Function 69, subfunction 1 - get contents of registers of debugged thread.
Parameters:
- eax = 69 - function number
- ebx = 1 - subfunction number
- ecx = thread identifier
- edx = size of context structure, must be 0x28=40 bytes
- esi = pointer to context structure
Returned value:
- function does not return value
Format of context structure: (FPU is not supported yet)
- +0: dword: eip
- +4: dword: eflags
- +8: dword: eax
- +12 = +0xC: dword: ecx
- +16 = +0x10: dword: edx
- +20 = +0x14: dword: ebx
- +24 = +0x18: dword: esp
- +28 = +0x1C: dword: ebp
- +32 = +0x20: dword: esi
- +36 = +0x24: dword: edi
Remarks:
- If the thread executes code of ring-0, the function returns
contents of registers of ring-3.
- Process must be loaded for debugging (as is shown in
general description).