开发者

IAT Hooking, QT library

I have a .dll injected into the address space of another process. The target app uses the QT library. I can insert a detour so that each time the QT function ?rowsInserted@QListView@@MAEXABVQModelIndex@@HH@Z is called my function is called ins开发者_如何学编程tead and then the call passed on. However, how do I get access to the parameters passed into ?rowsInserted@QListView@@MAEXABVQModelIndex@@HH@Z? Is this name garbled, in which case what is it normally?

Thanks.


It looks like the function is probably QListView::rowsInserted(const QModelIndex &, int, int). The parameters are listed in the function reference.


You could use the undname tool to undecorate function calls. It ships with Visual C++.
Raymond Chen blogged about it: Undecorating names to see why a function can't be found

C:\Program Files\Microsoft SDKs\Windows\v7.1>undname ?rowsInserted@QListView@@MAEXABVQModelIndex@@HH@Z

Undecoration of :- "?rowsInserted@QListView@@MAEXABVQModelIndex@@HH@Z"
is :- "protected: virtual void __thiscall QListView::rowsInserted(class QModelIndex const &,int,int)"
0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