Cheat Engine

[xentar]

Hi Dark Byte,

I am stuck with a problem, hope you can help me out.

What I am trying to do is be able to probe a running process for the value of it registers. So what I did was hook the IDT for interrupt 3, then overwrite an opcode of the running process with int3.

The simplest test case to check the handler is, I wrote a test application with the instructions int3 part of it, so whenever int3 is executed my handler is called I DbgPrint all the registers then return back to the running application so it can continue running.

If I have to overwrite the opcode of the running process with int3, that mean I have to preserve the original instructions. This is where I am not sure what to do.

By the looks of things, it seems I have to make a copy of the original instructions ( the complete instructions? or just the overwritten byte?).

How do I execute the overwritten instructions? Is the interrupt handler executing the original instruction?

Does it matter which instructions is overwritten? I assumed instructions that make use of the stack or jump to and address will be much more complicate. if the handler is the one that will execute the original instructions, at the handler code, I am not sure how to calculate the jump address, if instructions that make use of stack, the stack probably have changed.

Thanks you,