do
{
HDE hde;
UINT
CopyCodeLength;
LPVOID
CopyCodeData;
//对于出现的相对偏移地址,在跳板中都要给出新的相对地址
/*
74CA8B80 8B FF mov edi,edi
74CA8B82 55 push ebp
74CA8B83 8B EC mov ebp,esp
74CA8B85 6A 00 push 0
74CA8B87 FF 75 14 push dword ptr [ebp+14h]
74CA8B8A FF 75 10 push dword ptr [ebp+10h]
74CA8B8D FF 75 0C push dword ptr [ebp+0Ch]
74CA8B90 FF 75 08 push dword ptr [ebp+8]
74CA8B93 E8 F8 FC FF FF call _MessageBoxExW@20 (74CA8890h)
*/
ULONG_PTR
OldInstance = (
ULONG_PTR
)Trampoline->TargetFunctionAddress + OldPos;
ULONG_PTR
NewInstance = (
ULONG_PTR
)Trampoline->MemorySlot + NewPos;
//指令长度
CopyCodeLength = HDE_DISASM((
LPVOID
)OldInstance, &hde);
if
(hde.flags & F_ERROR)
return
FALSE;
CopyCodeData = (
LPVOID
)OldInstance;
//第一次时,CopyCodeData是MessageBox入口地址
if
(OldPos >=
sizeof
(JMP_REL))
{
// The trampoline function is long enough.
// Complete the function with the jump to the target function.
#if defined(_M_X64) || defined(__x86_64__)
jmp.address = pOldInst;
#else
//OldInstance = 74CA8B85
//目标 = 源 + Offset + 5
//Offset = 目标 - (源 + 5)
jmp.Operand = (
UINT32
)(OldInstance - (NewInstance +
sizeof
(jmp)));
//计算跳转到目标的偏移
#endif
CopyCodeData = &jmp;
CopyCodeLength =
sizeof
(jmp);
IsLoop = TRUE;
}
//......此处省略部分源码,突出重点
Trampoline->OldIPs[Trampoline->Index] = OldPos;
Trampoline->NewIPs[Trampoline->Index] = NewPos;
Trampoline->Index++;
// Avoid using memcpy to reduce the footprint.
#ifndef _MSC_VER
memcpy
((
LPBYTE
)ct->pTrampoline + newPos, pCopySrc, copySize);
#else
__movsb((
LPBYTE
)Trampoline->MemorySlot + NewPos, (
const
unsigned
char
*)CopyCodeData, CopyCodeLength);
#endif
NewPos += CopyCodeLength;
OldPos += hde.len;
}
while
(!IsLoop);