decoding thread context structure in x64dbg

Question

Is there any way to decode the thread context structure returned by "GetThreadContext" and used by "SetThreadContext" in x64dbg?

Answer 1

write a script like this
(this is not an actual representation of CONTEXT64
only a partially ripped up struct from MSDN CONTEXT DOCS

ClearTypes                                      // clear existing types

AddType uint64_t,DWORD64                        // add windows specific DWORD64,DWORD,WORD 
AddType uint32_t,DWORD
AddType uint16_t,WORD

AddUnion XMM_SAVE_AREA32                        // union and its members
AddMember XMM_SAVE_AREA32, DWORD64,NEON128,10
AddMember XMM_SAVE_AREA32, DWORD,ULL,20

AddStruct CONTEXT                               //create an empty structure 
AddMember CONTEXT,DWORD64,P1Home                // Add members 
AddMember CONTEXT,DWORD64,P2Home
AddMember CONTEXT,DWORD64,P3Home
AddMember CONTEXT,DWORD64,P4Home
AddMember CONTEXT,DWORD64,P5Home
AddMember CONTEXT,DWORD64,P6Home
AddMember CONTEXT,DWORD,ContextFlags
AddMember CONTEXT,DWORD,MxCsr
AddMember CONTEXT,WORD,SegCs
AddMember CONTEXT,WORD,SegDs
AddMember CONTEXT,WORD,SegEs
AddMember CONTEXT,WORD,SegFs
AddMember CONTEXT,WORD,SegGs
AddMember CONTEXT,WORD,SegSs
AddMember CONTEXT,DWORD,Eflags
AddMember CONTEXT,DWORD64,Regs,0x18             // hack to name/unions checked etc. 
AddMember CONTEXT,XMM_SAVE_AREA32,FloatSave     // union added as structs member
AddMember CONTEXT,DWORD64,VecRegs,0x3a          //0x3a qwords dumped together hack 

go to script tab load this script and run the script

check log tab for confirmation

you can decode any address as this Type in the main windows struct tab in dump MDI window

in x64 the Function SetThreadContext() has the CONTEXT in register rdx click struct tab
right click and Visit type enter struct name

and address which holds this struct (rdx )

the struct will be pretty printed as shown in screenshot below