如何获得hooked winapi函数的通话后参数？

Question

对于这个例子我谈论挂钩调用BeginPaint（），我迷上很好，我可以正常地访问所有呼叫前...

HDC WINAPI Mine_BeginPaint(HWND hWnd, LPPAINTSTRUCT lpPaint) 
{ 


    // do stuff here, inspecting PRE-CALL lppaint struct etc... 

    return fpBeginPaint(hWnd, lpPaint); 


} 

我正在寻找一种方式来检查这个lpPaint结构调用后，我怎么能这样做？

Answer 1

HDC WINAPI Mine_BeginPaint(HWND hWnd, LPPAINTSTRUCT lpPaint){ 
    // do stuff here, inspecting PRE-CALL lppaint struct etc... 
    HDC result = fpBeginPaint(hWnd, lpPaint); 
    //inspect here whatever you want. 
    return result; 
}