mirror of https://github.com/x64dbg/TitanEngine
7c07601581
A program-generated breakpoint exception (DebugBreak(), __debugbreak() or an
inline `int 3`) that is not in the engine's breakpoint table is currently
answered with DBG_EXCEPTION_NOT_HANDLED in the "breakpoint not in list" branch.
For a real single-byte int 3 the saved RIP already points past the instruction,
so passing it back to the debuggee re-raises it there: the program's own SEH
handler runs (or it becomes a second-chance/unhandled stop) and the debugger
cannot simply continue past the program's DebugBreak() the way Visual Studio
does (VS consumes it with DBG_CONTINUE and resumes at the next instruction).
This went through two iterations:
1. First attempt answered DBG_CONTINUE for every stray breakpoint exception.
That fixed DebugBreak() but regressed RaiseException(STATUS_BREAKPOINT):
the exception was consumed and the debuggee's __except handler no longer
ran.
2. Final version distinguishes a genuine single-byte int 3 from a programmatic
raise by reading the byte at ExceptionRecord.ExceptionAddress:
- 0xCC (a real int 3 instruction the program executed): DBG_CONTINUE, so the
thread resumes at the instruction after the int 3 and the debugger can
continue past the program's own DebugBreak() (no register surgery needed -
the CPU already advanced RIP; the Rip -= BreakPointSize rewind only applies
to breakpoints the engine itself patched in).
- otherwise (e.g. RaiseException(STATUS_BREAKPOINT)): DBG_EXCEPTION_NOT_HANDLED
is kept so the debuggee's SEH still runs.
Every other exception path is untouched (debugger-set breakpoints, the system
breakpoint, single-stepping, hardware/memory breakpoints, AV/div-zero etc.).
Verified on Windows x64 with a 21-case debugger test suite: DebugBreak(),
__debugbreak(), DebugBreak() with an SEH handler and
RaiseException(STATUS_BREAKPOINT)+__except all behave correctly, and the suite
shows no regressions. Related-but-distinct step-over-int3 cleanup was addressed
separately in PR #32 / issue #33.
|
||
|---|---|---|
| TitanEngine | ||
| TitanEngineLoaders/LibraryLoader | ||
| distorm | ||
| hooks | ||
| scylla_wrapper | ||
| .gitattributes | ||
| .gitignore | ||
| CMakeLists.txt | ||
| LICENSE | ||
| TitanEngine.sln | ||
| cmake.toml | ||
| cmkr.cmake | ||
| format.bat | ||
| install.bat | ||
| readme.txt | ||
| release.bat | ||
readme.txt
This is a bugfixed & enhanced version of TitanEngine v2.0.3
The following things have been fixed/added (list might be incomplete):
- fixed memory breakpoints in general
- fixed harware breakpoints in general
- only report exceptions that are unhandled by the debugger
- working on x64 (previously there was a structure alignment problem)
- some code commenting
- fixed DumpProcessExW (found/fix provided by Aguila)
- added a callback on the system breakpoint
- added memory breakpoints on execute
- added QWORD hardware breakpoints
- smaller and faster DLL loaders
- supports multiple calling conventions (including the callbacks)
- MinGW import libraries
- fixed exception handling
- Importer functions use Scyllas business logic now, much more accurate
- updated distorm lib to v3, was v1
- countless code improvements
NOTE: LUA, Python, MASM and Delphi might not work correctly
Mainly because their headers havent been adjusted
to these changes. However this is easy. Compare with
C/C++ headers, fix it up and send us.
If you are good with these kinda codes, please help review, do pull-requests,
and criticize what you think can be be improved !
You can discuss with us here
http://forum.tuts4you.com/forum/138-titanengine-community-edition/