我在写OD插件时,为什么读取被调试程序的当前指令时,总是读出来的12F4CC,怎么解决
代码如下:
extc void _export cdecl ODBG_Pluginmainloop(DEBUG_EVENT *debugevent)
{
TCHAR szText[200];
BYTE bMachineCode[200];
// HANDLE hProcess;
// DWORD dwRead,dwProcessId;
// LPVOID lpaddr;
DWORD dwThreadId;
t_thread * stThread;
if (debugevent == NULL)
return;
if (debugevent->dwDebugEventCode == EXCEPTION_DEBUG_EVENT)
{//本事件在调试 中断时和运行时都会发生 Exception成员指向EXCEPTION_DEBUG_INFO,其中的EXCEPTION_RECORD成员指向EXCEPTION_RECORD
if (pLastAddr == debugevent->u.Exception.ExceptionRecord.ExceptionAddress)
return;
pLastAddr = debugevent->u.Exception.ExceptionRecord.ExceptionAddress;
wsprintf(szText,"exception addr: %X",pLastAddr);
_Addtolist(0,0,szText);
memset(bMachineCode,0,32);
// dwProcessId = (DWORD)_Plugingetvalue(VAL_PROCESSID);
// wsprintf(szText,"process id: %X",dwProcessId);
// _Addtolist(0,0,szText);
// hProcess = (HANDLE)_Plugingetvalue(VAL_HPROCESS);
// dwProcessId = (DWORD)GetProcessId(hProcess);
// ReadProcessMemory(hProcess,lpaddr,bMachineCode,32,&dwRead);
// _Readmemory(bMachineCode,(ULONG)&pLastAddr,4,MM_SILENT);
// wsprintf(szText,"machine code: %X",bMachineCode);
dwThreadId = _Getcputhreadid();
stThread = _Findthread(dwThreadId);
_Readcommand(stThread->reg.ip,(char *)bMachineCode);
wsprintf(szText,"machine code: %X",bMachineCode);
_Addtolist(0,0,szText);
}
}
是不是不能放在调试事件中读呢?
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课