I am debugging an application. Another process is debugged by this application.

Here is the call

00705435  FF15 C0007500  CALL DWORD PTR DS [<&KERNEL32.ContinueDebugEvent>] 

I want to change call to DebugActiveProcessStop, what should I do ?

  • What do you expect to do with those calls ? I mean, you can simply change the EIP to DebugActiveProcessStop whenever you want, or patch the IAT to a code cave that will take the ContinueDebugEvent parameters and use them to call DebugActiveProcessStop, or hook ContinueDebugEvent directly.
    – Spl3en
    Jun 9, 2015 at 13:27
  • @ASD, what debugger are you using? Jun 9, 2015 at 14:05
  • @JasonGeffner am using ollydbg
    – ASD
    Jun 9, 2015 at 14:17
  • @ASD So... Problem solved ?
    – Spl3en
    Jun 10, 2015 at 12:28
  • @Spl3en yes i solved it.
    – ASD
    Jun 10, 2015 at 12:34


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.