x64dbg/x64dbg
x64dbg
/
x64dbg
1
0
Fork 0
Code Releases 2 Activity

DBG: do not add breakpoints to query process cookie when attaching

This commit is contained in:
Bálint Faragó 2019-10-30 17:54:26 +01:00 committed by Duncan Ogilvie
parent 44c9d81e60
commit 16d9e5a777
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/dbg/debugger.cpp
View File

@ -1714,7 +1714,7 @@ static void cbLoadDll(LOAD_DLL_DEBUG_INFO* LoadDll)
if(ModNameFromAddr(duint(base), modname, true) && scmp(modname, "ntdll.dll")) if(ModNameFromAddr(duint(base), modname, true) && scmp(modname, "ntdll.dll"))
{ {
if(settingboolget("Misc", "QueryProcessCookie")) if(settingboolget("Misc", "QueryProcessCookie"))
cookie.HandleNtdllLoad(); cookie.HandleNtdllLoad(bIsAttached);
if(settingboolget("Misc", "TransparentExceptionStepping")) if(settingboolget("Misc", "TransparentExceptionStepping"))
exceptionDispatchAddr = DbgValFromString("ntdll:KiUserExceptionDispatcher"); exceptionDispatchAddr = DbgValFromString("ntdll:KiUserExceptionDispatcher");
} }

4
src/dbg/debugger_cookie.h
View File

@ -9,10 +9,10 @@ struct CookieQuery
bool removeAddrBp = false; bool removeAddrBp = false;
bool removeRetBp = false; bool removeRetBp = false;
void HandleNtdllLoad() void HandleNtdllLoad(bool isAttached)
{ {
*this = CookieQuery(); *this = CookieQuery();
if(valfromstring("ntdll.dll:NtQueryInformationProcess", &addr)) if(!isAttached && valfromstring("ntdll.dll:NtQueryInformationProcess", &addr))
{ {
if(!BpGet(addr, BPNORMAL, nullptr, nullptr)) if(!BpGet(addr, BPNORMAL, nullptr, nullptr))
{ {