Search code examples
c++windowsthreadcontext

GetThreadContext returns EBP = 0

I'm trying to get the value of another process' EBP register on windows7 64 bits.
for this I'm using GetThreadContext like this: 

static CONTEXT threadContext;
memset(&threadContext, 0, sizeof(CONTEXT));
threadContext.ContextFlags = CONTEXT_FULL;
bool contextOk = GetThreadContext(threadHandle, &threadContext);

The EIP value seems ok, but EBP = 0. I tried using also WOW64_GetThreadContext but it didn't help... GetLastError() returns 0 so it's supposed to be ok. I do suspend this thread with SuspendThread and It DOESN'T happen every time I sample the thread.

What could cause this?

Solution

  • One possible cause is that the register's value really is zero at the time you inspect it. It's a general-purpose register, so the program can set it to whatever value it wants.