6.2.2按照书上的方法调试Heap_debug会提前停在Kernel32的代码里，
即使直接用Olly调试 也是同样结果
7C92E47A 8BFF mov edi, edi
7C92E47C > 8B4C24 04 mov ecx, dword ptr [esp+4]
7C92E480 8B1C24 mov ebx, dword ptr [esp]
7C92E483 51 push ecx
7C92E484 53 push ebx
7C92E485 E8 F1C00100 call 7C94A57B
7C92E48A 0AC0 or al, al
7C92E48C 74 0C je short 7C92E49A
7C812A60 5F pop edi
7C812A61 8D45 B0 lea eax, dword ptr [ebp-50]
7C812A64 50 push eax
7C812A65 FF15 0815807C call dword ptr [<&ntdll.RtlRaiseExcep>; ntdll.RtlRaiseException
7C812A6B 5E pop esi
7C812A6C C9 leave
7C812A6D C2 1000 retn 10
7C812A70 85FF test edi, edi
7C812A72 ^ 0F8E 3693FFFF jle 7C80BDAE
7C812A78 8B55 FC mov edx, dword ptr [ebp-4]
7C93DF15 8985 74FFFFFF mov dword ptr [ebp-8C], eax
7C93DF1B 8B40 30 mov eax, dword ptr [eax+30]
7C93DF1E F640 69 01 test byte ptr [eax+69], 1
7C93DF22 0F85 3A0C0200 jnz 7C95EB62
7C93DF28 803D C1E1997C 0>cmp byte ptr [7C99E1C1], 0
7C93DF2F 0F85 3A0C0200 jnz 7C95EB6F
7C93DF35 8D45 CC lea eax, dword ptr [ebp-34]
7C93DF38 50 push eax
7C93DF39 6A 0E push 0E
7C93DF3B 6A 01 push 1
7C93DF3D FF76 18 push dword ptr [esi+18]
7C93DF40 E8 0124FFFF call RtlImageDirectoryEntryToData 在这里
7C93DF45 8985 6CFFFFFF mov dword ptr [ebp-94], eax
7C93DF4B 85C0 test eax, eax
7C93DF4D 0F85 330C0200 jnz 7C95EB86
7C93DF53 F646 36 80 test byte ptr [esi+36], 80
7C93DF57 75 0D jnz short 7C93DF66
7C93DF59 FF76 18 push dword ptr [esi+18]
7C93DF5C 6A FF push -1
7C93DF5E E8 ABFFFEFF call ZwUnmapViewOfSection
7C93DF63 8945 C8 mov dword ptr [ebp-38], eax
7C93DF66 FF76 18 push dword ptr [esi+18]
7C93DF69 E8 53B8FFFF call LdrUnloadAlternateResourceModule
7C93DF6E 33C0 xor eax, eax
7C93DF70 3805 C4E0997C cmp byte ptr [7C99E0C4], al
7C93DF76 0F95C0 setne al
7C93DF79 50 push eax
7C93DF7A 56 push esi
7C93DF7B E8 EAFDFFFF call 7C93DD6A
7C93DF80 837E 4C 00 cmp dword ptr [esi+4C], 0
7C93DF84 0F85 090C0200 jnz 7C95EB93
7C93DF8A 56 push esi
7C93DF8B E8 16000000 call 7C93DFA6
7C93DF90 3B35 24E2997C cmp esi, dword ptr [7C99E224]
这是因为不同OS的原因么 我的环境是XP SP2
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
