Exemplo n.º 1
0
        public bool SetBreakpoint(IntPtr address)
        {
            if (BreakpointTable.ContainsKey(address))
            {
                return(false);
            }

            var buffer = mem.ReadBytes(address, 0x1);

            BreakpointTable.Add(address, buffer[0]);
            HitTable.Add(address, 0);
            mem.Write(address, new byte[] { 0xCC });

            return(true);
        }
Exemplo n.º 2
0
        public bool HandleException(
            DebuggerEventArgs e,
            Action <IntPtr> breakpointHit)
        {
            switch (e.DebugEvent.Exception.ExceptionRecord.ExceptionCode)
            {
            case ExceptionCode.EXCEPTION_BREAKPOINT:
                var addr = (IntPtr)e.DebugEvent.Exception.ExceptionRecord.ExceptionAddress;
                if (!BreakpointTable.TryGetValue(addr, out _))
                {
                    return(false);
                }

                uint hits;

                lock (HitTable)
                {
                    hits = ++HitTable[addr];
                    //var hits2 = HitTable.OrderByDescending(x => x.Value).ToArray();
                }

                //var writeResult = mem.Write(addr, new[] { originalByte });

                if (MaxHits <= 0 || hits < MaxHits)
                {
                    ThreadContext.EnableSingleStep(ThreadCache[e.DebugEvent.dwThreadId], (uint)addr);
                }
                else
                {
                    ThreadContext.SetEip(ThreadCache[e.DebugEvent.dwThreadId], (uint)addr);
                }

                lastBreakpoint = addr;
                breakpointHit(addr);
                e.DebugEvent.ContinueHandled();
                return(true);

            case ExceptionCode.EXCEPTION_SINGLE_STEP:
                mem.Write(lastBreakpoint, new byte[] { 0xCC });
                lastBreakpoint = IntPtr.Zero;
                ThreadContext.DisableSingleStep(ThreadCache[e.DebugEvent.dwThreadId]);
                e.DebugEvent.ContinueHandled();
                return(true);

            default:
                return(false);
            }
        }