x64dbg/x64dbg
x64dbg
/
x64dbg
1
0
Fork 0
Code Releases 5 Activity

DBG: try querying the process cookie before adding breakpoints

This commit is contained in:
Bálint Faragó 2019-10-30 18:59:38 +01:00 committed by Duncan Ogilvie
parent 16d9e5a777
commit e0e977c88a
1 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/dbg/debugger_cookie.h
View File

@ -12,14 +12,19 @@ struct CookieQuery
void HandleNtdllLoad(bool isAttached)
{
*this = CookieQuery();
if(!isAttached && valfromstring("ntdll.dll:NtQueryInformationProcess", &addr))
ULONG returnSize = 0;
NTSTATUS status = NtQueryInformationProcess(fdProcessInfo->hProcess, ProcessCookie, &cookie, sizeof(cookie), &returnSize);
if(!NT_SUCCESS(status))
{
if(!BpGet(addr, BPNORMAL, nullptr, nullptr))
if(!isAttached && valfromstring("ntdll.dll:NtQueryInformationProcess", &addr))
{
if(SetBPX(addr, UE_BREAKPOINT, (void*)cbUserBreakpoint))
removeAddrBp = true;
else
addr = 0;
if(!BpGet(addr, BPNORMAL, nullptr, nullptr))
{
if(SetBPX(addr, UE_BREAKPOINT, (void*)cbUserBreakpoint))
removeAddrBp = true;
else
addr = 0;
}
}
}
}