VEH HOOK

VEH实现不修改代码HOOK函数，基本原理：在对应函数上触发异常（0xCC，硬件断点）然后VEH处理异常实现HOOK

异常处理函数，修改传入的参数值

LONG CALLBACK VEH2(struct _EXCEPTION_POINTERS* pEP){
    printf(("VEH2 Do something HOOK\n"));
    //以下的注释，可以取消以观察不同的输出结果
    if ((STATUS_SINGLE_STEP == pEP->ExceptionRecord->ExceptionCode) && pEP->ContextRecord->Eip == (DWORD)MessageBoxA){
    	pEP->ContextRecord->Eip += 2; //jmp mov edi,edi
    	DWORD	*pStack = (DWORD*)pEP->ContextRecord->Esp;
    	pStack[1] = 0;
    	pStack[2] = (DWORD)&"hooked!";
    	pStack[3] = (DWORD)&"caption hook";
    	for(int i=0;i<10;i++)
    	{
    		printf("%08x\n",pStack[i]);
    	}
    	
        return EXCEPTION_CONTINUE_EXECUTION;
    }
    return EXCEPTION_CONTINUE_SEARCH;
}

PVECTORED_LIST p_veh_list = (PVECTORED_LIST)AddVectoredExceptionHandler(0,VEH2);
auto hX3 = SetHardwareBreakpoint(GetCurrentThread(),HWBRK_TYPE_CODE,HWBRK_SIZE_1,MessageBoxA);
MessageBoxA(NULL,"test","hkbreak",0);//触发异常