Question

如何用MSHookFunction来hook IDA里带有下划线前缀的函数

Answer 1

1. __attribute__((constructor)) void dylibMain()
   
2. {
   
3.     MSHookFunction(((void*)MSFindSymbol(NULL, "_CFUUIDCreate")),(void*)myCFUUIDCreate, (void**)&_orgCFUUIDCreate);
   
4.     MSHookFunction(((void*)MSFindSymbol(NULL, " __imp__CFUUIDCreate")),(void*)myCFUUIDCreate, (void**)&_orgCFUUIDCreate);
   
5. }