1

I am debugging an application. Another process is debugged by this application.

Here is the call

00705435  FF15 C0007500  CALL DWORD PTR DS [<&KERNEL32.ContinueDebugEvent>] 

I want to change call to DebugActiveProcessStop, what should I do ?

  • What do you expect to do with those calls ? I mean, you can simply change the EIP to DebugActiveProcessStop whenever you want, or patch the IAT to a code cave that will take the ContinueDebugEvent parameters and use them to call DebugActiveProcessStop, or hook ContinueDebugEvent directly. – Spl3en Jun 9 '15 at 13:27
  • @ASD, what debugger are you using? – Jason Geffner Jun 9 '15 at 14:05
  • @JasonGeffner am using ollydbg – ASD Jun 9 '15 at 14:17
  • @Spl3en Thanks. but i'm fuckin noob on that topics. first i decided to do dll injection or api hooking but i don't understand how to do that (after googling about that). so i find the easy way is this to change call directly. – ASD Jun 9 '15 at 14:18
  • @ASD So... Problem solved ? – Spl3en Jun 10 '15 at 12:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.