void EV_cbEndLog() { unsigned int esp_addr=(long)GetContextData(UE_ESP)+4; unsigned int return_eip=0; ReadProcessMemory(EV_fdProcessInfo->hProcess, (const void*)esp_addr, &return_eip, 4, 0); if(GetPE32SectionNumberFromVA(EV_va, return_eip)!=-1) { StopDebug(); } }
DWORD WINAPI IH_DebugThread(LPVOID lpStartAddress) //Thread for debugging { g_bFileIsDll=false; g_fdImageBase=0; g_fdEntryPoint=0; IH_fdProcessInfo=0; g_OutputDebugStringATotalCount=0; g_OutputDebugStringAMinorCount=0; DWORD IH_bytes_read=0; FILE_STATUS_INFO inFileStatus= {0}; IsPE32FileValidEx(g_szFileName, UE_DEPTH_SURFACE, &inFileStatus); if(inFileStatus.FileIs64Bit) { g_ErrorMessageCallback((char*)"64-bit files are not (yet) supported!", (char*)"Error!"); return 0; } HANDLE hFile, fileMap; ULONG_PTR va; //g_fdImageBase=(long)GetPE32Data(g_szFileName, 0, UE_IMAGEBASE); //g_PtrTargetData->ImageBase=g_fdImageBase; g_fdEntryPoint=(long)GetPE32Data(g_szFileName, 0, UE_OEP); StaticFileLoad(g_szFileName, UE_ACCESS_READ, false, &hFile, &IH_bytes_read, &fileMap, &va); g_fdEntrySectionNumber=GetPE32SectionNumberFromVA(va, g_fdEntryPoint+GetPE32Data(g_szFileName, 0, UE_IMAGEBASE)); g_PtrTargetData->EntrySectionNumber=g_fdEntrySectionNumber; StaticFileClose(hFile); g_fdEntrySectionSize= (long)GetPE32Data(g_szFileName, g_fdEntrySectionNumber, UE_SECTIONVIRTUALSIZE); g_fdEntrySectionOffset=(long)GetPE32Data(g_szFileName, g_fdEntrySectionNumber, UE_SECTIONVIRTUALOFFSET); g_bFileIsDll=inFileStatus.FileIsDLL; if(g_bFileIsDll==false) { IH_fdProcessInfo=(LPPROCESS_INFORMATION)InitDebugEx(g_szFileName, 0, 0, (void*)IH_cbEntryPoint); } else { IH_fdProcessInfo=(LPPROCESS_INFORMATION)InitDLLDebug(g_szFileName, false, 0, 0, (void*)IH_cbDllEntryPoint); } if(IH_fdProcessInfo) { DebugLoop(); return 0; } else { g_ErrorMessageCallback((char*)"Something went wrong during initialization...", (char*)"Error!"); return 0; } return 1; }