IAT Hooking, QT library
I have a .dll injected into the address space of another process. The target app uses the QT library. I can insert a detour so that each time the QT function ?rowsInserted@QListView@@MAEXABVQModelIndex@@HH@Z is called my function is called ins开发者_如何学编程tead and then the call passed on. However, how do I get access to the parameters passed into ?rowsInserted@QListView@@MAEXABVQModelIndex@@HH@Z? Is this name garbled, in which case what is it normally?
Thanks.
It looks like the function is probably QListView::rowsInserted(const QModelIndex &, int, int)
. The parameters are listed in the function reference.
You could use the undname
tool to undecorate function calls. It ships with Visual C++.
Raymond Chen blogged about it: Undecorating names to see why a function can't be found
C:\Program Files\Microsoft SDKs\Windows\v7.1>undname ?rowsInserted@QListView@@MAEXABVQModelIndex@@HH@Z
Undecoration of :- "?rowsInserted@QListView@@MAEXABVQModelIndex@@HH@Z"
is :- "protected: virtual void __thiscall QListView::rowsInserted(class QModelIndex const &,int,int)"
精彩评论