From 7a7530cef139af62f581b2d5b2820f0d94ed2c1c Mon Sep 17 00:00:00 2001 From: shocoman Date: Sun, 4 Jun 2023 14:27:25 +0700 Subject: [PATCH] Fix a bug that can change a stack value after stepping into a PUSHF instruction with a singleshoot breakpoint --- TitanEngine/TitanEngine.Debugger.DebugLoop.cpp | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/TitanEngine/TitanEngine.Debugger.DebugLoop.cpp b/TitanEngine/TitanEngine.Debugger.DebugLoop.cpp index b36e7d2..54541f4 100644 --- a/TitanEngine/TitanEngine.Debugger.DebugLoop.cpp +++ b/TitanEngine/TitanEngine.Debugger.DebugLoop.cpp @@ -554,12 +554,6 @@ __declspec(dllexport) void TITCALL DebugLoop() SetThreadContext(hActiveThread, &myDBGContext); EngineCloseHandle(hActiveThread); VirtualProtectEx(dbgProcessInformation.hProcess, (LPVOID)FoundBreakPoint.BreakPointAddress, FoundBreakPoint.BreakPointSize, OldProtect, &OldProtect); - ULONG_PTR ueCurrentPosition = FoundBreakPoint.BreakPointAddress; - unsigned char instr[16]; - MemoryReadSafe(dbgProcessInformation.hProcess, (void*)ueCurrentPosition, instr, sizeof(instr), 0); - char* DisassembledString = (char*)StaticDisassembleEx(ueCurrentPosition, (LPVOID)instr); - if(strstr(DisassembledString, "PUSHF")) - PushfBPX = true; if(FoundBreakPoint.BreakPointType == UE_SINGLESHOOT) { @@ -568,6 +562,16 @@ __declspec(dllexport) void TITCALL DebugLoop() ResetBPXAddressTo = NULL; ResetBPX = false; } + else + { + // if the current instruction pushes the flags, erase the trap flag from the stack after its execution + ULONG_PTR ueCurrentPosition = FoundBreakPoint.BreakPointAddress; + unsigned char instr[16]; + MemoryReadSafe(dbgProcessInformation.hProcess, (void*)ueCurrentPosition, instr, sizeof(instr), 0); + char* DisassembledString = (char*)StaticDisassembleEx(ueCurrentPosition, (LPVOID)instr); + if(strstr(DisassembledString, "PUSHF")) + PushfBPX = true; + } //execute callback myCustomBreakPoint = (fCustomBreakPoint)((LPVOID)FoundBreakPoint.ExecuteCallBack);