调试器调试指定进程的流程:
打开调试被调试进程;
while(true)
{
等待调试事件;
处理调试事件;
恢复调试事件;
}
///
打开被调试进程:DebugActiveProcess
This function allows a debugger to attach to an active process and then debug it.
BOOL DebugActiveProcess(
DWORD dwProcessId
);
等待调试事件:WaitForDebugEvent
This function blocks the debugger thread until a debug event is generated in the target process being debugged or the specified timeout elapses.
BOOL WaitForDebugEvent(
LPDEBUG_EVENT lpDebugEvent,
DWORD dwMilliseconds
);
调试事件的类型与具体信息:DEBUG_EVENT
typedef struct _DEBUG_EVENT {
DWORD dwDebugEventCode; //这个表示调试事件的类型
DWORD dwProcessId;
DWORD dwThreadId;
union { //根据不同的类型 使用不同的结构体
EXCEPTION_DEBUG_INFO Exception;
CREATE_THREAD_DEBUG_INFO CreateThread;
CREATE_PROCESS_DEBUG_INFO CreateProcessInfo;
EXIT_THREAD_DEBUG_INFO ExitThread;
EXIT_PROCESS_DEBUG_INFO ExitProcess;
LOAD_DLL_DEBUG_INFO LoadDll;
UNLOAD_DLL_DEBUG_INFO UnloadDll;
OUTPUT_DEBUG_STRING_INFO DebugString;
RIP_INFO RipInfo;
} u;
} DEBUG_EVENT;
恢复调试事件:ContinueDebugEvent
This function unblocks the debuggee thread identified by the given thread identifier.
BOOL ContinueDebugEvent( DWORD dwProcessId, DWORD dwThreadId, DWORD dwContinueStatus );