-
-
[求助]OD调试如何自动跟进异常处理过程中?
-
发表于:
2007-11-26 21:46
5664
-
00401000 > $ 8D4424 F8 lea eax, dword ptr [esp-8]
00401004 . 64:8705 00000>xchg dword ptr fs:[0], eax
0040100B . BB 2E104000 mov ebx, 0040102E
00401010 . 53 push ebx
00401011 . 50 push eax
00401012 . BE 00000000 mov esi, 0
00401017 . 8B06 mov eax, dword ptr [esi]
00401019 . 6A 00 push 0 ; /Style = MB_OK|MB_APPLMODAL
0040101B . 68 00304000 push 00403000 ; |Title = "OK"
00401020 . 68 10304000 push 00403010 ; |Text = "SEH Fail"
00401025 . 6A 00 push 0 ; |hOwner = NULL
00401027 . E8 1C000000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
0040102C . EB 13 jmp short 00401041
0040102E . 6A 00 push 0 ; /Style = MB_OK|MB_APPLMODAL
00401030 . 68 00304000 push 00403000 ; |Title = "OK"
00401035 . 68 03304000 push 00403003 ; |Text = "SEH Succeed "
0040103A . 6A 00 push 0 ; |hOwner = NULL
0040103C . E8 07000000 call <jmp.&USER32.MessageBoxA> ; \MessageBoxA
00401041 > 6A 00 push 0 ; /ExitCode = 0
00401043 . E8 06000000 call <jmp.&KERNEL32.ExitProcess> ; \ExitProcess
OD中取消非法访问内存复选框,F9运行,程序执行到00401017发生异常中断,此时按Shift+F7和Shift+F8,均转入ntdll领空,进入ntdll暂停后按Alt+F9(返回用户代码),想返回到0040102E跟踪异常处理过程,但无论如何也跟不进,程序直接跑飞了.(Ctrl+F8也不成)
请问不在0040102E上下F2断点,如何跟进异常处理过程继续调试?谢谢
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
