Cheat Engine

hhhuut · Posted: Sat Jan 16, 2016 9:18 am Post subject: CONTEXT_RECORD structure question

Hey together,

If I install a VEH for example and the handler gets triggered, it receives an EXCEPTION_POINTERS structure which also contains a CONTEXT_RECORD structure.

This context record structrue contains the basic state (so all the registers, stack, etc.) of the processor (resp. the application) at the moment the exception occured. So far so good.

If I'd now want to make the program continue on another spot, I'd have to change the EIP register of course. My question now is if it'd be enough to do a command like

atom0s · Posted: Sat Jan 16, 2016 12:49 pm Post subject:

You would need to be sure the other registers and stack are adjusted accordingly to the new location that you are trying to force the target to. Otherwise you are going to land up crashing due to an unbalanced stack or due to invalid register data.

For example if you want to set the Eip to execute a class function after the exception happens, you will need to be sure that ECX is set properly along with any other values and stack data that the call may be expecting.

Dark Byte · Posted: Sat Jan 16, 2016 2:19 pm Post subject:

contextrecord.eip is what you need to change

hhhuut · Posted: Sat Jan 16, 2016 2:44 pm Post subject:

Ok, thanks the both of you.