通过键盘钩子注入dll到进程1,然后在按键回调函数中new一个MFC自定义窗口类
代码如下:
pMainForm = new CMainForm(); //创建主窗口类
if (pMainForm->Create(IDD_DLG_MAIN, NULL) == FALSE)
{
delete pMainForm;
pMainForm = NULL;
return;
}
pMainForm->ShowWindow(SW_SHOW); //显示窗口
在释放的窗口的时候,调用delete MFC类对象,就报异常.
if (pMainForm)
{
//::DestroyWindow(pMainForm->m_hWnd); //MSDN:A thread cannot use DestroyWindow to destroy a window created by a different thread.
//pMainForm->DestroyWindow(); //--调用这个报错,只能在创建窗口的线程中调用
//SendMessage(pMainForm->m_hWnd, WM_DESTROY, NULL, NULL);
//_asm int 3
delete pMainForm; //调用这个会异常
pMainForm = NULL;
}
异常时,OD代码:
PUSH EDI
PUSH 0
CALL MFC42.#6581
PUSH DWORD PTR [ESI+20]
MOV ECX, EAX //EAX=0,异常开始了
CALL MFC42.#3848
CMP DWORD PTR [ESI+3C], 0
MOV EBX, EAX
JNZ SHORT MFC42.0AD56463
PUSH DWORD PTR [ESI+20]
CALL DestroyWindow
JMP SHORT MFC42.0AD5646B
可以肯定的是这里已经是析构函数,但还没到DestroyWindow
至于 CALL MFC42.#6581,CALL MFC42.#3848
这两个call是干什么的,能力有限,暂时还分析不出来?---如何分析,还请高人指点
我估计错误跟MFC窗口类本身定义有关,我的类里头一个句柄都没
class CMainForm : public CDialog
{
// Construction
public:
CMainForm(CWnd* pParent = NULL); // standard constructor
// Dialog Data
//{{AFX_DATA(CMainForm)
enum { IDD = IDD_DLG_MAIN };
CTabCtrl m_MainTab;
//}}AFX_DATA
// Overrides
// ClassWizard generated virtual function overrides
//{{AFX_VIRTUAL(CMainForm)
protected:
virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support
//}}AFX_VIRTUAL
// Implementation
protected:
// Generated message map functions
//{{AFX_MSG(CMainForm)
virtual BOOL OnInitDialog();
afx_msg void OnSelchangeMainTab(NMHDR* pNMHDR, LRESULT* pResult);
afx_msg void OnDestroy();
//}}AFX_MSG
DECLARE_MESSAGE_MAP()
};
[CTF入门培训]顶尖高校博士及硕士团队亲授《30小时教你玩转CTF》，视频+靶场+题目！助力进入CTF世界
