Ejemplo n.º 1
0
void EV_cbEndLog()
{
    unsigned int esp_addr=(long)GetContextData(UE_ESP)+4;
    unsigned int return_eip=0;
    ReadProcessMemory(EV_fdProcessInfo->hProcess, (const void*)esp_addr, &return_eip, 4, 0);
    if(GetPE32SectionNumberFromVA(EV_va, return_eip)!=-1)
    {
        StopDebug();
    }
}
Ejemplo n.º 2
0
DWORD WINAPI IH_DebugThread(LPVOID lpStartAddress) //Thread for debugging
{
    g_bFileIsDll=false;
    g_fdImageBase=0;
    g_fdEntryPoint=0;
    IH_fdProcessInfo=0;

    g_OutputDebugStringATotalCount=0;
    g_OutputDebugStringAMinorCount=0;



    DWORD IH_bytes_read=0;


    FILE_STATUS_INFO inFileStatus= {0};
    IsPE32FileValidEx(g_szFileName, UE_DEPTH_SURFACE, &inFileStatus);
    if(inFileStatus.FileIs64Bit)
    {
        g_ErrorMessageCallback((char*)"64-bit files are not (yet) supported!", (char*)"Error!");
        return 0;
    }
    HANDLE hFile, fileMap;
    ULONG_PTR va;

    //g_fdImageBase=(long)GetPE32Data(g_szFileName, 0, UE_IMAGEBASE);
    //g_PtrTargetData->ImageBase=g_fdImageBase;

    g_fdEntryPoint=(long)GetPE32Data(g_szFileName, 0, UE_OEP);

    StaticFileLoad(g_szFileName, UE_ACCESS_READ, false, &hFile, &IH_bytes_read, &fileMap, &va);

    g_fdEntrySectionNumber=GetPE32SectionNumberFromVA(va, g_fdEntryPoint+GetPE32Data(g_szFileName, 0, UE_IMAGEBASE));
    g_PtrTargetData->EntrySectionNumber=g_fdEntrySectionNumber;

    StaticFileClose(hFile);
    g_fdEntrySectionSize= (long)GetPE32Data(g_szFileName, g_fdEntrySectionNumber, UE_SECTIONVIRTUALSIZE);
    g_fdEntrySectionOffset=(long)GetPE32Data(g_szFileName, g_fdEntrySectionNumber, UE_SECTIONVIRTUALOFFSET);

    g_bFileIsDll=inFileStatus.FileIsDLL;


    if(g_bFileIsDll==false)
    {
        IH_fdProcessInfo=(LPPROCESS_INFORMATION)InitDebugEx(g_szFileName, 0, 0, (void*)IH_cbEntryPoint);
    }
    else
    {
        IH_fdProcessInfo=(LPPROCESS_INFORMATION)InitDLLDebug(g_szFileName, false, 0, 0, (void*)IH_cbDllEntryPoint);
    }

    if(IH_fdProcessInfo)
    {
        DebugLoop();
        return 0;
    }
    else
    {
        g_ErrorMessageCallback((char*)"Something went wrong during initialization...", (char*)"Error!");
        return 0;
    }
    return 1;
}