O'Reilly logo

Gray Hat Python by Justin Seitz

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Obtaining CPU Register State

A debugger must be able to capture the state of the CPU registers at any given point and time. This allows us to determine the state of the stack when an exception occurs, where the instruction pointer is currently executing, and other useful tidbits of information. We first must obtain a handle to the currently executing thread in the debuggee, which is achieved by using the OpenThread()[10] function. It looks like the following:

HANDLE WINAPI OpenThread(
    DWORD dwDesiredAccess,
    BOOL bInheritHandle,
    DWORD dwThreadId
);

This looks much like its sister function OpenProcess(), except this time we pass it a thread identifier (TID) instead of a process identifier.

We must obtain a list of all the threads that are executing ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required