬨備絾榪欓噷鏈変袱涓棶棰橈紝璇風湅涓嬮潰瀵笴reateRemoteThread 鐨勬弿榪幫細 銆銆絎竴涓棶棰樺疄闄呬笂鏄敱瀹冭嚜宸辮В鍐崇殑銆侺oadLibrary 鍜?FreeLibray 涓や釜鍑芥暟閮藉湪 kernel32.dll 涓傚洜涓哄繀欏諱繚璇乲ernel32瀛樺湪騫朵笖鍦ㄦ瘡涓?#8220;甯歌”榪涚▼涓殑鍔犺澆鍦板潃瑕佺浉鍚岋紝LoadLibrary/FreeLibray 鐨勫湴鍧鍦ㄦ瘡涓繘紼嬩腑鐨勫湴鍧瑕佺浉鍚岋紝榪欏氨淇濊瘉浜嗘湁鏁堢殑鎸囬拡琚紶閫掑埌榪滅▼榪涚▼銆?br>銆銆絎簩涓棶棰樹篃寰堝鏄撹В鍐熾傚彧瑕侀氳繃 WriteProcessMemory 灝?DLL 妯″潡鍚嶏紙LoadLibrary闇瑕佺殑DLL妯″潡鍚嶏級鎷瘋礉鍒拌繙紼嬭繘紼嬪嵆鍙?/p>
鎵浠ワ紝涓轟簡浣跨敤CreateRemoteThread 鍜?LoadLibrary 鎶鏈紝闇瑕佹寜鐓т笅鍒楁楠ゆ潵鍋氾細 銆銆姝ゅ錛屽鐞嗗畬鎴愬悗涓嶈蹇樹簡鍏抽棴鎵鏈夊彞鏌勶紝鍖呮嫭鍦ㄧ鍥涙鍜岀鍏鍒涘緩鐨勪袱涓嚎紼嬩互鍙婂湪絎竴姝ヨ幏鍙栫殑榪滅▼綰跨▼鍙ユ焺銆傜幇鍦ㄨ鎴戜滑鐪嬩竴涓?LibSpy 鐨勯儴鍒嗕唬鐮侊紝涓轟簡綆鍗曡搗瑙侊紝涓婅堪姝ラ鐨勫疄鐜扮粏鑺備腑鐨勯敊璇鐞嗕互鍙?UNICODE 鏀寔閮ㄥ垎琚暐鎺夈? 絎笁閮ㄥ垎錛?a name=CreateRemoteThread_鍜宊WriteProcessMemory_鎶鏈?CreateRemoteThread 鍜?WriteProcessMemory 鎶鏈?/a> 鑼冧緥紼嬪簭鈥斺擶inSpy 銆銆鍙﹀涓涓皢浠g爜鎷瘋礉鍒板彟涓涓繘紼嬪湴鍧絀洪棿騫跺湪璇ヨ繘紼嬩笂涓嬫枃涓墽琛岀殑鏂規硶鏄嬌鐢ㄨ繙紼嬬嚎紼嬪拰 WriteProcessMemory API銆傝繖縐嶆柟娉曚笉鐢ㄧ紪鍐欏崟鐙殑DLL錛岃屾槸鐢?WriteProcessMemory 鐩存帴灝嗕唬鐮佹嫹璐濆埌榪滅▼榪涚▼鈥斺旂劧鍚庣敤 CreateRemoteThread 鍚姩瀹冩墽琛屻傚厛鏉ョ湅鐪?CreateRemoteThread 鐨勫0鏄庯細 緇間笂鎵榪幫紝鎴戜滑寰楁寜鐓у涓嬬殑姝ラ鏉ュ仛錛?/p>
ThreadFunc 蹇呴』瑕侀伒寰殑鍘熷垯錛?/p>
銆銆濡傛灉浣犳病鏈夋寜鐓ц繖浜涜鍒欐潵鍋氾紝鐩爣榪涚▼寰堝彲鑳戒細宕╂簝銆傛墍浠ュ姟蹇呯墷璁般傚湪鐩爣榪涚▼涓笉瑕佸亣璁句換浣曚簨鎯呴兘浼氬儚鍦ㄦ湰鍦拌繘紼嬩腑閭f牱 錛堝弬瑙侀檮褰旻錛夈?
GetWindowTextRemote(A/W)
瑕佹兂浠?#8220;榪滅▼”緙栬緫妗嗚幏寰楀瘑鐮侊紝浣犻渶瑕佸仛鐨勫氨鏄皢鎵鏈夊姛鑳介兘灝佽鍦℅etWindowTextRemot(A/W):涓?/p>
銆銆涓嬮潰璁╂垜浠湅鐪嬪畠鐨勯儴鍒嗕唬鐮佲斺斿挨鍏舵槸娉ㄥ叆鏁版嵁鐨勪唬鐮佲斺斾互渚挎槑鐧?GetWindowTextRemote 鐨勫伐浣滃師鐞嗐傛澶勪負綆鍗曡搗瑙侊紝鐣ユ帀浜?UNICODE 鏀寔閮ㄥ垎銆?/p>
銆銆INJDATA 鏄竴涓娉ㄥ叆鍒拌繙紼嬭繘紼嬬殑鏁版嵁緇撴瀯銆備絾鍦ㄦ敞鍏ヤ箣鍓嶏紝緇撴瀯涓寚鍚?SendMessageA 鐨勬寚閽堟槸鍦ㄦ湰鍦板簲鐢ㄧ▼搴忎腑鍒濆鍖栫殑銆傚洜涓哄浜庢瘡涓嬌鐢╱ser32.dll鐨勮繘紼嬫潵璇達紝user32.dll鎬繪槸琚槧灝勫埌鐩稿悓鐨勫湴鍧錛屽洜姝わ紝SendMessageA 鐨勫湴鍧涔熻偗瀹氭槸鐩稿悓鐨勩傝繖灝變繚璇佷簡琚紶閫掑埌榪滅▼榪涚▼鐨勬槸涓涓湁鏁堢殑鎸囬拡銆?br> ThradFunc 鏄榪滅▼綰跨▼鎵ц鐨勪唬鐮併?/p>
鑼冧緥紼嬪簭鈥斺擨njectEx 銆銆榪欓噷涓昏鐨勯棶棰樻槸濡備綍灝嗘暟鎹紶鍒拌繙紼嬬獥鍙h繃紼?NewProc錛屽洜涓?NewProc 鏄竴涓洖璋冨嚱鏁幫紝瀹冨繀欏婚伒寰壒瀹氱殑瑙勮寖鍜屽師鍒欙紝鎴戜滑涓嶈兘綆鍗曞湴鍦ㄥ弬鏁頒腑浼犻?INJDATA鎸囬拡銆傚垢榪愮殑鏄垜鎵懼埌浜嗘湁涓や釜鏂規硶鏉ヨВ鍐寵繖涓棶棰橈紝鍙笉榪囪鍊熷姪姹囩紪璇█錛屾墍浠ヤ笉瑕佸拷鐣ヤ簡姹囩紪錛屽叧閿椂鍊欏畠鏄緢鏈夌敤鐨勶紒 濡備笅鍥炬墍紺猴細 銆銆鍦ㄨ繙紼嬭繘紼嬩腑錛孖NJDATA 琚斁鍦∟ewProc 涔嬪墠錛岃繖鏍?NewProc 鍦ㄧ紪璇戞椂渚跨煡閬?INJDATA 鍦ㄨ繙紼嬭繘紼嬪湴鍧絀洪棿涓殑鍐呭瓨浣嶇疆銆傛洿紜垏鍦拌錛屽畠鐭ラ亾鐩稿浜庡叾鑷韓浣嶇疆鐨?INJDATA 鐨勫湴鍧錛屾垜浠渶瑕佹墍鏈夎繖浜涗俊鎭備笅闈㈡槸 NewProc 鐨勪唬鐮侊細 銆銆榪欑鏂瑰紡 pData寰楀埌鐨勬槸紜紪鐮佸鹼紙鍦ㄦ垜浠殑榪涚▼涓槸鍘?NewProc 鐨勫唴瀛樺湴鍧錛夈傝繖涓嶆槸鎴戜滑鍗佸垎鎯寵鐨勩傚湪榪滅▼榪涚▼涓紝NewProc “褰撳墠”鎷瘋礉鐨勫唴瀛樺湴鍧涓庡畠琚Щ鍒扮殑瀹為檯浣嶇疆鏄棤鍏崇殑錛屾崲鍙ヨ瘽璇達紝鎴戜滑浼氶渶瑕佹煇縐嶇被鍨嬬殑“this 鎸囬拡”銆?br>铏界劧鐢?C/C++ 鏃犳硶瑙e喅榪欎釜闂錛屼絾鍊熷姪鍐呰仈姹囩紪鍙互瑙e喅錛屼笅闈㈡槸瀵?NewProc鐨勪慨鏀癸細 銆銆榪欐牱涓鏉ワ紝涓嶇 NewProc 琚Щ鍒頒粈涔堝湴鏂癸紝瀹冩昏兘璁$畻鍑哄叾鑷繁鐨勫湴鍧銆備絾鏄紝NewProc 鐨勫叆鍙g偣鍜?“POP ECX”涔嬮棿鐨勮窛紱誨彲鑳戒細闅忕潃浣犲緙栬瘧/閾炬帴閫夐」鐨勬敼鍙樿屽彉鍖栵紝鐢辨閫犳垚 RELEASE鍜孌EBUG鐗堟湰涔嬮棿涔熶細鏈夊樊鍒備絾鍏抽敭鏄綘浠嶇劧紜垏鍦扮煡閬撶紪璇戞椂鐨勫箋?/p>
姝ゅ嵆涓?InjecEx 涓嬌鐢ㄧ殑瑙e喅鏂規錛岀被浼間簬 HookInjEx錛屼氦鎹㈤紶鏍囩偣鍑?#8220;寮濮?#8221;宸﹀彸閿椂鐨勫姛鑳姐?br> 瀵逛簬鎴戜滑鐨勯棶棰橈紝鍦ㄨ繙紼嬭繘紼嬪湴鍧絀洪棿涓皢 INJDATA 鏀懼湪 NewProc 鍓嶉潰涓嶆槸鍞竴鐨勮В鍐沖姙娉曘傜湅涓嬮潰 NewProc鐨勫彉寮傜増鏈細 鍒扮洰鍓嶄負姝紝鏈夊嚑涓棶棰樻槸鎴戜滑鏈彁鍙婄殑錛岀幇鎬葷粨濡備笅錛?/p>
銆銆鏈鍚庯紝鏈夊嚑浠朵簨鎯呬竴瀹氳浜嗙劧浜庡績錛氫綘鐨勬敞鍏ヤ唬鐮佸緢瀹規槗鎽ф瘉鐩爣榪涚▼錛屽挨鍏舵槸娉ㄥ叆浠g爜鏈韓鍑洪敊鐨勬椂鍊欙紝鎵浠ヨ璁頒綇錛氭潈鍔涘甫鏉ヨ矗浠伙紒 闄勫綍A錛?/p>
涓轟粈涔?kernel32.dll 鍜寀ser32.dll 鎬繪槸琚槧灝勫埌鐩稿悓鐨勫湴鍧銆?br> 闄勫綍B錛?/p>
/GZ 緙栬瘧鍣ㄥ紑鍏?/p>
銆銆鍦ㄧ敓鎴?Debug 鐗堟湰鏃訛紝/GZ 緙栬瘧鍣ㄧ壒鎬ф槸榛樿鎵撳紑鐨勩備綘鍙互鐢ㄥ畠鏉ユ崟鑾鋒煇浜涢敊璇紙鍏蜂綋緇嗚妭璇峰弬鑰冪浉鍏蟲枃妗o級銆備絾瀵規垜浠殑鍙墽琛岀▼搴忔剰鍛崇潃浠涔堝憿錛?br>銆銆褰撴墦寮 /GZ 寮鍏籌紝緙栬瘧鍣ㄤ細娣誨姞涓浜涢澶栫殑浠g爜鍒板彲鎵ц紼嬪簭涓瘡涓嚱鏁版墍鍦ㄧ殑鍦版柟錛屽寘鎷竴涓嚱鏁拌皟鐢紙琚姞鍒版瘡涓嚱鏁扮殑鏈鍚庯級鈥斺旀鏌ュ凡緇忚鎴戜滑鐨勫嚱鏁頒慨鏀圭殑 ESP鍫嗘爤鎸囬拡銆備粈涔堬紒闅鵑亾鏈変竴涓嚱鏁拌皟鐢ㄨ娣誨姞鍒?ThreadFunc 鍚楋紵閭e皢瀵艱嚧鐏鵑毦銆俆hreadFunc 鐨勮繙紼嬫嫹璐濆皢璋冪敤涓涓湪榪滅▼榪涚▼涓笉瀛樺湪鐨勫嚱鏁幫紙鑷沖皯鏄湪鐩稿悓鐨勫湴鍧絀洪棿涓笉瀛樺湪錛?/p>
闄勫綍C錛?
闈欐佸嚱鏁板拰澧為噺閾炬帴 銆銆澧為噺閾炬帴涓昏浣滅敤鏄湪鐢熸垚搴旂敤紼嬪簭鏃剁緝鐭摼鎺ユ椂闂淬傚父瑙勯摼鎺ュ拰澧為噺閾炬帴鐨勫彲鎵ц紼嬪簭涔嬮棿鐨勫樊鍒槸鈥斺斿閲忛摼鎺ユ椂錛屾瘡涓嚱鏁拌皟鐢ㄧ粡鐢變竴涓澶栫殑JMP鎸囦護錛岃鎸囦護鐢遍摼鎺ュ櫒鍙戝嚭錛堣瑙勫垯鐨勪竴涓緥澶栨槸鍑芥暟澹版槑涓洪潤鎬侊級銆傝繖浜?JMP 鎸囦護鍏佽閾炬帴鍣ㄥ湪鍐呭瓨涓Щ鍔ㄥ嚱鏁幫紝榪欑縐誨姩鏃犻渶淇敼寮曠敤鍑芥暟鐨?CALL鎸囦護銆備絾榪欎簺JMP鎸囦護涔熺‘瀹炲鑷翠簡涓浜涢棶棰橈細濡?ThreadFunc 鍜?AfterThreadFunc 灝嗘寚鍚慗MP鎸囦護鑰屼笉鏄疄闄呯殑浠g爜銆傛墍浠ュ綋璁$畻ThreadFunc 鐨勫ぇ灝忔椂錛? 闄勫綍D錛?/p>
涓轟粈涔?ThreadFunc鐨勫眬閮ㄥ彉閲忓彧鏈?4k錛?/p>
銆銆灞閮ㄥ彉閲忔繪槸瀛樺偍鍦ㄥ爢鏍堜腑錛屽鏋滄煇涓嚱鏁版湁256涓瓧鑺傜殑灞閮ㄥ彉閲忥紝褰撹繘鍏ヨ鍑芥暟鏃訛紝鍫嗘爤鎸囬拡灝卞噺灝?56涓瓧鑺傦紙鏇寸簿紜湴璇達紝鍦ㄥ嚱鏁板紑濮嬪錛夈備緥濡傦紝涓嬮潰榪欎釜鍑芥暟錛? 娉ㄦ剰浜嬮」 涓轟粈涔堣灝嗗紑鍏寵鍙ユ媶鍒嗘垚涓変釜浠ヤ笂? 鐢ㄤ笅闈㈣繖涓緥瀛愬緢瀹規槗瑙i噴榪欎釜闂錛屽亣璁炬湁濡備笅榪欎箞涓涓嚱鏁幫細 銆銆鐜板湪錛屼綘涔熻璁や負鍑虹幇涓婅堪鎯呭喌鍙槸鍥犱負CASE甯擱噺琚湁鎰忛夋嫨涓鴻繛緇殑錛?錛?錛?錛?錛夈傚垢榪愮殑鏄紝瀹冪殑榪欎釜鏂規鍙互搴旂敤浜庡ぇ澶氭暟鐜板疄渚嬪瓙涓紝鍙湁鍋忕Щ閲忕殑璁$畻紼嶅井鏈変簺澶嶆潅銆備絾鏈変袱涓緥澶栵細 銆銆鏄劇劧錛屽崟鐙垽鏂瘡涓殑CASE甯擱噺鐨勮瘽錛岀粨鏋滀唬鐮佺箒鐞愯楁椂錛屼絾浣跨敤CMP鍜孞MP鎸囦護鍒欎嬌寰楃粨鏋滀唬鐮佺殑鎵ц灝卞儚鏅氱殑if-else 璇彞銆?br>鏈夎叮鐨勫湴鏂癸細濡傛灉浣犱笉鏄庣櫧CASE璇彞浣跨敤甯擱噺琛ㄨ揪寮忕殑鐞嗙敱錛岄偅涔堢幇鍦ㄥ簲璇ュ紕鏄庣櫧浜嗗惂銆備負浜嗗垱寤哄湴鍧琛紝鏄劇劧鍦ㄧ紪璇戞椂灝卞簲璇ョ煡閬撶浉鍏沖湴鍧銆?/p>
鐜板湪鍥炲埌闂錛?br>娉ㄦ剰鍒板湴鍧 0040100C 澶勭殑JMP鎸囦護浜嗗悧錛熸垜浠潵鐪嬬湅Intel鍏充簬鍗佸叚榪涘埗鎿嶄綔鐮?FF 鐨勬枃妗f槸鎬庝箞璇寸殑錛?/p>
銆銆鍘熸潵JMP 浣跨敤浜嗕竴縐嶇粷瀵瑰鍧鏂瑰紡錛屼篃灝辨槸璇達紝瀹冪殑鎿嶄綔鏁幫紙CASE璇彞涓殑 0040102C錛夎〃紺轟竴涓粷瀵瑰湴鍧銆傝繕鐢ㄦ垜璇翠粈涔堝悧錛熻繙紼?ThreadFunc 浼氱洸鐩湴璁や負鍦板潃琛ㄤ腑寮鍏沖湴鍧鏄?0040102C錛孞MP鍒頒竴涓敊璇殑鍦版柟錛岄犳垚榪滅▼榪涚▼宕╂簝銆? 涓轟粈涔堣繙紼嬭繘紼嬩細宕╂簝鍛紵 褰撹繙紼嬭繘紼嬪穿婧冩椂錛屽畠鎬繪槸浼氬洜涓轟笅闈㈣繖浜涘師鍥狅細 銆銆涓嶇鍝鎯呭喌錛屼綘閮借灝忓績緲肩考鍦頒嬌鐢?CreateRemoteThread 鍜?WriteProcessMemory 鎶鏈傚挨鍏惰娉ㄦ剰浣犵殑緙栬瘧鍣?閾炬帴鍣ㄩ夐」錛屼竴涓嶅皬蹇冨畠浠氨浼氬湪 ThreadFunc 娣誨姞鍐呭銆?
