Text only | Text with Images

The MASM Forum

General => The Campus => Topic started by: kesmezar on January 02, 2021, 03:51:03 AM

Title: How to read and restore registers and flags of another program at runtime?
Post by: kesmezar on January 02, 2021, 03:51:03 AM
Hi,  I'm reading values ​​with ollydbg. What I want to learn is to read and write them in my own program.
Title: Re: Reading and writing Cpu registers at runtime
Post by: hutch-- on January 02, 2021, 04:42:45 PM
I am not sure what you are after but reading and writing CPU registers is technically trivial.

mov reg, reg
mov reg, mem
mov mem, reg
note - mov mem, mem will fail, the cpu does not have an instruction for it.
Title: Re: Reading and writing Cpu registers at runtime
Post by: kesmezar on January 02, 2021, 08:40:36 PM
@hutch-- thanks for the info.
Title: Re: Reading and writing Cpu registers at runtime
Post by: kesmezar on January 04, 2021, 08:01:37 PM
When you change the address, a very different result is read.
I wonder if I'm making a mistake in the type definitions?
Title: Re: How to read and restore registers and flags of another program at runtime?
Post by: TouEnMasm on January 04, 2021, 09:21:13 PM
as a sample who can help you see http://luce.yves.pagesperso-orange.fr/fpu_au_pas_a_pas.html (http://luce.yves.pagesperso-orange.fr/fpu_au_pas_a_pas.html)
It is very usefull with the FPU but  he can also work with others registers.
The dowload is in the bottom of the page.
Title: Re: How to read and restore registers and flags of another program at runtime?
Post by: jj2007 on January 04, 2021, 09:26:14 PM
So what is WriteProcessMemory supposed to do?
Title: Re: How to read and restore registers and flags of another program at runtime?
Post by: kesmezar on January 04, 2021, 09:58:16 PM
@TouEnMasm Thank you very much, I'm reviewing.

@jj2007 "WriteProcessMemory" only served to maintain a stable loop in the offset part.I realized that it would not be possible to write this way with the information given by @hutch--. Also, I'm researching your use of "DumpRegs" on this topic at " http://masm32.com/board/index.php?topic=5354.0 "


An example that I found while researching and was not fully working. Maybe someone needs this.
https://web.archive.org/web/20160314134907/http://kipirvine.com/asm/examples/Test_WriteStackFrame.asm
Title: Re: How to read and restore registers and flags of another program at runtime?
Post by: hutch-- on January 04, 2021, 11:01:12 PM
Sounds like you are making a games patch or something similar, just be careful not to post anything that is illegal as it gets us into trouble and we would have to remove it.
Title: Re: How to read and restore registers and flags of another program at runtime?
Post by: kesmezar on January 04, 2021, 11:08:13 PM
It is definitely not a game or an illegal issue.
The first non-working sample I found was of course taken from such places. But I am aware of the forum rules, I am too old for the game.
As an administrator, you are free to do whatever is necessary.
Title: Re: How to read and restore registers and flags of another program at runtime?
Post by: hutch-- on January 05, 2021, 02:35:20 AM
No problems, just make sure you don't get us into trouble.
Title: Re: How to read and restore registers and flags of another program at runtime?
Post by: jj2007 on January 05, 2021, 03:07:07 AM
Quote from: kesmezar on January 04, 2021, 09:58:16 PMI'm researching your use of "DumpRegs" on this topic at " http://masm32.com/board/index.php?topic=5354.0 "

Avoid the Irvine stuff. There are better examples for deb (http://www.jj2007.eu/MasmBasicQuickReference.htm#Mb1019) use in Dynamic arrays (http://masm32.com/board/index.php?topic=7978.0) and Debugging inside a WM_PAINT handler (http://masm32.com/board/index.php?topic=5245.0).
Title: Re: How to read and restore registers and flags of another program at runtime?
Post by: kesmezar on January 06, 2021, 02:45:52 AM
@jj2007 thank you.

"Avoid the Irvine stuff." I would like to know the reason for your saying.?
Title: Re: How to read and restore registers and flags of another program at runtime?
Post by: jj2007 on January 06, 2021, 03:48:43 AM
Quote from: kesmezar on January 06, 2021, 02:45:52 AM
@jj2007 thank you. "Avoid the Irvine stuff." I would like to know the reason for your saying.

- does not conform with the Windows ABI
- used only by a few(?) universities for beginners courses
- not freely available(?)

The examples we see from time to time here in the forum are, well, strange. But nobody stops you from using his stuff. There is even a dedicated sub-forum (http://masm32.com/board/index.php?board=56.0). Enjoy :thumbsup:
Text only | Text with Images