我用的是windbg6.2版本的。
openexacutable以后停在以下位置：
Executable search path is:
ModLoad: 00400000 00408000 Demo.exe
ModLoad: 77f80000 77ffb000 ntdll.dll
ModLoad: 79170000 79196000 C:\WINNT\system32\mscoree.dll
ModLoad: 77e60000 77f38000 C:\WINNT\system32\KERNEL32.dll
ModLoad: 796d0000 79732000 C:\WINNT\system32\ADVAPI32.dll
ModLoad: 786f0000 78761000 C:\WINNT\system32\RPCRT4.DLL
(d0c.d34): Break instruction exception - code 80000003 (first chance)
eax=00000000 ebx=00131f04 ecx=00000009 edx=00000000 esi=7ffdf000 edi=00131f70
eip=77fa144b esp=0012f984 ebp=0012fc98 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
*** WARNING: symbols timestamp is wrong 0x3ef31d0f 0x41e648e0 for ntdll.dll
ntdll!RtlpProcessWaitCompletion+0x180:
77fa144b cc int 3
然后我想停在mscorwks.dll装载的时候：
0:000>sxe ld:mscorwks.dll;g
但是发现拦不住任何load动作：
ModLoad: 772a0000 77306000 C:\WINNT\system32\SHLWAPI.dll
ModLoad: 77f40000 77f7c000 C:\WINNT\system32\GDI32.dll
ModLoad: 77df0000 77e55000 C:\WINNT\system32\USER32.dll
ModLoad: 78000000 78045000 C:\WINNT\system32\msvcrt.dll
ModLoad: 75e00000 75e1a000 C:\WINNT\system32\IMM32.DLL
ModLoad: 6c330000 6c338000 C:\WINNT\system32\LPK.DLL
ModLoad: 65d20000 65d74000 C:\WINNT\system32\USP10.dll
ModLoad: 791b0000 79412000 C:\WINNT\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
ModLoad: 7c340000 7c396000 C:\WINNT\Microsoft.NET\Framework\v1.1.4322\MSVCR71.dll
ModLoad: 79040000 79085000 C:\WINNT\Microsoft.NET\Framework\v1.1.4322\fusion.dll
ModLoad: 00880000 00ac5000 C:\WINNT\system32\SHELL32.dll
ModLoad: 71710000 71794000 C:\WINNT\system32\COMCTL32.dll
ModLoad: 79780000 79980000 c:\winnt\microsoft.net\framework\v1.1.4322\mscorlib.dll
ModLoad: 79980000 79ca6000 c:\winnt\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_1edd84e4\mscorlib.dll
ModLoad: 79510000 79523000 C:\WINNT\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
ModLoad: 79430000 7947c000 C:\WINNT\Microsoft.NET\Framework\v1.1.4322\MSCORJIT.DLL
ModLoad: 51a70000 51af0000 C:\WINNT\Microsoft.NET\Framework\v1.1.4322\diasymreader.dll
ModLoad: 77a30000 77b27000 C:\WINNT\system32\ole32.dll
eax=7c35f0cb ebx=7ffdf000 ecx=7c38cca4 edx=00000000 esi=77f8dd80 edi=00000000
eip=77f8dd8b esp=0012fecc ebp=0012ff94 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
ntdll!LdrVerifyImageMatchesChecksum+0x157:
77f8dd8b c20800 ret 0x8
到这里就已经全部跑完了。这样的话我就不能在mscorwks.dll装载后.load sos了。请教是什么原因呢？我用的SOS.DLL是网上下的dbgnetfx.exe里面的，不过.Net SDK自带的SOS.DLL也不行。
[课程]FART 脱壳王！加量不加价！FART作者讲授！
