-
-
[求助]请教WiNrOOt等了解.NET程序调试的兄弟
-
发表于:
2005-1-11 15:11
4307
-
[求助]请教WiNrOOt等了解.NET程序调试的兄弟
1.用OD调试C#编写的小程序,忽略所有异常,载入或附加程序,程序就运行了,OD中无任何代码!什么原因怎么办?
(平台:XP+SP2,OllyDbg1.10)
2.用ildasm等反汇编工具分析到关键地方时,如果在winhex中找到相应地址修改?
比如如下代码:
IL_0000: ldarg.0
IL_0001: ldfld class [System.Windows.Forms]System.Windows.Forms.TextBox dearjohnletter.Form1::textBox1
IL_0006: callvirt instance string [System.Windows.Forms]System.Windows.Forms.Control::get_Text()
IL_000b: ldstr "520"
IL_0010: call bool [mscorlib]System.String::op_Equality(string,
string)
IL_0015: brfalse.s IL_0029
IL_0017: ldarg.0
IL_0018: ldfld class [System.Windows.Forms]System.Windows.Forms.TextBox dearjohnletter.Form1::textBox1
IL_001d: ldstr bytearray (60 4F F2 5D 53 62 00 5F 11 62 84 76 C3 5F ) // `O.]Sb._.b.v._
IL_0022: callvirt instance void [System.Windows.Forms]System.Windows.Forms.Control::set_Text(string)
IL_0027: br.s IL_0039
IL_0029: ldarg.0
IL_002a: ldfld class [System.Windows.Forms]System.Windows.Forms.TextBox dearjohnletter.Form1::textBox1
IL_002f: ldstr bytearray (11 62 84 76 C3 5F 8B 4E 60 4F 0D 4E C2 61 ) // .b.v._.N`O.N.a
IL_0034: callvirt instance void [System.Windows.Forms]System.Windows.Forms.Control::set_Text(string)
IL_0039: ret
} // end of method Form1::button1_Click
如何NOP掉这句:
IL_0015: brfalse.s IL_0029
在winhex中怎么找到它进行修改?
请详细说明,谢谢!
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课