涓銆?鍦ㄤ腑鍥戒綘鍗冧竾涓嶈鍥犱負瀛︿範鎶鏈氨鍙互鎹㈡潵紼沖畾鐨勭敓媧誨拰楂樼殑钖按寰呴亣錛屼綘鍗冧竾鏇翠笉瑕佽涓哄摢浜涗粠浜?甯傚満寮鍙戯紝璺戣吙鐨勪漢錛屾病鏈夊墠閫斻?br />
涓嶇煡閬撲綘鏄笉鏄煡閬擄紝鍜變滑涓浗鏈夌浉褰撳ぇ鐨勪竴閮ㄥ垎杞歡鍏徃錛屼粬浠殑杞歡寮鍙戝洟闃熼兘灝忕殑鍙滐紝鐢氳嚦鍙湁1-3涓漢錛岃繛涓涓」鐩皬緇勯兘綆椾笉涓婏紝鑰岃繖鏍風殑鍥㈤槦鍗磋鎵挎媴涓涓蔣浠跺叕鍙告墍鏈夌殑杞歡寮鍙戜換鍔★紝鍦ㄨ蔣浠朵笂綰垮拰寮鍙戠殑鍏抽敭闃舵闇瑕佸洟闃熺殑鎴愬憳娌℃棩娌″鐨勫姞鐝紝榪橀渶瑕佷負嫻嬭瘯鍑虹殑BUG鍜屼笉鑳芥寜鏃舵彁浜ょ殑杞歡妯″潡鍔熻兘鑰屽績鎬蹇愬繎錛屾湁鐨勬椂鍊欏鏋滀綘涓嶅垢鍔犲叆鐜板満寮鍙戠殑鍥㈤槦浣犲垯闇瑕佽儗浜曠涔″憡鍒綘鐨勫コ鍙嬶紝榪涜灝侀棴寮鍙戯紝浣犲鉤鏃墮櫎浜嗙紪鐮佷箣澶栧氨鏄悆楗拰鐫¤錛堟湁閽辯殑鍏徃鐢氳嚦璇蜂釜淇濆涓轟綘鍋氶キ錛屼互璁╀綘鑺傜渷鍑烘洿澶氱殑鏃墮棿鏉ユ姇鍏ュ埌宸ヤ綔涓紝璁╀綘涓鐩村湪閭g绱簡灝變紤鎭紝涓嶇瘡灝辯珛鍗沖伐浣滅殑鐘舵侊級
鏇村彲鎬曠殑鏄紝浼氳浣犳帴瑙︾殑浜洪檯鍏崇郴闈炲父鍗曚竴錛岄櫎浜嗘湁闄愮殑鎶鏈漢鍛樹箣澶栦綘鍑犱箮瑙佷笉鍒板仛鍏朵粬琛屼笟宸ヤ綔鍜岃亴浣嶇殑浜猴紝浣犵殑鏈嬪弸鍦堝瓙灝忎笖鍗曚竴錛岀敋鑷崇牬鍧忎綘鍘熸湁鐨勭埍鎯咃紙鎯寵薄涓涓嬶紝浣犲湪澶栧湴鍋氱幇鍦哄紑鍙?涓湀浠ヤ笂錛屽嵈浠庢病璺熷コ鍙嬭榪囦竴闈㈢殑璇濓紝浣犵殑濂沖弸鏄笉鏄細瀵逛綘鍛茬墮瑁傚槾錛夈?br />
涔熻浣犳嬁鍒頒簡鎵璋撶殑鐧介鐨勫伐璧勶紝浣嗕綘鍗翠粠姝ゅけ鍘諱韓鍙楃敓媧葷殑鑷敱錛屽鏋滀綘鎯沖仛鎶鏈漢鍛樺挨鍏舵槸寮鍙戜漢鍛橈紝鎴戞兂浣犲緢蹇氨浼氱悊瑙o紝浣犲涔堟兂鍦ㄤ竴涓湴鏂歸暱鏈熷緟涓孌墊椂闂達紝璁よ瘑涓浜涙湅鍙嬶紝澶氫竴浜涚敓媧繪椂闂寸殑鎰挎湜銆?br />
姣斾箣浜庢垜浠殑鐢熸椿鍜屼漢闄呭叧緋誨強宸ヤ綔錛岄偅浜涗粠浜嬪敭鍓嶅拰甯傚満寮鍙戠殑鏈嬪弸錛屽嵈鏈夋瘮鎴戜滑澶氱殑澶氱殑宸ヤ綔涔嬪鐨勬椂闂達紝鐢氳嚦浠栦滑宸ヤ綔鐨勬椂闂存湁鐨勬椂鍊欐槸鍜岀敓媧葷殑鏃墮棿鏄彲浠ュ吋欏劇殑錛屼粬浠彲浠ラ氳繃甯傚満寮鍙戯紝璁よ瘑鍚勪釜琛屼笟鐨勪漢澹紝鍙互璁よ瘑鍚勭鍚勬牱鐨勬湅鍙嬶紝浠栦滑姣旀垜浠潶鐜囪鏇存湁鍙戣儲鍜屽彂灞曠殑鏈轟細錛屽彧瑕佷粬浠窡鎴戜滑涓鏍峰嫟濂嬨傦紙鏈変竴縐嶅嫟濂嬬殑鏅氫漢錛屽鏋滅粰浠栨崲涓湴鏂癸紝浠栭┈涓婁細鎴愪負涓涓嫟濂嬩笖鍑轟紬鐨勪漢銆傦級
浜屻傚湪瀛︿範鎶鏈殑鏃跺欏崈涓囦笉瑕佽涓哄鏋滃仛鍒版妧鏈渶寮猴紝灝卞彲浠ユ垚涓?00%鍙楀皧閲嶇殑浜恒?br />
鏈変竴嬈′竴涓漢鍦ㄩ潰璇曢」鐩粡鐞嗙殑鏃跺欒浜嗚繖涔堜竴孌佃瘽錛氭垜鍙敤鏈鍚瘽鐨勪漢錛屾寜鐓ф垜鐨勮姹傚仛鍙鏄惉璇濆氨瑕侊紝濡傛灉涓嶅惉璇濅笉綆′粬鎶鏈啀濂戒篃涓嶈銆傞殢鍚庤繖涓漢寰楀埌浜嗚瘯鐢ㄦ満浼氾紝濡傛灉娌℃剰澶栫殑璇濓紝浠栦竴瀹氫細鏄笅涓涓」鐩粡鐞嗙殑緇т換鑰呫?br />
鏈嬪弸浠綘鐭ラ亾鍚楋紵涓嶇浣犳妧鏈湁澶氬己錛屼綘涔熶笉鍙兘鑷敱鐨勮吘鍑烘椂闂磋薄鍒漢閭f牱鐮旂┒涓涓婰INUX婧愮爜錛岀敋鑷沖啓涓涓狶INUX鏍風殑鏉頒綔鏉ヨ〃鐜頒綘鐨勬墠鑳姐備綘闇瑕佸仛鐨勫氨鏄寜鐓ц姹傚啓浠g爜錛屽啓浠g爜鐨勫惈涔夊氨鏄兘瑙勫畾濂斤紝浣犳寜鐓ц瀹氬啓錛屼綘寰堝揩灝變細鍙戠幇浣犳槰澶╁啓鐨勪唬鐮侊紝璺熶粖澶╁啓鐨勪唬鐮佹湁寰堝綾諱技錛岀瓑浣犲啓榪囦竴孌墊椂闂寸殑浠g爜錛屼綘灝嗛鐣ワ細澶嶅埗錛屾嫹璐濓紝綺樿創閭f牱鐨勬妧鏈浣犳潵璇存槸浣曠瓑閲嶈銆傦紙濡傛灉浣犳病鏈夊仛榪?騫翠互涓婄殑鐪熸鎰忎箟涓婄殑寮鍙戜笉瑕佸弽椹蟲垜錛夈?br />
濡傛灉浣犲垢榪愮殑鑳藉鍚埌甯傚満浜哄憳鐨勮皥璇濓紝鎴栨槸棰嗗浠殑璋堣瘽錛屼綘浼氶殣綰﹁寰椾粬浠兘鍦ㄦ妸鎶鏈漢鍛樺綋浣滅紪鐮佺殑鏈哄櫒鏉ョ湅錛屼綘鐨勪環鍊煎茍娌℃湁浣犳兂璞$殑閭d箞閲嶈銆傝屽湪浣犳墍鍦ㄧ殑鍥㈤槦鍐呴儴錛屼綘鍙兘姝e湪涓轟竴涓妧鏈棶棰樼殑璁ㄨ鍐嶈窡鍚屼簨鎼炲唴鑰楋紝鍥犱負浠栦笉鏈嶄綘錛屼綘涔熶笉鏈嶄粬錛屼綘浠兘璁や負鑷繁鐨勫錛屽叾瀹炰綘浠袱涓兘瀵癸紝鑰屼簤璁虹殑鐩殑灝辨槸涓轟簡鍦ㄥ叧閿満鍚堣瘉鏄庝竴涓嬭嚜宸辨瘮瀵規柟鎶鏈ソ錛屾瘮瀵規柟寮恒傦紙鍦ㄤ竴涓」鐩紑鍙戜腑錛屾病鏈変漢鎰挎剰闀挎湡鍚埆浜虹殑錛屾繪兂鎹釜浣嶇疆棰嗗鍒漢銆傦級
涓夈備綘鏇翠笉瑕佽涓猴紝濡傛灉鎴戞妧鏈濂斤紝鎴戝氨鑷繁鍒涗笟錛岃嚜宸辨湁鍒涗笟鐨勮祫鏈紝鍥犱負鑷繁鏄悶鎶鏈殑銆?br />
濡傛灉浣犻偅鏍瘋涓猴紝鐪熺殑鏄ぇ閿欑壒閿欎簡錛屼綘鍙互鍋氫釜璋冩煡鍦ㄩ潪鎶鏈漢緹や腑錛屾病鏈夊嚑涓漢鐭ラ亾C#涓嶫AVA鐨勶紝鏇磋皥涓嶄笂鏉ユ璧忎綘鐨勬妧鏈槸濂借繕鏄笉濂姐備竴鍙ヨ瘽錛屾妧鏈粎浠呮槸涓涓伐鍏鳳紝鍠勪簬榪愮敤榪欎釜宸ュ叿涓哄埆浜哄共媧葷殑浜猴紝鍗村線寰涓嶅お鎿呴暱鐢ㄨ繖涓伐鍏鋒潵涓鴻嚜宸卞垱涓氾紝鍥犱負榪欐槸涓や釜姒傚康錛岃緇冪殑鎶鑳戒篃鏄畬鍏ㄤ笉鍚岀殑銆?br />
鍒涗笟鏈寮濮嬬殑鏃跺欙紝浣犵殑浜洪檯鍏崇郴錛屼綘澶勭悊浜洪檯鍏崇郴鐨勮兘鍔涳紝浣犲紺句細娼滆鍒欑殑璁よ瘑錛岃繕鏈変綘鏄庣櫧涓嶆槑鐧藉埆浜虹殑蹇冿紝浣犱細涓嶄細璇磋浜哄枩嬈㈢殑璇濓紝榪樻湁浣犲鑷繁鎵鎻愪緵鐨勬湇鍔$殑絳栧垝鍜屾帹閿絳夌瓑錛屼篃璁告湁涓涓囷紝涓鐧句竾涓煎緱鎴戜滑閲嶈鐨勯棶棰橈紝浣嗕綘浼氬彂鐜版妧鏈嵈寰堝皯鏈夊彲鑳藉寘鍚湪榪欎竴涓囨垨涓鐧句竾涔嬪唴錛屽鏋滀綘鍒涗笟鍒頒簡涓涓揩鎴愬姛鐨勯樁孌碉紝浣犱細榪欐牱鍛婅瘔鑷繁錛氭垜騫插悧瑕佷翰鑷仛鎶鏈紝鎴戣仒涓涓漢涓嶅氨琛屼簡錛岃繖鏃跺欎綘鎵嶇湡姝d細鐞嗚В鎶鏈殑浣滅敤錛屽拰浣犱互鍓嶅仛鎶鏈漢鍛樼殑浣滅敤銆?br />
[灝忕粨]
鍩轟簬涓婇潰鐨勮璁猴紝鎴戝鍔濋偅浜涘涔犳妧鏈殑鏈嬪弸錛屽崈涓囦笉瑕佹嬁縐戜婦鑰冭瘯鏍風殑蹇冩佸幓瀛︿範鎶鏈?瀵規妧鏈殑瀛︿範鍑犺繎鐨勭棿榪鳳紝鎯蟲帉鎻℃墍鏈夋墍鏈夌殑鎶鏈紝浠ヨ鑷繁鎴愪負鎶鏈鍩熺殑鏉冨▉鍜屼笓瀹訛紝浠ュ湪蹇呰鐨勬椂鍊欐垨鏄績閲屼笉鐣呭揩鐨勬椂鍊欏埌緗戜笂瀵圭潃鑿滈笩璇磋嚜宸辨槸鍓嶈緢銆?br />
鎶鏈粎浠呮槸涓涓伐鍏鳳紝鏄綘鍦ㄤ漢鐢熶竴涓樁孌電敓瀛樼殑宸ュ叿錛屼綘鍙互涓杈堝瓙鍠滄浠栵紝浣嗘渶濂戒笉瑕佷竴杈堝瓙闈犲畠鐢熷瓨銆?br />
鎺屾彙鎶鏈殑鍞竴鐩殑灝辨槸鎷垮畠鎵懼伐浣滐紙濡傛灉浣犱笉鎯蟲妸鎶鏈綋浣滀綘絎簩鐢熷懡鐨勮瘽錛夛紝灝辨槸騫叉椿銆傛墍浠ヤ綘鍦ㄥ涔犵殑鏃跺欏崈涓囦笉瑕佸幓鍋氶偅浜涙墍璋撶殑鎶鏈範棰樻垨鏄爺絀墮偅浜涘附娉$畻娉曪紝鏈澶ф暟綆楁硶浜嗭紝浠涔堝彨騫叉椿錛?br />
灝辨槸鍋氫竴涓笢瑗胯鍒漢鐢紝鍒漢鐢ㄤ簡錛屽彲浠ユ彁楂樹粬浠殑宸ヤ綔鏁堢巼錛屾兂璞″惂錛屼綘鍋?涓囬亾鎶鏈範棰樻湁浠涔堢敤錛熷彧浼氳浜鴻寰楅吀鑵愶紝榪樻槸鍦ㄥ涔犵殑鏃跺欙紝澶氬煿鍏諱簺鑷繁鍔″疄鐨勬佸害鍚э紝姣斿鐮旂┒涓涓嬪綋鍦板競鍦虹洰鍓嶆湁鍝簺杞歡鍏徃鐢ㄤ漢錛岃嚜宸辯浠栦滑鐨勮姹傚埌搴曟湁澶氳繙錛岃嚜宸卞叿浣撳簲璇ユ庝箞鍋氭墠鍙互杈懼埌浠栦滑鐨勮姹傘傜瓑浣犲垎鏋愬畬榪欎簺錛屼綘灝變細鍙戠幇錛屾壘宸ヤ綔鎴愬姛錛屾妧鏈殑璐$尞鐜囧叾瀹炲茍娌℃湁浣犲師鏉ユ兂璞$殑閭d箞楂樸?br />
涓嶇浣犳槸瀛︿範鎶鏈負浜嗘壘宸ヤ綔榪樻槸鍒涗笟錛屼綘閮借瀵規妧鏈湰韜湁涓竻閱掔殑璁よ瘑錛屽湪涓浗涓嶄細鍑虹幇BILL GATES錛屽洜涓猴紝涓浗鐩墠榪樹笉鏄崄鍒嗙殑灝婇噸鎶鏈漢鎵嶏紝榪樹粎浠呯殑鍋滅暀鍦ㄦ妸杞歡鎶鏈漢鎵嶅綋浣滀漢鎵嶆満鍣ㄦ潵鐢ㄧ殑灝村艾澧冨湴銆傦紙濡傛灉浣犱笉鐞嗚В錛屼竴縐嶅彲鑳芥槸浣犵洰鍓嶄粎浠呬粠浜嬭繃鎶鏈伐浣滐紝浣犵殑鏈嬪弸鍦堝瓙閲屾妧鏈被鐨勬湅鍙嬪崰浜嗗ぇ澶氭暟錛屼竴縐嶅彲鑳芥槸浣犺繕娌℃湁宸ヤ綔錛屼絾鍠滄璇繪瘮灝斻傜洊鑼ㄧ殑浼犺錛夈?
