Forum
|
|
finding breakpoints
|
Dragonborn |
|
New Member
Group: Members
Posts: 8
Member No.: 55955
Joined: 6-January 13
|
i am dragonborn and have questions about software breakpoints. how to detect them? i know the opcode for software breakpoints which is x0cc. i can code a loop which search the whole memory for that opcode, but the problem is that my program uses a lot x0cc bytes. so i have to find the real breakpoints not "fake" x0cc's.
some help would be nice, i code in masm
|
|
|
|
Dragonborn |
|
New Member
Group: Members
Posts: 8
Member No.: 55955
Joined: 6-January 13
|
i do not understand why calculate lenght of x0cc it is just 1 byte. i got a example but as i said in my first post this example will find false breakpoints
CODE | invoke CreateFile, ADDR NamePath, 0, 0, 0, OPEN_EXISTING, 0, 0 mov hFile, eax invoke GetFileSize, hFile, 0 mov ecx, eax; end size mov edi, 00400000h; example begin size mov al, 0CCh repne scasb jz being_debugged; bp found jmp ok |
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
Track this topic
Receive email notification when a reply has been made to this topic and you are not active on the board.
Subscribe to this forum
Receive email notification when a new topic is posted in this forum and you are not active on the board.
Download / Print this Topic
Download this topic in different formats or view a printer friendly version.
|
|
|