NTSTATUS
__stdcall
NtCreateSection[color=#0000ff](PHANDLE SectionHandle,
       ACCESS_MASK DesiredAccess,
       POBJECT_ATTRIBUTES ObjectAttributes,
       PLARGE_INTEGER SectionSize,
       ULONG Protect,
       ULONG Attributes,
       HANDLE FileHandle)
{
       NTSTATUS status = 0;
       PFILE_OBJECT FileObject;
       int var_1C;
       int var_20;
       int var_24;
       int var_34;

       if (Attributes & 0E29FFFFFh)
              return STATUS_INVALID_PARAMETER_6;

       if (!(Attributes & 0D000000h))
              return STATUS_INVALID_PARAMETER_6;

       if (!(Attributes & 1000000h))
              return STATUS_INVALID_PARAMETER_6;

       if (Attributes & 1C400000h)
              return STATUS_INVALID_PARAMETER_6;

       if ((Attributes & 8000000h) && (Attributes & 8000000h))
              return STATUS_INVALID_PARAMETER_6;

       if (Protect < PAGE_EXECUTE_READWRITE)
              return STATUS_INVALID_PAGE_PROTECTION;

       if (UserMode == KeGetPreviousMode())
       {
              try
              {
                     MmUserProbeAddress();
                     //这里不是太懂
       }
              except (EXCEPTION_EXECUTE_HANDLER)
              {
                     return GetExceptionCode();
              }
       }

       var_1C = 0;
       while (true)
       {
              status = MmCreateSection(&var_24, DesiredAccess, ObjectAttributes, &var_34, Protect, Attributes, FileHandle, 0);
              if (status > 0)
              {
                     if (STATUS_FILE_LOCK_CONFLICT == status)
                     {
                            KeDelayExecutionThread(0, 0, MmHalfSecond);
                            continue;
                     }
                     else
                            return status;
              }
              else
                     break;
       }
       if (0 != *(&var_24 + 14h))
       {
              FileObject = *(*(&var_24 + 14h) + 24h);
              if (NULL != FileObject)
                     CcZeroEndOfLastPage(FileObject);
       }
       status = ObInsertObject(var_24, 0, DesiredAccess, 0, 0, &var_20);
       if (status > 0)
              return status;
       *SectionHandle = var_20;
       return status;
}

NTSTATUS
NtCreateSection [color=#0000ff](
    __out PHANDLE SectionHandle,
    __in ACCESS_MASK DesiredAccess,
    __in_opt POBJECT_ATTRIBUTES ObjectAttributes,
    __in_opt PLARGE_INTEGER MaximumSize,
    __in ULONG SectionPageProtection,
    __in ULONG AllocationAttributes,
    __in_opt HANDLE FileHandle
    )
/*++
Routine Description:
    This function creates a section object and opens a handle to the object
    with the specified desired access.

Arguments:

    SectionHandle - A pointer to a variable that will
        receive the section object handle value.

    DesiredAccess - The desired types of access for the section.

    DesiredAccess Flags
         EXECUTE - Execute access to the section is desired.
         READ - Read access to the section is desired.
         WRITE - Write access to the section is desired.

    ObjectAttributes - Supplies a pointer to an object attributes structure.

    MaximumSize - Supplies the maximum size of the section in bytes.
                  This value is rounded up to the host page size and
                  specifies the size of the section (page file
                  backed section) or the maximum size to which a
                  file can be extended or mapped (file backed
                  section).

    SectionPageProtection - Supplies the protection to place on each page
                            in the section.  One of PAGE_READ, PAGE_READWRITE,
                            PAGE_EXECUTE, or PAGE_WRITECOPY and, optionally,
                            PAGE_NOCACHE or PAGE_WRITECOMBINE
                            may be specified.

    AllocationAttributes - Supplies a set of flags that describe the
                           allocation attributes of the section.

        AllocationAttributes Flags

        SEC_BASED - The section is a based section and will be
                    allocated at the same virtual address in each process
                    address space that receives the section.  This does not
                    imply that addresses are reserved for based sections.
                    Rather if the section cannot be mapped at the based address
                    an error is returned.