]]>
]]>
4銆佹枃瀛楀父閲忓尯 鈥斿父閲忓瓧絎︿覆灝辨槸鏀懼湪榪欓噷鐨勩?紼嬪簭緇撴潫鍚庣敱緋葷粺閲婃斁
5銆佺▼搴忎唬鐮佸尯鈥斿瓨鏀懼嚱鏁頒綋鐨勪簩榪涘埗浠g爜銆?
2.1鐢寵鏂瑰紡
stack:
鐢辯郴緇熻嚜鍔ㄥ垎閰嶃?/u> 渚嬪錛屽0鏄庡湪鍑芥暟涓竴涓眬閮ㄥ彉閲?int b; 緋葷粺鑷姩鍦ㄦ爤涓負b寮杈熺┖闂?br>heap:
闇瑕佺▼搴忓憳鑷繁鐢寵錛屽茍鎸囨槑澶у皬錛屽湪c涓璵alloc鍑芥暟
濡俻1 = (char *)malloc(10);
鍦–++涓敤new榪愮畻絎?br>濡俻2 = (char *)malloc(10);
浣嗘槸娉ㄦ剰p1銆乸2鏈韓鏄湪鏍堜腑鐨勩?br>2.2鐢寵鍚庣郴緇熺殑鍝嶅簲
鏍堬細鍙鏍堢殑鍓╀綑絀洪棿澶т簬鎵鐢寵絀洪棿錛岀郴緇熷皢涓虹▼搴忔彁渚涘唴瀛橈紝鍚﹀垯灝嗘姤寮傚父鎻愮ず鏍堟孩鍑恒?br>鍫嗭細棣栧厛搴旇鐭ラ亾鎿嶄綔緋葷粺鏈変竴涓褰曠┖闂插唴瀛樺湴鍧鐨勯摼琛?/font>錛屽綋緋葷粺鏀跺埌紼嬪簭鐨勭敵璇鋒椂錛?br>浼?閬嶅巻璇ラ摼琛紝瀵繪壘絎竴涓┖闂村ぇ浜庢墍鐢寵絀洪棿鐨勫爢緇撶偣錛岀劧鍚庡皢璇ョ粨鐐逛粠絀洪棽緇撶偣閾捐〃涓垹闄わ紝騫跺皢璇ョ粨鐐圭殑絀洪棿鍒嗛厤緇欑▼搴忥紝鍙﹀錛屽浜庡ぇ澶氭暟緋葷粺錛屼細鍦ㄨ繖鍧楀唴 瀛樼┖闂翠腑鐨勯鍦板潃澶勮褰曟湰嬈″垎閰嶇殑澶у皬錛岃繖鏍鳳紝浠g爜涓殑delete璇彞鎵嶈兘姝g‘鐨勯噴鏀炬湰鍐呭瓨絀洪棿銆傚彟澶栵紝鐢變簬鎵懼埌鐨勫爢緇撶偣鐨勫ぇ灝忎笉涓瀹氭濂界瓑浜庣敵璇風殑澶?灝忥紝緋葷粺浼氳嚜鍔ㄧ殑灝嗗浣欑殑閭i儴鍒嗛噸鏂版斁鍏ョ┖闂查摼琛ㄤ腑銆?br>2.3鐢寵澶у皬鐨勯檺鍒?/font>
鏍堬細鍦╓indows涓?鏍堟槸鍚戜綆鍦板潃鎵╁睍鐨勬暟鎹粨鏋勶紝鏄竴鍧?榪炵畫鐨勫唴瀛樼殑鍖哄煙銆傝繖鍙ヨ瘽鐨勬剰鎬濇槸鏍堥《鐨勫湴鍧鍜屾爤鐨勬渶澶у閲忔槸緋葷粺棰勫厛瑙勫畾濂界殑錛屽湪 WINDOWS涓嬶紝鏍堢殑澶у皬鏄?M錛堜篃鏈夌殑璇存槸1M錛屾諱箣鏄竴涓紪璇戞椂灝辯‘瀹氱殑甯告暟錛夛紝濡傛灉鐢寵鐨勭┖闂磋秴榪囨爤鐨勫墿浣欑┖闂存椂錛屽皢鎻愮ずoverflow銆傚洜 姝わ紝鑳戒粠鏍堣幏寰楃殑絀洪棿杈冨皬銆?br>鍫嗭細鍫嗘槸鍚戦珮鍦板潃鎵╁睍鐨勬暟鎹粨鏋勶紝鏄笉榪炵畫鐨勫唴瀛樺尯鍩熴?/font>榪欐槸鐢變簬緋葷粺鏄敤閾捐〃鏉ュ瓨鍌ㄧ殑絀洪棽鍐呭瓨鍦板潃鐨勶紝鑷劧鏄笉榪炵畫鐨勶紝鑰岄摼琛ㄧ殑閬嶅巻鏂瑰悜鏄敱浣庡湴鍧鍚戦珮鍦板潃銆傚爢鐨勫ぇ灝忓彈闄愪簬璁$畻鏈虹郴緇熶腑鏈夋晥鐨勮櫄鎷熷唴瀛樸傜敱姝ゅ彲瑙侊紝鍫嗚幏寰楃殑絀洪棿姣旇緝鐏墊椿錛屼篃姣旇緝澶с?br>2.4鐢寵鏁堢巼鐨勬瘮杈冿細
鏍堢敱緋葷粺鑷姩鍒嗛厤錛岄熷害杈冨揩銆備絾紼嬪簭鍛樻槸鏃犳硶鎺у埗鐨勩?/font>
鍫嗘槸鐢眓ew鍒嗛厤鐨勫唴瀛橈紝涓鑸熷害姣旇緝鎱紝鑰屼笖瀹規槗浜х敓鍐呭瓨紕庣墖,涓嶈繃鐢ㄨ搗鏉ユ渶鏂逛究.
鍙﹀錛屽湪WINDOWS涓嬶紝鏈濂界殑鏂瑰紡鏄敤VirtualAlloc鍒嗛厤鍐呭瓨錛屼粬涓嶆槸鍦ㄥ爢錛屼篃涓嶆槸鍦ㄦ爤鏄洿鎺ュ湪榪涚▼鐨勫湴鍧絀洪棿涓繚鐣欎竴蹇唴瀛橈紝铏界劧鐢ㄨ搗鏉ユ渶涓嶆柟渚褲備絾鏄熷害錛?涔熸渶鐏墊椿
2.5鍫嗗拰鏍堜腑鐨勫瓨鍌ㄥ唴瀹?/font>
鏍堬細 鍦ㄥ嚱鏁拌皟鐢ㄦ椂錛岀涓涓繘鏍堢殑鏄富鍑芥暟涓悗鐨勪笅涓鏉℃寚浠わ紙鍑芥暟璋冪敤璇彞鐨勪笅涓鏉″彲鎵ц璇彞錛夌殑鍦板潃錛岀劧鍚庢槸鍑芥暟鐨勫悇涓弬鏁幫紝鍦ㄥぇ澶氭暟鐨凜緙栬瘧鍣ㄤ腑錛屽弬鏁版槸鐢卞彸寰宸﹀叆鏍堢殑錛岀劧鍚庢槸鍑芥暟涓殑灞閮ㄥ彉閲忋傛敞鎰忛潤鎬佸彉閲忔槸涓嶅叆鏍堢殑銆?br>褰撴湰嬈″嚱鏁拌皟鐢ㄧ粨鏉熷悗錛屽眬閮ㄥ彉閲忓厛鍑烘爤錛岀劧鍚庢槸鍙傛暟錛屾渶鍚庢爤欏舵寚閽堟寚鍚戞渶寮濮嬪瓨鐨勫湴鍧錛屼篃灝辨槸涓誨嚱鏁頒腑鐨勪笅涓鏉℃寚浠わ紝紼嬪簭鐢辮鐐圭戶緇繍琛屻?br>鍫嗭細涓鑸槸鍦ㄥ爢鐨勫ご閮ㄧ敤涓涓瓧鑺傚瓨鏀懼爢鐨勫ぇ灝忋傚爢涓殑鍏蜂綋鍐呭鏈夌▼搴忓憳瀹夋帓銆?br>2.6瀛樺彇鏁堢巼鐨勬瘮杈?/font>
char s1[] = "aaaaaaaaaaaaaaa";
char *s2 = "bbbbbbbbbbbbbbbbb";
aaaaaaaaaaa鏄湪榪愯鏃跺埢璧嬪肩殑錛?br>鑰宐bbbbbbbbbb鏄湪緙栬瘧鏃跺氨紜畾鐨勶紱
浣嗘槸錛屽湪浠ュ悗鐨勫瓨鍙栦腑錛屽湪鏍堜笂鐨勬暟緇勬瘮鎸囬拡鎵鎸囧悜鐨勫瓧絎︿覆(渚嬪鍫?蹇?br>姣斿錛?br>#include
void main()
{
char a = 1;
char c[] = "1234567890";
char *p ="1234567890";
a = c[1];
a = p[1];
return;
}
瀵瑰簲鐨勬眹緙栦唬鐮?br>10: a = c[1];
00401067 8A 4D F1 mov cl,byte ptr [ebp-0Fh]
0040106A 88 4D FC mov byte ptr [ebp-4],cl
11: a = p[1];
0040106D 8B 55 EC mov edx,dword ptr [ebp-14h]
00401070 8A 42 01 mov al,byte ptr [edx+1]
00401073 88 45 FC mov byte ptr [ebp-4],al
絎竴縐嶅湪璇誨彇鏃剁洿鎺ュ氨鎶婂瓧絎︿覆涓殑鍏冪礌璇誨埌瀵勫瓨鍣╟l涓紝鑰岀浜岀鍒欒鍏堟妸鎸噀dx涓紝鍦ㄦ牴鎹甧dx璇誨彇瀛楃錛屾樉鐒舵參浜嗐?br>
2.7灝忕粨錛?/strong>
鍫嗗拰鏍堢殑鍖哄埆鍙互鐢ㄥ涓嬬殑姣斿柣鏉ョ湅鍑猴細
浣跨敤鏍堝氨璞℃垜浠幓楗閲屽悆楗?/font>錛屽彧綆$偣鑿滐紙鍙戝嚭鐢寵錛夈佷粯閽便佸拰鍚冿紙浣跨敤錛夛紝鍚冮ケ浜嗗氨璧幫紝涓嶅繀鐞嗕細鍒囪彍銆佹礂鑿滅瓑鍑嗗宸ヤ綔鍜屾礂紕椼佸埛閿呯瓑鎵熬宸ヤ綔錛?font color=#ff00ff>浠栫殑濂藉鏄揩鎹鳳紝浣嗘槸鑷敱搴﹀皬銆?/font>
浣跨敤鍫嗗氨璞℃槸鑷繁鍔ㄦ墜鍋氬枩嬈㈠悆鐨勮彍鑲?/font>錛屾瘮杈冮夯鐑︼紝浣嗘槸姣?font color=#ff0000>杈冪鍚堣嚜宸辯殑鍙e懗錛岃屼笖鑷敱搴﹀ぇ銆?/p>
]]>
鈥斺?a >濡備綍鐢ㄨ鎶鏈瓙綾誨寲榪滅▼鎺т歡
鈥斺?a href="http://www.vckbase.com/document/viewdoc/?id=1886#浣曟椂浣跨敤_CreateRemoteThread_鍜宊WriteProcessMemory_鎶鏈?>浣曟椂浣跨敤 CreateRemoteThread 鍜?WriteProcessMemory 鎶鏈?/font>

::SendMessage( hPwdEdit, WM_GETTEXT, nMaxChars, psBuffer );
銆銆濡傛灉浣犲畨瑁呬竴涓挬瀛愮洃鎺ф煇浜涚嚎紼嬶紙WH_CALLWNDPROC錛夌殑闈為槦鍒楁秷鎭紝鍦ㄦ秷鎭瀹為檯鍙戦佸埌錛堟煇浜涚獥鍙g殑錛夐挬瀛愪綔鐢ㄧ殑綰跨▼涔嬪墠錛岃DLL 鏄笉浼氳鏄犲皠鍒拌繙紼嬭繘紼嬬殑銆傛崲鍙ヨ瘽璇達紝濡傛灉 UnhookWindowsHookEx 鍦ㄦ煇涓秷鎭鍙戦佸埌閽╁瓙浣滅敤鐨勭嚎紼嬩箣鍓嶈璋冪敤錛孌LL 鏍規湰涓嶄細琚槧灝勫埌榪滅▼榪涚▼錛堝嵆浣?SetWindowsHookEx 鏈韓璋冪敤鎴愬姛錛夈備負浜嗗己鍒惰繘琛屾槧灝勶紝鍦ㄨ皟鐢?SetWindowsHookEx 涔嬪悗椹笂鍙戦佷竴涓簨浠跺埌鐩稿叧鐨勭嚎紼嬨?br>銆銆鍦║nhookWindowsHookEx浜嗕箣鍚庯紝瀵逛簬娌℃湁鏄犲皠鐨凞LL澶勭悊鏂規硶涔熶竴鏍楓傚彧鏈夊湪瓚沖鐨勪簨浠跺彂鐢熷悗錛孌LL鎵嶄細鏈夌湡姝g殑鏄犲皠銆?
BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved )
{
if( ul_reason_for_call == DLL_PROCESS_ATTACH )
{
// Increase reference count via LoadLibrary
char lib_name[MAX_PATH];
::GetModuleFileName( hModule, lib_name, MAX_PATH );
::LoadLibrary( lib_name );
// Safely remove hook
::UnhookWindowsHookEx( g_hHook );
}
return TRUE;
}
銆銆閭d箞浼氬彂鐢熶粈涔堝憿錛熼鍏堟垜浠氳繃Windows 閽╁瓙灝咲LL鏄犲皠鍒拌繙紼嬭繘紼嬨傜劧鍚庯紝鍦―LL琚疄闄呮槧灝勪箣鍚庯紝鎴戜滑瑙e紑閽╁瓙銆傞氬父褰撶涓涓秷鎭埌杈鵑挬瀛愪綔鐢ㄧ嚎紼嬫椂錛孌LL姝ゆ椂涔熶笉浼氳鏄犲皠銆傝繖閲岀殑澶勭悊鎶宸ф槸璋冪敤LoadLibrary閫氳繃澧炲姞 DLLs鐨勫紩鐢ㄨ鏁版潵闃叉鏄犲皠涓嶆垚鍔熴?br>銆銆鐜板湪鍓╀笅鐨勯棶棰樻槸濡備綍鍗歌澆DLL錛孶nhookWindowsHookEx 鏄笉浼氬仛榪欎釜浜嬫儏鐨勶紝鍥犱負閽╁瓙宸茬粡涓嶄綔鐢ㄤ簬綰跨▼浜嗐備綘鍙互鍍忎笅闈㈣繖鏍峰仛錛?br>
HINSTANCE LoadLibrary(
LPCTSTR lpLibFileName // 搴撴ā鍧楁枃浠跺悕鐨勫湴鍧
);
BOOL FreeLibrary(
HMODULE hLibModule // 瑕佸姞杞界殑搴撴ā鍧楃殑鍙ユ焺
);
DWORD WINAPI ThreadProc(
LPVOID lpParameter // 綰跨▼鏁版嵁
);
HANDLE hThread;
char szLibPath[_MAX_PATH]; // “LibSpy.dll”妯″潡鐨勫悕縐?(鍖呮嫭鍏ㄨ礬寰?;
void* pLibRemote; // 榪滅▼榪涚▼涓殑鍦板潃錛宻zLibPath 灝嗚鎷瘋礉鍒版澶?
DWORD hLibModule; // 瑕佸姞杞界殑妯″潡鐨勫熀鍦板潃錛圚MODULE錛?
HMODULE hKernel32 = ::GetModuleHandle("Kernel32");
// 鍒濆鍖杝zLibPath
//...
