在一个微博上看到一篇文章 简单逆向微软EMET工具的小功能
http://blog.sina.com.cn/s/blog_6fc131560100n96c.html
我也用了windbg调试，第一个用windbg。我打开程序后，F5运行，确实是停在这里了：
0:000> g
ModLoad: 5cc30000 5cc56000 C:\WINDOWS\system32\ShimEng.dll
ModLoad: 003b0000 003c1000 C:\WINDOWS\AppPatch\emet.dll
ModLoad: 77be0000 77c38000 C:\WINDOWS\system32\msvcrt.dll
(d5c.d4c): Single step exception - code 80000004 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00002654 ecx=7c80262c edx=0c917432 esi=7c807649 edi=00000244
eip=014e007c esp=0013faf4 ebp=7c800000 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202
014e007c 03dd add ebx,ebp
看了看一下调试寄存器 Dr0= 7c802648, Dr1= 7c90341c 。然后之后我选择不处理异常并继续，后为这样：
0:000> gn
eax=000000c0 ebx=00000000 ecx=02480248 edx=02480248 esi=00000000 edi=013cff6c
eip=7c92e4f4 esp=013cff3c ebp=013cff94 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
ntdll!KiFastSystemCallRet:
7c92e4f4 c3 ret
然后我想继续运行就不行了，不管是步入，逐过程等都不行了。
0:000> gn
eax=000000c0 ebx=00000000 ecx=02480248 edx=02480248 esi=00000000 edi=013cff6c
eip=7c92e4f4 esp=013cff3c ebp=013cff94 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
ntdll!KiFastSystemCallRet:
7c92e4f4 c3 ret
0:001> t
^ No runnable debuggees error in 't'
0:001> p
^ No runnable debuggees error in 'p'
0:001> gu
^ No runnable debuggees error in 'gu'
