-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathexample.cpp
71 lines (57 loc) · 1.76 KB
/
example.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
#include "fridacpp.h"
#include <cassert>
int test1()
{
return 42;
}
class TestClass {
public:
int test2(int first)
{
printf("test2 execute, my this %p, my arg %d\n", this, first);
return first + 42;
}
int test3()
{
printf("test3 execute, my this %p\n", this);
return 0;
}
};
class HookTest1 : public InvocationListener {
long thiz = 0;
public:
void on_enter(GumInvocationContext* context) override
{
printf("%s ecx: %x\n", __func__, context->cpu_context->ecx);
thiz = context->cpu_context->ecx;
printf("saved this %lx\n", thiz);
}
void on_leave(GumInvocationContext* context) override
{
printf("%s eax: %x, ecx: %x\n", __func__, context->cpu_context->eax, context->cpu_context->ecx);
gum_invocation_context_replace_return_value(context, (gpointer)100);
printf("%s eax: %d, ecx: %x\n", __func__, context->cpu_context->eax, context->cpu_context->ecx);
using Test3type = int (*)();
auto test3_addr = &TestClass::test3;
auto test3Type = (Test3type)(*(int*)&test3_addr);
printf("now thiz %lx\n", thiz);
__asm mov eax, this;
__asm mov ecx, [eax] HookTest1.thiz;
__asm call test3_addr;
}
};
int main()
{
printf("TESTING\n");
auto* interceptor = new Intercepter();
auto* listener = new HookTest1();
interceptor->attach((gpointer)test1, listener, nullptr);
auto r = test1();
assert(r == 100);
auto x = &TestClass::test2;
printf("test2 address %lx\n", *(long*)&x);
interceptor->attach((gpointer) * (long*)&x, listener, nullptr);
TestClass testClass;
testClass.test2(40);
return 0;
}