可以实现PE HOOK。这种方法对于拦截、分析其他内核驱动的函数调用来说用的比较多。原理是根据替换 PE 格式导出表中的相应函数来实现的。

-Can achieve PE HOOK. This method for the interception, analysis of other core-driven function call is used more. The principle is based on PE format to export table to replace the corresponding function of the implementation.