Question

I want to detect possible hardware breakpoints on my application. To do this I need read access to debug registers. Direct access is not possible so I do this in this way:

HANDLE thread = GetCurrentThread();

WOW64_CONTEXT context;
context.ContextFlags = CONTEXT_FULL;
BOOL status = Wow64GetThreadContext(thread, &context);

if (!status)
    return -1;

std::cout << std::hex << context.Dr0 << " " << context.Dr1 << " " << context.Dr2 << " " << context.Dr3 << " " << std::endl;

What I see on stdout is: cccccccc cccccccc cccccccc cccccccc even if there are hw breakpoints set by me.

Do I need some special permissions to access those registers? The application is 32 bit but I’m working on Windows 7 x64 if that matters.

Answer 1

Wrong ContextFlags value, you need CONTEXT_ALL to include CONTEXT_DEBUG_REGISTERS.