// 1. 鍦ㄨ繙紼嬭繘紼嬩腑涓簊zLibPath 鍒嗛厤鍐呭瓨
// 2. 灝唖zLibPath 鍐欏叆鍒嗛厤鐨勫唴瀛?
pLibRemote = ::VirtualAllocEx( hProcess, NULL, sizeof(szLibPath),
MEM_COMMIT, PAGE_READWRITE );
::WriteProcessMemory( hProcess, pLibRemote, (void*)szLibPath,
sizeof(szLibPath), NULL );
// 灝?LibSpy.dll" 鍔犺澆鍒拌繙紼嬭繘紼嬶紙浣跨敤CreateRemoteThread 鍜?LoadLibrary錛?
hThread = ::CreateRemoteThread( hProcess, NULL, 0,
(LPTHREAD_START_ROUTINE) ::GetProcAddress( hKernel32,
"LoadLibraryA" ),
pLibRemote, 0, NULL );
::WaitForSingleObject( hThread, INFINITE );
// 鑾峰彇鎵鍔犺澆鐨勬ā鍧楃殑鍙ユ焺
::GetExitCodeThread( hThread, &hLibModule );
// 娓呴櫎
::CloseHandle( hThread );
::VirtualFreeEx( hProcess, pLibRemote, sizeof(szLibPath), MEM_RELEASE );
銆 鍋囪鎴戜滑瀹為檯鎯寵娉ㄥ叆鐨勪唬鐮佲斺擲endMessage 鈥斺旇鏀懼湪DllMain (DLL_PROCESS_ATTACH)涓紝鐜板湪瀹冨凡緇忚鎵ц銆傞偅涔堢幇鍦ㄥ簲璇ヤ粠鐩爣榪涚▼涓皢DLL 鍗歌澆錛?
// 浠庣洰鏍囪繘紼嬩腑鍗歌澆"LibSpy.dll" (浣跨敤 CreateRemoteThread 鍜?FreeLibrary)
hThread = ::CreateRemoteThread( hProcess, NULL, 0,
(LPTHREAD_START_ROUTINE) ::GetProcAddress( hKernel32,
"FreeLibrary" ),
(void*)hLibModule, 0, NULL );
::WaitForSingleObject( hThread, INFINITE );
// 娓呴櫎
::CloseHandle( hThread );
榪涚▼闂撮氫俊
銆銆鍒扮洰鍓嶄負姝紝鎴戜滑鍙璁轟簡鍏充簬濡備綍灝咲LL 娉ㄥ叆鍒拌繙紼嬭繘紼嬬殑鍐呭錛屼絾鏄紝鍦ㄥぇ澶氭暟鎯呭喌涓嬶紝娉ㄥ叆鐨?DLL 閮介渶瑕佷笌鍘熷簲鐢ㄧ▼搴忚繘琛屾煇縐嶆柟寮忕殑閫氫俊錛堝洖鎯充竴涓嬶紝鎴戜滑鐨凞LL鏄鏄犲皠鍒版煇涓繙紼嬭繘紼嬬殑鍦板潃絀洪棿閲屼簡錛屼笉鏄湪鏈湴搴旂敤紼嬪簭鐨勫湴鍧絀洪棿涓級銆傛瘮濡傜瀵嗕睛嫻嬬▼搴忥紝DLL蹇呴』瑕佺煡閬撳疄闄呭寘鍚瘑鐮佺殑鎺т歡鍙ユ焺錛屾樉鐒訛紝緙栬瘧鏃舵棤娉曞皢榪欎釜鍊艱繘琛岀‖緙栫爜銆傚悓鏍鳳紝涓鏃LL鑾峰緱浜嗙瀵嗭紝瀹冨繀欏誨皢瀹冨彂閫佸洖鍘熷簲鐢ㄧ▼搴忥紝浠ヤ究鑳芥紜樉紺哄嚭鏉ャ?br>銆銆騫歌繍鐨勬槸錛屾湁璁稿鏂規硶澶勭悊榪欎釜闂錛屾枃浠舵槧灝勶紝WM_COPYDATA錛屽壀璐存澘浠ュ強寰堢畝鍗曠殑 #pragma data_seg 鍏變韓鏁版嵁孌電瓑錛屾湰鏂囨垜涓嶆墦綆椾嬌鐢ㄨ繖浜涙妧鏈紝鍥犱負MSDN錛?#8220;榪涚▼闂撮氫俊”閮ㄥ垎錛変互鍙婂叾瀹冩笭閬撳彲浠ユ壘鍒板緢澶氭枃妗e弬鑰冦備笉榪囨垜鍦?LibSpy渚嬪瓙涓繕鏄嬌鐢ㄤ簡 #pragma data_seg銆傜粏鑺傝鍙傝?LibSpy 婧愪唬鐮併?
HANDLE CreateRemoteThread(
HANDLE hProcess, // 浼犲叆鍒涘緩鏂扮嚎紼嬬殑榪涚▼鍙ユ焺
LPSECURITY_ATTRIBUTES lpThreadAttributes, // 瀹夊叏灞炴ф寚閽?
DWORD dwStackSize, // 瀛楄妭涓哄崟浣嶇殑鍒濆綰跨▼鍫嗘爤
LPTHREAD_START_ROUTINE lpStartAddress, // 鎸囧悜綰跨▼鍑芥暟鐨勬寚閽?
LPVOID lpParameter, // 鏂扮嚎紼嬩嬌鐢ㄧ殑鍙傛暟
DWORD dwCreationFlags, // 鍒涘緩鏍囧織
LPDWORD lpThreadId // 鎸囧悜榪斿洖鐨勭嚎紼婭D
);
濡傛灉浣犳瘮杈冨畠涓?CreateThread錛圡SDN錛夌殑澹版槑錛屼綘浼氭敞鎰忓埌濡備笅鐨勫樊鍒細
switch( expression ) {
case constant1: statement1; goto END;
case constant2: statement2; goto END;
case constant3: statement2; goto END;
}
switch( expression ) {
case constant4: statement4; goto END;
case constant5: statement5; goto END;
case constant6: statement6; goto END;
}
END:
鎴栬呭皢瀹冧滑淇敼鎴愪竴涓?if-else if 緇撴瀯璇彞錛堝弬瑙侀檮褰旹錛夈?int GetWindowTextRemoteA( HANDLE hProcess, HWND hWnd, LPSTR lpString );
int GetWindowTextRemoteW( HANDLE hProcess, HWND hWnd, LPWSTR lpString );
鍙傛暟璇存槑錛?
hProcess錛氱紪杈戞鎺т歡鎵灞炵殑榪涚▼鍙ユ焺錛?
hWnd錛氬寘鍚瘑鐮佺殑緙栬緫妗嗘帶浠跺彞鏌勶紱
lpString錛氭帴鏀舵枃鏈殑緙撳啿鎸囬拡錛?
榪斿洖鍊鹼細榪斿洖鍊兼槸鎷瘋礉鐨勫瓧絎︽暟錛?/pre>
INJDATA
typedef LRESULT (WINAPI *SENDMESSAGE)(HWND,UINT,WPARAM,LPARAM);
typedef struct {
HWND hwnd; // 緙栬緫妗嗗彞鏌?
SENDMESSAGE fnSendMessage; // 鎸囧悜user32.dll 涓?SendMessageA 鐨勬寚閽?
char psText[128]; // 鎺ユ敹瀵嗙爜鐨勭紦鍐?
} INJDATA;
ThreadFunc鍑芥暟static DWORD WINAPI ThreadFunc (INJDATA *pData)
{
pData->fnSendMessage( pData->hwnd, WM_GETTEXT, // Get password
sizeof(pData->psText),
(LPARAM)pData->psText );
return 0;
}
// 璇ュ嚱鏁板湪ThreadFunc涔嬪悗鏍囪鍐呭瓨鍦板潃
// int cbCodeSize = (PBYTE) AfterThreadFunc - (PBYTE) ThreadFunc.
static void AfterThreadFunc (void)
{
}
濡備綍浣跨敤璇ユ妧鏈瓙綾誨寲榪滅▼鎺т歡
涓嬮潰鎴戜滑灝嗚璁轟竴浜涙洿澶嶆潅鐨勫唴瀹癸紝濡備綍瀛愮被鍖栧睘浜庡彟涓涓繘紼嬬殑鎺т歡銆?br>
棣栧厛錛屼綘寰楁嫹璐濅袱涓嚱鏁板埌榪滅▼榪涚▼鏉ュ畬鎴愭浠誨姟
鏂規硶涓錛?/p>

static LRESULT CALLBACK NewProc(
HWND hwnd, // 紿楀彛鍙ユ焺
UINT uMsg, // 娑堟伅鏍囩ず絎?
WPARAM wParam, // 絎竴涓秷鎭弬鏁?
LPARAM lParam ) // 絎簩涓秷鎭弬鏁?
{
INJDATA* pData = (INJDATA*) NewProc; // pData 鎸囧悜 NewProc
pData--; // 鐜板湪pData 鎸囧悜INJDATA;
// 鍥炴兂涓涓婭NJDATA 琚疆浜庤繙紼嬭繘紼婲ewProc涔嬪墠;
//-----------------------------
// 姝ゅ鏄瓙綾誨寲浠g爜
// ........
//-----------------------------
// 璋冪敤鍘熺獥鍙h繃紼?
// fnOldProc (鐢盨etWindowLong 榪斿洖) 琚紙榪滅▼錛塗hreadFunc鍒濆鍖?
// 騫惰淇濆瓨鍦紙榪滅▼錛塈NJDATA;涓?
return pData->fnCallWindowProc( pData->fnOldProc,
hwnd,uMsg,wParam,lParam );
}
浣嗚繖閲岃繕鏈変竴涓棶棰橈紝瑙佺涓琛屼唬鐮侊細
INJDATA* pData = (INJDATA*) NewProc;
static LRESULT CALLBACK NewProc(
HWND hwnd, // 紿楀彛鍙ユ焺
UINT uMsg, // 娑堟伅鏍囩ず絎?
WPARAM wParam, // 絎竴涓秷鎭弬鏁?
LPARAM lParam ) // 絎簩涓秷鎭弬鏁?
{
// 璁$畻INJDATA 緇撴瀯鐨勪綅緗?
// 鍦ㄨ繙紼嬭繘紼嬩腑璁頒綇榪欎釜INJDATA
// 琚斁鍦∟ewProc涔嬪墠
INJDATA* pData;
_asm {
call dummy
dummy:
pop ecx // <- ECX 鍖呭惈褰撳墠鐨凟IP
sub ecx, 9 // <- ECX 鍖呭惈NewProc鐨勫湴鍧
mov pData, ecx
}
pData--;
//-----------------------------
// 姝ゅ鏄瓙綾誨寲浠g爜
// ........
//-----------------------------
// 璋冪敤鍘熸潵鐨勭獥鍙h繃紼?
return pData->fnCallWindowProc( pData->fnOldProc,
hwnd,uMsg,wParam,lParam );
}
銆銆閭d箞錛屾帴涓嬫潵璇ユ庝箞鍔炲憿錛熶簨瀹炰笂錛屾瘡涓繘紼嬮兘鏈変竴涓壒孌婄殑瀵勫瓨鍣紝瀹冩寚鍚戜笅涓鏉¤鎵ц鐨勬寚浠ょ殑鍐呭瓨浣嶇疆銆傚嵆鎵璋撶殑鎸囦護鎸囬拡錛屽湪32浣?Intel 鍜?AMD 澶勭悊鍣ㄤ笂琚〃紺轟負 EIP銆傚洜涓?EIP鏄竴涓笓鐢ㄥ瘎瀛樺櫒錛屼綘鏃犳硶璞℃搷浣滀竴鑸父瑙勫瓨鍌ㄥ櫒錛堝錛欵AX錛孍BX絳夛級閭f牱閫氳繃緙栫▼瀛樺彇瀹冦備篃灝辨槸璇存病鏈夋搷浣滀唬鐮佹潵瀵誨潃 EIP錛屼互渚跨洿鎺ヨ鍙栨垨淇敼鍏跺唴瀹廣備絾鏄紝EIP 浠嶇劧榪樻槸鍙互閫氳繃闂存帴鏂規硶淇敼鐨勶紙騫朵笖闅忔椂鍙互淇敼錛夛紝閫氳繃JMP錛孋ALL鍜孯ET榪欎簺鎸囦護瀹炵幇銆備笅闈㈡垜浠氨閫氳繃渚嬪瓙鏉ヨВ閲婇氳繃 CALL/RET 瀛愪緥紼嬭皟鐢ㄦ満鍒跺湪32浣?Intel 鍜?AMD 澶勭悊鍣ㄤ笂鏄浣曞伐浣滅殑銆?
銆銆褰撲綘璋冪敤錛堥氳繃 CALL錛夋煇涓瓙渚嬬▼鏃訛紝瀛愪緥紼嬬殑鍦板潃琚姞杞藉埌 EIP錛屼絾鍗充究鏄湪 EIP鏉慨鏀逛箣鍓嶏紝鍏舵棫鐨勯偅涓艱鑷姩PUSH鍒板爢鏍堬紙琚敤浜庡悗闈綔涓烘寚浠ゆ寚閽堣繑鍥烇級銆傚湪瀛愪緥紼嬫墽琛屽畬鏃訛紝RET 鎸囦護鑷姩灝嗗爢鏍堥《POP鍒?EIP銆?br>銆銆鐜板湪浣犵煡閬撲簡濡備綍閫氳繃 CALL 鍜?RET 瀹炵幇 EIP 鐨勪慨鏀癸紝浣嗗浣曡幏鍙栧叾褰撳墠鐨勫煎憿錛熶笅闈㈠氨鏉ヨВ鍐寵繖涓棶棰橈紝鍓嶉潰璁茶繃錛孋ALL PUSH EIP 鍒板爢鏍堬紝鎵浠ワ紝涓轟簡鑾峰彇鍏跺綋鍓嶅鹼紝璋冪敤“鍝戝嚱鏁?#8221;錛岀劧鍚庡啀POP鍫嗘爤欏躲傝鎴戜滑鐢ㄧ紪璇戝悗鐨?NewProc 鏉ヨВ閲婅繖涓獚闂ㄣ?
Address OpCode/Params Decoded instruction
--------------------------------------------------
:00401000 55 push ebp ; entry point of
; NewProc
:00401001 8BEC mov ebp, esp
:00401003 51 push ecx
:00401004 E800000000 call 00401009 ; *a* call dummy
:00401009 59 pop ecx ; *b*
:0040100A 83E909 sub ecx, 00000009 ; *c*
:0040100D 894DFC mov [ebp-04], ecx ; mov pData, ECX
:00401010 8B45FC mov eax, [ebp-04]
:00401013 83E814 sub eax, 00000014 ; pData--;
.....
.....
:0040102D 8BE5 mov esp, ebp
:0040102F 5D pop ebp
:00401030 C21000 ret 0010
鏂規硶浜岋細
static LRESULT CALLBACK NewProc(
HWND hwnd, // 紿楀彛鍙ユ焺
UINT uMsg, // 娑堟伅鏍囩ず絎?
WPARAM wParam, // 絎竴涓秷鎭弬鏁?
LPARAM lParam ) // 絎簩涓秷鎭弬鏁?
{
INJDATA* pData = 0xA0B0C0D0; // 铏氭瀯鍊?
//-----------------------------
// 瀛愮被鍖栦唬鐮?
// ........
//-----------------------------
// 璋冪敤鍘熸潵鐨勭獥鍙h繃紼?
return pData->fnCallWindowProc( pData->fnOldProc,
hwnd,uMsg,wParam,lParam );
}
銆銆姝ゅ 0xA0B0C0D0 鍙槸榪滅▼榪涚▼鍦板潃絀洪棿涓湡瀹烇紙緇濆錛塈NJDATA鍦板潃鐨勫崰浣嶇銆傚墠闈㈣榪囷紝浣犳棤娉曞湪緙栬瘧鏃剁煡閬撹鍦板潃銆備絾浣犲彲浠ュ湪璋冪敤 VirtualAllocEx 錛堜負INJDATA錛変箣鍚庡緱鍒?INJDATA 鍦ㄨ繙紼嬭繘紼嬩腑鐨勪綅緗傜紪璇戞垜浠殑 NewProc 鍚庯紝鍙互寰楀埌濡備笅緇撴灉錛?
Address OpCode/Params Decoded instruction
--------------------------------------------------
:00401000 55 push ebp
:00401001 8BEC mov ebp, esp
:00401003 C745FCD0C0B0A0 mov [ebp-04], A0B0C0D0
:0040100A ...
....
:0040102D 8BE5 mov esp, ebp
:0040102F 5D pop ebp
:00401030 C21000 ret 0010
鍥犳錛屽叾緙栬瘧鐨勪唬鐮侊紙鍗佸叚榪涘埗錛夊皢鏄細
558BECC745FCD0C0B0A0......8BE55DC21000.
鐜板湪浣犲彲浠ヨ薄涓嬮潰榪欐牱緇х畫錛?
558BECC745FCD0C0B0A0......8BE55DC21000 <- 鍘熸潵鐨凬ewProc 錛堟敞1錛?
558BECC745FC00008A00......8BE55DC21000 <- 淇敼鍚庣殑NewProc錛屼嬌鐢ㄧ殑鏄疘NJDATA鐨勫疄闄呭湴鍧銆?/pre>
涔熷氨鏄錛屼綘鐢ㄧ湡姝g殑 INJDATA錛堟敞2錛?鍦板潃鏇夸唬浜嗚櫄鎷熷?A0B0C0D0錛堟敞2錛夈?
