HWBP is constantly triggered menu

User Tag List

Results 1 to 5 of 5
  1. #1
    34D's Avatar Member
    Reputation
    4
    Join Date
    May 2020
    Posts
    45
    Thanks G/R
    8/3
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    HWBP is constantly triggered

    Hello, I tried to use HWBP, but there seems to be hooked already exists in ntdll by wow. Because I did another local test program completely normal.

    My HWBP can normally trigger VEH and can also receive and modify Rip to its own function normally.

    but.. when I am in WOW and execute SetThreadContext, it starts immediately, even without me actively triggering the bp I set.

    At present, I have tried to hook NtSetContextThread NtGetContextThread NtContinue KiUserExceptionDispatcher

    nd try to adjust or repair registers dr0 dr6 dr7 and ContextFlags and EFlags in various places, but the Dr0 address I set will be triggered always.

    I have been researching for many days but I still haven't solved it. There is really no way. Help, I hope someone can provide some guidance.

    THANKS
    Last edited by 34D; 3 Weeks Ago at 03:08 AM.

    These ads disappear when you log in.

  2. #2
    aeo's Avatar Contributor Authenticator enabled
    Reputation
    116
    Join Date
    Apr 2007
    Posts
    237
    Thanks G/R
    50/52
    Trade Feedback
    6 (100%)
    Mentioned
    1 Post(s)
    Tagged
    0 Thread(s)
    I told you in a PM. They make syscalls, your hooks wont work...... The only hook that will work is KiUserExceptionDispatcher. The rest will be bypassed. If they have another thread checking for DRs set. your are toast.

    You are now starting to get into their antidebug checks. You need to pass them all if you want to be able to handle HWBPs. Id suggest you read more into anti debug.
    Last edited by aeo; 3 Weeks Ago at 08:52 AM.

  3. #3
    34D's Avatar Member
    Reputation
    4
    Join Date
    May 2020
    Posts
    45
    Thanks G/R
    8/3
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by aeo View Post
    I told you in a PM. They make syscalls, your hooks wont work...... The only hook that will work is KiUserExceptionDispatcher. The rest will be bypassed. If they have another thread checking for DRs set. your are toast.

    You are now starting to get into their antidebug checks. You need to pass them all if you want to be able to handle HWBPs. Id suggest you read more into anti debug.
    Thank you, I will look for relevant information

  4. #4
    air999's Avatar Contributor
    Reputation
    108
    Join Date
    Nov 2014
    Posts
    90
    Thanks G/R
    6/57
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    this guy is very slow in learning)

  5. #5
    ChrisIsMe's Avatar Active Member
    Reputation
    79
    Join Date
    Apr 2017
    Posts
    119
    Thanks G/R
    49/36
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by air999 View Post
    this guy is very slow in learning)
    He's shown quite a bit of growth over the last few months so I don't see why you are purposefully trying to flame someone who's actually trying to learn.

  6. Thanks Corthezz, thateuler (2 members gave Thanks to ChrisIsMe for this useful post)

Similar Threads

  1. Replies: 1
    Last Post: 11-06-2018, 04:31 AM
  2. [Bot] Is there a free VPN that constantly changes your IP?
    By TheViho in forum Pokemon GO Hacks|Cheats
    Replies: 3
    Last Post: 08-13-2016, 02:38 AM
  3. [Exploit] Find out if an opposite faction player is online
    By Matt in forum World of Warcraft Exploits
    Replies: 7
    Last Post: 11-04-2006, 09:22 AM
  4. Is there a Hack to...
    By opaque in forum World of Warcraft General
    Replies: 8
    Last Post: 05-24-2006, 08:18 PM
  5. ALSO what or what is syndrom really usefull for?
    By case in forum World of Warcraft General
    Replies: 2
    Last Post: 03-20-2006, 11:00 PM
All times are GMT -5. The time now is 01:28 PM. Powered by vBulletin® Version 4.2.3
Copyright © 2021 vBulletin Solutions, Inc. All rights reserved. User Alert System provided by Advanced User Tagging (Pro) - vBulletin Mods & Addons Copyright © 2021 DragonByte Technologies Ltd.
Digital Point modules: Sphinx-based search