break points cause access violation - c

Question

I write the program in C, and I'm using windows.
I have a program that take an exe from the user, and every 5 instructions I put a break point so it's become harder to crack the program. I'm using disassembly library to make sure that the opcode that I replaced is the first opcode of an instruction. Every time that I replace opcode with 0XCC I write the address of the opcode and the original opcode on a table. After the replace, I open a new process with debug flag and every time there is a break point, the child process throw an exception, and the father process replace the 0XCC with the original opcode. The code that replace the opcode to the original look something like this:
address = (DWORD)debug_event->u.Exception.ExceptionRecord.ExceptionAddress;
if (!VirtualProtectEx(pi->hProcess, (LPVOID)address, sizeof(BYTE), PAGE_READWRITE, &last_protect)) {
log_error("VirtualProtectEx failed LAST ERROR: %d", GetLastError());
goto l_cleanup;
}
log_trace("Trying to write the opcode: [0x%x] to the address: [0x%x]", *opcode, address);
if (!WriteProcessMemory(pi->hProcess, (LPVOID)address, opcode, sizeof(BYTE), &number_of_bytes_write)) {
log_error("WriteProcessMemory failed LAST ERROR: %d", GetLastError());
goto l_cleanup;
}
if (!VirtualProtectEx(pi->hProcess, (LPVOID)address, sizeof(BYTE), last_protect, &last_protect)) {
log_error("VirtualProtectEx failed LAST ERROR: %d", GetLastError());
goto l_cleanup;
}
log_trace("Successfully changed the opcode to the original one");
ctx.ContextFlags = CONTEXT_FULL;
if (!GetThreadContext(pi->hThread, &ctx)) {
log_error("GetThreadContext failed LAST ERROR: %d", GetLastError());
goto l_cleanup;
}
log_trace("Trying to change the EIP with the value: [0x%lx] to the value: [0x%x]", ctx.Eip, address);
ctx.Eip -= 1;
if (!SetThreadContext(pi->hThread, &ctx)) {
log_error("SetThreadContext failed LAST ERROR: %d", GetLastError());
goto l_cleanup;
}
I also have a while loop that run until the exception of the exit process.
This is the code that change the instruction and update the table:
address_of_code = text_section.VirtualAddress - text_section.PointerToRawData;
for (INT counter = 0; counter < count - 1; ++counter)
{
if (0 == counter % 5) {
loaded_PE->data[instructions[counter].address] = 0xCC;
info.address = instructions[counter].address + address_of_code;
info.opcode = instructions[counter].bytes[0];
info.length = instructions[counter].size;
log_trace("address: %x", instructions[counter].address +
address_of_code);
log_trace("instruction: %s", instructions[counter].mnemonic);
log_trace("length: %d", instructions[counter].size);
if (!INFO_TABLE__update_table(&info, table)) {
log_error("INFO_TABLE__update_table failed");
goto l_cleanup;
}
}
}
Instructions is an array that I recieve from the library Capstone. The loaded_PE-> store the data of the PE from the client. I call the disassembly function with the address of the entry point and the size of the code - the entry point. Counter is the number of the instructions the capstone library found. Info struct hold the information about the replace.
This is the call for the disassembly library:
count = cs_disasm(handle, data, size_to_modify, entry_point - text_section.VirtualAddress
+ text_section.PointerToRawData, 0, &instructions);
Now to my problem. I'm taking a simple program like this:
int main() {
char str[] = "hello";
printf("%s\n", str);
return 0;
I start to replace the instructions from the entry point. Now if I run the program that debug the new program I get the print and everything works fine. But if I change the number of instructions that I replace to every 10 instructions, I get an error. After the "hello" I get an access violation. After I checked the address of this access violation, I found that the program try to read 4 bytes before the address of the string on the stack and failed.
this is the line that try to read the location
this is the string and the address that the program trying to read
I don't understand why sometimes it's work and sometimes it's not.
One more thing. If I change the program to be like this:
int main() {
char* str = "hello";
printf("%s\n", str);
return 0;
I don't get any errors.
I hope I explained myself fine. Thanks for the help!