IDA分析某软件，发现如下的函数调用
.text:0046706F push offset sub_478280
.text:00467074 push offset sub_478220
.text:00467079 push 2
.text:0046707B push 0Ch
.text:0046707D push edx
.text:0046707E call ??_L@YGXPAXIHP6EX0@Z1@Z ; `eh vector constructor iterator'(void *,uint,int,void (*)(void *),void (*)(void *))
这个 call ??_L@YGXPAXIHP6EX0@Z1@Z 我看像是库函数，后2个参数是2个回调函数的地址
请问怎么知道这个函数是哪个库函数呢？（附他的实现过程）
.text:004A009C ; void __stdcall `eh vector constructor iterator'(void *,unsigned int,int,void (__thiscall *)(void *),void (__thiscall *)(void *))
.text:004A009C ??_L@YGXPAXIHP6EX0@Z1@Z proc near ; CODE XREF: sub_42F150+322p
.text:004A009C ; sub_446D30+13p ...
.text:004A009C
.text:004A009C var_20 = dword ptr -20h
.text:004A009C var_1C = dword ptr -1Ch
.text:004A009C var_10 = dword ptr -10h
.text:004A009C var_4 = dword ptr -4
.text:004A009C arg_0 = dword ptr 8
.text:004A009C arg_4 = dword ptr 0Ch
.text:004A009C arg_8 = dword ptr 10h
.text:004A009C arg_C = dword ptr 14h
.text:004A009C
.text:004A009C push ebp
.text:004A009D mov ebp, esp
.text:004A009F push 0FFFFFFFFh
.text:004A00A1 push offset unk_4A9118
.text:004A00A6 push offset loc_4A006C
.text:004A00AB mov eax, large fs:0
.text:004A00B1 push eax
.text:004A00B2 mov large fs:0, esp
.text:004A00B9 sub esp, 10h
.text:004A00BC push ebx
.text:004A00BD push esi
.text:004A00BE push edi
.text:004A00BF xor eax, eax
.text:004A00C1 mov [ebp+var_20], eax
.text:004A00C4 mov [ebp+var_4], eax
.text:004A00C7 mov [ebp+var_1C], eax
.text:004A00CA
.text:004A00CA loc_4A00CA: ; CODE XREF: `eh vector constructor iterator'(void *,uint,int,void (*)(void *),void (*)(void *))+47j
.text:004A00CA mov eax, [ebp+var_1C]
.text:004A00CD cmp eax, [ebp+arg_8]
.text:004A00D0 jge short loc_4A00E5
.text:004A00D2 mov esi, [ebp+arg_0]
.text:004A00D5 mov ecx, esi
.text:004A00D7 call [ebp+arg_C]
.text:004A00DA add esi, [ebp+arg_4]
.text:004A00DD mov [ebp+arg_0], esi
.text:004A00E0 inc [ebp+var_1C]
.text:004A00E3 jmp short loc_4A00CA
.text:004A00E5 ; ----------------------------------------------------------------------------
.text:004A00E5
.text:004A00E5 loc_4A00E5: ; CODE XREF: `eh vector constructor iterator'(void *,uint,int,void (*)(void *),void (*)(void *))+34j
.text:004A00E5 mov [ebp+var_20], 1
.text:004A00EC or [ebp+var_4], 0FFFFFFFFh
.text:004A00F0 call sub_4A0106
.text:004A00F5 mov ecx, [ebp+var_10]
.text:004A00F8 mov large fs:0, ecx
.text:004A00FF pop edi
.text:004A0100 pop esi
.text:004A0101 pop ebx
.text:004A0102 leave
.text:004A0103 retn 14h
.text:004A0103 ??_L@YGXPAXIHP6EX0@Z1@Z endp
/////////////////////////////////////
//call sub_4A0106
/////////////////////////////////////
.text:004A0106
.text:004A0106 sub_4A0106 proc near ; CODE XREF: `eh vector constructor iterator'(void *,uint,int,void (*)(void *),void (*)(void *))+54p
.text:004A0106 cmp dword ptr [ebp-20h], 0
.text:004A010A jnz short locret_4A011D
.text:004A010C push dword ptr [ebp+18h]
.text:004A010F push dword ptr [ebp-1Ch]
.text:004A0112 push dword ptr [ebp+0Ch]
.text:004A0115 push dword ptr [ebp+8]
.text:004A0118 call ?__ArrayUnwind@@YGXPAXIHP6EX0@Z@Z ; __ArrayUnwind(void *,uint,int,void (*)(void *))
.text:004A011D
.text:004A011D locret_4A011D: ; CODE XREF: sub_4A0106+4j
.text:004A011D retn
.text:004A011D sub_4A0106 endp
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
