在dump中,查找entry.asm的二进制字节
_RtlFindActivationContextSectionString的二进制:
0:000> s 0012ff40 L2000000 8B 46 20 8A 56 2C
00000000`00500cd8 8b 46 20 8a 56 2c 88 10-8b 56 2d 89 50 01 b9 10 .F .V,...V-.P...
0:000> u 00500cd8
00000000`00500cd8 8b4620 mov eax,dword ptr [rsi+20h]
00000000`00500cdb 8a562c mov dl,byte ptr [rsi+2Ch]
00000000`00500cde 8810 mov byte ptr [rax],dl
00000000`00500ce0 8b562d mov edx,dword ptr [rsi+2Dh]
00000000`00500ce3 895001 mov dword ptr [rax+1],edx
00000000`00500ce6 b910000000 mov ecx,10h
00000000`00500ceb 51 push rcx
00000000`00500cec 8d4658 lea eax,[rsi+58h]
0:000> u
00000000`00500cef 50 push rax
00000000`00500cf0 8d4638 lea eax,[rsi+38h]
0000