You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Dangerfreak opened this issue
Mar 12, 2024
· 0 comments
Labels
bugThe issue describes a bug. It does not mean the bug has been reproduced by a developer.try thisThis issue needs to be tried by a developer to see if more information is needed.
This issue happens for GleeBug engine only (TitanEngine works): Open any .exe (32 or 64 bit) file and set a breakpoint (F2) at any CALL or JMP or conditional jump like JE or JNE within the code . Now run the debugger until the breakpoint is reached and press space (=assemble) to change the code exactly at this CALL/JMP, e.g. to NOP. You'll notice, that the first byte won't change. If it is a multi-byte command, only the bytes after the first byte will be changed.
Example:
Code before function "Assemble" (random code):
006EEF77 | E8 49040000 | call 6EF3C5 (breakpoint was set to this line)
Press space and change the code above to NOP (checkboxes all checked to see it better)
Code after function "Assemble":
006EEF77 | E8 90909090 | call 90FF800C
The first byte (E8) is unchanged! This seems to be a bug for me.
Note: If you set the breakpoint to another command (no CALL or JUMP), it works as it should.
The text was updated successfully, but these errors were encountered:
mrexodia
added
bug
The issue describes a bug. It does not mean the bug has been reproduced by a developer.
try this
This issue needs to be tried by a developer to see if more information is needed.
labels
Mar 26, 2024
bugThe issue describes a bug. It does not mean the bug has been reproduced by a developer.try thisThis issue needs to be tried by a developer to see if more information is needed.
This issue happens for GleeBug engine only (TitanEngine works): Open any .exe (32 or 64 bit) file and set a breakpoint (F2) at any CALL or JMP or conditional jump like JE or JNE within the code . Now run the debugger until the breakpoint is reached and press space (=assemble) to change the code exactly at this CALL/JMP, e.g. to NOP. You'll notice, that the first byte won't change. If it is a multi-byte command, only the bytes after the first byte will be changed.
Example:
006EEF77 | E8 49040000 | call 6EF3C5 (breakpoint was set to this line)
006EEF77 | E8 90909090 | call 90FF800C
The first byte (E8) is unchanged! This seems to be a bug for me.
Note: If you set the breakpoint to another command (no CALL or JUMP), it works as it should.
The text was updated successfully, but these errors were encountered: