Closed lngex closed 1 month ago
I suspect you may have forgotten to clear the Trap Flag (TF) in EFLAGS/RFLAGS, so you're single stepping the target. (EFlags &= 0b_0001_0000_0000
)
Closing this as there doesn't appear to be a bug in the crate. Feel free to continue the discussion if needed.
For future API questions, please consider https://stackoverflow.com/questions/tagged/windows-rs.
I suspect you may have forgotten to clear the Trap Flag (TF) in EFLAGS/RFLAGS, so you're single stepping the target. (
EFlags &= 0b_0001_0000_0000
)
I tried to set E Flags, but it also got stuck in a loop. I saw in the C++ example that TF was not handled, so I suspect it's a bug
I don't believe SEH works in Rust at the present.
I don't believe SEH works in Rust at the present.
I don't believe SEH works in Rust at the present.
VEH is used here, and as far as I know, it only requires calling the AddVectoredExceptionHandler to add the processor and set breakpoints
Here's a simple working sample:
[package]
name = "app"
version = "0.0.0"
edition = "2021"
publish = false
[dependencies.windows]
version = "0.58.0"
features = [
"Win32_Foundation",
"Win32_System_Diagnostics_Debug",
"Win32_System_Kernel"
]
use windows::Win32::{
Foundation::EXCEPTION_SINGLE_STEP,
System::Diagnostics::Debug::{
AddVectoredExceptionHandler, RaiseException, EXCEPTION_CONTINUE_EXECUTION,
EXCEPTION_CONTINUE_SEARCH, EXCEPTION_POINTERS,
},
};
fn main() -> windows::core::Result<()> {
println!("Start");
unsafe {
let _ = AddVectoredExceptionHandler(0, Some(handler));
RaiseException(EXCEPTION_SINGLE_STEP.0 as _, 0, None);
};
println!("End");
Ok(())
}
unsafe extern "system" fn handler(info: *mut EXCEPTION_POINTERS) -> i32 {
let exception_record = info.read().ExceptionRecord.read();
match exception_record.ExceptionCode {
EXCEPTION_SINGLE_STEP => {
println!("[*] Swallowing exception");
EXCEPTION_CONTINUE_EXECUTION
}
_ => EXCEPTION_CONTINUE_SEARCH,
}
}
If you're still having trouble, please create an issue with a minimal standalone repro case.
Summary
Set the breakpoint address in register dr0 and set dr7 to 0x55. Then use AddVectoredExceptionHandler to add a callback function (PVECTORED_EXCEPTION_HANDLER), set EIP in the callback function and return EXCEPTION_CONTINUE_SEARCH. But the end result is that the breakpoint is triggered repeatedly. The expected result is that execution starts from EIP after the callback function ends.
Crate manifest
Crate code