How to read and restore registers and flags of another program at runtime?

[kesmezar]

Hi,  I'm reading values ​​with ollydbg. What I want to learn is to read and write them in my own program.

[hutch--]

I am not sure what you are after but reading and writing CPU registers is technically trivial.

mov reg, reg
mov reg, mem
mov mem, reg
note - mov mem, mem will fail, the cpu does not have an instruction for it.

[kesmezar]

@hutch-- thanks for the info.

[kesmezar]

When you change the address, a very different result is read.
I wonder if I'm making a mistake in the type definitions?

[TouEnMasm]

as a sample who can help you see http://luce.yves.pagesperso-orange.fr/fpu_au_pas_a_pas.html
It is very usefull with the FPU but  he can also work with others registers.
The dowload is in the bottom of the page.

[jj2007]

So what is WriteProcessMemory supposed to do?

[kesmezar]

@TouEnMasm Thank you very much, I'm reviewing.

@jj2007 "WriteProcessMemory" only served to maintain a stable loop in the offset part.I realized that it would not be possible to write this way with the information given by @hutch--. Also, I'm researching your use of "DumpRegs" on this topic at " http://masm32.com/board/index.php?topic=5354.0 "


An example that I found while researching and was not fully working. Maybe someone needs this.
https://web.archive.org/web/20160314134907/http://kipirvine.com/asm/examples/Test_WriteStackFrame.asm

[hutch--]

Sounds like you are making a games patch or something similar, just be careful not to post anything that is illegal as it gets us into trouble and we would have to remove it.

[kesmezar]

It is definitely not a game or an illegal issue.
The first non-working sample I found was of course taken from such places. But I am aware of the forum rules, I am too old for the game.
As an administrator, you are free to do whatever is necessary.

[hutch--]

No problems, just make sure you don't get us into trouble.

[jj2007]

I'm researching your use of "DumpRegs" on this topic at " http://masm32.com/board/index.php?topic=5354.0 "

Avoid the Irvine stuff. There are better examples for deb use in Dynamic arrays and Debugging inside a WM_PAINT handler.

[kesmezar]

@jj2007 thank you.

"Avoid the Irvine stuff." I would like to know the reason for your saying.?

[jj2007]

@jj2007 thank you. "Avoid the Irvine stuff." I would like to know the reason for your saying.

- does not conform with the Windows ABI
- used only by a few(?) universities for beginners courses
- not freely available(?)

The examples we see from time to time here in the forum are, well, strange. But nobody stops you from using his stuff. There is even a dedicated sub-forum. Enjoy