Bug in single stepping over a popf setting the trap flag
Posted June 4th, 2008 by SilvioCesare
in
Title of the post nearly sums it up. In win32, single stepping over a popf that sets the trap flag. The trap flag when examined using GetThreadContext reports the trap flag as being clear.
I tried for the first time installing OllyDbg today also, but Olly has no problem in detecting the trap flag as set. I’m not sure how it is able to do this.
To implement a solution in my own debugger, I will have to disassemble from the instruction pointer. If its a popf, I will retrieve the contents from the stack and check for the trap flag being set. If it is, I will call DbgContinue with DBG_EXCEPTION_NOT_HANDLED.

Recent comments
5 days 9 hours ago
5 days 20 hours ago
6 days 11 hours ago
6 days 18 hours ago
1 week 12 hours ago
1 week 12 hours ago
1 week 3 days ago
2 weeks 3 days ago
2 weeks 3 days ago
2 weeks 3 days ago