        SEC_RESERVE - All pages of the section are set to the reserved state.

        SEC_COMMIT - All pages of the section are set to the commit state.

        SEC_IMAGE - The file specified by the file handle is an
                    executable image file.

        SEC_FILE - The file specified by the file handle is a mapped
                   file.  If a file handle is supplied and neither
                   SEC_IMAGE or SEC_FILE is supplied, SEC_FILE is
                   assumed.

        SEC_NO_CHANGE - Once the file is mapped, the protection cannot
                        be changed nor can the view be unmapped.  The
                        view is unmapped when the process is deleted.
                        Cannot be used with SEC_IMAGE.

        SEC_LARGE_PAGES - The section will be created using large pages.
                          This physical memory is allocated immediately upon
                          section creation (instead of upon access).  If
                          contiguous physical memory for the large page(s)
                          cannot be found, then the section creation will fail
                          (rather than use small pages).
                          Since this physical memory is allocated up front and
                          is nonpaged (to ensure it remains physically
                          contiguous and in a large page), privilege is
                          required.  Since section mappers can extend the
                          section life indefinitely, section creators should
                          ensure proper access permissions are used.
                          Note subsequent mapped views must specify a large
                          page aligned start address and length (or must
                          have available virtual space so the system can find
                          one) for them to automatically receive large page(s)
                          for the view.  Callers of the map APIs do not need
                          to specify large pages - the system will automatically
                          provide the mapping in large pages (assuming
                          satisfactory alignment) or small pages if not.

    FileHandle - Supplies an optional handle of an open file object.
                 If the value of this handle is NULL, then the
                 section will be backed by a paging file.  Otherwise
                 the section is backed by the specified data file.

Return Value:
    NTSTATUS.
--*/
{
    NTSTATUS Status;
    PVOID Section;
    HANDLE Handle;
    LARGE_INTEGER LargeSize;
    LARGE_INTEGER CapturedSize;
    ULONG RetryCount;
    PCONTROL_AREA ControlArea;

    if ((AllocationAttributes & ~(SEC_COMMIT | SEC_RESERVE | SEC_BASED |
            SEC_LARGE_PAGES | SEC_IMAGE | SEC_NOCACHE |
            SEC_NO_CHANGE)) != 0) {
        return STATUS_INVALID_PARAMETER_6;
    }

    if ((AllocationAttributes & (SEC_COMMIT | SEC_RESERVE | SEC_IMAGE)) == 0) {
        return STATUS_INVALID_PARAMETER_6;
    }

    if ((AllocationAttributes & SEC_IMAGE) &&
            (AllocationAttributes & (SEC_COMMIT | SEC_RESERVE |
                            SEC_LARGE_PAGES |
                            SEC_NOCACHE | SEC_NO_CHANGE))) {
        return STATUS_INVALID_PARAMETER_6;
    }

    if ((AllocationAttributes & SEC_COMMIT) &&
            (AllocationAttributes & SEC_RESERVE)) {
        return STATUS_INVALID_PARAMETER_6;
    }

    //
    // Check the SectionProtection Flag.
    //

    if ((SectionPageProtection & PAGE_NOCACHE) ||
        (SectionPageProtection & PAGE_WRITECOMBINE) ||
        (SectionPageProtection & PAGE_GUARD) ||
        (SectionPageProtection & PAGE_NOACCESS)) {

        //
        // No cache is only specified through the SEC_NOCACHE
        // option in the allocation attributes.
        //

        return STATUS_INVALID_PAGE_PROTECTION;
    }

    if (KeGetPreviousMode() != KernelMode) {
        try {
            ProbeForWriteHandle(SectionHandle);
            if (ARGUMENT_PRESENT (MaximumSize)) {
#if !defined (_WIN64)

                //
                // Note we only probe for byte alignment because prior to 2195,
                // we never probed at all!  We don"t want to break user apps
                // that had bad alignment if they worked before.
                //

                ProbeForReadSmallStructure(MaximumSize, sizeof(LARGE_INTEGER), sizeof(UCHAR));
#else

