Windows软件调试学习笔记（七）—— 单步步入&单步步过
单步步入
描述：
- 单步步入的实现依赖于单步异常。
- 当我们需要观察每一行代码（包括函数内部的代码）执行之后寄存器与内存的变化，通常会采用单步步入。
- 当使用单步步入时，可采用在下一行代码的首字节设置INT 3断点的方式实现。
- CPU为我们提供了一种更为方便的方法，即使用陷阱标志位（TF位）。
设置单步异常
将TF位置1
处理单步异常
单步产生的异常与硬件断点产生的异常一致，都是STATUS_SINGLE_STEP（单步异常）
实验1：单步异常的设置与处理
1）编译并运行以下代码：
#include <stdio.h>
#include <windows.h>
#include <tlhelp32.h>
#define DEBUGGEE "C:\\helloworld.exe"
//被调试进程ID,进程句柄，OEP
DWORD dwDebuggeePID = 0;
//被调试线程句柄
HANDLE hDebuggeeThread = NULL;
HANDLE hDebuggeeProcess = NULL;
//系统断点
BOOL bIsSystemInt3 = TRUE;
//被INT 3覆盖的数据
CHAR OriginalCode = 0;
//线程上下文
CONTEXT Context;
typedef HANDLE (__stdcall *FnOpenThread) (DWORD, BOOL, DWORD);
VOID InitDebuggeeInfo(DWORD dwPID, HANDLE hProcess)
{
dwDebuggeePID = dwPID;
hDebuggeeProcess = hProcess;
}
DWORD GetProcessId(LPTSTR lpProcessName)
{
HANDLE hProcessSnap = NULL;
PROCESSENTRY32 pe32 = {0};
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if(hProcessSnap == (HANDLE)-1)
{
return 0;
}
pe32.dwSize = sizeof(PROCESSENTRY32);
if(Process32First(hProcessSnap, &pe32))
{
do
{
if(!strcmp(lpProcessName, pe32.szExeFile))
return (int)pe32.th32ProcessID;
} while (Process32Next(hProcessSnap, &pe32));
}
else
{
CloseHandle(hProcessSnap);
}
return 0;
}
BOOL WaitForUserCommand()
{
BOOL bRet = FALSE;
CHAR command;
printf("COMMAND>");
command = getchar();
switch(command)
{
case 't':
bRet = TRUE;
//1. 获取线程上下文
Context.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS;
GetThreadContext(hDebuggeeThread, &Context);
//2. 设置陷阱标志位
Context.EFlags |= 0x100;
//3. 设置线程上下文
SetThreadContext(hDebuggeeThread, &Context);
break;
case 'p':
bRet = TRUE;
break;
case 'g':
bRet = TRUE;
break;
}
getchar();
return bRet;
}
VOID SetHardBreakPoint(PVOID pAddress)
{
//1. 获取线程上下文
Context.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS;
GetThreadContext(hDebuggeeThread, &Context);
//2. 设置断点位置
Context.Dr0 = (DWORD)pAddress;
Context.Dr7 |= 1;
//3. 设置断点长度和类型
Context.Dr7 &= 0xfff0ffff; //执行断点（16、17位 置0） 1字节（18、19位 置0）
//5. 设置线程上下文
SetThreadContext(hDebuggeeThread, &Context);
}
BOOL Int3ExceptionProc(EXCEPTION_DEBUG_INFO *pExceptionInfo)
{
BOOL bRet = FALSE;
//1. 将INT 3修复为原来的数据（如果是系统断点，不用修复）
if(bIsSystemInt3)
{
bIsSystemInt3 = FALSE;
return TRUE;
}
else
{
WriteProcessMemory(hDebuggeeProcess, pExceptionInfo->ExceptionRecord.ExceptionAddress, &OriginalCode, 1, NULL);
}
//2. 显示断点位置
printf("Int 3断点：0x%p \r\n", pExceptionInfo->ExceptionRecord.ExceptionAddress);
//3. 获取线程上下文
Context.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS;
GetThreadContext(hDebuggeeThread, &Context);
//4. 修正EIP
Context.Eip--;
SetThreadContext(hDebuggeeThread, &Context);
//5. 显示反汇编代码、寄存器等
/*
硬件断点需要设置在被调试进程的的线程上下文中。
因此当被调试程序触发调试器设置的INT 3断点时，此时设置硬件断点较为合理。