銆銆涓庡叾瀹冩柟娉曟瘮杈冿紝浣跨敤 CreateRemoteThread 鍜?WriteProcessMemory 鎶鏈繘琛屼唬鐮佹敞鍏ユ洿鐏墊椿錛岃繖縐嶆柟娉曚笉闇瑕侀澶栫殑 dll錛屼笉騫哥殑鏄紝璇ユ柟娉曟洿澶嶆潅騫朵笖椋庨櫓鏇村ぇ錛屽彧瑕乀hreadFunc鍑虹幇鍝曚竴涓佺偣閿欒錛屽緢瀹規槗灝辮錛堝茍涓旀渶澶у彲鑳藉湴浼氾級浣胯繙紼嬭繘紼嬪穿婧冿紙鍙傝闄勫綍 F錛夛紝鍥犱負璋冭瘯榪滅▼ ThreadFunc 灝嗘槸涓涓彲鎬曠殑姊﹂瓏錛屽彧鏈夊湪娉ㄥ叆鐨勬寚浠ゆ暟寰堝皯鏃訛紝浣犳墠搴旇鑰冭檻浣跨敤榪欑鎶鏈繘琛屾敞鍏ワ紝瀵逛簬澶у潡鐨勪唬鐮佹敞鍏ワ紝鏈濂界敤 I.鍜孖I 閮ㄥ垎璁ㄨ鐨勬柟娉曘?br>
WinSpy 浠ュ強 InjectEx 璇蜂粠榪欓噷涓嬭澆婧愪唬鐮?/font>銆?/p>
瑙e喅鏂規
OS
榪涚▼
I銆丠ooks
Win9x 鍜?WinNT
浠呬粎涓?USER32.DLL 錛堟敞3錛夐摼鎺ョ殑榪涚▼
II銆丆reateRemoteThread & LoadLibrary
浠?WinNT錛堟敞4錛?/td>
鎵鏈夎繘紼嬶紙娉?錛? 鍖呮嫭緋葷粺鏈嶅姟錛堟敞6錛?/td>
III銆丆reateRemoteThread & WriteProcessMemory
銆浠?WinNT
鎵鏈夎繘紼? 鍖呮嫭緋葷粺鏈嶅姟
鏈湴搴旂敤 錛坰mss.exe, os2ss.exe, autochk.exe 絳夛級涓嶄嬌鐢?Win32 API錛屾墍浠ヤ篃涓嶄細涓?kernel32.dll 閾炬帴銆傚敮涓涓涓緥澶栨槸 csrss.exe錛學in32 瀛愮郴緇熸湰韜紝瀹冩槸鏈湴搴旂敤紼嬪簭錛屼絾鍏舵煇浜涘簱錛垀winsrv.dll錛夐渶瑕?Win32 DLLs錛屽寘鎷?kernel32.dll錛?
銆銆鍥犱負鏈枃涓殑璁稿渚嬪瓙鏄叧浜庡瘑鐮佺殑錛屼綘涔熻榪樿榪?Zhefu Zhang 鍐欑殑鍙﹀涓綃囨枃绔?#8220;Super Password Spy++” 錛屽湪璇ユ枃涓紝浠栬В閲婁簡濡備綍鑾峰彇IE 瀵嗙爜妗嗕腑鐨勫唴瀹癸紝姝ゅ錛屼粬榪樼ず鑼冧簡濡備綍淇濇姢浣犵殑瀵嗙爜鎺т歡鍏嶅彈綾諱技鐨勬敾鍑匯?/p>
銆銆鎴戠殑鍋囧畾錛氬洜涓篗icrosoft 鐨勭▼搴忓憳璁や負榪欐牱鍋氭湁鍔╀簬閫熷害浼樺寲錛屼負浠涔堝憿錛熸垜鐨勮В閲婃槸鈥斺旈氬父涓涓彲鎵ц紼嬪簭鏄敱鍑犱釜閮ㄥ垎緇勬垚錛屽叾涓寘鎷?#8220;.reloc” 銆傚綋閾炬帴鍣ㄥ垱寤?EXE 鎴栬?DLL鏂囦歡鏃訛紝瀹冨鏂囦歡琚槧灝勫埌鍝釜鍐呭瓨鍦板潃鍋氫簡涓涓亣璁俱傝繖灝辨槸鎵璋撶殑棣栭夊姞杞?鍩哄湴鍧銆傚湪鏄犲儚鏂囦歡涓墍鏈夌粷瀵瑰湴鍧閮芥槸鍩轟簬閾炬帴鍣ㄩ閫夌殑鍔犺澆鍦板潃錛屽鏋滅敱浜庢煇縐嶅師鍥狅紝鏄犲儚鏂囦歡娌℃湁琚姞杞藉埌璇ュ湴鍧錛岄偅涔堣繖鏃?#8220;.reloc”灝辮搗浣滅敤浜嗭紝瀹冨寘鍚槧鍍忔枃浠朵腑鐨勬墍鏈夊湴鍧鐨勬竻鍗曪紝榪欎釜娓呭崟涓殑鍦板潃鍙嶆槧浜嗛摼鎺ュ櫒棣栭夊姞杞藉湴鍧鍜屽疄闄呭姞杞藉湴鍧鐨勫樊鍒紙鏃犺濡備綍錛岃娉ㄦ剰緙栬瘧鍣ㄤ駭鐢熺殑澶у鏁版寚浠や嬌鐢ㄦ煇縐嶇浉瀵瑰湴鍧瀵誨潃錛屽洜姝わ紝騫舵病鏈変綘鎯寵薄鐨勯偅涔堝鍦板潃鍙緵閲嶆柊鍒嗛厤錛夛紝鍙︿竴鏂歸潰錛屽鏋滃姞杞藉櫒鑳藉鎸夌収閾炬帴鍣ㄩ閫夊湴鍧鍔犺澆鏄犲儚鏂囦歡錛岄偅涔?#8220;.reloc”灝辮瀹屽叏蹇界暐鎺変簡銆?br>銆銆浣唊ernel32.dll 鍜寀ser32.dll 鍙婂叾鍔犺澆鍦板潃涓轟綍瑕佷互榪欑鏂瑰紡鍔犺澆鍛紵鍥犱負姣忎竴涓?Win32 紼嬪簭閮介渶瑕乲ernel32.dll錛屽茍涓斿ぇ澶氭暟Win32 紼嬪簭涔熼渶瑕?user32.dll錛岄偅涔堟繪槸灝嗗畠浠紙kernel32.dll 鍜寀ser32.dll錛夋槧灝勫埌棣栭夊湴鍧鍙互鏀硅繘鎵鏈夊彲鎵ц紼嬪簭鐨勫姞杞芥椂闂淬傝繖鏍蜂竴鏉ワ紝鍔犺澆鍣ㄧ粷涓嶈兘淇敼kernel32.dll and user32.dll.涓殑浠諱綍錛堢粷瀵癸級鍦板潃銆傛垜浠敤涓嬮潰鐨勪緥瀛愭潵璇存槑錛?br>銆銆灝嗘煇涓簲鐢ㄧ▼搴?App.exe 鐨勬槧鍍忓熀鍦板潃璁劇疆鎴?KERNEL32鐨勫湴鍧錛?base:"0x77e80000"錛夋垨 USER32鐨勯閫夊熀鍦板潃錛?base:"0x77e10000"錛夛紝濡傛灉 App.exe 涓嶆槸浠?USER32 瀵煎叆鏂瑰紡鏉ヤ嬌鐢?USER32錛岃屾槸閫氳繃LoadLibrary 鍔犺澆錛岄偅涔堢紪璇戝茍榪愯App.exe 鍚庯紝浼氭姤鍑洪敊璇俊鎭紙"Illegal System DLL Relocation"鈥斺旈潪娉曠郴緇烡LL鍦板潃閲嶅垎閰嶏級錛孉pp.exe 鍔犺澆澶辮觸銆?br>涓轟粈涔堜細榪欐牱鍛紵褰撳垱寤鴻繘紼嬫椂錛學in 2000銆乄in XP 鍜學in 2003緋葷粺鐨勫姞杞藉櫒瑕佹鏌?kernel32.dll 鍜寀ser32.dll 鏄惁琚槧灝勫埌棣栭夊熀鍦板潃錛堝疄闄呬笂錛屽畠浠殑鍚嶅瓧閮借紜紪鐮佽繘浜嗗姞杞藉櫒錛夛紝濡傛灉娌℃湁琚姞杞藉埌棣栭夊熀鍦板潃錛屽皢鍙戝嚭閿欒銆傚湪 WinNT4涓紝涔熶細媯鏌le32.dll錛屽湪WinNT 3.51 鍜岃緝浣庣増鏈殑Windows涓紝鐢變簬涓嶄細鍋氳繖鏍風殑媯鏌ワ紝鎵浠ernel32.dll 鍜寀ser32.dll鍙互琚姞杞戒換浣曞湴鏂廣傚彧鏈塶tdll.dll鎬繪槸琚姞杞藉埌鍏跺熀鍦板潃錛屽姞杞藉櫒涓嶈繘琛屾鏌ワ紝涓鏃tdll.dll娌℃湁鍦ㄥ叾鍩哄湴鍧錛岃繘紼嬪氨鏃犳硶鍒涘緩銆?br>
鎬諱箣錛屽浜?WinNT 4 鍜岃緝楂樼殑鐗堟湰涓?/p>
const int cbCodeSize = ((LPBYTE) AfterThreadFunc - (LPBYTE) ThreadFunc)
銆銆浣犲疄闄呬笂璁$畻鐨勬槸鎸囧悜 ThreadFunc 鐨凧MPs 鍜孉fterThreadFunc涔嬮棿鐨?#8220;璺濈” 錛堥氬父瀹冧滑浼氱揣鎸ㄧ潃錛屼笉鐢ㄨ冭檻璺濈闂錛夈傜幇鍦ㄥ亣璁?ThreadFunc 鐨勫湴鍧浣嶄簬004014C0 鑰屼即闅忕殑 JMP鎸囦護浣嶄簬 00401020銆?
:00401020 jmp 004014C0
...
:004014C0 push EBP ; ThreadFunc 鐨勫疄闄呭湴鍧
:004014C1 mov EBP, ESP
...
閭d箞
WriteProcessMemory( .., &ThreadFunc, cbCodeSize, ..);
銆銆灝嗘嫹璐?#8220;JMP 004014C0”鎸囦護錛堜互鍙婇殢鍚巆bCodeSize鑼冨洿鍐呯殑鎵鏈夋寚浠わ級鍒拌繙紼嬭繘紼嬧斺斾笉鏄疄闄呯殑 ThreadFunc銆傝繙紼嬭繘紼嬭鎵ц鐨勭涓浠朵簨鎯呭皢鏄?#8220;JMP 004014C0” 銆傚畠灝嗕細鍦ㄥ叾鏈鍚庡嚑鏉℃寚浠ゅ綋涓斺旇繙紼嬭繘紼嬪拰鎵鏈夎繘紼嬪潎濡傛銆備絾 JMP鎸囦護鐨勮繖涓?#8220;瑙勫垯”涔熸湁渚嬪銆傚鏋滄煇涓嚱鏁拌澹版槑涓洪潤鎬佺殑錛屽畠灝嗕細琚洿鎺ヨ皟鐢紝鍗充嬌澧為噺閾炬帴涔熸槸濡傛銆傝繖灝辨槸涓轟粈涔堣鍒?4瑕佸皢 ThreadFunc 鍜?AfterThreadFunc 澹版槑涓洪潤鎬佹垨紱佺敤澧為噺閾炬帴鐨勭紭鏁呫傦紙鏈夊叧澧為噺閾炬帴鐨勫叾瀹冧俊鎭弬瑙?Matt Pietrek鐨勬枃绔?#8220;Remove Fatty Deposits from Your Applications Using Our 32-bit Liposuction Tools” 錛?
void Dummy(void) {
BYTE var[256];
var[0] = 0;
var[1] = 1;
var[255] = 255;
}
緙栬瘧鍚庣殑姹囩紪濡備笅錛?
:00401000 push ebp
:00401001 mov ebp, esp
:00401003 sub esp, 00000100 ; change ESP as storage for
; local variables is needed
:00401006 mov byte ptr [esp], 00 ; var[0] = 0;
:0040100A mov byte ptr [esp+01], 01 ; var[1] = 1;
:0040100F mov byte ptr [esp+FF], FF ; var[255] = 255;
:00401017 mov esp, ebp ; restore stack pointer
:00401019 pop ebp
:0040101A ret
銆銆娉ㄦ剰涓婅堪渚嬪瓙涓紝鍫嗘爤鎸囬拡鏄浣曡淇敼鐨勶紵鑰屽鏋滄煇涓嚱鏁伴渶瑕?KB浠ヤ笂灞閮ㄥ彉閲忓唴瀛樼┖闂村張浼氭庝箞鏍峰憿錛熷叾瀹烇紝鍫嗘爤鎸囬拡騫朵笉鏄鐩存帴淇敼錛岃屾槸閫氳繃鍙︿竴涓嚱鏁拌皟鐢ㄦ潵淇敼鐨勩傚氨鏄繖涓澶栫殑鍑芥暟璋冪敤浣垮緱鎴戜滑鐨?ThreadFunc “琚牬鍧?#8221;浜嗭紝鍥犱負鍏惰繙紼嬫嫹璐濅細璋冪敤涓涓笉瀛樺湪鐨勪笢瑗褲?br>銆銆鎴戜滑鐪嬬湅鏂囨。涓鍫嗘爤鎺㈡祴鍜?/Gs緙栬瘧鍣ㄩ夐」鏄庝箞璇寸殑錛?br>鈥斺?#8220;/GS鏄竴涓帶鍒跺爢鏍堟帰嫻嬬殑楂樼駭鐗規э紝鍫嗘爤鎺㈡祴鏄竴緋誨垪緙栬瘧鍣ㄦ彃鍏ュ埌姣忎釜鍑芥暟璋冪敤鐨勪唬鐮併傚綋鍑芥暟琚縺媧繪椂錛屽爢鏍堟帰嫻嬮渶瑕佺殑鍐呭瓨絀洪棿鏉ュ瓨鍌ㄧ浉鍏沖嚱鏁扮殑灞閮ㄥ彉閲忋?br>銆銆濡傛灉鍑芥暟闇瑕佺殑絀洪棿澶т簬涓哄眬閮ㄥ彉閲忓垎閰嶇殑鍫嗘爤絀洪棿錛屽叾鍫嗘爤鎺㈡祴琚縺媧匯傞粯璁ょ殑澶у皬鏄竴涓〉闈紙鍦?0x86澶勭悊鍣ㄤ笂4kb錛夈傝繖涓煎厑璁稿湪Win32 搴旂敤紼嬪簭鍜學indows NT铏氭嫙鍐呭瓨綆$悊鍣ㄤ箣闂磋繘琛岃皚鎱庤皟鏁翠互渚垮鍔犺繍琛屾椂鎵胯緇欑▼搴忓爢鏍堢殑鍐呭瓨銆?#8221;
鎴戠‘淇℃湁浜轟細闂細鏂囨。涓殑“……鍫嗘爤鎺㈡祴鍒頒竴鍧楅渶瑕佺殑鍐呭瓨絀洪棿鏉ュ瓨鍌ㄧ浉鍏沖嚱鏁扮殑灞閮ㄥ彉閲?#8230;…”閭d簺緙栬瘧鍣ㄩ夐」錛堝畠浠殑鎻忚堪錛夊湪浣犲畬鍏ㄥ紕鏄庣櫧涔嬪墠鏈夋椂鐪熺殑璁╀漢姘旀劋銆備緥濡傦紝濡傛灉鏌愪釜鍑芥暟闇瑕?2KB鐨勫眬閮ㄥ彉閲忓瓨鍌ㄧ┖闂達紝鍫嗘爤鍐呭瓨灝嗚繘琛屽涓嬫柟寮忕殑鍒嗛厤錛堟洿綺劇‘鍦拌鏄?#8220;鎵胯” 錛夈?
sub esp, 0x1000 ; "鍒嗛厤" 絎竴嬈?4 Kb
test [esp], eax ; 鎵胯涓涓柊欏靛唴瀛橈紙濡傛灉榪樻病鏈夋壙璇猴級
sub esp, 0x1000 ; "鍒嗛厤" 絎簩嬈? Kb
test [esp], eax ; ...
sub esp, 0x1000
test [esp], eax
銆銆娉ㄦ剰4KB鍫嗘爤鎸囬拡鏄浣曡淇敼鐨勶紝鏇撮噸瑕佺殑鏄紝姣忎竴姝ヤ箣鍚庡爢鏍堝簳鏄浣曡“瑙﹀強”錛堣緇忚繃媯鏌ワ級銆傝繖鏍蜂繚璇佸湪“鍒嗛厤”錛堟壙璇猴級鍙︿竴欏甸潰涔嬪墠錛屽綋鍓嶉〉闈㈡壙璇虹殑鑼冨洿涔熷寘鍚爢鏍堝簳銆?
