Ret Address Recorder

轉：http://old.xxxxx.im/viewthread.php?tid=25694

還是以前的名字比較好聽我覺得...
這個很好用的喔...稍微改一下還有很多用途...
這裡教了怎麼寫表跟查表...

1. // Ret Address Recorder
2. // Auther: Inndy
3. [ENABLE]
4. Alloc(HookProc, 128)
5. Label(LoopSearch)
6. Label(Return)
7. Label(AddToList)
8. Alloc(EspList, 2048)
9. Alloc(Count, 4)
10. RegisterSymbol(HookProc)
11. RegisterSymbol(EspList)
12. RegisterSymbol(Count)
13. 
    
14. HookProc:
15. Pushad
16. Mov Eax, [Esp+20]
17. Cmp Eax, 00400000 // [Esp] 下限
18. Jl Return
19. Cmp Eax, 01000000 // [Esp] 上限
20. Jg Return
21. Mov Ebx, EspList
22. Mov Ecx, [Count]
23. Test Ecx, Ecx
24. Je AddToList
25. Dec Ecx
26. LoopSearch:
27. Cmp [Ebx+Ecx*4], Eax
28. Je Return
29. Test Ecx, Ecx
30. Je AddToList
31. Dec Ecx
32. Jmp LoopSearch
33. AddToList:
34. Mov Ecx, [Count]
35. Mov [Ebx+Ecx*4], Eax
36. Inc [Count]
37. Return:
38. Popad
39. // Orginal Code Here Please
40. 
    
41. // Jump Back Here Please
42. 
    
43. // {Address}:
44. // Jmp HookProc
45. [DISABLE]
46. // Restore Hook Here Please
47. 
    
48. Dealloc(HookProc)
49. Dealloc(EspList)
50. Dealloc(Count)
51. UnregisterSymbol(HookProc)
52. UnregisterSymbol(EspList)
53. UnregisterSymbol(Count)