                ProbeForReadSmallStructure(MaximumSize, sizeof(LARGE_INTEGER), PROBE_ALIGNMENT (LARGE_INTEGER));

#endif
                LargeSize = *MaximumSize;
            }
            else {
                ZERO_LARGE (LargeSize);
            }
        } except (EXCEPTION_EXECUTE_HANDLER) {
            return GetExceptionCode();
        }
    }
    else {
        if (ARGUMENT_PRESENT (MaximumSize)) {
            LargeSize = *MaximumSize;
        }
        else {
            ZERO_LARGE (LargeSize);
        }
    }
    RetryCount = 0;

retry:
    CapturedSize = LargeSize;
    ASSERT (KeGetCurrentIrql() < DISPATCH_LEVEL);
    Status = MmCreateSection (&Section,
                              DesiredAccess,
                              ObjectAttributes,
                              &CapturedSize,
                              SectionPageProtection,
                              AllocationAttributes,
                              FileHandle,
                              NULL);

    ASSERT (KeGetCurrentIrql() < DISPATCH_LEVEL);
    if (!NT_SUCCESS(Status)) {
        if ((Status == STATUS_FILE_LOCK_CONFLICT) &&
            (RetryCount < 3)) {

            //
            // The file system may have prevented this from working
            // due to log file flushing.  Delay and try again.
            //

            RetryCount += 1;
            KeDelayExecutionThread (KernelMode,
                                    FALSE,
                                    (PLARGE_INTEGER)&MmHalfSecond);
            goto retry;
        }
        return Status;
    }

    ControlArea = ((PSECTION)Section)->Segment->ControlArea;
    if ((ControlArea != NULL) && (ControlArea->FilePointer != NULL)) {
        CcZeroEndOfLastPage (ControlArea->FilePointer);
    }

    //
    // Note if the insertion fails, Ob will dereference the object for us.
    //

    Status = ObInsertObject (Section,
                             NULL,
                             DesiredAccess,
                             0,
                             (PVOID *)NULL,
                             &Handle);

    if (NT_SUCCESS(Status)) {
        try {
            *SectionHandle = Handle;
        } except (EXCEPTION_EXECUTE_HANDLER) {
            //
            // If the write attempt fails, then do not report an error.
            // When the caller attempts to access the handle value,
            // an access violation will occur.
            //
        }
    }
    return Status;
}

int f(int i)
{
    if(i < 10)
    {
        int* p = &i;
        char a = (char)i;
        char b = *((char*)p + 1);
        char c = *((char*)p + 2);
        char d = *((char*)p + 3);
        returna * b * c * d;
    }
    returnf(i) + f(i - 1);
}

00401000  push        ebx                   //保护寄存器
00401001  mov         ebx,dword ptr [esp+8] //将i赋给ebx
00401005  cmp         ebx,0Ah               //比较i和10的大小(i - 0Ah)
00401008  jge         401025h               //大于等于跳转
0040100A  movsx       ecx,byte ptr [esp+0Ah]//ecx = *((char*)p + 2);
0040100F  movsx       edx,byte ptr [esp+0Bh]//edx = *((char*)p + 3);
00401014  movsx       eax,bh                //eax = *((char*)p + 1);
00401017  imul        eax,ecx               //eax = eax * ecx;
0040101A  imul        eax,edx               //eax = eax * dex;
0040101D  movsx       ecx,bl                //ecx = (char)i;
00401020  imul        eax,ecx               //eax = eax * ecx;
00401023  pop         ebx                   //恢复寄存器
00401024  ret                               //返回
00401025  lea         edx,[ebx-1]           //edx = ebx - i;
00401028  push        esi                   //保护寄存器
00401029  push        edx                   //传递参数
0040102A  call        401000h               //f(i - 1)
0040102F  push        ebx                   //传递参数
00401030  mov         esi,eax               //esi = eax = f(i - 1)
00401032  call        401000h               //f(i)
00401037  add         esp,8                 //维护堆栈平衡
0040103A  add         eax,esi               //eax = f(i) + f(i - 1)
0040103C  pop         esi                   //恢复寄存器
0040103D  pop         ebx                   //恢复寄存器
0040103E  ret                               //返回

        int f(int i)
       {  
       if (i < 2)
            return 1;
        return f(i) + f(i - 1);
    }

