0

I was wondering if it was possible to change the value of a register when an instruction gets executed. For example

0x10 call eax

Say eax contains 0x20 at that point, I want to add 0x10 to it so that the address that gets called is now 0x30.

What I tried doing was set a AddVectoredExceptionHandler and put an INT3 on 0x10. When my exception handler gets called, I restore the original byte at 0x10. Then I add 0x10 to eax and jump to ExceptionInfo->ContextRecord->Eip. This obviously doesn't work well because I never return to the OS.

Is there another way or is this even possible?

1 Answer 1

1

Alright, so apparently you can just edit ExceptionInfo->ContextRecord->Eax inside your

LONG CALLBACK VectoredHandler( _In_ PEXCEPTION_POINTERS ExceptionInfo );

function and the OS will set the eax to that value when it returns the execution back to where the exception was(If you return EXCEPTION_CONTINUE_EXECUTION.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.