銆銆“姣忎竴涓嚎紼嬪埌杈懼叾鑷繁鐨勫爢鏍堢┖闂達紝榛樿鎯呭喌涓嬶紝姝ょ┖闂寸敱鎵胯鐨勪互鍙婇鐣欑殑鍐呭瓨緇勬垚錛屾瘡涓嚎紼嬩嬌鐢?1 MB棰勭暀鐨勫唴瀛橈紝浠ュ強涓欏墊壙璇虹殑鍐呭瓨錛岀郴緇熷皢鏍規嵁闇瑕佷粠棰勭暀鐨勫爢鏍堝唴瀛樹腑鎵胯涓欏靛唴瀛樺尯鍩?#8221; 錛堝弬瑙?MSDN CreateThread > dwStackSize > Thread Stack Size錛?br>銆銆榪樺簲璇ユ竻妤氫負浠涔堟湁鍏熾/GS 鐨勬枃。璇村湪鍫嗘爤鎺㈤拡鍦 Win32 搴旂敤紼嬪簭鍜學indows NT铏氭嫙鍐呭瓨綆$悊鍣ㄤ箣闂磋繘琛岃皚鎱庤皟鏁淬?br>
鐜板湪鍥炲埌鎴戜滑鐨凾hreadFunc浠ュ強 4KB 闄愬埗
銆銆铏界劧浣犲彲浠ョ敤 /Gs 闃叉璋冪敤鍫嗘爤鎺㈡祴渚嬬▼錛屼絾鍦ㄦ枃妗e浜庤繖鏍風殑鍋氭硶緇欏嚭浜嗚鍛婏紝姝ゅ錛屾枃浠舵弿榪板彲浠ョ敤 #pragma check_stack 鎸囦護鍏抽棴鎴栨墦寮鍫嗘爤鎺㈡祴銆備絾鏄繖涓寚浠ゅソ鍍忎竴鐐逛綔鐢ㄩ兘娌℃湁錛堣涔堣繖涓枃妗f槸鍨冨溇錛岃涔堟垜鐤忓拷浜嗗叾瀹冧竴浜涗俊鎭紵錛夈傛諱箣錛孋reateRemoteThread 鍜?WriteProcessMemory 鎶鏈彧鑳界敤浜庢敞鍏ュ皬鍧椾唬鐮侊紝鎵浠ヤ綘鐨勫眬閮ㄥ彉閲忓簲璇ュ敖閲忓皯鑰楄垂涓浜涘唴瀛樺瓧鑺傦紝鏈濂戒笉瑕佽秴榪?4KB闄愬埗銆?/p>
闄勫綍E錛?
int Dummy( int arg1 )
{
int ret =0;
switch( arg1 ) {
case 1: ret = 1; break;
case 2: ret = 2; break;
case 3: ret = 3; break;
case 4: ret = 0xA0B0; break;
}
return ret;
}
緙栬瘧鍚庡彉鎴愪笅闈㈣繖涓牱瀛愶細
鍦板潃 鎿嶄綔鐮?鍙傛暟 瑙i噴鍚庣殑鎸囦護
--------------------------------------------------
; arg1 -> ECX
:00401000 8B4C2404 mov ecx, dword ptr [esp+04]
:00401004 33C0 xor eax, eax ; EAX = 0
:00401006 49 dec ecx ; ECX --
:00401007 83F903 cmp ecx, 00000003
:0040100A 771E ja 0040102A
; JMP 鍒拌〃***涓殑鍦板潃涔嬩竴
; 娉ㄦ剰 ECX 鍖呭惈鐨勫亸縐?
:0040100C FF248D2C104000 jmp dword ptr [4*ecx+0040102C]
:00401013 B801000000 mov eax, 00000001 ; case 1: eax = 1;
:00401018 C3 ret
:00401019 B802000000 mov eax, 00000002 ; case 2: eax = 2;
:0040101E C3 ret
:0040101F B803000000 mov eax, 00000003 ; case 3: eax = 3;
:00401024 C3 ret
:00401025 B8B0A00000 mov eax, 0000A0B0 ; case 4: eax = 0xA0B0;
:0040102A C3 ret
:0040102B 90 nop
; 鍦板潃琛?**
:0040102C 13104000 DWORD 00401013 ; jump to case 1
:00401030 19104000 DWORD 00401019 ; jump to case 2
:00401034 1F104000 DWORD 0040101F ; jump to case 3
:00401038 25104000 DWORD 00401025 ; jump to case 4
娉ㄦ剰濡備綍瀹炵幇榪欎釜寮鍏寵鍙ワ紵
銆銆涓庡叾鍗曠嫭媯鏌ユ瘡涓狢ASE璇彞錛屼笉濡傚垱寤轟竴涓湴鍧琛紝鐒跺悗閫氳繃綆鍗曞湴璁$畻鍦板潃琛ㄧ殑鍋忕Щ閲忚岃煩杞埌姝g‘鐨凜ASE璇彞銆傝繖瀹為檯涓婃槸涓縐嶆敼榪涖傚亣璁句綘鏈?0涓狢ASE璇彞銆傚鏋滀笉浣跨敤涓婅堪鐨勬妧宸э紝浣犲緱鎵ц50嬈?CMP鍜孞MP鎸囦護鏉ヨ揪鍒版渶鍚庝竴涓狢ASE銆傜浉鍙嶏紝鏈変簡鍦板潃琛ㄥ悗錛屼綘鍙互閫氳繃琛ㄦ煡璇㈣煩杞埌浠諱綍CASE璇彞錛屼粠璁$畻鏈虹畻娉曡搴﹀拰鏃墮棿澶嶆潅搴︾湅錛屾垜浠敤O(5)浠f浛浜哋(2n)綆楁硶銆傚叾涓細
鎿嶄綔鐮併鎸囦護 銆銆銆銆鎻忚堪
FF /4 銆JMP r/m32 銆Jump near, absolute indirect,
銆銆銆銆銆銆銆銆銆銆銆address given in r/m32
:004014C0 push EBP ; ThreadFunc 鐨勫叆鍙g偣
:004014C1 mov EBP, ESP
...
:004014C5 call 0041550 ; 榪欓噷灝嗕嬌榪滅▼榪涚▼宕╂簝
...
:00401502 ret
濡傛灉 CALL 鏄敱緙栬瘧鍣ㄦ坊鍔犵殑鎸囦護錛堝洜涓烘煇浜?#8220;紱佸繉” 寮鍏沖/GZ鏄墦寮鐨勶級錛屽畠灝嗚瀹氫綅鍦?ThreadFunc 鐨勫紑濮嬬殑鏌愪釜鍦版柟鎴栬呯粨灝懼銆?
]]>
鍏堣В閲婁竴涓嬭繙紼嬭繘紼嬶紝鍏跺疄灝辨槸瑕佹鍏ヤ綘鐨勪唬鐮佺殑榪涚▼錛岀浉瀵逛簬浣犵殑宸ヤ綔榪涚▼錛堝鏋滃彨鏈湴榪涚▼鐨勮瘽錛夊畠灝卞彨榪滅▼榪涚▼錛屽彲鐞嗚В涓哄涓匯?/p>
棣栧厛浠嬬粛涓涓嬫垜浠殑涓昏宸ュ叿CreateRemoteThread錛岃繖閲屽厛灝嗗嚱鏁板師鍨嬬畝鍗曚粙緇嶄互涓嬨?/p>
CreateRemoteThread鍙皢綰跨▼鍒涘緩鍦ㄨ繙紼嬭繘紼嬩腑銆?/p>
鍑芥暟鍘熷瀷
HANDLE CreateRemoteThread(
HANDLE hProcess, // handle to process
LPSECURITY_ATTRIBUTES lpThreadAttributes, // SD
SIZE_T dwStackSize, // initial stack size
LPTHREAD_START_ROUTINE lpStartAddress, // thread function
LPVOID lpParameter, // thread argument
DWORD dwCreationFlags, // creation option
LPDWORD lpThreadId // thread identifier
);
鍙傛暟璇存槑錛?br>hProcess
[杈撳叆] 榪涚▼鍙ユ焺
lpThreadAttributes
[杈撳叆] 綰跨▼瀹夊叏鎻忚堪瀛楋紝鎸囧悜SECURITY_ATTRIBUTES緇撴瀯鐨勬寚閽?br>dwStackSize
[杈撳叆] 綰跨▼鏍堝ぇ灝忥紝浠ュ瓧鑺傝〃紺?br>lpStartAddress
[杈撳叆] 涓涓狶PTHREAD_START_ROUTINE綾誨瀷鐨勬寚閽堬紝鎸囧悜鍦ㄨ繙紼嬭繘紼嬩腑鎵ц鐨勫嚱鏁板湴鍧
lpParameter
[杈撳叆] 浼犲叆鍙傛暟
dwCreationFlags
[杈撳叆] 鍒涘緩綰跨▼鐨勫叾瀹冩爣蹇?/p>
lpThreadId
[杈撳嚭] 綰跨▼韜喚鏍囧織錛屽鏋滀負NULL,鍒欎笉榪斿洖
榪斿洖鍊?br>鎴愬姛榪斿洖鏂扮嚎紼嬪彞鏌勶紝澶辮觸榪斿洖NULL錛屽茍涓斿彲璋冪敤GetLastError鑾峰緱閿欒鍊箋?/p>
鎺ヤ笅鏉ユ垜浠皢浠ヤ袱縐嶆柟寮忎嬌鐢–reateRemoteThread錛屽ぇ瀹跺彲浠ラ鐣ュ埌CreateRemoteThread鐨勭閫氾紝瀹冧嬌浣犵殑浠g爜鍙互鑴辯浣犵殑榪涚▼錛屾鍏ュ埌鍒殑榪涚▼涓繍琛屻?/p>
絎竴縐嶆柟寮?
絎竴縐嶆柟寮忥紝鎴戜滑浣跨敤鍑芥暟鐨勫艦寮忋傚嵆鎴戜滑灝嗚嚜宸辯▼搴忎腑鐨勪竴涓嚱鏁版鍏ュ埌榪滅▼榪涚▼涓?/p>
姝ラ1錛氶鍏堝湪浣犵殑榪涚▼涓垱寤哄嚱鏁癕yFunc錛屾垜浠皢鎶婂畠鏀懼湪鍙︿竴涓繘紼嬩腑榪愯錛岃繖閲屼互windows
璁$畻鍣ㄤ負鐩爣榪涚▼銆?br>static DWORD WINAPI MyFunc (LPVOID pData)
{
//do something
//...
//pData杈撳叆欏瑰彲浠ユ槸浠諱綍綾誨瀷鍊?br>//榪欓噷鎴戜滑浼氫紶鍏ヤ竴涓狣WORD鐨勫煎仛紺轟緥錛屽茍涓旂畝鍗曡繑鍥?br>return *(DWORD*)pData;
}
static void AfterMyFunc (void) {
}
榪欓噷鏈変釜灝忔妧宸э紝瀹氫箟浜嗕竴涓猻tatic void AfterMyFunc (void)錛涗負浜嗕笅闈㈢‘瀹氭垜浠殑浠g爜澶у皬
姝ラ2錛氬畾浣嶇洰鏍囪繘紼嬶紝榪欓噷鏄竴涓綆楀櫒
HWND hStart = ::FindWindow (TEXT("SciCalc"),NULL);
姝ラ3錛氳幏寰楃洰鏍囪繘紼嬪彞鏌勶紝榪欓噷鐢ㄥ埌涓や釜涓嶅お甯哥敤鐨勫嚱鏁幫紙褰撶劧濡傛灉緇忓父鍋氱嚎紼?榪涚▼絳夋柟闈㈢殑 欏圭洰鐨勮瘽錛屽氨寰堥潰鐔熶簡錛夛紝浣嗗強鏈夌敤
DWORD PID, TID;
TID = ::GetWindowThreadProcessId (hStart, &PID);
HANDLE hProcess;
hProcess = OpenProcess(PROCESS_ALL_ACCESS,false,PID);
姝ラ4錛氬湪鐩爣榪涚▼涓厤鍙橀噺鍦板潃絀洪棿錛岃繖閲屾垜浠垎閰?0涓瓧鑺傦紝騫朵笖璁懼畾涓哄彲浠ヨ
鍐橮AGE_READWRITE錛屽綋鐒朵篃鍙涓哄彧璇葷瓑鍏跺畠鏍囧織錛岃繖閲屽氨涓嶄竴涓璇存槑浜嗐?br>char szBuffer[10];
*(DWORD*)szBuffer=1000;//for test
void *pDataRemote =(char*) VirtualAllocEx( hProcess, 0, sizeof(szBuffer), MEM_COMMIT,
PAGE_READWRITE );
姝ラ5錛氬啓鍐呭鍒扮洰鏍囪繘紼嬩腑鍒嗛厤鐨勫彉閲忕┖闂?br>::WriteProcessMemory( hProcess, pDataRemote, szBuffer,(sizeof(szBuffer),NULL);
姝ラ6錛氬湪鐩爣榪涚▼涓垎閰嶄唬鐮佸湴鍧絀洪棿
璁$畻浠g爜澶у皬
DWORD cbCodeSize=((LPBYTE) AfterMyFunc - (LPBYTE) MyFunc);
鍒嗛厤浠g爜鍦板潃絀洪棿
PDWORD pCodeRemote = (PDWORD) VirtualAllocEx( hProcess, 0, cbCodeSize, MEM_COMMIT,
PAGE_EXECUTE_READWRITE );
姝ラ7錛氬啓鍐呭鍒扮洰鏍囪繘紼嬩腑鍒嗛厤鐨勪唬鐮佸湴鍧絀洪棿
WriteProcessMemory( hProcess, pCodeRemote, &MyFunc, cbCodeSize, NULL);
姝ラ8錛氬湪鐩爣榪涚▼涓墽琛屼唬鐮?/p>
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0,
(LPTHREAD_START_ROUTINE) pCodeRemote,
pDataRemote, 0 , NULL);
DWORD h;
if (hThread)
{
::WaitForSingleObject( hThread, INFINITE );
::GetExitCodeThread( hThread, &h );
TRACE("run and return %d\n",h);
::CloseHandle( hThread );
}
榪欓噷鏈夊嚑涓煎緱璇存槑鐨勫湴鏂?
浣跨敤WaitForSingleObject絳夊緟綰跨▼緇撴潫;
浣跨敤GetExitCodeThread鑾峰緱榪斿洖鍊鹼紱
鏈鍚庡叧闂彞鏌凜loseHandle銆?/p>
姝ラ9錛氭竻鐞嗙幇鍦?/p>
閲婃斁絀洪棿
::VirtualFreeEx( hProcess, pCodeRemote,
cbCodeSize,MEM_RELEASE );
::VirtualFreeEx( hProcess, pDataRemote,
cbParamSize,MEM_RELEASE );
鍏抽棴榪涚▼鍙ユ焺
::CloseHandle( hProcess );
絎簩縐嶆柟寮?
絎簩縐嶆柟寮忥紝鎴戜滑浣跨敤鍔ㄦ佸簱鐨勫艦寮忋傚嵆鎴戜滑灝嗚嚜宸變竴涓姩鎬佸簱妞嶅叆鍒拌繙紼嬭繘紼嬩腑銆?/p>
榪欓噷涓嶅啀閲嶅涓婇潰鐩稿悓鐨勬楠?鍙啓鍑哄叾涓叧閿殑鍦版柟.
鍏抽敭1:
鍦ㄦ楠?涓皢鍔ㄦ佸簱鐨勮礬寰勪綔涓哄彉閲忎紶鍏ュ彉閲忕┖闂?
鍏抽敭2:
鍦ㄦ楠?涓?灝咷etProcAddress浣滀負鐩爣鎵ц鍑芥暟.
hThread = ::CreateRemoteThread( hProcess, NULL, 0,
(LPTHREAD_START_ROUTINE )::GetProcAddress(
hModule, "LoadLibraryA"),
pDataRemote, 0, NULL );
鍙﹀鍦ㄦ楠?,娓呯悊鐜板満涓鍏堣鍏堣繘琛岄噴鏀炬垜浠殑鍔ㄦ佸簱.涔熷嵆綾諱技姝ラ8鎵ц鍑芥暟FreeLibrary
hThread = ::CreateRemoteThread( hProcess, NULL, 0,
(LPTHREAD_START_ROUTINE )::GetProcAddress(
hModule, "FreeLibrary"),
(void*)hLibModule, 0, NULL );
濂戒簡,闄愪簬綃囧箙涓嶈兘澶熶粙緇嶇殑寰堢粏,鍦ㄤ嬌鐢ㄨ繃紼嬩腑濡傛湁鐤戦棶鍙悜浣滆呭挩璇?錛堝紑鍙戠幆澧冿細windows2000/vc6.0錛?
鏈枃鏉ヨ嚜CSDN鍗氬錛岃漿杞借鏍囨槑鍑哄錛?a >http://blog.csdn.net/fangchao918628/archive/2008/08/30/2852744.aspx
鍦ㄤ富鏂囦歡涓紝鐢?pragma data_seg寤虹珛涓
涓柊鐨勬暟鎹騫跺畾涔夊叡浜暟鎹紝鍏跺叿浣撴牸寮忎負錛?
