[MetaHook] Find a function signature

Find a non-public function signature, we need a tool "IDA Pro"

( You can open picture in a new window :D )

Step 1

Load your PE file in IDA

[MetaHook] Find a function signature

Step 2

Find your function, you can use F5 to decompile a function

You can refer to the string and function to locate your function

[MetaHook] Find a function signature

Step 3

Find your function signature

Open IDA Hex view

[MetaHook] Find a function signature

And double-click your function in Function List (on IDA Window left)

[MetaHook] Find a function signature

All right, this is your function signature, copy this line

Step 4

Maby you use the signature in C/C++

[MetaHook] Find a function signature

Now, you can use SearchPattern() to get the function address in memory.

上一篇:Prism 5 + MEF中的ModuleCatalog.CreateFromXaml问题


下一篇:无需密码卸载360天擎