示例#1
0
        private void OnFunctionCalled(NktHook hook, NktProcess process, NktHookCallInfo hookCallInfo)
        {
            string         strDocument = "Document: ";
            INktParamsEnum paramsEnum  = hookCallInfo.Params();
            INktParam      param       = paramsEnum.First();

            param = paramsEnum.Next();
            param = paramsEnum.Next();
            if (param.PointerVal != IntPtr.Zero)
            {
                INktParamsEnum paramsEnumStruct = param.Evaluate().Fields();
                INktParam      paramStruct      = paramsEnumStruct.First();
                strDocument += paramStruct.ReadString();
                strDocument += "\n";
            }
            Output(strDocument);
        }
示例#2
0
        /// <summary>
        /// WriteFile调用事件处理函数
        /// </summary>
        /// <param name="hook"></param>
        /// <param name="process"></param>
        /// <param name="hookCallInfo"></param>
        private void OnWriteFileCalled(NktHook hook, NktProcess process, NktHookCallInfo hookCallInfo)
        {
            string strDocument = "Document: ";

            INktParamsEnum paramsEnum = hookCallInfo.Params();

            INktParam hFile = paramsEnum.First();

            //paramsEnum.Next();
            //paramsEnum.Next();
            //paramsEnum.Next();
            //paramsEnum.Next();

            INktParam lpBuffer = paramsEnum.Next();

            INktParam nNumberOfBytesToWrite = paramsEnum.Next();

            #region  着官方示例写的 毛用没有
            if (hFile.PointerVal != IntPtr.Zero)
            {
                INktParamsEnum hFileEnumStruct = hFile.Evaluate().Fields();
                INktParam      hFileStruct     = hFileEnumStruct.First();
            }

            Console.Out.WriteLine(lpBuffer.ReadString());

            Console.Out.WriteLine(lpBuffer.Address);

            if (lpBuffer.PointerVal != IntPtr.Zero)
            {
                strDocument += lpBuffer.ReadString();
                strDocument += "\n";
            }

            Output(strDocument);
            #endregion

            var h_file = QueryFileHandle(hFile.Address);

            ReadBuffer(lpBuffer.Address, nNumberOfBytesToWrite.Address);
        }