Cheat Engine

Ecoste · Newbie cheater Reputation: 0 Joined: 25 Jun 2012 Posts: 10

How do debuggers set INT3 breakpoints and handle them?

Ok, I overwrite an instruction with INT3+NOPs to fill the void, and remember what it was to replace it later. This part is easy.

But, what then? How do I set the interrupt handler function, there must be some kind of system call to do that, no? I can't find any information on doing this in Windows user mode.

Could someone point me to some resources that explain on how to do this or provide an example?

Thank you.

ParkourPenguin · Posted: Tue Aug 16, 2016 9:30 pm Post subject:

Haven't done this myself but this should get you started.
https://msdn.microsoft.com/en-us/library/windows/desktop/ms679276%28v=vs.85%29.aspx

Ecoste · Newbie cheater Reputation: 0 Joined: 25 Jun 2012 Posts: 10

Dark Byte · Posted: Wed Aug 17, 2016 4:23 am Post subject:

also no need to nop the rest. Just the first byte is enough

on breakpoint restore the byte
do stuff you wanted to do on break
do a single step, and set the 0xcc back

Ecoste · Newbie cheater Reputation: 0 Joined: 25 Jun 2012 Posts: 10

Thanks for replying guys! Just to add to the answers, I found one more way, you can also roll with SEH or VEH.

VEH: msdn.microsoft()com/en-us/library/windows/desktop/ms679273(v=vs.85).aspx

SEH: microsoft()com/msj/0197/exception/exception.aspx

With SEH, you gotta make sure the EXCEPTION_REGISTRATION is located on the stack because Windows checks if it's within the range of the stack for security purposes.

With VEH, do something like

hhhuut · Posted: Wed Aug 17, 2016 4:34 pm Post subject:

Probably your link is just the wrong one, but use the Vectored Exception Handler rather than the Vectored Continue Handler.