Joined: 17 Feb 2008 Posts: 520 Location: Inside the Intel CET shadow stack
Posted: Sun Oct 14, 2018 6:14 am Post subject: Setting a BP and pulling thread context
I've got a case where it'd be very useful to have the Lua script set a BP on a particular instruction found via aobscan, then pull the thread context and extract a particular register value. Is this possible, or do I need to go the route of injecting a code cave and copying the register value to a known memory address that can be read back out? _________________
It's not fun unless every exploit mitigation is enabled.
Joined: 25 Jan 2006 Posts: 8579 Location: 127.0.0.1
Posted: Sun Oct 14, 2018 12:52 pm Post subject:
The 'context' is set to globals when debugger_onBreakpoint is called.
Code:
When a breaking breakpoint hits (that includes single stepping) and the lua function debugger_onBreakpoint() is defined it will be called and the global variables EAX, EBX, .... will be filled in
Return 0 if you want the userinterface to be updated and anything else if not (e.g You continued from the breakpoint in your script)
So you can directly access the registers as globals in Lua. _________________
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum