X86 32bit architecture help, please.

07/30/2009 02:05 IAmHawtness#1

So, I'm writing my own debugger for Conquer in VB6. It works perfectly with Windows Vista Home Edition SP1, however it fails on my Windows XP SP3 computer, everytime it hits a breakpoint, it continues in an infinite loop at the instruction, even though I set the set Resume Flag to 1 which should prevent this from happening.

My Vista computer has an Intel Core 2 Duo T8300 processor, while my XP computer has an AMD Athlon 64 X2 6000+ processor.

Does anyone know what could be wrong?

Code:

If ExceptionCode = EXCEPTION_SINGLE_STEP Then
   ContinueStatus = DBG_CONTINUE
   Debug.Print "Single step exception occured"
   SuspendThread (ThreadHandle)
   ExceptionHandler ThreadHandle, ExceptionAddress
 End If

ContinueDebugEvent DebugEvent.dwProcessId, DebugEvent.dwThreadId, ContinueStatus
ResumeThread (ThreadHandle)
CloseHandle (ThreadHandle)

Code:

Public Sub ExceptionHandler(hThread As Long, ExceptionAddress As Long)

Dim cThread As CONTEXT

cThread.ContextFlags = CONTEXT_FULL
GetThreadContext hThread, cThread
cThread.EFlags = cThread.EFlags Or EFLAG_RF
SetThreadContext hThread, cThread

07/30/2009 13:51 raptordin#2

Sorry that I can not help you as I have the same problem. My AMD x64 Quad core has completely different memory allocations thus I can not utilize any codes published by any one and If I managed to code something no one will be able to benefit from it.

I had a request here earlier which no one replied to regarding x64 architecture programing.

08/01/2009 13:28 IAmHawtness#3

I found out that somehow the SetThreadContext API fails on Windows XP.

Does anyone know how that could be? Insufficient privileges? - Although that doesn't really sound like XP.

Edit:
The SetThreadContext only fails when I try to set the EFlags of the processor, trying to enable the Resume Flag, however it works fine when changing EAX, EBX, EDX, Segments, etc. It seems that only the EFlags don't change.

Edit2:
Okay, this is seriously weird. I can change almost all the flags, except for some. I can change the carry flag, the zero flag, the trap flag, etc., however I am unable to set certain flags such as the I/O Privilege Flag and the Resume Flag.

I think I need some specific privileges and debug privileges don't seem to be sufficient. Ideas, anyone?

08/02/2009 13:05 Zeelia#4

You're coding in C language?
Isn't there some ALL_PRIVILEGES const which you can use?

Check out this though, maybe it can help you?
[Only registered and activated users can see links. Click Here To Register...]

*EDIT* Sorry, I saw your first post and you are writing VB but maybe that site can help anyway, even though it is in C.

//Zeelia

08/02/2009 20:54 IAmHawtness#5

Quote:

Originally Posted by Zeelia

You're coding in C language?
Isn't there some ALL_PRIVILEGES const which you can use?

Check out this though, maybe it can help you?
[Only registered and activated users can see links. Click Here To Register...]

*EDIT* Sorry, I saw your first post and you are writing VB but maybe that site can help anyway, even though it is in C.

//Zeelia

Nope, that's not the problem, but thanks for the input. :)

It seems that somehow, certain CPU flags such as the Resume Flag and IOPL Flag are "protected" in Windows XP, however they are not in Windows Vista :confused:.

08/02/2009 21:28 Zeelia#6

Well if they are protected, there's nothing you can do except trying to re-download the DLL, maybe its an old version or something?
Since Vista uses a different service pack than XP, the DLL might be newer or modified.

*EDIT* Oh yeah, you can also try to copy the executable (of your application) from Vista to XP and try to run it, if you aren't using the DLL as a resource (included) file then the application will try to use the local file if it exists.
The application should throw an error. Try this out =)

//Zeelia

08/02/2009 21:57 IAmHawtness#7

Quote:

Originally Posted by Zeelia

Well if they are protected, there's nothing you can do except trying to re-download the DLL, maybe its an old version or something?
Since Vista uses a different service pack than XP, the DLL might be newer or modified.

*EDIT* Oh yeah, you can also try to copy the executable (of your application) from Vista to XP and try to run it, if you aren't using the DLL as a resource (included) file then the application will try to use the local file if it exists.
The application should throw an error. Try this out =)

//Zeelia

I made my program on my Windows XP computer, and it didn't work the way I wanted it to, so I modified it, but before modifying it, I tried it on my laptop - the one with Vista - and it worked fine for some strange reason. And err, the DLL that my program uses is the ntdll.dll from the system32 directory. Copying that from Windows Vista to XP would probably screw up my computer a bit :p

08/02/2009 23:16 Zeelia#8

haha XD I agree but what if you use it as an included resource?? I mean like if you add it to your programs resources and then call the dll by My.Application.Resources("ntdll.dll") or something like that.
That should work.

But I still think that you should try creating the executable on Vista and then running on XP.
//Zeelia

08/02/2009 23:25 IAmHawtness#9

Quote:

Originally Posted by Zeelia

haha XD I agree but what if you use it as an included resource?? I mean like if you add it to your programs resources and then call the dll by My.Application.Resources("ntdll.dll") or something like that.
That should work.

But I still think that you should try creating the executable on Vista and then running on XP.
//Zeelia

I already tried compiling the application on Vista. I think the problem is something like Windows XP ignores the Resume Flag on the CPU. I just made an account in the Cheat Engine forums, I reckon they would have some knowledge about the problem.:)

08/04/2009 11:42 IAmHawtness#10

Sorry for the double post, but it seems that epvp might not be the best place to ask for this. At least not the CO2 Programming Section.

Does anyone know of a forum where people could help me with this, perhaps? The Cheat Engine forums are slow as hell, I registered three days ago and my account hasn't been activated yet.

Thank you.