JWP Programs Newbie cheater
Reputation: 0
Joined: 19 Dec 2011 Posts: 23
|
Posted: Fri Feb 17, 2012 7:45 pm Post subject: How does CE get specific registers? |
|
|
Hi. I tried to get specific registers(like CE, Find out what write -- ).
so I wrote :
function DebugActiveProcessStop(dwProcessId: DWORD): BOOL; stdcall;
external kernel32 name 'DebugActiveProcessStop';
procedure CreateProcessDebugEvent_(DBG_EVENT:Debug_Event);
begin
Con.ContextFlags:=CONTEXT_DEBUG_REGISTERS;
GetThreadContext(DBG_EVENT.CreateProcessInfo.hThread, Con);
Form1.Label1.Caption:='EAX - '+IntToHex(Con.Eax, 8);
Form1.Label2.Caption:='EBX - '+IntToHex(Con.Ebx, 8);
Form1.Label3.Caption:='ECX - '+IntToHex(Con.Ecx, 8);
Form1.Label4.Caption:='EDX - '+IntToHex(Con.Edx, 8);
end;
function ThreadFunc:BOOLEAN; stdcall;
var Devent:Debug_event;
begin
//CreateProcessDebugEvent_(Devent);
while (WaitForDebugEvent(Devent, Infinite)) do
begin
if Devent.dwDebugEventCode = Create_Process_Debug_Event then
begin
CreateProcessDebugEvent_(Devent);
end
else
if Devent.dwDebugEventCode = Exception_Debug_Event then
begin
CreateProcessDebugEvent_(Devent);
end
else
if Devent.dwDebugEventCode = Exit_Process_Debug_Event then
begin
Break;
end;
ContinueDebugEvent(Devent.dwProcessId, Devent.dwThreadId, DBG_CONTINUE);
end;
end;
procedure TForm1.Button1Click(Sender: TObject);
var con:Context;
ProcessId:THandle;
ThreadHandle, TID:THandle;
begin
ProcessId:=GetProcessIdByName('Pinball.exe'); // This is my function to get ProcessId
if ProcessId = 0 then
begin
Raise Exception.Create('Can''t get ProcessId. Check your process name.');
exit;
end;
if not DebugActiveProcess(ProcessId) then
begin
Raise Exception.Create('failed debug process.');
exit;
end;
ThreadHandle:=CreateThread(nil, 0, @ThreadFunc, 0, TID);
end;
--------
But It returns 00000000.
eax , ebx, ecx, edx are 00000000..
so I tried to attach that process by CE.
CE Gets Specific Registers. (not like 00000000..)
I want to get the specific registers(LIKE CE!!).
Is there anyone to know??
please answer to me.
thanks for the reading.
|
|