0
CONTEXT ctx;                             
ctx.ContextFlags = CONTEXT_ALL;         // I want to see all registers
GetThreadContext(pi.hThread, &ctx);     // Now I see the register
ctx.Eax = newEntryPoint;                // Changing EAX register
SetThreadContext(pi.hThread, &ctx)      // Returns 1 (nonzero is success);

Running on a 32bit process, changing EAX to another 32bit process.

The remote thread is suspended (since it was created) while I work on it.

Looking at the registers using windbg shows that the value remains the same.

I'm not sure where the problem is. Thank you for your time.

EDIT: Nevermind. It's only windbg. The values do change. Thankyou.

  • Does it mysteriously start working if you take windbg out of the equation? Instead, have the remote thread print out the value of EAX itself, then block on an event object, then print out the value of EAX a second time after it becomes unblocked. From your other program, wait for the remote thread to become blocked (instead of calling SuspendThread), then call SetThreadContext, then post the event object. If it works when you do that, I will explain why. – zwol Feb 1 at 19:31
  • I'll be honest, it sounds a bit complicated for me. I'm also not sure if those objects exist in c, neither how to use them. Look at the edit I added, it may help you help me :) – Trigosin Darom Feb 1 at 20:27
  • While editing I understood there's no problem. – Trigosin Darom Feb 1 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.