【发布时间】:2019-09-16 13:55:40
【问题描述】:
这是什么意思?我知道 NtUnMapViewOfSection 是一个指向带有 2 个参数和一个长返回值的 Winapi 函数的指针。而且我知道这个块正在将“GetProcAddress”及其参数转换为 NtUnmapViewOfSection 对象。但是最后一行在做什么?
typedef LONG (WINAPI * NtUnmapViewOfSection)(HANDLE ProcessHandle, PVOID BaseAddress);
NtUnmapViewOfSection xNtUnmapViewOfSection;
xNtUnmapViewOfSection = NtUnmapViewOfSection(GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtUnmapViewOfSection"));
xNtUnmapViewOfSection(Pinfo.hProcess, PVOID(dwImageBase)); // Pinfo is PROCESS_INFORMATION and dwImageBase is a pointer to DWORD
【问题讨论】:
-
xNtUnmapViewOfSection = NtUnmapViewOfSection(GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtUnmapViewOfSection"));是一种不寻常的演员阵容。如果它被写成xNtUnmapViewOfSection = (NtUnmapViewOfSection)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtUnmapViewOfSection");,那么我们分配给函数指针可能会更清楚(而不是像你可能天真假设的那样调用函数)。
标签: c++ winapi function-pointers typedef