关于hook掉sysctl反调试的问题

@Iri wrote:

想直接hook掉sysctl函数，在hook函数执行原sysctl函数，再把info.kp_proc.p_flag直接赋值 = 0；但是一直编译不过去：
member reference base type 'void' is not a structure or union
，我应该怎么改呢？(c++弱鸡求指导下。。。)

#include <sys/types.h>
#include <sys/sysctl.h>
#import <substrate.h>


int (*old_sysctlHook)(int *a, u_int mib, void *info, size_t *size, void *e, size_t f);

int sysctlHook(int *a, u_int mib, void *info, size_t *size, void *e, size_t f) {
    printf("--------hooksysctlSuccess-------");

    int value =  old_sysctlHook(a,mib,info,size,e,f);

    info.kp_proc.p_flag = 0;

    return value;
}

%ctor {
    MSHookFunction((int *)MSFindSymbol(NULL,"_sysctl"), (int *)sysctlHook, (int **)&old_sysctlHook);
}

Posts: 2

Participants: 2

Read full topic