调试基本框架

// test.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//
#include<Windows.h>
#include<stdio.h>

void ThreadProc(PVOID context)

{
	DWORD pid = *(DWORD*)context;
	printf("要调试的进程ID是%d\n", pid);
	Sleep(2000);
	if (!DebugActiveProcess(pid))
	{
		printf("不能调试目标进程,错误码%d", GetLastError());
		system("pause");
	}

	DEBUG_EVENT de;
	while (WaitForDebugEvent(&de, INFINITE))
	{
		switch (de.dwDebugEventCode)
		{
		case EXCEPTION_DEBUG_EVENT:
			printf("异常码:%x\n", de.dwDebugEventCode);
			ContinueDebugEvent(de.dwProcessId, de.dwThreadId, DBG_EXCEPTION_NOT_HANDLED);
			continue;

		case CREATE_THREAD_DEBUG_EVENT:
			printf("创建线程\n");
			break;

		case CREATE_PROCESS_DEBUG_EVENT:
			printf("创建进程\n");
			break;

		case EXIT_THREAD_DEBUG_EVENT:
			printf("退出线程\n");
			break;

		case EXIT_PROCESS_DEBUG_EVENT:
			printf("退出进程\n");
			break;

		case LOAD_DLL_DEBUG_EVENT:
			printf("加载模块\n");
			break;

		case UNLOAD_DLL_DEBUG_EVENT:
			printf("卸载模块\n");
			break;

		default:
			printf("未处理异常\n");
			break;

		}

		ContinueDebugEvent(de.dwProcessId, de.dwThreadId, DBG_CONTINUE);
	}

}

int main(int argc, char* argv[])
{
	int ProcessId = 0;
	printf("输入被调试进程ID: \n");

	scanf_s("%d",&ProcessId);

	CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)ThreadProc, &ProcessId, 0, NULL);
	system("pause");
	return 0;
}