*/
//SetHardBreakPoint((PVOID)((DWORD)pExceptionInfo->ExceptionRecord.ExceptionAddress+1));
//6. 等待用户命令
while(bRet == FALSE)
{
bRet = WaitForUserCommand();
}
return bRet;
}
BOOL AccessExceptionProc(EXCEPTION_DEBUG_INFO *pExceptionInfo)
{
BOOL bRet = TRUE;
return bRet;
}
BOOL SingleStepExceptionProc(EXCEPTION_DEBUG_INFO *pExceptionInfo)
{
BOOL bRet = FALSE;
//1. 获取线程上下文
Context.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS;
GetThreadContext(hDebuggeeThread, &Context);
//2. 判断是否是硬件断点导致的异常
if(Context.Dr6 & 0xF) //B0~B3不为空 硬件断点
{
//2.1 显示断点信息
printf("硬件断点：%x 0x%p \n", Context.Dr7&0x00030000, Context.Dr0);
//2.2 将断点去除
Context.Dr0 = 0;
Context.Dr7 &= 0xfffffffe;
}
else //单步异常
{
//2.1 显示断点信息
printf("单步异常：0x%p \n", Context.Eip);
//2.2 将断点去除
Context.Dr7 &= 0xfffffeff;
}
//3.设置线程上下文
SetThreadContext(hDebuggeeThread, &Context);
//4. 显示寄存器信息/反汇编代码
//...略
//5. 等待用户命令
while(bRet == FALSE)
{
bRet = WaitForUserCommand();
}
return bRet;
}
BOOL ExceptionHandler(DEBUG_EVENT *pDebugEvent)
{
BOOL bRet = TRUE;
EXCEPTION_DEBUG_INFO *pExceptionInfo = NULL;
pExceptionInfo = &pDebugEvent->u.Exception;
//得到线程句柄，后面要用
FnOpenThread MyOpenThread = (FnOpenThread)GetProcAddress(LoadLibrary("kernel32.dll"), "OpenThread");
hDebuggeeThread = MyOpenThread(THREAD_ALL_ACCESS, FALSE, pDebugEvent->dwThreadId);
switch(pExceptionInfo->ExceptionRecord.ExceptionCode)
{
//INT 3异常
case EXCEPTION_BREAKPOINT:
bRet = Int3ExceptionProc(pExceptionInfo);
break;
//访问异常
case EXCEPTION_ACCESS_VIOLATION:
bRet = AccessExceptionProc(pExceptionInfo);
break;
//单步执行
case EXCEPTION_SINGLE_STEP:
bRet = SingleStepExceptionProc(pExceptionInfo);
break;
}
return bRet;
}
VOID SetInt3BreakPoint(LPVOID addr)
{
CHAR int3 = 0xCC;
//1. 备份
ReadProcessMemory(hDebuggeeProcess, addr, &OriginalCode, 1, NULL);
//2. 修改
WriteProcessMemory(hDebuggeeProcess, addr, &int3, 1, NULL);
}
int main(int argc, char* argv[])
{
BOOL nIsContinue = TRUE;
DEBUG_EVENT debugEvent = {0};
BOOL bRet = TRUE;
DWORD dwContinue = DBG_CONTINUE;
//1.创建调试进程
STARTUPINFO startupInfo = {0};
PROCESS_INFORMATION pInfo = {0};
GetStartupInfo(&startupInfo);
bRet = CreateProcess(DEBUGGEE, NULL, NULL, NULL, TRUE, DEBUG_PROCESS || DEBUG_ONLY_THIS_PROCESS, NULL, NULL, &startupInfo, &pInfo);
if(!bRet)
{
printf("CreateProcess error: %d \n", GetLastError());
return 0;
}
hDebuggeeProcess = pInfo.hProcess;
//2.调试循环
while(nIsContinue)
{
bRet = WaitForDebugEvent(&debugEvent, INFINITE);
if(!bRet)
{
printf("WaitForDebugEvent error: %d \n", GetLastError());
return 0;
}
switch(debugEvent.dwDebugEventCode)
{
//1.异常
case EXCEPTION_DEBUG_EVENT:
bRet = ExceptionHandler(&debugEvent);
if(!bRet)
dwContinue = DBG_EXCEPTION_NOT_HANDLED;
break;
//2.