#pragma data_seg 錛?shareddata") //鍚嶇О鍙互
//鑷繁瀹氫箟錛屼絾蹇呴』涓庝笅闈㈢殑涓鑷淬?
HWND sharedwnd=NULL;//鍏變韓鏁版嵁
#pragma data_seg()
浠呭畾涔変竴涓暟鎹榪樹笉鑳借揪鍒板叡浜暟鎹殑鐩殑錛岃繕瑕佸憡璇夌紪璇戝櫒璇ユ鐨勫睘鎬э紝鏈変袱縐嶆柟娉曞彲浠ュ疄鐜拌鐩殑 錛堝叾鏁堟灉鏄浉鍚岀殑錛夛紝涓縐嶆柟娉曟槸鍦?DEF鏂囦歡涓姞鍏ュ涓嬭鍙ワ細 SETCTIONS shareddata READ WRITE SHARED 鍙︿竴縐嶆柟娉曟槸鍦ㄩ」鐩緗摼鎺ラ夐」(Project Setting --銆塋ink)涓姞鍏ュ涓嬭鍙ワ細 /SECTION:shareddata,rws
絎竴鐐癸細浠涔堟槸鍏變韓鏁版嵁孌碉紵涓轟粈涔堣鐢ㄥ叡浜暟鎹錛燂紵瀹冩湁浠涔堢敤閫旓紵錛?
鍦╓in16鐜涓紝DLL鐨勫叏灞鏁版嵁瀵規瘡涓澆鍏ュ畠鐨勮繘紼嬫潵璇撮兘鏄浉鍚岀殑錛涜屽湪Win32鐜涓紝鎯呭喌鍗村彂鐢熶簡鍙樺寲錛孌LL鍑芥暟涓殑浠g爜鎵鍒涘緩鐨勪換浣曞璞★紙鍖呮嫭鍙橀噺錛夐兘褰掕皟鐢ㄥ畠鐨勭嚎紼嬫垨榪涚▼鎵鏈夈傚綋榪涚▼鍦ㄨ澆鍏LL鏃訛紝鎿嶄綔緋葷粺鑷姩鎶奃LL鍦板潃鏄犲皠鍒拌榪涚▼鐨勭鏈夌┖闂達紝涔熷氨鏄繘紼嬬殑铏氭嫙鍦板潃絀洪棿錛岃屼笖涔熷鍒惰DLL鐨勫叏灞鏁版嵁鐨勪竴浠芥嫹璐濆埌璇ヨ繘紼嬬┖闂淬備篃灝辨槸璇存瘡涓繘紼嬫墍鎷ユ湁鐨勭浉鍚岀殑DLL鐨勫叏灞鏁版嵁錛屽畠浠殑鍚嶇О鐩稿悓錛屼絾鍏跺煎嵈騫朵笉涓瀹氭槸鐩稿悓鐨勶紝鑰屼笖鏄簰涓嶅共娑夌殑銆?
鍥犳錛屽湪Win32鐜涓嬭鎯沖湪澶氫釜榪涚▼涓叡浜暟鎹紝灝卞繀欏昏繘琛屽繀瑕佺殑璁劇疆銆傚湪璁塊棶鍚屼竴涓狣ll鐨勫悇榪涚▼涔嬮棿鍏變韓瀛樺偍鍣ㄦ槸閫氳繃瀛樺偍鍣ㄦ槧灝勬枃浠舵妧鏈疄鐜扮殑銆備篃鍙互鎶婅繖浜涢渶瑕佸叡浜殑鏁版嵁鍒嗙鍑烘潵錛屾斁緗湪涓涓嫭绔嬬殑鏁版嵁孌甸噷錛屽茍鎶婅孌電殑灞炴ц緗負鍏變韓銆傚繀欏葷粰榪欎簺鍙橀噺璧嬪垵鍊鹼紝鍚﹀垯緙栬瘧鍣ㄤ細鎶婃病鏈夎祴鍒濆鍊肩殑鍙橀噺鏀懼湪涓涓彨鏈鍒濆鍖栫殑鏁版嵁孌典腑銆?
#pragma data_seg棰勫鐞嗘寚浠ょ敤浜庤緗叡浜暟鎹銆備緥濡傦細
#pragma data_seg("SharedDataName") HHOOK hHook=NULL; //蹇呴』鍦ㄥ畾涔夌殑鍚屾椂榪涜鍒濆鍖?!!!#pragma data_seg()
鍦?pragma data_seg("SharedDataName")鍜?pragma data_seg()涔嬮棿鐨勬墍鏈夊彉閲忓皢琚闂Dll鐨勬墍鏈夎繘紼嬬湅鍒板拰鍏變韓銆傚啀鍔犱笂涓鏉℃寚浠?pragma comment(linker,"/section:.SharedDataName,rws"),[娉ㄦ剰錛氭暟鎹妭鐨勫悕縐癷s case sensitive]閭d箞榪欎釜鏁版嵁鑺備腑鐨勬暟鎹彲浠ュ湪鎵鏈塂LL鐨勫疄渚嬩箣闂村叡浜傛墍鏈夊榪欎簺鏁版嵁鐨勬搷浣滈兘閽堝鍚屼竴涓疄渚嬬殑錛岃屼笉鏄湪姣忎釜榪涚▼鐨勫湴鍧絀洪棿涓兘鏈変竴浠姐?
褰撹繘紼嬮殣寮忔垨鏄懼紡璋冪敤涓涓姩鎬佸簱閲岀殑鍑芥暟鏃訛紝緋葷粺閮借鎶婅繖涓姩鎬佸簱鏄犲皠鍒拌繖涓繘紼嬬殑铏氭嫙鍦板潃絀洪棿閲?浠ヤ笅綆縐?鍦板潃絀洪棿")銆傝繖浣垮緱DLL鎴愪負榪涚▼鐨勪竴閮ㄥ垎錛屼互榪欎釜榪涚▼鐨勮韓浠芥墽琛岋紝浣跨敤榪欎釜榪涚▼鐨勫爢鏍堛?榪欓」鎶鏈張鍙玞ode Injection鎶鏈紝琚箍娉涘湴搴旂敤鍦ㄤ簡鐥呮瘨銆侀粦瀹㈤鍩燂紒鍛靛懙^_^)
絎簩鐐癸細鍦ㄥ叿浣撲嬌鐢ㄥ叡浜暟鎹鏃墮渶瑕佹敞鎰忕殑涓浜涢棶棰橈紒
Win32 DLLs are mapped into the address space of the calling process. By default, each process using a DLL has its own instance of all the DLLs global and static variables. (娉ㄦ剰: 鍗充嬌鏄叏灞鍙橀噺鍜岄潤鎬佸彉閲忎篃閮戒笉鏄叡浜殑!) If your DLL needs to share data with other instances of it loaded by other applications, you can use either of the following approaches:
· Create named data sections using the data_seg pragma.
· Use memory mapped files. See the Win32 documentation about memory mapped files.
Here is an example of using the data_seg pragma:
#pragma data_seg (".myseg")
int i = 0;
char a[32] = "hello world";
#pragma data_seg()
data_seg can be used to create a new named section (.myseg in this example). The most typical usage is to call the data segment .shared for clarity. You then must specify the correct sharing attributes for this new named data section in your .def file or with the linker option /SECTION:.MYSEC,RWS. (榪欎釜緙栬瘧鍙傛暟鏃㈠彲浠ヤ嬌鐢╬ragma鎸囦護鏉ユ寚瀹氾紝涔熷彲浠ュ湪VC鐨処DE涓寚瀹氾紒)
There are restrictions to consider before using a shared data segment:
· Any variables in a shared data segment must be statically initialized. In the above example, i is initialized to 0 and a is 32 characters initialized to hello world.
· All shared variables are placed in the compiled DLL in the specified data segment. Very large arrays can result in very large DLLs. This is true of all initialized global variables.
· Never store process-specific information in a shared data segment. Most Win32 data structures or values (such as HANDLEs) are really valid only within the context of a single process.
· Each process gets its own address space. It is very important that pointers are never stored in a variable contained in a shared data segment. A pointer might be perfectly valid in one application but not in another.
· It is possible that the DLL itself could get loaded at a different address in the virtual address spaces of each process. It is not safe to have pointers to functions in the DLL or to other shared variables.
鍏舵牸寮忎竴鑸負: #Pragma Para
鍏朵腑Para 涓哄弬鏁幫紝涓嬮潰鏉ョ湅涓浜涘父鐢ㄧ殑鍙傛暟銆?/font>
Message 鍙傛暟鏄垜鏈鍠滄鐨勪竴涓弬鏁幫紝瀹冭兘澶熷湪緙栬瘧淇℃伅杈撳嚭紿楀彛涓緭鍑虹浉搴旂殑淇℃伅錛岃繖瀵逛簬婧愪唬鐮佷俊鎭殑鎺у埗鏄潪甯擱噸瑕佺殑銆傚叾浣跨敤鏂規硶涓猴細
#Pragma message(“娑堟伅鏂囨湰”)
褰撶紪璇戝櫒閬囧埌榪欐潯鎸囦護鏃跺氨鍦ㄧ紪璇戣緭鍑虹獥鍙d腑灝嗘秷鎭枃鏈墦鍗板嚭鏉ャ?br>褰撴垜浠湪紼嬪簭涓畾涔変簡璁稿瀹忔潵鎺у埗婧愪唬鐮佺増鏈殑鏃跺欙紝鎴戜滑鑷繁鏈夊彲鑳介兘浼氬繕璁版湁娌℃湁姝g‘鐨勮緗繖浜涘畯錛屾鏃舵垜浠彲浠ョ敤榪欐潯鎸囦護鍦ㄧ紪璇戠殑鏃跺欏氨榪涜媯鏌ャ?br>鍋囪鎴戜滑甯屾湜鍒ゆ柇鑷繁鏈夋病鏈夊湪婧愪唬鐮佺殑浠涔堝湴鏂瑰畾涔変簡_X86榪欎釜瀹忓彲浠ョ敤涓嬮潰鐨勬柟娉?br>#ifdef _X86
#Pragma message(“_X86 macro activated!”)
#endif
褰撴垜浠畾涔変簡_X86榪欎釜瀹忎互鍚庯紝搴旂敤紼嬪簭鍦ㄧ紪璇戞椂灝變細鍦ㄧ紪璇戣緭鍑虹獥鍙i噷鏄劇ず“_
X86 macro activated!”銆傛垜浠氨涓嶄細鍥犱負涓嶈寰楄嚜宸卞畾涔夌殑涓浜涚壒瀹氱殑瀹忚屾姄鑰蟲尃鑵簡銆?/font>
鏍煎紡濡傦細
#pragma code_seg( ["section-name"[,"section-class"] ] )
瀹冭兘澶熻緗▼搴忎腑鍑芥暟浠g爜瀛樻斁鐨勪唬鐮佹錛屽綋鎴戜滑寮鍙戦┍鍔ㄧ▼搴忕殑鏃跺欏氨浼氫嬌鐢ㄥ埌瀹冦?/font>
鍙鍦ㄥご鏂囦歡鐨勬渶寮濮嬪姞鍏ヨ繖鏉℃寚浠ゅ氨鑳藉淇濊瘉澶存枃浠惰緙栬瘧涓嬈★紝榪欐潯鎸囦護瀹為檯涓婂湪VC6涓氨宸茬粡鏈変簡錛屼絾鏄冭檻鍒板吋瀹規у茍娌℃湁澶鐨勪嬌鐢ㄥ畠銆?/font>
琛ㄧず棰勭紪璇戝ご鏂囦歡鍒版涓烘錛屽悗闈㈢殑澶存枃浠朵笉榪涜棰勭紪璇戙侭CB鍙互棰勭紪璇戝ご鏂囦歡浠ュ姞蹇摼鎺ョ殑閫熷害錛屼絾濡傛灉鎵鏈夊ご鏂囦歡閮借繘琛岄緙栬瘧鍙堝彲鑳藉崰澶紓佺洏絀洪棿錛屾墍浠ヤ嬌鐢ㄨ繖涓夐」鎺掗櫎涓浜涘ご鏂囦歡銆?br>鏈夋椂鍗曞厓涔嬮棿鏈変緷璧栧叧緋伙紝姣斿鍗曞厓A渚濊禆鍗曞厓B錛屾墍浠ュ崟鍏傿瑕佸厛浜庡崟鍏傾緙栬瘧銆備綘鍙互鐢?pragma startup鎸囧畾緙栬瘧浼樺厛綰э紝濡傛灉浣跨敤浜?pragma package(smart_init) 錛孊CB灝變細鏍規嵁浼樺厛綰х殑澶у皬鍏堝悗緙栬瘧銆?/font>
#pragma resource "*.dfm"琛ㄧず鎶?.dfm鏂囦歡涓殑璧勬簮鍔犲叆宸ョ▼銆?.dfm涓寘鎷獥浣撳瑙傜殑瀹氫箟銆?/font>
搴旂敤紼嬪簭鐨勫叆鍙f枃浠跺墠闈㈠姞涓?/font>
#pragma data_seg("flag_data")
int app_count = 0;
#pragma data_seg()
#pragma comment(linker,"/SECTION:flag_data,RWS")
鐒跺悗紼嬪簭鍚姩鐨勫湴鏂瑰姞涓?/font>
if(app_count>0) // 濡傛灉璁℃暟澶т簬0錛屽垯閫鍑哄簲鐢ㄧ▼搴忋?br>{
//MessageBox(NULL, "宸茬粡鍚姩涓涓簲鐢ㄧ▼搴?, "Warning", MB_OK);
//printf("no%d application", app_count);
return FALSE;
}
app_count++;
Windows 鍦ㄤ竴涓猈in32紼嬪簭鐨勫湴鍧絀洪棿鍛ㄥ洿絳戜簡涓閬撳銆傞氬父錛屼竴涓▼搴忕殑鍦板潃絀洪棿涓殑鏁版嵁鏄鏈夌殑錛屽鍒殑紼嬪簭鑰岃█鏄笉鍙鐨勩備絾鏄墽琛孲TRPROG鐨勫涓墽琛屽疄浣撹〃紺轟簡STRLIB鍦ㄧ▼搴忕殑鎵鏈夋墽琛屽疄浣撲箣闂村叡浜暟鎹槸姣棤闂鐨勩傚綋鎮ㄥ湪涓涓猄TRPROG紿楀彛涓鍔犳垨鑰呭垹闄や竴涓瓧絎︿覆鏃訛紝榪欑鏀瑰彉灝嗙珛鍗沖弽鏄犲湪鍏跺畠鐨勭獥鍙d腑銆?/font>
鍦ㄥ叏閮ㄤ緥紼嬩箣闂達紝STRLIB鍏變韓涓や釜鍙橀噺錛氫竴涓瓧絎︽暟緇勫拰涓涓暣鏁幫紙璁板綍宸插偍瀛樼殑鏈夋晥瀛楃涓茬殑涓暟錛夈係TRLIB灝嗚繖涓や釜鍙橀噺鍌ㄥ瓨鍦ㄥ叡浜殑涓涓壒孌婂唴瀛樺尯孌典腑錛?/font>
#pragma data_seg ("shared")
int iTotal = 0 ;
WCHAR szStrings [MAX_STRINGS][MAX_LENGTH + 1] = { '\0' } ;
#pragma data_seg ()
絎竴涓?pragma鍙欒堪寤虹珛鏁版嵁孌碉紝榪欓噷鍛藉悕涓簊hared銆傛偍鍙互灝嗚繖孌靛懡鍚嶄負浠諱綍涓涓偍鍠滄鐨勫悕瀛椼傚湪榪欓噷鐨?pragma鍙欒堪涔嬪悗鐨勬墍鏈夊垵濮嬪寲浜嗙殑鍙橀噺閮芥斁鍦╯hared鏁版嵁孌典腑銆傜浜屼釜#pragma鍙欒堪鏍囩ず孌電殑緇撴潫銆傚鍙橀噺榪涜涓撻棬鐨勫垵濮嬪寲鏄緢閲嶈鐨勶紝鍚﹀垯緙栬瘧鍣ㄥ皢鎶婂畠浠斁鍦ㄦ櫘閫氱殑鏈垵濮嬪寲鏁版嵁孌典腑鑰屼笉鏄斁鍦╯hared涓?/font>
榪炵粨鍣ㄥ繀欏葷煡閬撴湁涓涓宻hared銆嶅叡浜暟鎹銆傚湪銆孭roject Settings銆嶅璇濇閫夋嫨銆孡ink銆嶉〉闈㈠嵎鏍囥傞変腑銆孲TRLIB銆嶆椂鍦ㄣ孭roject Options銆嶅瓧孌碉紙鍦≧elease鍜孌ebug璁懼畾涓潎鍙級錛屽寘鍚笅闈㈢殑榪炵粨鍙欒堪錛?/font>
/SECTION:shared,RWS
瀛楁瘝RWS琛ㄧず孌靛叿鏈夎銆佸啓鍜屽叡浜睘鎬с傛垨鑰咃紝鎮ㄤ篃鍙互鐩存帴鐢―LL鍘熷鐮佹寚瀹氳繛緇撻夐」錛屽氨鍍忔垜浠湪STRLIB.C閭f牱錛?/font>
#pragma comment(linker,"/SECTION:shared,RWS")
鍏變韓鐨勫唴瀛樻鍏佽iTotal鍙橀噺鍜宻zStrings瀛楃涓叉暟緇勫湪STRLIB鐨勬墍鏈変緥紼嬩箣闂村叡浜傚洜涓篗AX_STRINGS絳変簬256錛岃?MAX_LENGTH絳変簬63錛屾墍浠ワ紝鍏變韓鍐呭瓨孌電殑闀垮害涓?2,772瀛楄妭錛峣Total鍙橀噺闇瑕?瀛楄妭錛?56涓寚閽堜腑鐨勬瘡涓涓兘闇瑕?28瀛楄妭銆?/font>
鐧芥潹
銆
“鍦ㄦ紜殑鍦哄悎浣跨敤鎭板綋鐨勭壒鎬?#8221; 瀵圭О鑱岀殑C++紼嬪簭鍛樻潵璇存槸涓涓熀鏈爣鍑嗐傛兂瑕佸仛鍒拌繖鐐癸紝棣栧厛瑕佷簡瑙h璦涓瘡涓壒鎬х殑瀹炵幇鏂瑰紡鍙婂叾寮閿銆傛湰鏂囦富瑕佽璁虹浉瀵逛簬浼犵粺 C 鑰岃█錛屽鏁堢巼鏈夊獎鍝嶇殑鍑犱釜C++鏂扮壒鎬с?/p>
鐩稿浜庝紶緇熺殑 C 璇█錛孋++ 寮曞叆鐨勯澶栧紑閿浣撶幇鍦ㄤ互涓嬩袱涓柟闈細
| 妯℃澘銆佺被灞傛緇撴瀯銆佸己綾誨瀷媯鏌ョ瓑鏂扮壒鎬э紝浠ュ強澶ч噺浣跨敤浜嗚繖浜涙柊鐗規х殑 STL 鏍囧噯搴撻兘澧炲姞浜嗙紪璇戝櫒璐熸媴銆備絾鏄簲褰撶湅鍒幫紝榪欎簺鏂版満鑳藉湪涓嶉檷浣庯紝鐢氳嚦錛堢敱浜庢ā鏉跨殑鍐呰仈鑳藉姏錛夋彁鍗囦簡紼嬪簭鎵ц鏁堢巼鐨勫墠鎻愪笅錛屾槑鏄懼噺杞諱簡騫垮ぇ C++ 紼嬪簭鍛樼殑宸ヤ綔閲忋?
