Is it possible to know with dumpbin tools if a execu开发者_运维知识库table under windows use the command arp ?
No, not really. If it has arp.exe
as a string literal, and passes that string literal to WinExec
, CreateProcess
, etc., that'll be pretty easy to find. It could, however, do something like reading arp.exe
in from a file at run-time, which will make it considerably more difficult to find.
精彩评论