弄了半天，总不能正确运行，鼠标移动可以，可是点击发出的命令以及键盘操作都不能正确回放？
请各位大人给指点一下？还有记录回放时的准确时间差该如何算，我用本条记录时间减去上条记录时间返回，也没什么效果，所以直接返回了固定数值。
请 指点！
.386
.model flat,stdcall
option casemap:none
include C:\RadASM\masm32\macros\Strings.mac
include windows.inc
include user32.inc
include kernel32.inc
includelib user32.lib
includelib kernel32.lib
IDD_DLG1 equ 1000
IDC_BTN1 equ 1001
IDC_BTN2 equ 1002
IDC_BTN3 equ 1003
IDC_EDT1 equ 1004
IDC_EDT2 equ 1005
.data
hInstance dd ?
hWinMain dd ?
hHook dd ?
hFile dd ?
szFileSize dd ?
szFileName db "recode.txt",0
play dd 1
rec dd 1
delay dd 0
.code
_hook2 proc uses ebx esi edi dwCode,wParam,lParam
LOCAL @read
xor ebx,ebx
.if dwCode==HC_GETNEXT && play==1
mov esi,lParam
invoke ReadFile,hFile,esi,20,addr @read,NULL
.if delay==1
mov ebx,50
mov delay,0
.endif
.elseif dwCode==HC_SKIP && play==1
mov delay,1
invoke SetFilePointer,hFile,20,0,FILE_CURRENT
add eax,20
.if eax>szFileSize
invoke UnhookWindowsHookEx,hHook
invoke CloseHandle,hFile
.endif
.elseif dwCode<0
invoke CallNextHookEx,hHook,dwCode,wParam,lParam
mov ebx,eax
.elseif dwCode==HC_SYSMODALOFF
mov play,1
.elseif dwCode==HC_SYSMODALON
MOV play,0
.endif
mov eax,ebx
ret
_hook2 endp
_hook1 proc uses ebx esi edi dwCode,wParam,lParam
LOCAL @Writed
.IF dwCode<0
invoke CallNextHookEx,hHook,dwCode,wParam,lParam
.elseif dwCode==HC_SYSMODALON
mov rec,0
.elseif dwCode==HC_SYSMODALOFF
mov rec,1
.elseif dwCode==HC_ACTION && rec==1
mov ebx,lParam
invoke WriteFile,hFile,ebx,20,addr @Writed,NULL
invoke SetEndOfFile,hFile
.endif
ret
_hook1 endp
_DlgProc proc uses ebx esi edi hWnd,uMsg,wParam,lParam
mov eax,uMsg
.if eax==WM_COMMAND
mov eax,wParam
.if ax==IDC_BTN1
invoke CreateFile,offset szFileName,GENERIC_READ or GENERIC_WRITE,0,0,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL
mov hFile,eax
invoke SetWindowsHookEx,WH_JOURNALRECORD,_hook1,hInstance,NULL
.if eax!=0
mov hHook,eax
.else
invoke MessageBox,NULL,$CTA0("安装记录钩子错误"),$CTA0("安装记录钩子错误"),MB_OK
.endif
.elseif ax==IDC_BTN2
invoke CreateFile,offset szFileName,GENERIC_READ,0,0,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL
.if eax!=INVALID_HANDLE_VALUE
mov hFile,eax
invoke GetFileSize,hFile,NULL
mov szFileSize,eax
invoke SetWindowsHookEx,WH_JOURNALPLAYBACK,offset _hook2,hInstance,NULL
.if eax!=0
mov hHook,eax
.else
invoke MessageBox,NULL,$CTA0("回放钩子安装失败"),$CTA0("回放钩子安装失败"),MB_OK
.endif
.else
invoke MessageBox,NULL,$CTA0("打开记录文件失败"),$CTA0("打开记录文件失败"),MB_OK
.endif
.elseif ax==IDC_BTN3
invoke UnhookWindowsHookEx,hHook
invoke CloseHandle,hFile
.endif
.elseif eax==WM_INITDIALOG
push hWnd
pop hWinMain
.elseif eax==WM_CLOSE
invoke EndDialog,hWinMain,NULL
.else
mov eax,FALSE
ret
.endif
mov eax,TRUE
ret
_DlgProc endp
start:
invoke GetModuleHandle,NULL
mov hInstance,eax
invoke DialogBoxParam,hInstance,IDD_DLG1,NULL,_DlgProc,NULL
invoke ExitProcess,NULL
end start
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