case CREATE_THREAD_DEBUG_EVENT:
break;
//3.创建进程
case CREATE_PROCESS_DEBUG_EVENT:
//设置INT 3断点
SetInt3BreakPoint((PCHAR)debugEvent.u.CreateProcessInfo.lpStartAddress);
break;
//4.
case EXIT_THREAD_DEBUG_EVENT:
break;
//5.
case EXIT_PROCESS_DEBUG_EVENT:
break;
//6.
case LOAD_DLL_DEBUG_EVENT:
break;
//7.
case UNLOAD_DLL_DEBUG_EVENT:
break;
//8.
case OUTPUT_DEBUG_STRING_EVENT:
break;
}
bRet = ContinueDebugEvent(debugEvent.dwProcessId, debugEvent.dwThreadId, DBG_CONTINUE);
}
return 0;
}
运行结果：
2）多次输入t并回车，单步执行
3）输入g并回车，程序继续运行
单步步过
- 当遇到CALL指令时，若无需进入函数内部进行调试，可以使用单步步过。
- 与单步步入不同的是，单步步过的实现依赖于软件断点或硬件断点。
实现思路
- 判断当前指令是否为CALL指令
- 若不是CALL指令，设置TF为1触发单步异常
- 若是CALL指令，判断OPCODE是E8还是FF15
- 若OPCODE是E8，在当前地址之后的第5个字节设置软件断点（E8指令占5个字节）
- 若OPCODE是FF15，在当前地址之后的第6个字节设置软件断点（FF15指令占6个字节）
实验2：实现单步步过
1）编译并运行以下代码：
#include <stdio.h>
#include <windows.h>
#include <tlhelp32.h>
#define DEBUGGEE "C:\\helloworld.exe"
//被调试进程ID,进程句柄，OEP
DWORD dwDebuggeePID = 0;
//被调试线程句柄
HANDLE hDebuggeeThread = NULL;
HANDLE hDebuggeeProcess = NULL;
//系统断点
BOOL bIsSystemInt3 = TRUE;
//被INT 3覆盖的数据
CHAR cOriginalCode = 0;
//线程上下文
CONTEXT Context;
typedef HANDLE (__stdcall *FnOpenThread) (DWORD, BOOL, DWORD);
VOID InitDebuggeeInfo(DWORD dwPID, HANDLE hProcess)
{
dwDebuggeePID = dwPID;
hDebuggeeProcess = hProcess;
}
DWORD GetProcessId(LPTSTR lpProcessName)
{
HANDLE hProcessSnap = NULL;
PROCESSENTRY32 pe32 = {0};
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if(hProcessSnap == (HANDLE)-1)
{
return 0;
}
pe32.dwSize = sizeof(PROCESSENTRY32);
if(Process32First(hProcessSnap, &pe32))
{
do
{
if(!strcmp(lpProcessName, pe32.szExeFile))
return (int)pe32.th32ProcessID;
} while (Process32Next(hProcessSnap, &pe32));
}
else
{
CloseHandle(hProcessSnap);
}
return 0;
}
VOID SetInt3BreakPoint(LPVOID addr)
{
CHAR int3 = 0xCC;
//1. 备份
ReadProcessMemory(hDebuggeeProcess, addr, &cOriginalCode, 1, NULL);
//2. 修改
WriteProcessMemory(hDebuggeeProcess, addr, &int3, 1, NULL);
}
BOOL WaitForUserCommand()
{
BOOL bRet = FALSE;
CHAR command;
WORD wBuffer;
printf("COMMAND>");
command = getchar();
switch(command)
{
case 't':
bRet = TRUE;
//1. 获取线程上下文
Context.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS;
GetThreadContext(hDebuggeeThread, &Context);
//2. 设置陷阱标志位
Context.EFlags |= 0x100;
//3. 设置线程上下文
SetThreadContext(hDebuggeeThread, &Context);
break;
case 'p':
bRet = TRUE;
bRet = TRUE;
//1. 获取线程上下文
