debugger icon indicating copy to clipboard operation
debugger copied to clipboard

Support reading from segment:offset pairs

Open samrussell opened this issue 3 years ago • 1 comments

This is required for accessing OS specific structures like PEB/TEB which will be useful for any anti-anti-debugger code (e.g. porting ScyllaHide or similar) via FS/GS

This can be added in DebuggerMemory::ReadMemory() as an extra parameter (could be overloaded to retain the existing interface which defaults to CS/DS/ES assuming these are the same)

samrussell avatar Jul 22 '22 08:07 samrussell

A workaround is to manually calculate the actually address corresponding toseg:off and read it directly. It would be nice if we can do it directly

xusheng6 avatar Nov 02 '22 03:11 xusheng6