Open RelicOfTesla opened 10 years ago
@poizan42 @martona This problem is only after merge e58a58ca31dbe14f202b9b26315bff9f7a32598c (Merge branch 'fix-remove-max-limit-patch' ) When I switch to efa4d7e7695a1fd934250b1acadf8a630f081b5f (remove @poizan42 change), IT'S OK. My OS is win7 x64,( but build in x86 mode) //////////////////
int (WINAPI* OldMessageBoxA)( in_opt HWND hWnd, __in_opt LPCSTR lpText, in_opt LPCSTR lpCaption, __in UINT uType) = MessageBoxA;
int WINAPI NewMessageBoxA( in_opt HWND hWnd, __in_opt LPCSTR lpText, in_opt LPCSTR lpCaption, __in UINT uType) { return 0; }
int _tmain(int argc, _TCHAR* argv[]) { Mhook_SetHook((void)&OldMessageBoxA, NewMessageBoxA); Mhook_Unhook((void)&OldMessageBoxA); MessageBoxA(0, 0, 0, 0);
return 0;
}
In function Mhook_SetHook, ppSystemFunction is assigned to pTrampoline->codeTrampoline. In Mhook_Unhook, ppSystemFunction is passed to TrampolineGet, by comparing with pCurrent->pHookFunction to get owned pTrampoline.
In my test, unhook always return FALSE because TrampolineGet always return NULL.
This bug can be fixed by modifying function TrampolineGet pCurrent->pHookFunction to pCurrent->codeTrampoline
Only hook one api, and call the Mhook_Unhook to restore it, It's bad to TrampolineGet return NULL.