Back to home page

DOS ain't dead

Forum index page

Log in | Register

Back to the forum
Board view  Mix view

Confusing DEBUG - EDIT (Miscellaneous)

posted by cm(R) Homepage E-mail, Düsseldorf, Germany, 19.08.2010, 01:19

> It's more complicated.

Only a little.

> - read the byte at CS:E/IP-1
> - restore its BPs
> - if the byte it has read is 0CCh AND entry into Debug was through
> interrupt 3, then it again reads the byte at CS:E/IP-1.

Fits my description up to here.

> If its value is NO
> LONGER 0CCh, then Debug assumes one of its BPs were hit and decrements
> E/IP.

This additional check, however, doesn't avoid my exploit. Whether you include that check in DEBUG really depends on your preference: let's say there was a CCh byte anyway - which byte did cause the interrupt, the one we wrote there or the one that was there anyway? I go with the first answer.

With the second answer, you display the message about "unexpected breakpoint interrupt" and don't decrement IP. I think you should rather not display the message but point to the int3 instruction in the disassembly.

EDIT: The MS DEBUG that I just tested chose the first answer just like me ;-)



Complete thread:

Back to the forum
Board view  Mix view
15297 Postings in 1378 Threads, 254 registered users, 15 users online (0 registered, 15 guests)
DOS ain't dead | Admin contact
RSS Feed
powered by my little forum