was der Quellcode da bewirken soll, brauch ich ja nicht großartig sagen - einfach ein event-logger (mouse und keyboard),
aber wieso der als 32-bit Proggi genau das macht was ich erwarte und als 64-bit Proggi genau nix passiert, soll ma mal einer erklären;
Spoiler anzeigen
C: evt.c
#include <stdio.h>
#include <windows.h>
#ifdef _WIN64
const char* pszSetKbdOutput = "SetKbdOutput";
const char* pszKeybrdProc = "KeybrdProc";
const char* pszSetMouseOutput = "SetMouseOutput";
const char* pszMouseProc = "MouseProc";
#else
const char* pszSetKbdOutput = "_SetKbdOutput@4";
const char* pszKeybrdProc = "_KeybrdProc@12";
const char* pszSetMouseOutput = "_SetMouseOutput@4";
const char* pszMouseProc = "_MouseProc@12";
#endif
LRESULT (CALLBACK * pfnSetKbdOutput) ( void (CALLBACK *) ( WPARAM, LPARAM ) );
LRESULT (CALLBACK * pfnKeybrdProc) ( int, WPARAM, LPARAM );
LRESULT (CALLBACK * pfnSetMouseOutput) ( void (CALLBACK *) ( WPARAM, LPARAM ) );
LRESULT (CALLBACK * pfnMouseProc) ( int, WPARAM, LPARAM );
void CALLBACK kbdOutput( WPARAM wParam, LPARAM lParam );
void CALLBACK mouseOutput( WPARAM wParam, LPARAM lParam );
void messageLoop( void );
int main( int argc, char* argv[ ] )
{
HMODULE hMod = LoadLibrary( ".\\evtfunc.dll" );
printf( "evt-logger: ...\n" );
if ( hMod )
{
pfnSetKbdOutput = (LRESULT (CALLBACK*) (void(CALLBACK*)(WPARAM,LPARAM))) GetProcAddress( hMod, pszSetKbdOutput );
pfnKeybrdProc = (LRESULT (CALLBACK*) (int,WPARAM,LPARAM)) GetProcAddress( hMod, pszKeybrdProc );
pfnSetMouseOutput = (LRESULT (CALLBACK*) (void(CALLBACK*)(WPARAM,LPARAM))) GetProcAddress( hMod, pszSetMouseOutput );
pfnMouseProc = (LRESULT (CALLBACK*) (int,WPARAM,LPARAM)) GetProcAddress( hMod, pszMouseProc );
if ( pfnSetKbdOutput && pfnKeybrdProc && pfnSetMouseOutput && pfnMouseProc )
{
pfnSetKbdOutput( kbdOutput );
pfnSetMouseOutput( mouseOutput );
if ( SetWindowsHookEx( WH_KEYBOARD, pfnKeybrdProc, (HINSTANCE) hMod, 0 ) &&
SetWindowsHookEx( WH_MOUSE, pfnMouseProc, (HINSTANCE) hMod, 0 ) )
{
messageLoop( );
}
else
printf( "SetWindowsHookEx failed.\n" );
}
else
printf( "GetProcAddress failed: entry-points not found.\n" );
}
else
printf( "LoadLibrary failed.\n" );
return 0;
}
void CALLBACK kbdOutput( WPARAM wParam, LPARAM lParam )
{
printf( "[kbd] wParam: 0x%08x, lParam: 0x%08lx\n", wParam, lParam );
}
void CALLBACK mouseOutput( WPARAM wParam, LPARAM lParam )
{
printf( "[mouse] wParam: 0x%08x, lParam: 0x%08lx\n", wParam, lParam );
}
void messageLoop( void )
{
MSG msg;
while ( GetMessage( (LPMSG) &msg, (HWND) NULL, (UINT) 0, (UINT) 0 ) )
{
TranslateMessage( (CONST MSG*) &msg );
DispatchMessage( (CONST MSG*) &msg );
}
}C: evtfunc.c
#include <windows.h>
static void (CALLBACK * pfnKbdOutput) ( WPARAM wParam, LPARAM lParam ) = (void (CALLBACK *) ( WPARAM, LPARAM )) NULL;
static void (CALLBACK * pfnMouseOutput) ( WPARAM wParam, LPARAM lParam ) = (void (CALLBACK *) ( WPARAM, LPARAM )) NULL;
__declspec( dllexport ) LRESULT CALLBACK SetKbdOutput( void (CALLBACK * pfnKbdOutputArg) ( WPARAM, LPARAM ) );
__declspec( dllexport ) LRESULT CALLBACK SetMouseOutput( void (CALLBACK * pfnMouseOutputArg) ( WPARAM, LPARAM ) );
__declspec( dllexport ) LRESULT CALLBACK KeybrdProc( int code, WPARAM wParam, LPARAM lParam );
__declspec( dllexport ) LRESULT CALLBACK MouseProc( int code, WPARAM wParam, LPARAM lParam );
LRESULT CALLBACK SetKbdOutput( void (CALLBACK * pfnKbdOutputArg) ( WPARAM, LPARAM ) )
{
pfnKbdOutput = pfnKbdOutputArg;
return (LRESULT) 0;
}
LRESULT CALLBACK SetMouseOutput( void (CALLBACK * pfnMouseOutputArg) ( WPARAM, LPARAM ) )
{
pfnMouseOutput = pfnMouseOutputArg;
return (LRESULT) 0;
}
LRESULT CALLBACK KeybrdProc( int code, WPARAM wParam, LPARAM lParam )
{
if ( ( code == HC_ACTION ) || ( code == HC_NOREMOVE ) )
{
if ( pfnKbdOutput )
pfnKbdOutput( wParam, lParam );
}
return CallNextHookEx( (HHOOK) NULL, code, wParam, lParam );
}
LRESULT CALLBACK MouseProc( int code, WPARAM wParam, LPARAM lParam )
{
if ( ( code == HC_ACTION ) || ( code == HC_NOREMOVE ) )
{
if ( pfnMouseOutput )
pfnMouseOutput( wParam, lParam );
}
return CallNextHookEx( (HHOOK) NULL, code, wParam, lParam );
}kompiliert und gelinkt wird des so:
cl.exe /LD /MD evtfunc.c user32.lib bufferoverflowu.lib
cl.exe /MD evt.c user32.lib bufferoverflowu.lib
und aufgerufen einfach so
evt.exe
)
