I'm trying to get the value of another process' EBP register on windows7 64 bits.
for this I'm using GetThreadContext like this:static CONTEXT threadContext;
memset(&threadContext, 0, sizeof(CONTEXT));
threadContext.ContextFlags = CONTEXT_FULL;
bool contextOk = GetThreadContext(threadHandle, &threadContext);
The EIP value seems ok, but EBP = 0. I tried using also WOW64_GetThreadContext but it didn't help... GetLastError() returns 0 so it's supposed to be ok. I do suspend this thread with SuspendThread and It DOESN'T happen every time开发者_开发百科 I sample the thread.
What could cause this?
One possible cause is that the register's value really is zero at the time you inspect it. It's a general-purpose register, so the program can set it to whatever value it wants.
精彩评论