Skip to content

Commit

Permalink
Merge pull request #2 from 1uhp2tye35wqxv64szjrb0dkcongm78i/fix
Browse files Browse the repository at this point in the history
Fixed a typo: "DbgBreakPrint" to "DbgBreakPoint"
  • Loading branch information
chkp-alexanderc authored Nov 11, 2021
2 parents 714633c + 88592dc commit c8307f8
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions _techniques/process-memory.md
Original file line number Diff line number Diff line change
Expand Up @@ -502,13 +502,13 @@ bool IsDebuggerPresent()

<br />
<h4><a class="a-dummy" name="patch_ntdll_dbgbreakpoint">2.3. Patch ntdll!DbgBreakPoint()</a></h4>
The function <tt>ntdll!DbgBreakPrint()</tt> has the following implementation:
The function <tt>ntdll!DbgBreakPoint()</tt> has the following implementation:

<div style="text-align: center">
<img src="{{site.baseurl}}/assets/images/dbgbreakpoint.png">
</div>

<br />It is called when a debugger attaches to a running process. It allows the debugger to gain control because an exception is raised which it can intercept. If we erase the breakpoint inside <tt>ntdll!DbgBreakPrint()</tt>, the debugger won't break in and the thread will exit.
<br />It is called when a debugger attaches to a running process. It allows the debugger to gain control because an exception is raised which it can intercept. If we erase the breakpoint inside <tt>ntdll!DbgBreakPoint()</tt>, the debugger won't break in and the thread will exit.

<hr class="space">

Expand Down

0 comments on commit c8307f8

Please sign in to comment.