用OD载入扫雷，按下F7或F8：
0007FF71 9C PUSHFD
0007FF72 68 54FD0700 PUSH 7FD54
0007FF77 E8 64FDFFFF CALL 0007FCE0
0007FF7C 81C4 04000000 ADD ESP,4
0007FF82 9D POPFD
0007FF83 61 POPAD
0007FF84 81C4 E4020000 ADD ESP,2E4
0007FF8A - E9 923EF800 JMP winmine.<模块入口点>
看看7FCE0：
0007FCE0 83EC 0C SUB ESP,0C
0007FCE3 56 PUSH ESI
0007FCE4 8B7424 14 MOV ESI,DWORD PTR SS:[ESP+14]
0007FCE8 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8]
0007FCEC C74424 04 00000>MOV DWORD PTR SS:[ESP+4],0
0007FCF4 8D46 14 LEA EAX,DWORD PTR DS:[ESI+14]
0007FCF7 50 PUSH EAX
0007FCF8 51 PUSH ECX
0007FCF9 FF56 0C CALL DWORD PTR DS:[ESI+C]
0007FCFC 8D5424 04 LEA EDX,DWORD PTR SS:[ESP+4]
0007FD00 8D4424 08 LEA EAX,DWORD PTR SS:[ESP+8]
0007FD04 52 PUSH EDX
0007FD05 50 PUSH EAX
0007FD06 6A 00 PUSH 0
0007FD08 6A 00 PUSH 0
0007FD0A FF56 08 CALL DWORD PTR DS:[ESI+8]
0007FD0D 8B4E 10 MOV ECX,DWORD PTR DS:[ESI+10]
0007FD10 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4]
0007FD14 83E1 01 AND ECX,1
0007FD17 80F9 01 CMP CL,1
0007FD1A 75 1D JNZ SHORT 0007FD39
0007FD1C 85C0 TEST EAX,EAX
0007FD1E 75 25 JNZ SHORT 0007FD45
0007FD20 8D5424 04 LEA EDX,DWORD PTR SS:[ESP+4]
0007FD24 8D4424 08 LEA EAX,DWORD PTR SS:[ESP+8]
0007FD28 52 PUSH EDX
0007FD29 50 PUSH EAX
0007FD2A 6A 00 PUSH 0
0007FD2C 6A 00 PUSH 0
0007FD2E FF16 CALL DWORD PTR DS:[ESI]
0007FD30 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4]
0007FD34 5E POP ESI
0007FD35 83C4 0C ADD ESP,0C
0007FD38 C3 RETN
0007FD39 85C0 TEST EAX,EAX
0007FD3B 74 08 JE SHORT 0007FD45
0007FD3D 50 PUSH EAX
0007FD3E FF56 04 CALL DWORD PTR DS:[ESI+4]
0007FD41 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4]
0007FD45 5E POP ESI
0007FD46 83C4 0C ADD ESP,0C
0007FD49 C3 RETN
用OD载入任意exe都是如此，求大大指点如何在不结束其他进程的情况下正常调试。
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
