这是上面代码的源代码,楼主去看看C0NT.ASM就知道了
;
; The entrypoint of all PE files will now contain a jump around the address
; of the debugger hook vector. Eventually, the debugger will load it from
; here, but for now the debugger still looks for the exported name.
;
; We need to touch this symbol somewhere in the startup code so that it
; doesn't get smart-linked out, and the most logical place to put it was here
; where it will eventually need to be when we change the debugger to look
; for it here and not to use the exported name.
;
jmp skip_dbg_vector
db 'fb:C++HOOK' ; special signature
nop ; alignment byte
db 0E9h ; encode a jmp instruction
; so that the disassembler in
; the IDE can see past this
; address to the skip_dbg_vector
dd offset ___CPPdebugHook_segment
skip_dbg_vector:
mov eax, __TLS_index
shl eax, 2
mov __TLS_index4, eax
