leakymingebox
March 6th, 2010, 13:22
Hi all,
I'm trying to make a small tool that allows me to 'freeze' a memory location and prevent all writes to that address from changing the contents. I have hardware breakpoints working fine, but I need more than 4. So I am looking at protecting the appropriate page[S] as read-only, then handling the access violation exceptions.
Once I've caught the exception I need to do 2 things:
1. If the violation was caused by writing a different address in that page, then I want to perform the write operation myself and continue running. Do you know how I can get the information on the *value* that was being written? I can get the address easy enough from ExceptionInformation[0] but I don't see where the value comes from.
2. In all cases I want to continue running the target from after the instruction that caused the exception. The CONTEXT->Eip holds the address of the exception-causing instruction. Is there an easy way to get the address of the next instruction, or do I need to manually part-disassemble the current one myself, and figure out how big it is (and therefore where the next one would start)?
Thanks.
I'm trying to make a small tool that allows me to 'freeze' a memory location and prevent all writes to that address from changing the contents. I have hardware breakpoints working fine, but I need more than 4. So I am looking at protecting the appropriate page[S] as read-only, then handling the access violation exceptions.
Once I've caught the exception I need to do 2 things:
1. If the violation was caused by writing a different address in that page, then I want to perform the write operation myself and continue running. Do you know how I can get the information on the *value* that was being written? I can get the address easy enough from ExceptionInformation[0] but I don't see where the value comes from.
2. In all cases I want to continue running the target from after the instruction that caused the exception. The CONTEXT->Eip holds the address of the exception-causing instruction. Is there an easy way to get the address of the next instruction, or do I need to manually part-disassemble the current one myself, and figure out how big it is (and therefore where the next one would start)?
Thanks.