x64dbg
/
TitanEngine
mirror of https://github.com/x64dbg/TitanEngine
1
0
Fork 0
Code Releases Activity

Preserve debug registers in breakpoint step-over context 

ContextControlFlags is used by the debug loop's SetThreadContext calls during
breakpoint step-over. Under WoW64 (x64 debugger, 32-bit target) writing back
with plain CONTEXT_CONTROL cleared the DR0..DR7 registers armed via hbreak.
Include CONTEXT_DEBUG_REGISTERS so a breakpoint step never erases them.
This commit is contained in:
linsmod 2026-08-02 09:25:44 +08:00
parent f425de392c
commit 92cbf60a69
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
TitanEngine/Global.Debugger.cpp
View File

@ -43,7 +43,12 @@ CRITICAL_SECTION engineStepActiveCr;
// Workaround for a bug in the kernel with x64 emulation on ARM
DWORD ContextControlFlags = []
{
DWORD flags = CONTEXT_CONTROL;
// CONTEXT_CONTROL alone reads/writes only the control registers. When the
// debugger (x64) cross-debugs a 32-bit target under WoW64, a SetThreadContext
// issued with plain CONTEXT_CONTROL clobbers the debug registers the user
// armed via hbreak (DR0..DR7) — Windows writes back the whole flagged set.
// Include CONTEXT_DEBUG_REGISTERS so breakpoint steps never erase them.
DWORD flags = CONTEXT_CONTROL | CONTEXT_DEBUG_REGISTERS;
typedef BOOL(WINAPI * type_IsWow64Process2)(HANDLE, USHORT*, USHORT*);
auto p_IsWow64Process2 = (type_IsWow64Process2)GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "IsWow64Process2");
if(p_IsWow64Process2)