Geek asks and answers

How to skip a line from execution in windbg every time it hits?

Suppose I want to skip line 3 of the func function every time it is called

int func() {
     int a = 10, b =20;
     a = 25;
     b = 30;
     return a+b
}

therefore, each time it should return 40 (i.e. does not execute the 3rd line a = 25) Is there a similar command in windbg, for example jmp in gdb?

+5
source share
3 answers

again a very late answer, but if you mess with the assembly it is not preferable to
set a conditional breakpoint to skip the execution of one line

in the example below, 401034 is a string that you do not want to execute. so set a conditional breakpoint on this line to skip it

bp 401034 "r eip = @$eip + size of current instruction";gc"
7 in this case gc = gofrom the condition l break

jmptest:\>dir /b
jmptest.c

jmptest:\>type jmptest.c
#include <stdio.h>
int func()
{
    int a = 10 , b = 20;
    a = 25;
    b = 30;
    return a+b;
}
int main (void)
{
    int i , ret;
    for (i= 0; i< 10; i++)
    {
        ret = func();
        printf("we want 40 we get %d\n",ret);
    }
    return 0;
}
jmptest:\>cl /nologo /Zi jmptest.c
jmptest.c

jmptest:\>dir /b *.exe
jmptest.exe

jmptest:\>cdb -c "uf func;q" jmptest.exe | grep 401
00401020 55              push    ebp
00401021 8bec            mov     ebp,esp
00401023 83ec08          sub     esp,8
00401026 c745fc0a000000  mov     dword ptr [ebp-4],0Ah
0040102d c745f814000000  mov     dword ptr [ebp-8],14h
00401034 c745fc19000000  mov     dword ptr [ebp-4],19h
0040103b c745f81e000000  mov     dword ptr [ebp-8],1Eh
00401042 8b45fc          mov     eax,dword ptr [ebp-4]
00401045 0345f8          add     eax,dword ptr [ebp-8]
00401048 8be5            mov     esp,ebp
0040104a 5d              pop     ebp
0040104b c3              ret

jmptest:\>cdb -c "bp 401034 \"r eip = 0x40103b;gc\";g;q " jmptest.exe | grep wan
t
we want 40 we get 40
we want 40 we get 40
we want 40 we get 40
we want 40 we get 40
we want 40 we get 40
we want 40 we get 40
we want 40 we get 40
we want 40 we get 40
we want 40 we get 40
we want 40 we get 40

jmptest:\>
+5
source

, a (.. "a = 25;" NOP). , , NOP .

, - NOP 0x90 e (, "ew @eip 0x9090" ). , a.

, , " ":

http://msdn.microsoft.com/en-us/library/windows/hardware/ff542851(v=vs.85).aspx

+3

More articles:


All Articles