Windows下的函数hook技术[5]

  case DLL_THREAD_ATTACH:
   break;
  case DLL_THREAD_DETACH:
   break;
  case DLL_PROCESS_DETACH:
   if (UninstallTextoutHook())
   {
    WriteLog("Uninstall hook success.\n");
   }else
   {
    WriteLog("Unintall hook failed.\n");
   }
   break;
    }
    return TRUE;
}

#define DWORD_PTR DWORD*
#define __LOCAL_SIZE 40h

#define NAKED_PROLOG()                                                 \
    DWORD_PTR dwRet ;                                                  \
    DWORD_PTR dwESI ;                                                  \
    {                                                                  \
        __asm PUSH  EBP                 /* Set up the standard frame.*/\
        __asm MOV   EBP , ESP                                          \
        __asm SUB   ESP , __LOCAL_SIZE  /* Save room for the local   */\
                                        /* variables.                */\
        __asm MOV   EAX , EBP           /* EBP has the stack coming  */\
                                        /* into the fn. in it.       */\
        __asm ADD   EAX , 4             /* Account for PUSH EBP      */\
        __asm MOV   EAX , [EAX]         /* Get return address.       */\
        __asm MOV   [dwRet] , EAX       /* Save return address.      */\
        __asm MOV   [dwESI] , ESI       /* Save ESI so chkesp in dbg */\
                                        /* builds works.             */\
    }