Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Wow, people still use LCC... Last time I used it was ~10 years ago.</p> <p>I decompiled <code>wedit.exe</code> and can confirm there is no official way to disable this behavior.</p> <p>I patched the binary if that works for you. I uploaded it <a href="http://www.box.com/s/t2hygokia5y5g7qr4ehx" rel="nofollow noreferrer">here</a>.</p> <p>To those who concerned about viruses and such I patched <code>wedit</code> taken from <a href="http://www.cs.virginia.edu/~lcc-win32/lccwin32.exe" rel="nofollow noreferrer">here</a>. About box says it's version 4.0 compiled at Sep 16 2009.</p> <p>Here is patched function to those who interested:</p> <pre><code>int __cdecl sub_44CF0D(HANDLE hProcess) { int result; // eax@1 int v2; // ST0C_4@10 int v3; // eax@20 int v4; // eax@23 int v5; // eax@25 int v6; // [sp+10h] [bp-68h]@11 int v7; // [sp+14h] [bp-64h]@1 struct _DEBUG_EVENT DebugEvent; // [sp+18h] [bp-60h]@1 v7 = 1; result = WaitForDebugEvent(&amp;DebugEvent, dwMilliseconds); if ( result ) { sub_44C67A(&amp;DebugEvent); if ( DebugEvent.dwDebugEventCode == 1 ) { if ( DebugEvent.u.Exception.ExceptionRecord.ExceptionCode == EXCEPTION_ACCESS_VIOLATION &amp;&amp; !(dword_482860 &amp; 1) &amp;&amp; !dword_484328 &amp;&amp; DebugEvent.u.Exception.dwFirstChance ) { sub_44E1A5(0); sub_44CEB2(v2); return ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId, 0x80010001u); } v6 = 0; v7 = sub_44D2C4((int)&amp;DebugEvent, hProcess, (int)&amp;v6); if ( v6 &amp;&amp; DebugEvent.u.Exception.dwFirstChance ) return ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId, 0x80010001u); goto LABEL_41; } if ( DebugEvent.dwDebugEventCode == 3 ) { if ( dword_483C94 ) { dword_48428C = 1; LABEL_41: if ( dword_483C6C ) sub_44ECDC(); if ( v7 ) { result = ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId, 0x10002u); } else { dword_49BF68 = 1; ResetEvent(dword_484AE4); dword_4843C8 = DebugEvent.dwThreadId; result = sub_4524CD(); } return result; } Sleep(0x32u); dword_49BF64 = 1; dword_49BF68 = 1; qword_483C74 = __PAIR__( (unsigned int)DebugEvent.u.Exception.ExceptionRecord.ExceptionAddress, DebugEvent.u.Exception.ExceptionRecord.ExceptionInformation[2]); if ( dword_484288 ) ::hProcess = (HANDLE)DebugEvent.u.Exception.ExceptionRecord.ExceptionFlags; else ::hProcess = hProcess; dword_483C84 = DebugEvent.dwProcessId; hThread = DebugEvent.u.Exception.ExceptionRecord.ExceptionRecord; dword_483C9C = (HANDLE)DebugEvent.u.Exception.ExceptionRecord.ExceptionCode; dwThreadId = DebugEvent.dwThreadId; dword_483C94 = 0; if ( sub_45A83A() ) { v4 = sub_4026A6(28); dword_484330 = v4; *(_DWORD *)(v4 + 4) = hThread; *(_DWORD *)(v4 + 8) = dwThreadId; if ( dword_484288 ) { sub_455B58(); } else { Sleep(0x64u); v5 = sub_45AAFC(); if ( !v5 ) return PostMessageA(dword_4849EC, 0x111u, 0x64u, 0); if ( dword_484354 ) goto LABEL_50; sub_455B58(); if ( dword_483C70 &amp;&amp; *(_DWORD *)(dword_483C70 + 52) ) *(_DWORD *)(*(_DWORD *)(dword_483C70 + 52) + 36) = sub_451577(**(_DWORD **)(dword_483C70 + 52), 1u); v5 = *(_DWORD *)(dword_483C70 + 52); if ( v5 &amp;&amp; *(_DWORD *)(v5 + 36) ) { LABEL_50: if ( !dword_483C6C ) sub_44E92A(v5); sub_44CC3D(); sub_451600(); PostMessageA(dword_4849EC, 0x111u, 0x154u, 0); } else { sub_4029CA("Imposible to find %s\nRunning without source display", *(_DWORD *)(dword_483C70 + 20)); dword_484344 = 1; v7 = 1; PostMessageA(dword_4849EC, 0x111u, 0x154u, 0); } } goto LABEL_41; } dword_484338 = 1; v3 = sub_44DB56(qword_483C74); if ( v3 ) *(_BYTE *)(v3 + 29) &amp;= 0xFDu; result = ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId, 0x10002u); } else { if ( DebugEvent.dwDebugEventCode != 5 ) goto LABEL_41; if ( DebugEvent.dwProcessId != dword_483C84 ) { v7 = 1; goto LABEL_41; } dword_49BF64 = 0; dword_49BF68 = 1; dword_481614 = 0; result = sub_402A32(4520, SLOBYTE(DebugEvent.u.Exception.ExceptionRecord.ExceptionCode)); if ( !dword_483C6C ) result = sub_40B155(lpCmdLine); } } else { if ( dword_483C6C ) result = sub_44ECDC(); } return result; } </code></pre> <p><code>if</code> under <code>LABEL_50</code> is what I patched (from 0x75 to 0xEB).</p> <p>It was easy to spot the place because I expected <a href="http://msdn.microsoft.com/en-us/library/windows/desktop/ms681674%28v=vs.85%29.aspx" rel="nofollow noreferrer">WriteProcessMemory</a> to be used to write 0xCC at entry-point of application that is being debugged.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload