先写一个demo,查看FindWindowW FindWindowExW的函数指针
HMODULE hModule = LoadLibrary(L"user32.dll");
if (hModule != NULL)
{
while (true)
{
FUN_FindWindowW FindWindowWFunc = (FUN_FindWindowW)GetProcAddress(hModule, "FindWindowW");
if (FindWindowWFunc != NULL)
{
printf("FindWindowW 函数指针地址:%p\r\n", FindWindowWFunc);
HWND hWnd = FindWindowWFunc(L"123", NULL);
}
FUN_FindWindowExW FindWindowExWFunc = (FUN_FindWindowExW)GetProcAddress(hModule, "FindWindowExW");
if (FindWindowExWFunc != NULL)
{
printf("FindWindowExW 函数指针地址:%p\r\n", FindWindowExWFunc);
HWND hWnd = FindWindowExWFunc(NULL,NULL, L"DingtalkMsgComming", NULL);
int n = (BYTE*)FindWindowExWFunc - (BYTE*)FindWindowWFunc;
printf("指针偏移:%d 0X%X\r\n",n,n);
FUN_FindWindowExW TextFun = (FUN_FindWindowExW)((BYTE*)FindWindowWFunc + n);
printf("TextFun 函数指针地址:%p\r\n", TextFun);
hWnd = TextFun(NULL, NULL, L"DingtalkMsgComming", NULL);
int wjr = 0;
}
Sleep(5000);
}
FreeLibrary(hModule);
}
windbg调试该程序 设置断点
bu USER32!FindWindowW
可以看到函数指针地址和打印出来的都一样的 都是**68483650
当函数命中时,地址也一致
按F8(t)一直往下走,耐心走