#pragma pack(1)
typedef struct _TRAMPOLINE
{
	LPVOID TargetFunctionAddress;      
	LPVOID FakeFunctionAddress;        
	LPVOID MemorySlot;                   // MemorySlot 32字节

#if defined(_M_X64) || defined(__x86_64__)
	LPVOID pRelay;          // [Out] Address of the relay function.
#endif
//	BOOL   patchAbove;      // [Out] Should use the hot patch area?  //Patch  --->补丁   //0xA 0xB
	UINT   Index;           // [Out] Number of the instruction boundaries.
	UINT8  OldIPs[8];       // [Out] Instruction boundaries of the target function.      //恢复
	UINT8  NewIPs[8];       // [Out] Instruction boundaries of the trampoline function.  //Hook
} TRAMPOLINE, *PTRAMPOLINE;

typedef struct _MEMORY_SLOT
{
	union
	{
		struct _MEMORY_SLOT *Flink;
		UINT8 BufferData[MEMORY_SLOT_SIZE];
	};
} MEMORY_SLOT, *PMEMORY_SLOT;  //32字节

    对于TRAMPOLINE的构建是一块相对复杂的内容。可以看到结构体的前两个成员分别是原函数地址和我们想要到达的自定义函数地址，第三个成员MemorySlot，记录的是原函数地址开头的五个字节，以及跳转回原函数的jmp指令，OldPos和NewPos则分别保存了在构建MemorySlot的过程中，已经读取的目标函数偏移字节数，和已经写入的Detour函数字节数。

 　构建MemorySlot是通过一个do_While循环来实现的，首先它需要保存好被覆盖的那些字节数，所以在原函数已经读取的字节数少于jmp+四字节offset，一共五字节之前，MemorySlot要先备份下原来的指令，一旦原函数已经读取的字节数超过或者等于覆盖所需要的五字节时，也就不必再备份原来函数基地址处的指令了，因为仅仅只是覆盖五字节的内容：

do
{
 
HDE       hde;  
UINT     CopyCodeLength;
LPVOID   CopyCodeData;
//对于出现的相对偏移地址，在跳板中都要给出新的相对地址
/*
74CA8B80 8B FF                mov         edi,edi
74CA8B82 55                   push        ebp
74CA8B83 8B EC                mov         ebp,esp
74CA8B85 6A 00                push        0
74CA8B87 FF 75 14             push        dword ptr [ebp+14h]
74CA8B8A FF 75 10             push        dword ptr [ebp+10h]
74CA8B8D FF 75 0C             push        dword ptr [ebp+0Ch]
74CA8B90 FF 75 08             push        dword ptr [ebp+8]
74CA8B93 E8 F8 FC FF FF       call        _MessageBoxExW@20 (74CA8890h)
*/
ULONG_PTROldInstance = (ULONG_PTR)Trampoline->TargetFunctionAddress + OldPos;
ULONG_PTRNewInstance = (ULONG_PTR)Trampoline->MemorySlot + NewPos;
//指令长度
 
CopyCodeLength = HDE_DISASM((LPVOID)OldInstance, &hde);
if(hde.flags & F_ERROR)
returnFALSE;
CopyCodeData = (LPVOID)OldInstance;//第一次时，CopyCodeData是MessageBox入口地址
if(OldPos >=sizeof(JMP_REL))  
{
// The trampoline function is long enough.
// Complete the function with the jump to the target function.
#if defined(_M_X64) || defined(__x86_64__)
jmp.address = pOldInst;
#else       
//OldInstance = 74CA8B85
//目标 = 源 + Offset + 5
//Offset = 目标 - (源 + 5)
jmp.Operand = (UINT32)(OldInstance - (NewInstance  +sizeof(jmp)));  //计算跳转到目标的偏移
#endif
CopyCodeData = &jmp;
CopyCodeLength =sizeof(jmp);
IsLoop = TRUE;
}
//......此处省略部分源码，突出重点
Trampoline->OldIPs[Trampoline->Index] = OldPos;
Trampoline->NewIPs[Trampoline->Index] = NewPos;
Trampoline->Index++;
// Avoid using memcpy to reduce the footprint.
#ifndef _MSC_VER
memcpy((LPBYTE)ct->pTrampoline + newPos, pCopySrc, copySize);
#else
__movsb((LPBYTE)Trampoline->MemorySlot + NewPos, (constunsignedchar*)CopyCodeData, CopyCodeLength);
#endif
NewPos += CopyCodeLength;
OldPos += hde.len;
}while(!IsLoop);

    在这段do_while循环里，通过反汇编可以清晰地看到MemorySlot一步步的构建,在测试代码中我Hook的是MessageBox函数，所以在看MemorySlot的构造过程之前，先来看一看反汇编下原始的MessageBox的机器指令：

　对应着MessageBox的机器指令，来看MemorySlot在do while循环中的构造过程： 

　局部变量窗口找到MemorySlot的地址：

if (OldPos >= sizeof(JMP_REL))   
		{
			// The trampoline function is long enough.
			// Complete the function with the jump to the target function.
#if defined(_M_X64) || defined(__x86_64__)
			jmp.address = pOldInst;
#else        
			//OldInstance = 74CA8B85

			//目标 = 源 + Offset + 5
			//Offset = 目标 - (源 + 5) 
			jmp.Operand = (UINT32)(OldInstance - (NewInstance  + sizeof(jmp)));   //计算跳转到目标的偏移

#endif
			CopyCodeData = &jmp;
			CopyCodeLength = sizeof(jmp);

			IsLoop = TRUE;
		}

HookEntry->IsEnabled   = FALSE;

//存储源函数的数据内容  5字节的备份
memcpy(HookEntry->Backup, TargetFunctionAddress, sizeof(JMP_REL));

	MessageBoxW(NULL, L"HelloWorld", L"HelloWorld", 0);

int WINAPI DetourMessageBox(
	_In_opt_ HWND    hWnd,
	_In_opt_ WCHAR* lpText,
	_In_opt_ WCHAR* lpCaption,
	_In_     UINT    uType)
{
	__OriginalMessageBoxW(hWnd,L"FakeMessageBox",L"FakeMessageBox",uType);
	return 0;
}

	if (SeCreateHook(&MessageBoxW, &DetourMessageBox,
		reinterpret_cast<LPVOID*>(&__OriginalMessageBoxW)) != STATUS_SUCCESS)
	{
		return;
	}