HWBP is constantly triggered menu

User Tag List

Results 1 to 5 of 5
  1. #1
    34D's Avatar Member
    Reputation
    4
    Join Date
    May 2020
    Posts
    57
    Thanks G/R
    10/3
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    HWBP is constantly triggered

    Hello, I tried to use HWBP, but there seems to be hooked already exists in ntdll by wow. Because I did another local test program completely normal.

    My HWBP can normally trigger VEH and can also receive and modify Rip to its own function normally.

    but.. when I am in WOW and execute SetThreadContext, it starts immediately, even without me actively triggering the bp I set.

    At present, I have tried to hook NtSetContextThread NtGetContextThread NtContinue KiUserExceptionDispatcher

    nd try to adjust or repair registers dr0 dr6 dr7 and ContextFlags and EFlags in various places, but the Dr0 address I set will be triggered always.

    I have been researching for many days but I still haven't solved it. There is really no way. Help, I hope someone can provide some guidance.

    THANKS
    Last edited by 34D; 04-19-2021 at 03:08 AM.

    HWBP is constantly triggered
  2. #2
    aeo's Avatar Contributor
    Reputation
    126
    Join Date
    Apr 2007
    Posts
    270
    Thanks G/R
    84/62
    Trade Feedback
    7 (100%)
    Mentioned
    2 Post(s)
    Tagged
    0 Thread(s)
    I told you in a PM. They make syscalls, your hooks wont work...... The only hook that will work is KiUserExceptionDispatcher. The rest will be bypassed. If they have another thread checking for DRs set. your are toast.

    You are now starting to get into their antidebug checks. You need to pass them all if you want to be able to handle HWBPs. Id suggest you read more into anti debug.
    Last edited by aeo; 04-19-2021 at 08:52 AM.

  3. #3
    34D's Avatar Member
    Reputation
    4
    Join Date
    May 2020
    Posts
    57
    Thanks G/R
    10/3
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by aeo View Post
    I told you in a PM. They make syscalls, your hooks wont work...... The only hook that will work is KiUserExceptionDispatcher. The rest will be bypassed. If they have another thread checking for DRs set. your are toast.

    You are now starting to get into their antidebug checks. You need to pass them all if you want to be able to handle HWBPs. Id suggest you read more into anti debug.
    Thank you, I will look for relevant information

  4. #4
    air999's Avatar Contributor
    Reputation
    131
    Join Date
    Nov 2014
    Posts
    102
    Thanks G/R
    9/62
    Trade Feedback
    0 (0%)
    Mentioned
    1 Post(s)
    Tagged
    0 Thread(s)
    this guy is very slow in learning)

  5. #5
    ChrisIsMe's Avatar Contributor
    Reputation
    164
    Join Date
    Apr 2017
    Posts
    210
    Thanks G/R
    67/100
    Trade Feedback
    0 (0%)
    Mentioned
    3 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by air999 View Post
    this guy is very slow in learning)
    He's shown quite a bit of growth over the last few months so I don't see why you are purposefully trying to flame someone who's actually trying to learn.

  6. Thanks Corthezz, thateuler (2 members gave Thanks to ChrisIsMe for this useful post)

Similar Threads

  1. Replies: 1
    Last Post: 11-06-2018, 04:31 AM
  2. [Bot] Is there a free VPN that constantly changes your IP?
    By TheViho in forum Pokemon GO Hacks|Cheats
    Replies: 3
    Last Post: 08-13-2016, 02:38 AM
  3. [Exploit] Find out if an opposite faction player is online
    By Matt in forum World of Warcraft Exploits
    Replies: 7
    Last Post: 11-04-2006, 09:22 AM
  4. Is there a Hack to...
    By opaque in forum World of Warcraft General
    Replies: 8
    Last Post: 05-24-2006, 08:18 PM
  5. ALSO what or what is syndrom really usefull for?
    By case in forum World of Warcraft General
    Replies: 2
    Last Post: 03-20-2006, 11:00 PM
All times are GMT -5. The time now is 04:53 PM. Powered by vBulletin® Version 4.2.3
Copyright © 2024 vBulletin Solutions, Inc. All rights reserved. User Alert System provided by Advanced User Tagging (Pro) - vBulletin Mods & Addons Copyright © 2024 DragonByte Technologies Ltd.
Digital Point modules: Sphinx-based search