00401000  push    esi
00401001  mov     esi, dword ptr [esp+8]    //esp+8对应的时参数i
00401005  cmp     esi, 2                    //(i < 2)?
00401008  jge     short 00401011
0040100A  mov     eax, 1                    // eax对应的是返回值，这里返回1
0040100F  pop     esi
00401010  retn
00401011  lea     eax, dword ptr [esi-2]    //eax = i–2;
00401014  push    edi
00401015  push    eax                       //传递参数
00401016  call    00401000
0040101B  add     esi, -1                   //esi = i–1;
0040101E  push    esi                       //传递参数
0040101F  mov     edi, eax                  //edi = f(i–2);
00401021  call    00401000
00401026  add     esp, 8                    //参见第4点
00401029  add     eax, edi                  //eax = f(i–1) + edi
0040102B  pop     edi
0040102C  pop     esi
0040102D  retn

004114B0    55              push    ebp
004114B1    8BEC            mov     ebp, esp
004114B3    81EC C0000000   sub     esp, 0C0
004114B9    53              push    ebx
004114BA    56              push    esi
004114BB    57              push    edi
004114BC    8DBD 40FFFFFF   lea     edi, dword ptr [ebp-C0]
004114C2    B9 30000000     mov     ecx, 30
004114C7    B8 CCCCCCCC     mov     eax, CCCCCCCC
004114CC    F3:AB           rep     stos dword ptr es:[edi]
004114CE    837D 08 02      cmp     dword ptr [ebp+8], 2
004114D2    7D 07           jge     short 004114DB
004114D4    B8 01000000     mov     eax, 1
004114D9    EB 22           jmp     short 004114FD
004114DB    8B45 08         mov     eax, dword ptr [ebp+8]
004114DE    83E8 01         sub     eax, 1
004114E1    50              push    eax
004114E2    E8 72FCFFFF     call    00411159
004114E7    83C4 04         add     esp, 4
004114EA    8BF0            mov     esi, eax
004114EC    8B4D 08         mov     ecx, dword ptr [ebp+8]
004114EF    83E9 02         sub     ecx, 2
004114F2    51              push    ecx
004114F3    E8 61FCFFFF     call    00411159
004114F8    83C4 04         add     esp, 4
004114FB    03C6            add     eax, esi
004114FD    5F              pop     edi
004114FE    5E              pop     esi
004114FF    5B              pop     ebx
00411500    81C4 C0000000   add     esp, 0C0
00411506    3BEC            cmp     ebp, esp
00411508    E8 97FCFFFF     call    004111A4
0041150D    8BE5            mov     esp, ebp
0041150F    5D              pop     ebp
00411510    C3              retn

for (int i = 0; i < 10; i++)
{
    int dword = sizeof(int);
}

0041137e c745f800000000  mov     dword ptr [ebp-8],0   //int i = 0;
00411385 eb09            jmp     00411390              //跳转到循环条件
00411387 8b45f8          mov     eax,dword ptr [ebp-8] //i++
0041138a 83c001          add     eax,1
0041138d 8945f8          mov     dword ptr [ebp-8],eax
00411390 837df80a        cmp     dword ptr [ebp-8],0Ah //(i < 10)?
00411394 7d09            jge     0041139f              //如果i >= 10则跳转
00411396 c745ec04000000  mov     dword ptr [ebp-14h],4 //循环内容
0041139d ebe8            jmp     00411387              //进行下一次循环
0041139f 33c0            xor     eax,eax               //结束

void main()
{
   for (int i = 0; i < 10; i++)
   {
    int dword = sizeof(dword);
   }
}

00401000 33c0            xor     eax,eax
00401002 c3              ret

int main()
{
   int t = 0;
   for (int i = 0; i < 10; i++)
   {
    int dword = sizeof(dword);
    t += dword;
   }
   return t;
}

