Re: [Mingw-w64-public] Help required about process and dll injection

2014-11-14 Thread Vincent Torri
On Fri, Nov 14, 2014 at 5:01 PM, lh_mouse wrote: > Hmm have a test yourself. :< > Since you are writing a debugger you can wait for the breakpoint. The system > generates an exception with code EXCEPTION_BREAKPOINT and your debugger > should handle it. Otherwise your program would be terminated.

Re: [Mingw-w64-public] Help required about process and dll injection

2014-11-14 Thread Vincent Torri
On Fri, Nov 14, 2014 at 4:49 PM, Vincent Torri wrote: > Hey, > > thanks for the answer. coments below > > On Fri, Nov 14, 2014 at 3:35 PM, lh_mouse wrote: >> Possible solution: >> 0) Load the debugee in suspended mode; >> 1) Calculate the address of its entry point (typically mainCRTStartup or >

Re: [Mingw-w64-public] Help required about process and dll injection

2014-11-14 Thread Mook
Hi! You had to go and have an interesting problem, so I wrote a crappy sample :p https://gist.github.com/mook/33abbeb13b6bb511fc21 - Note that I didn't close the handles that I should (see the various WaitForDebugEvent-related documentation). On 11/14/2014 07:49 AM, Vincent Torri wrote: > Hey,

Re: [Mingw-w64-public] Help required about process and dll injection

2014-11-14 Thread lh_mouse
Hmm have a test yourself. :< Since you are writing a debugger you can wait for the breakpoint. The system generates an exception with code EXCEPTION_BREAKPOINT and your debugger should handle it. Otherwise your program would be terminated. -- Best r

Re: [Mingw-w64-public] Help required about process and dll injection

2014-11-14 Thread Vincent Torri
Hey, thanks for the answer. coments below On Fri, Nov 14, 2014 at 3:35 PM, lh_mouse wrote: > Possible solution: > 0) Load the debugee in suspended mode; > 1) Calculate the address of its entry point (typically mainCRTStartup or > WinMainCRTStartup) from its PE header, since its header should no

Re: [Mingw-w64-public] Help required about process and dll injection

2014-11-14 Thread lh_mouse
Possible solution: 0) Load the debugee in suspended mode; 1) Calculate the address of its entry point (typically mainCRTStartup or WinMainCRTStartup) from its PE header, since its header should now have been loaded into RAM; 2) Overwrite the byte at that address with 0xCC (a.k.a. int3 instruction

[Mingw-w64-public] Help required about process and dll injection

2014-11-14 Thread Vincent Torri
Hello My question is not related to mingw-w64 itself, I know, but i'm desperatly trying to find help. Kai told me that maybe some people here could help me. I'm trying to write some kind of debugger to find leaks in a program by injecting a DLL in the process I want to debug [1]. I have already a