1. 将msnmsgr.exe复制msnmsgr2.exe
2. 用WinDBG打开msnmsgr.exe。
3. 用bp命令设置如下断点：
bp kernel32!CreateEventA "j (poi(esp+10) != 0) 'da poi(esp+10)';'g'"
4. g命令，开始运行进程。
5. 断点会不断被hit，并打印出CreateEvent创建的Event名字。
6. 继续g，直到找到一个叫“MSNMSGR”的Event：
0:000> g
ModLoad: 75e60000 75e87000 C:\WINDOWS\system32\apphelp.dll
ModLoad: 4dc30000 4dc5e000 C:\WINDOWS\system32\msctfime.ime
ModLoad: 777b0000 77833000 C:\WINDOWS\system32\CLBCatQ.DLL
ModLoad: 77010000 770d6000 C:\WINDOWS\system32\COMRes.dll
ModLoad: 74540000 745d4000 C:\WINDOWS\system32\mlang.dll
ModLoad: 59300000 59499000 C:\Program Files\MSN Messenger\msgslang.dll
ModLoad: 5b200000 5b42c000 C:\Program Files\MSN Messenger\msgsres.dll
*** ERROR: Module load completed but symbols could not be loaded for msnmsgr.exe
004cb7cc "MSNMSGR"
eax=00000001 ebx=00000000 ecx=000015d3 edx=7ffb0000 esi=008ee290 edi=77e67a55
eip=77e58f0b esp=0006fe88 ebp=0006fec4 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
kernel32!CreateEventA:
77e58f0b 8bff mov edi,edi
7. 用db命令，打出地址附近的字节：
0:000> db 004cb7cc
004cb7cc 4d 53 4e 4d 53 47 52 00-00 00 00 00 2e 00 90 90 MSNMSGR.........
004cb7dc 2e 00 00 00 52 74 6c 4c-6f 67 4f 75 74 70 75 74 ....RtlLogOutput
004cb7ec 00 00 00 00 53 6f 66 74-77 61 72 65 5c 4d 69 63 ....Software\Mic
004cb7fc 72 6f 73 6f 66 74 5c 4d-53 4e 4d 65 73 73 65 6e rosoft\MSNMessen
004cb80c 67 65 72 00 41 70 70 53-65 74 74 69 6e 67 73 00 ger.AppSettings.
004cb81c e2 23 5c 27 47 37 d0 11-9f ea 00 aa 00 3f 86 46 .#\'G7.......?.F
004cb82c 64 c1 cf dc 38 2b d2 11-b7 ec 00 c0 4f 8f 5d 9a d...8+......O.].
004cb83c 64 00 6c 00 6c 00 00 00-00 00 00 00 04 00 00 00 d.l.l...........
8. 用UltraEditor打开msnmsgr2.exe，根据上面的字节找到文件资源中的字符串MSNMSGR。将其改为其它字符串，如MSNNSGR。保存msnmsgr2.exe
9. 运行msnmsgr2.exe打开Windows Live Messenger的第二个实例。
Quoted from ".NET Weblog of J. Michael Palermo IV" at:
http://weblogs.asp.net/palermo4/archive/2005/02/14/372170.aspx
Please visit the original link for some interesting replies =)
I have a managed heap of memories regarding you - none of which are IDisposable.? Therefore?I?am compiling my references, and persisting?them to you in this file, which is ISerializable and will last for generations (at?most 3).
I remember how I met you... heartbroken over java (how slow that old?relationship was).? When I first heard of you, I heard you were COOL.? Then I found out how diverse you were in so many languages.? You marshalled right over to my world.? How easy it was for you to communicate over so many platforms!? You understood my profile, and now I could see sharp-ly into your IIdentity.
You took me to your visual studio - it was RAD.? So many views and hidden regions!? You were so organized with your task list.? I love how everything was color coded.? It was in that environment when I broke down and stated: "You auto-complete me..."
We had our bugs to work out - we were not the exception.? One time you thought we had a break-point.? But we would continue to try.? Nothing went unhanlded.? We caught everything, and finally we come to this moment.
How do you do it?? You stay true to so many standards, yet manifest so much.? You have such class!? There is no other type like you.??As I?reflect about you, I see that you have many methods - some very internal, some private, and some very protected.? Some of your ways are too abstract to know.? But what is public about you, anyone can see why you encapsulate so much inside.? From what I derive, we can override anything (unless we sealed it).
Let's not box ourselves into the typical cast.? We should look to the future - is it?generic?? I don't know - I may be partial.? I will have to iterate over this until I yield.
How long will we survive?
while (this!=null)
{ continue; }
办公室里冷冷清清的，整个team只有5个人驻守着……似乎US和EMEA的customer都理解我们在过国庆，没什么Case进来……
离开座位去break room（注：不是厕所）给杯子加水时看到我们的CPR和TL正在那里聊着，在探讨有什么好办法自动批量地关case，CPR建议直接修改SQL Server数据库，而TL觉得录Macro比较好……一会又说到了在Sql连接上设断点和NetMon，看来Asia这边也没什么活干……
窗外就是繁华喧闹的徐家汇……昨天晚上下班时，楼下还有露天晚会，精美的小食，音响里放着backstreet boy的歌，走不出五步便会见到一个让人眼睛一亮的MM……（也或许我的品位比较低）
好像完全是两个世界，楼里的人们都是埋头苦干的工作狂，典型的特征便是脚上旧款的凉鞋，头发凌乱，没刮胡子，穿着公司发的t shirt几天不换……楼外的则是俊男靓女们，衣着前卫光鲜，装备着最新的MD、手机……似乎我们这群楼里的土包子，和这个小资之地有些不格格不入……
活干完了，看了一会Jeff的PRGAPPS4，六点到了便准备下班了，真是难得，迟疑了几分钟，有点不好意思走的感觉……看了一下MSN，楼上的姐姐似乎活还没做完，可怜的姐姐，四年的国庆就没休过一天假，我和她道了别，一路离开时经过CPR和TL们的cubicle，他们居然都已经不见踪影了……
五分钟后，徐家汇美罗城前的时尚人群中，一个胡子拉碴的青年匆匆穿过……
偶然找到一个有Windows 2.0的VPC。在大谈Longhorn和Avalon的今日，见过这个“先驱”的人恐怕不多……（我没认错吧？）
托开心的福，能在这里安一个家……刚搬了些自己的老帖来……以后有时间一定多更新……
笨人对.Net和Windows Installer的兴趣比较大，但比较水，各位成名大侠多多关照……