Wayne
January 12th, 2003, 20:49
Consider the following code ...
<pre>50 PUSH EAX
51 PUSH ECX
56 PUSH ESI</pre>
When a debugger sets a breakpoint on the first instruction, it replaces 50 with CC, and the debugger when it gets there then breaks at that instruction. When the user presses Step Into to go to the next instruction (api ContinueDebugEvent), it replaces CC with the original instruction - 50 (push eax). However, wouldnt the call to ContinueDebugEvent immediately go to the next instruction (51 PUSH ECX) and skip over the first instruction? Because if it didnt do that, it seems the debugger would get stuck in a loop? But if it does skip over the instruction, then wouldn't I need to decrement the EIP register?
Any help would be much appreciated!
<pre>50 PUSH EAX
51 PUSH ECX
56 PUSH ESI</pre>
When a debugger sets a breakpoint on the first instruction, it replaces 50 with CC, and the debugger when it gets there then breaks at that instruction. When the user presses Step Into to go to the next instruction (api ContinueDebugEvent), it replaces CC with the original instruction - 50 (push eax). However, wouldnt the call to ContinueDebugEvent immediately go to the next instruction (51 PUSH ECX) and skip over the first instruction? Because if it didnt do that, it seems the debugger would get stuck in a loop? But if it does skip over the instruction, then wouldn't I need to decrement the EIP register?
Any help would be much appreciated!