一个inlinehook代码有点看不懂可以直接写inlinehook特别是pcode的赋值

WGの执行官

VOID Recoveryhook(PVOID address,PUCHAR code,ULONG codelenth)
{
__asm
{
  cli
   mov eax, cr0
   and eax,not 0x10000
   mov cr0,eax

}
RtlCopyMemory(address,code,codelenth);
__asm
{

  mov eax ,cr0
   or eax, 0x10000
   mov cr0,eax
   sti

}
}

VOID HOOK(PVOID addres ,ULONG Funaddr,PUCHAR presecode, ULONG presecodelength)
{
KdBreakPoint();
PULONG pcode ;
UCHAR JmpCode[] = {0xe9,0x00,0x00,0x00,0x00};  //jmp到你要跳到的地址
RtlCopyMemory(presecode,addres, presecodelength);//参数1保存以前的代码
presecode [presecodelength] = 0xe9;      
pcode = (PULONG)((ULONG)presecode  + presecodelength +1);

*pcode = (ULONG)addres - (ULONG)presecode - 5;  
pcode = (PULONG)((ULONG )JmpCode +1);
*pcode =(ULONG)Funaddr - (ULONG)addres - 5;  //跳Funaddr
Recoveryhook(addres,JmpCode,5);   //将jmpcode的值赋值到addr中去 5个字节      
}