我喜欢替换静态函数地址：

 AddressOfHookSoundFunction = (DWORD)GetModuleHandleA("myfile.exe") + 0x0F3B65; // good: 4406117 (integer)

使用签名模式：

 SigScan Scanner;

 AddressOfHookSoundFunction = Scanner.FindPattern("myfile.exe", "\x55\x8B\xEC\x83\xEC\x14\x53\x56\x8B", "xxxxxxxxx"); // bad: 3685831 (integer)

但该值不同，仅适用于静态地址：0x0F3B65

这里是 IDA 截图：

可能我插入了错误的转储信息。

这里是签名扫描的代码：

class SigScan
{
public:
    // For getting information about the executing module
    MODULEINFO GetModuleInfo(char *szModule)
    {
        MODULEINFO modinfo = { 0 };
        HMODULE hModule = GetModuleHandleA(szModule);
        if (hModule == 0)
            return modinfo;
        GetModuleInformation(GetCurrentProcess(), hModule, &modinfo, sizeof(MODULEINFO));
        return modinfo;
    }

    // for finding a signature/pattern in memory of another process
    DWORD FindPattern(char *module, char *pattern, char *mask)
    {
        MODULEINFO mInfo = GetModuleInfo(module);
        DWORD base = (DWORD)mInfo.lpBaseOfDll;
        DWORD size = (DWORD)mInfo.SizeOfImage;
        DWORD patternLength = (DWORD)strlen(mask);

        for (DWORD i = 0; i < size - patternLength; i++)
        {
            bool found = true;
            for (DWORD j = 0; j < patternLength; j++)
            {
                found &= mask[j] == '?' || pattern[j] == *(char*)(base + i + j);
            }
            if (found)
            {
                return base + i;
            }
        }

        return NULL;
    }
};

你能帮我吗 ？