Added VEH debegguer, functions comments and renamed functions

This commit is contained in:
2025-08-20 10:58:43 +02:00
parent 33001e9d59
commit 93b583ebc2
2 changed files with 118 additions and 11 deletions

View File

@@ -7,6 +7,7 @@
#include <spdlog/spdlog.h>
#include <spdlog/sinks/basic_file_sink.h>
#include <iomanip>
#include <tlhelp32.h>
static std::shared_ptr<spdlog::logger> _log;
std::unordered_map<void*, Memory::PatchInfo> Memory::patches;
@@ -32,7 +33,6 @@ void Memory::PatchBytes(void* address, const char* bytes, size_t len)
VirtualProtect(address, len, oldProtect, &oldProtect);
}
//void Memory::RestoreBytes(uintptr_t address)
void Memory::RestoreBytes(void *address)
{
auto it = patches.find(address);
@@ -50,7 +50,7 @@ void Memory::RestoreBytes(void *address)
}
}
bool Memory::wait_for_module(const std::string& module_name, int timeoutMs = 15000, int intervalMs = 500)
bool Memory::WaitForModule(const std::string& module_name, int timeoutMs = 15000, int intervalMs = 500)
{
const HANDLE hProc = GetCurrentProcess();
@@ -81,21 +81,21 @@ bool Memory::wait_for_module(const std::string& module_name, int timeoutMs = 150
return false;
}
std::string Memory::byteToHexEscaped(const BYTE byte) {
std::string Memory::ByteToHexEscaped(const BYTE byte) {
std::ostringstream oss;
oss << "\\x" << std::uppercase << std::hex << std::setw(2)
<< std::setfill('0') << static_cast<int>(byte);
return oss.str();
}
uint8_t* Memory::aob_scan(
uint8_t* Memory::AOBScan(
const std::string& module_name,
const std::string& signature,
DWORD protect_flags = PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_READWRITE | PAGE_EXECUTE_WRITECOPY,
std::shared_ptr<spdlog::logger> log) {
_log = log;
if (!wait_for_module(module_name))
if (!WaitForModule(module_name))
{
if (log) log->warn("Skipping AOB scan because module '{}' is unavailable.", module_name);
return nullptr;
@@ -181,3 +181,76 @@ uint8_t* Memory::aob_scan(
if (log) log->warn("Module '{}' unexpectedly disappeared during scan.", module_name);
return nullptr;
}
PVOID Memory::SetupOrClearHardwareBreakPointForAllThreads(uintptr_t targetAddress, PVOID vehHandle, bool enable, PVECTORED_EXCEPTION_HANDLER pVEH, int hwIndex)
{
DWORD pid = GetCurrentProcessId();
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if (snapshot == INVALID_HANDLE_VALUE) return nullptr;
THREADENTRY32 te;
te.dwSize = sizeof(te);
// Add VectoredExceptionHandler
if (enable && !vehHandle && pVEH)
{
vehHandle = AddVectoredExceptionHandler(1, pVEH);
}
if (Thread32First(snapshot, &te))
{
do
{
if (te.th32OwnerProcessID != pid) continue;
HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, te.th32ThreadID);
if (!hThread) continue;
CONTEXT ctx = {};
ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS;
if (GetThreadContext(hThread, &ctx))
{
if (enable)
{
switch (hwIndex) {
case 0: ctx.Dr0 = targetAddress; break; // Set Hardware breakpoint #1
case 1: ctx.Dr1 = targetAddress; break; // Set Hardware breakpoint #2
case 2: ctx.Dr2 = targetAddress; break; // Set Hardware breakpoint #3
case 3: ctx.Dr3 = targetAddress; break; // Set Hardware breakpoint #4
default: break;
}
ctx.Dr7 |= (1ULL << (hwIndex * 2)); // activate hardware breakpoint
}
else
{
switch (hwIndex) {
case 0: ctx.Dr0 = 0; break; // Unset Hardware breakpoint #1
case 1: ctx.Dr1 = 0; break; // Unset Hardware breakpoint #2
case 2: ctx.Dr2 = 0; break; // Unset Hardware breakpoint #3
case 3: ctx.Dr3 = 0; break; // Unset Hardware breakpoint #4
default: break;
}
ctx.Dr7 &= ~(1ULL << (hwIndex * 2)); // deactivate hardware breakpoint
}
SetThreadContext(hThread, &ctx);
}
CloseHandle(hThread);
} while (Thread32Next(snapshot, &te));
}
CloseHandle(snapshot);
// Remove VectoredExceptionHandler
if (!enable && vehHandle)
{
RemoveVectoredExceptionHandler(vehHandle);
vehHandle = nullptr;
}
return vehHandle;
}