I post this message to forum some days ago, but forum still write 20 messages but there are 21. Maybe it is interesting.

What are the methods to access the debug registers under NT ? How
reliable is GetThreadContext() (for dr) ?
See http://elicz.com/infos/SEHall.zip

How do you "switch" to kernel mode (ring-0), more or less manually,
without using a driver (sys) ?
See http://elicz.com/export/DumpXDT.zip


Or if you interesting about debug breakpoints you can read:
See http://www.anticracking.sk/Articles/How_working_with_debug_breakpoints.txt

Exit