I customized a vector exception handler and added a breakpoint at 0x00430A11, but my handler will always be called, even if Eip is set.Set a breakpoint at dr 0 except the own thread,dr7=0x55
unsafe extern "system" fn sunlight(exceptioninfo: *mut EXCEPTION_POINTERS) -> i32 {
let mut exceptioninfo_value = exceptioninfo.read();
let mut record_value = exceptioninfo_value.ExceptionRecord.read();
if record_value.ExceptionCode == EXCEPTION_SINGLE_STEP {
if (record_value.ExceptionAddress as u32) == 0x00430A11 {
let mut context = exceptioninfo_value.ContextRecord.read();
context.Ecx = 100;
// Execute the assembly of the current hoo
// 00430A11 add dword ptr ds:[eax+5560],ecx
let ptr = (context.Eax + 0x5560) as *mut u32;
ptr.write(ptr.read() + context.Ecx);
// Execute next assembly
// 00430A17 mov ecx,dword ptr ds:[eax+5560]
context.EFlags = 0b_0001_0000_0000;
context.Eip = context.Eip + 6;
return EXCEPTION_CONTINUE_EXECUTION;
}
}
return EXCEPTION_CONTINUE_SEARCH;
}
I tried commenting add dword ptr ds:[eax+5560],ecx, or changing the breakpoint address and setting EFlags = 0b_0001_0000_0000. But it’s no use. I hope to continue execution from context.Eip after returning EXCEPTION_CONTINUE_EXECUTION instead of looping all the time.
New contributor
Fuckliao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.