00401000 b828000000      mov     eax,28h
00401005 c3              ret

        mov     eax, 0
        jmp     compare
        increase:
        add     eax, 1
        compare:
        cmp     eax, 0Ah
        jge     end
        mov     dword ptr [ebp-14h],4
        jmp     increase
end:  
        xor     eax,eax

void SetLastError(DWORD dwErrCode)
{
//这里的dwLastErr指向当前线程的最后一个错误的缓存地址
extern DWORD *dwLastErr = edi + 34h;
//这条语句估计时调试时用的，暂时不知道g_dwLastErrorToBreakOn这个全局变量有什么用- -
if (0 != g_dwLastErrorToBreakOn && dwErrCode == g_dwLastErrorToBreakOn)
  DbgBreakPoint();
  
if (dwErrCode == *dwLastErr)
  return;
else
{
  *dwLastErr == dwErrCode;
  return;
}
}

AMS
0:000> uf Kernel32!SetLastError
kernel32!SetLastError:
7c809342 8bff            mov     edi,edi
7c809344 55              push    ebp
7c809345 8bec            mov     ebp,esp
7c809347 56              push    esi
7c809348 57              push    edi
7c809349 64a118000000    mov     eax,dword ptr fs:[00000018h]
7c80934f 8b7508          mov     esi,dword ptr [ebp+8]
7c809352 8bf8            mov     edi,eax
7c809354 a1c456887c      mov     eax,dword ptr [kernel32!g_dwLastErrorToBreakOn (7c8856c4)]
7c809359 85c0            test    eax,eax
7c80935b 0f85a6080300    jne     kernel32!SetLastError+0x1b (7c839c07)

kernel32!SetLastError+0x24:
7c809361 397734          cmp     dword ptr [edi+34h],esi
7c809364 0f8541040000    jne     kernel32!SetLastError+0x29 (7c8097ab)

kernel32!SetLastError+0x2c:
7c80936a 5f              pop     edi
7c80936b 5e              pop     esi
7c80936c 5d              pop     ebp
7c80936d c20400          ret     4

kernel32!SetLastError+0x29:
7c8097ab 897734          mov     dword ptr [edi+34h],esi
7c8097ae e9b7fbffff      jmp     kernel32!SetLastError+0x2c (7c80936a)

kernel32!SetLastError+0x1b:
7c839c07 3bf0            cmp     esi,eax
7c839c09 0f8552f7fcff    jne     kernel32!SetLastError+0x24 (7c809361)

kernel32!SetLastError+0x1f:
7c839c0f e86a6c0400      call    kernel32!DbgBreakPoint (7c88087e)
7c839c14 e948f7fcff      jmp     kernel32!SetLastError+0x24 (7c809361)

#include "windows.h"
#include "detours.h"

//
// Trampolines
//

DETOUR_TRAMPOLINE(int __stdcall Real_MessageBoxW(HWND hWnd,
            LPCWSTR lpText,
            LPCWSTR lpCaption,
            UINT uType),
                  MessageBoxW);

//
// Detours
//

int __stdcall Mine_MessageBoxW(HWND hWnd,
      LPCWSTR lpText,
      LPCWSTR lpCaption,
      UINT uType)
{
        return Real_MessageBoxW(hWnd, lpText, L"嘿嘿,Hook住啦!", uType);
}

//
// TrampolineWith
//

void TrampolineWith(void)
{
        DetourFunctionWithTrampoline((PBYTE)Real_MessageBoxW,
                                 (PBYTE)Mine_MessageBoxW);
}

//
// RemoveTrampoline
//

void RemoveTrampoline(void)
{
        DetourRemove((PBYTE)Real_MessageBoxW,(PBYTE)Mine_MessageBoxW);
}

int main()
{
        MessageBoxW(NULL, L"Just a simple test.", L"Info", MB_OK);
        TrampolineWith();
        MessageBoxW(NULL, L"Just a simple test.", L"Info", MB_OK);
        RemoveTrampoline();
        MessageBoxW(NULL, L"Just a simple test.", L"Info", MB_OK);
        return 0;
}

unsafe
{
    fixed (byte* ptr = &key[0])
    {
        Encrypt(ptr, BUFFER_SIZE);
    }
}