Windbg ignores changing registers to overcome an access violation

access-violation, windbg

Solution

You have to use

gh (Go with Exception Handled)

to continue after you have manipulated your eax register

(2f14.1950): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=7efde000 ecx=94a31deb edx=0f709488 esi=0033f99c edi=0033fa80
eip=000d1a3f esp=0033f99c ebp=0033fa80 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
SimpleCrash!wmain+0x3f:
000d1a3f 8b08            mov     ecx,dword ptr [eax]  ds:002b:00000000=????????

0:000> r @eax=@eip
0:000> gh
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=77882100 edi=778820c0
eip=7779fcc2 esp=0033f9e8 ebp=0033fa04 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!NtTerminateProcess+0x12:
7779fcc2 83c404          add     esp,4

Problem

I am trying to debug an access violation in my program using WinDbg. The debugger catches the access violation correctly: ``` (2604.1e74): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=0808e7fb ebx=007b39f8 ecx=000116e7 edx=7ead8618 esi=00000000 edi=00000000 eip=006ed845 esp=0818ff24 ebp=0818ff30 iopl=0 nv up ei pl nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 image00400000!t_control.is_focused+0x15: 006ed845 8b8051070000 mov eax,dword ptr [eax+751h] ds:002b:0808ef4c=???????? ``` I want to “skip” the access violation so that I can continue debugging (e.g. step out of the faulting function to inspect the data structures of the caller). So I change `eax` so that it points to a readable memory, for instance the current code, so I do: ``` 0:025> r eax=eip ``` This seems to work fine, as the following verification seems to indicate: ``` 0:025> r eax=006ed845 ebx=007b39f8 ecx=000116e7 edx=7ead8618 esi=00000000 edi=00000000 eip=006ed845 esp=0818ff24 ebp=0818ff30 iopl=0 nv up ei pl nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 image00400000!t_control.is_focused+0x15: 006ed845 8b8051070000 mov eax,dword ptr [eax+751h] ds:002b:006edf96=012c0000 ``` However, as soon as I try to step (or continue) the program, it faults again in exactly the same way, as if the register did not change at all: ``` 0:025> p (2604.1e74): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=0808e7fb ebx=007b39f8 ecx=000116e7 edx=7ead8618 esi=00000000 edi=00000000 eip=006ed845 esp=0818ff24 ebp=0818ff30 iopl=0 nv up ei pl nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 image00400000!t_control.is_focused+0x15: 006ed845 8b8051070000 mov eax,dword ptr [eax+751h] ds:002b:0808ef4c=???????? ``` What am I doing wrong? (The debuggee is a 32-bit program written in Delphi, running under WinDbg X86, on 64-bit Windows 7. Neither the debuggee, nor WinDbg run elevated.)

Original source