Jump to content
Tuts 4 You

Issues with TitanEngine StepInto()


Recommended Posts

As far as I can understand StepInto() function in titanengine steps into a instruction and contains a call back to execute after stepping into has been done. My code doesn't do what I want, wich is basically keep in a vector all instructions it executes until reaching handler_start.

void vm::DoNothing(){ }
std::vector<std::string> vm::fetch_handler(){
std::vector<std::string> handler;
std::string disasm;
static uint32_t eip_control = GetContextData(UE_EIP);
void* dbg = 0;
do {
eip_control = GetContextData(UE_EIP);
disasm.assign((const char*)Disassemble((LPVOID)eip_control));
dump_ << disasm <<std::endl;
} while (eip_control != handler_start); return handler;

Basically GetContextData() doesn't really change the value of eip_control, making me think that the StepInto() did actually nothing. What do you think its wrong?


Best Regards.

Link to comment



First of all I recommend compiling the latest TitanEngine yourself (in case you didn't do that already).


StepInto returns immediately, it only sets a few internal values. A blogpost of mine should give a little information about how TitanEngine works internally. http://mrexodia.cf/x64_dbg/2014/12/24/x64_dbg-from-top-to-bottom-1

Basically the callback you set will be called inside the debug loop, so code should look something like this:

void cbStep()
    StepInto((void*)cbStep); //returns immediately
    //log here
void cbEntryPoint()
void Debug()
    //initialize some stuff here
    InitDebug(filename, cmdline, (void*)cbEntryPoint);
    DebugLoop(); //this one will not return until the program is terminated


Full example: https://forum.tuts4you.com/topic/34308-sdk-example-x64-mpresspespin-unpacker/



  • Like 1
Link to comment

Yeah - I have changed it to something like 

void vm::cbOn_get_h(){
dump_ << std::endl;
} void vm::fetch_handler(){ std::string disasm;
static uint32_t eip_control = GetContextData(UE_EIP);
eip_control = GetContextData(UE_EIP);
disasm.assign((const char*)Disassemble((LPVOID)eip_control));
if (eip_control != handler_start){
dump_ << disasm <<std::endl; }

And it seems to be working thank you.

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...