开发者

GetThreadContext returns EBP = 0

开发者 https://www.devze.com 2023-04-04 22:39 出处:网络
I\'m trying to get the value of another process\' EBP register onwindows7 64 bits. for this I\'m using GetThreadContext like this:

I'm trying to get the value of another process' EBP register on windows7 64 bits.

for this I'm using GetThreadContext like this:

static CONTEXT threadContext;
memset(&threadContext, 0, sizeof(CONTEXT));
threadContext.ContextFlags = CONTEXT_FULL;
bool contextOk = GetThreadContext(threadHandle, &threadContext);

The EIP value seems ok, but EBP = 0. I tried using also WOW64_GetThreadContext but it didn't help... GetLastError() returns 0 so it's supposed to be ok. I do suspend this thread with SuspendThread and It DOESN'T happen every time开发者_开发百科 I sample the thread.

What could cause this?


One possible cause is that the register's value really is zero at the time you inspect it. It's a general-purpose register, so the program can set it to whatever value it wants.

0

精彩评论

暂无评论...
验证码 换一张
取 消