鐢ㄥ嚑縐掗挓鐨凜PU鏃墮棿鎹㈠彇鍑犱漢鏃ョ殑杈涘嫟鍔沖姩錛岄檮甯﹁妭鐪佷簡鏃ュ悗璋冭瘯鍜岀淮鎶や唬鐮佺殑鏃墮棿錛岃繖鐐瑰紑閿褰撶畻瓚呭箋?/p> 褰撶劧錛屽湪浣跨敤榪欎簺鐗規х殑鏃跺欙紝涔熸湁涓嶅皯浼樺寲鎶宸с傛瘮濡傦細緙栬瘧涓涓?騫挎硾渚濊禆妯℃澘搴撶殑澶у瀷杞歡鏃訛紝鍑犳潯鏄懼紡瀹炰緥鍖栨寚浠ゅ氨鍙兘浣跨紪璇戦熷害鎻愰珮鍑犲崄鍊嶏紱鎭板綋鍦扮粍鍚堜嬌鐢ㄩ儴鍒嗕笓闂ㄥ寲鍜屽畬鍏ㄤ笓闂ㄥ寲錛屼笉浣嗗彲浠ユ渶浼樺寲紼嬪簭鐨勬墽琛屾晥鐜囷紝榪樺彲浠ヨ鍚屾椂浣跨敤澶氱涓嶅悓鍙傛暟瀹炰緥鍖栦竴濂楁ā鏉跨殑紼嬪簭浣撶Н鏄捐憲鍑忓皬…… |
銆
榪愯鏃跺紑閿鎭愭曟槸紼嬪簭鍛樻渶鍏沖績鐨勯棶棰樹箣涓浜嗐傜浉瀵逛笌浼犵粺C紼嬪簭鑰岃█錛孋++涓湁鍙兘寮曞叆棰濆榪愯鏃跺紑閿鐨勬柊鐗規у寘鎷細
鍏充簬鍏朵腑絎洓鐐癸細寮傚父錛屽浜庡ぇ澶氭暟鐜頒唬緙栬瘧鍣ㄦ潵璇達紝鍦ㄦ甯告儏鍐碉紙鏈姏鍑哄紓甯革級涓嬶紝try鍧椾腑鐨勪唬鐮佹墽琛屾晥鐜囧拰鏅氫唬鐮佷竴鏍烽珮錛岃屼笖鐢變簬涓嶅啀闇瑕佷嬌鐢ㄤ紶緇熶笂閫氳繃榪斿洖鍊兼垨鍑芥暟璋冪敤鏉ュ垽鏂敊璇殑鏂瑰紡錛屼唬鐮佺殑瀹為檯鎵ц鏁堢巼榪樺彲鑳借繘涓姝ユ彁楂樸傛姏鍑哄拰鎹曟崏寮傚父鐨勬晥鐜囦篃鍙槸鍦ㄦ煇浜涙儏鍐典笅鎵嶄細紼嶄綆浜庡嚱鏁版甯歌繑鍥炵殑鏁堢巼錛屼綍鍐靛浜庝竴涓紪鍐欒壇濂界殑紼嬪簭錛屾姏鍑哄拰鎹曟崏寮傚父鐨勬満浼氬簲璇ヤ笉澶氥傚叧浜庡紓甯鎬嬌鐢ㄧ殑璇︾粏璁ㄨ錛屽弬瑙侊細C++緙栫爜瑙勮寖姝f枃涓殑鐩稿叧閮ㄥ垎鍜?a >C++寮傚父鏈哄埗鐨勫疄鐜版柟寮忓拰寮閿鍒嗘瀽涓鑺傘?/p> 鑰岀浜旂偣錛屽璞$殑鏋勯犲拰鏋愭瀯寮閿涔熶笉鎬繪槸瀛樺湪銆傚浜庝笉闇瑕佸垵濮嬪寲/閿姣佺殑綾誨瀷錛屽茍娌℃湁鏋勯犲拰鏋愭瀯鐨勫紑閿錛岀浉鍙嶅浜庨偅浜涢渶瑕佸垵濮嬪寲/閿姣佺殑綾誨瀷鏉ヨ錛屽嵆浣跨敤浼犵粺鐨凜鏂瑰紡瀹炵幇錛屼篃鑷沖皯闇瑕佷笌涔嬬浉褰撶殑寮閿銆傝繖閲岃娉ㄦ剰鐨勪竴鐐規槸灝介噺涓嶈璁╂瀯閫犲拰鏋愭瀯鍑芥暟榪囦簬鑷冭偪錛岀壒鍒槸鍦ㄤ竴涓被灞傛緇撴瀯涓洿瑕佹敞鎰忋傛椂鍒諱繚鎸佷綘鐨勬瀯閫犮佹瀽鏋勫嚱鏁頒腑鍙湁鏈蹇呰鐨勫垵濮嬪寲鍜岄攢姣佹搷浣滐紝鎶婇偅浜涘茍涓嶆槸姣忎釜錛堝瓙錛夊璞¢兘闇瑕佹墽琛岀殑鎿嶄綔鐣欑粰鍏朵粬鏂規硶鍜屾淳鐢熺被鍘昏В鍐熾?/p> 鍏跺疄瀵逛竴涓紭縐鐨勭紪璇戝櫒鑰岃█錛孋++鐨勫悇縐嶇壒鎬ф湰韜氨鏄嬌鐢–/姹囩紪鍔犱互鍗冮敜鐧劇偧鑰屾渶浼樺寲瀹炵幇鐨勩傚彲浠ヨ錛屾兂鐢–鐢氳嚦姹囩紪姣旂紪璇戝櫒鏇撮珮鏁堝湴瀹炵幇鏌愪釜C++鐗規у嚑涔庢槸涓嶅彲鑳界殑銆傝鏄湡鑳藉仛鍒拌繖涓鐐圭殑璇濓紝澶т緺灝卞簲璇ュ幓鍐欎釜緙栬瘧鍣ㄩ犵騫垮ぇ紼嬪簭鍛樻墠瀵癸綖 C++涔嬫墍浠?琚箍娉涜涓烘瘮C“浣庢晥”錛屽叾鏍規湰鍘熷洜鍦ㄤ簬錛氱敱浜庣▼搴忓憳瀵規煇浜涚壒鎬х殑瀹炵幇鏂瑰紡鍙婂叾浜х敓鐨勫紑閿涓嶅浜嗚В錛岃嚧浣夸粬浠湪閿欒鐨勫満鍚堜嬌鐢ㄤ簡閿欒鐨勭壒鎬с傝岃繖浜涢敊璇熀鏈兘闆嗕腑鍦細
鍏朵腑鍓嶄袱鐐逛笂鏂囧凡緇忚榪囷紝涓嬮潰璁ㄨ絎笁鐐廣?/p> 涓轟簡璇存槑RTTI銆佽櫄鍑芥暟鍜岃櫄鍩虹被鐨勫疄鐜版柟寮忥紝榪欓噷棣栧厛緇欏嚭涓涓粡鍏哥殑鑿卞艦緇ф壙瀹炰緥錛屽強鍏跺叿浣撳疄鐜幫紙涓轟簡渚夸簬鐞嗚В錛岃繖閲屾晠鎰忓拷鐣ヤ簡涓浜涙棤鍏崇揣瑕佺殑浼樺寲錛夛細 |

鍥句腑铏氱澶翠唬琛ㄥ亸縐伙紝瀹炵澶翠唬琛ㄦ寚閽?/p>
| 鐢變笂鍥懼緱鍒版瘡縐嶇壒鎬х殑榪愯鏃跺紑閿濡備笅錛?
銆
鍙錛屽叧浜庤佸ぉ“楗挎椂鎺夐楗箋佺潯鏃舵帀鑰佸﹩”絳夌編濂戒紶璇寸函灞炶埃璦銆備絾鍑′漢宸ュ埗鍝佸繀涓嶅畬緹庯紝鎬繪湁璁捐涓婄殑鍙栬垗錛屾湁鍏墮傚簲鐨勫満鍚堜篃鏈夊叾涓嶉傜敤鐨勫湴鏂廣?/p> C++涓殑姣忎釜鐗規э紝閮芥槸浠庣▼搴忓憳騫蟲椂鐨勭敓浜х敓媧諱腑閫愭笎綺懼寲鑰屾潵鐨勩傚湪涓嶆紜殑鍦哄悎浣跨敤瀹冧滑蹇呯劧浼氬紩璧烽昏緫銆佽涓哄拰鎬ц兘涓婄殑闂銆傚浜庝笂榪扮壒鎬э紝搴旇鍙湪蹇呰銆佸悎鐞嗙殑鍓嶆彁涓嬫墠浣跨敤銆?/p> "dynamic_cast" 鐢ㄤ簬鍦ㄧ被灞傛緇撴瀯涓極娓革紝瀵規寚閽堟垨寮曠敤榪涜鑷敱鐨勫悜涓娿佸悜涓嬫垨浜ゅ弶寮哄埗銆?typeid" 鍒欑敤浜庤幏鍙栦竴涓璞℃垨寮曠敤鐨勭‘鍒囩被鍨嬶紝涓?"dynamic_cast" 涓嶅悓錛屽皢 "typeid" 浣滅敤浜庢寚閽堥氬父鏄竴涓敊璇紝瑕佸緱鍒頒竴涓寚閽堟寚鍚戜箣瀵硅薄鐨則ype_info錛屽簲褰撳厛灝嗗叾瑙e紩鐢紙渚嬪錛?typeid(*p);"錛夈?/p> 涓鑸湴璁詫紝鑳界敤铏氬嚱鏁拌В鍐崇殑闂灝變笉瑕佺敤 "dynamic_cast"錛岃兘澶熺敤 "dynamic_cast" 瑙e喅鐨勫氨涓嶈鐢?"typeid"銆傛瘮濡傦細
浠ヤ笂浠g爜鐢?"dynamic_cast" 鍐欎細紼嶅ソ涓鐐癸紝褰撶劧鏈濂界殑鏂瑰紡榪樻槸鍦–Shape閲屽畾涔夊悕涓?"rotate" 鐨勮櫄鍑芥暟銆?/p> 铏氬嚱鏁版槸C++浼楀榪愯鏃跺鎬佺壒鎬т腑寮閿鏈灝忥紝涔熸渶甯哥敤鐨勬満鍒躲傝櫄鍑芥暟鐨勫ソ澶勫拰浣滅敤榪欓噷涓嶅啀澶氳錛屽簲褰撴敞鎰忓湪瀵規ц兘鏈夎嫑鍒昏姹傜殑鍦哄悎錛屾垨鑰呴渶瑕侀綣佽皟鐢紝瀵規ц兘褰卞搷杈冨ぇ鐨勫湴鏂癸紙姣斿姣忕閽熻璋冪敤鎴愬崈涓婁竾嬈★紝鑰岃嚜韜唴瀹瑰張寰堢畝鍗曠殑浜嬩歡澶勭悊鍑芥暟錛夎鎱庣敤铏氬嚱鏁般?/p> 闇瑕佺壒鍒鏄庣殑涓鐐規槸錛氳櫄鍑芥暟鐨勮皟鐢ㄥ紑閿涓庨氳繃鍑芥暟鎸囬拡鐨勯棿鎺ュ嚱鏁拌皟鐢紙渚嬪錛氱粡鍏窩紼嬪簭涓父瑙佺殑錛岄氳繃鎸囧悜緇撴瀯涓殑涓涓嚱鏁版寚閽堟垚鍛樿皟鐢紱浠ュ強璋冪敤DLL/SO涓殑鍑芥暟絳夊父瑙佹儏鍐碉級鏄浉褰撶殑銆傛瘮璧峰嚱鏁拌皟鐢ㄦ湰韜殑寮閿錛堜繚瀛樼幇鍦?>浼犻掑弬鏁?>浼犻掕繑鍥炲?>鎭㈠鐜板満錛夋潵璇達紝涓嬈℃寚閽堥棿鎺ュ紩鐢ㄦ槸寰笉瓚抽亾鐨勩傝繖灝變嬌寰?strong>鍦ㄧ粷澶ч儴鍒嗗彲浠ヤ嬌鐢ㄥ嚱鏁扮殑鍦哄悎涓兘鑳藉璐熸媴寰楄搗铏氭柟娉?/strong>鐨勪簺寰澶栧紑閿銆?/p> 浣滀負涓縐嶆敮鎸佸緇ф壙鐨勯潰鍚戝璞¤璦錛岃櫄鍩虹被鏈夋椂鏄繚璇佺被灞傛緇撴瀯姝g‘涓鑷寸殑涓縐嶅繀涓嶅彲灝戠殑鎵嬫銆備絾鍦ㄩ渶瑕侀綣佷嬌鐢ㄥ熀綾繪彁渚涚殑鏈嶅姟錛屽張瀵規ц兘瑕佹眰杈冮珮鐨勫満鍚堬紝搴旇灝介噺閬垮厤浣跨敤瀹冦傚湪鍩虹被涓病鏈夋暟鎹垚鍛樼殑鍦哄悎錛屼篃鍙互瑙i櫎浣跨敤铏氬熀綾匯備緥濡傦紝鍦ㄤ笂鍥句腑錛屽鏋滅被 "BB" 涓笉瀛樺湪鏁版嵁鎴愬憳錛岄偅涔?"BB" 灝卞彲浠ヤ綔涓轟竴涓櫘閫氬熀綾誨垎鍒 "B1" 鍜?"B2" 緇ф壙銆傝繖鏍風殑浼樺寲鍦ㄨ揪鍒扮浉鍚屾晥鏋滅殑鍓嶆彁涓嬶紝瑙i櫎浜嗚櫄鍩虹被寮曡搗鐨勫紑閿銆備笉榪囪繖縐嶄紭鍖栦篃浼氬甫鏉ヤ竴浜涢棶棰橈細浠?"DD" 鍚戜笂寮哄埗鍒?"BB" 鏃朵細寮曡搗姝т箟錛岀牬鍧忎簡綾誨眰嬈$粨鏋勭殑閫昏緫鍏崇郴銆?/p> 涓婅堪鐗規х殑絀洪棿寮閿涓鑸兘鏄彲浠ユ帴鍙楃殑錛屽綋鐒朵篃瀛樺湪涓浜涚壒渚嬶紝姣斿錛氬湪瀛樺偍甯冨眬闇瑕佸拰浼犵粺C緇撴瀯鍏煎鐨勫満鍚堛佸湪鑰冭檻瀵歸綈鐨勫満鍚堛佸湪闇瑕佷負涓涓湰鏉ュ昂瀵稿緢灝忕殑綾誨悓鏃跺疄渚嬪寲璁稿瀵硅薄鐨勫満鍚堢瓑絳夈?/p> |
||||||||||||||||