Context.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS;
GetThreadContext(hDebuggeeThread, &Context);
//2. 读取当前EIP指向的机器码
ReadProcessMemory(hDebuggeeProcess, (LPVOID)Context.Eip, &wBuffer, 2, NULL);
if((wBuffer & 0xFF) == 0xE8)
{
//3. 在当前地址之后的第5个字节设置软件断点（E8指令占5个字节）
SetInt3BreakPoint((LPVOID)(Context.Eip+5));
}
else if(wBuffer == 0x15FF)
{
//3. 在当前地址之后的第6个字节设置软件断点（FF15指令占6个字节）
SetInt3BreakPoint((LPVOID)(Context.Eip+6));
}
else
{
//3. 不是CALL指令，设置陷阱标志位触发单步异常即可
Context.EFlags |= 0x100;
//4. 设置线程上下文
SetThreadContext(hDebuggeeThread, &Context);
}
break;
case 'g':
bRet = TRUE;
break;
}
getchar();
return bRet;
}
VOID SetHardBreakPoint(PVOID pAddress)
{
//1. 获取线程上下文
Context.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS;
GetThreadContext(hDebuggeeThread, &Context);
//2. 设置断点位置
Context.Dr0 = (DWORD)pAddress;
Context.Dr7 |= 1;
//3. 设置断点长度和类型
Context.Dr7 &= 0xfff0ffff; //执行断点（16、17位 置0） 1字节（18、19位 置0）
//5. 设置线程上下文
SetThreadContext(hDebuggeeThread, &Context);
}
BOOL Int3ExceptionProc(EXCEPTION_DEBUG_INFO *pExceptionInfo)
{
BOOL bRet = FALSE;
//1. 将INT 3修复为原来的数据（如果是系统断点，不用修复）
if(bIsSystemInt3)
{
bIsSystemInt3 = FALSE;
return TRUE;
}
else
{
WriteProcessMemory(hDebuggeeProcess, pExceptionInfo->ExceptionRecord.ExceptionAddress, &cOriginalCode, 1, NULL);
}
//2. 显示断点位置
printf("Int 3断点：0x%p \r\n", pExceptionInfo->ExceptionRecord.ExceptionAddress);
//3. 获取线程上下文
Context.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS;
GetThreadContext(hDebuggeeThread, &Context);
//4. 修正EIP
Context.Eip--;
SetThreadContext(hDebuggeeThread, &Context);
//5. 显示反汇编代码、寄存器等
/*
硬件断点需要设置在被调试进程的的线程上下文中。
因此当被调试程序触发调试器设置的INT 3断点时，此时设置硬件断点较为合理。
*/
//SetHardBreakPoint((PVOID)((DWORD)pExceptionInfo->ExceptionRecord.ExceptionAddress+1));
//6. 等待用户命令
while(bRet == FALSE)
{
bRet = WaitForUserCommand();
}
return bRet;
}
BOOL AccessExceptionProc(EXCEPTION_DEBUG_INFO *pExceptionInfo)
{
BOOL bRet = TRUE;
return bRet;
}
BOOL SingleStepExceptionProc(EXCEPTION_DEBUG_INFO *pExceptionInfo)
{
BOOL bRet = FALSE;
//1. 获取线程上下文
Context.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS;
GetThreadContext(hDebuggeeThread, &Context);
//2. 判断是否是硬件断点导致的异常
if(Context.Dr6 & 0xF) //B0~B3不为空 硬件断点
{
//2.1 显示断点信息
printf("硬件断点：%x 0x%p \n", Context.Dr7&0x00030000, Context.Dr0);
//2.2 将断点去除
Context.Dr0 = 0;
Context.Dr7 &= 0xfffffffe;
}
else //单步异常
{
//2.1 显示断点信息
printf("单步异常：0x%p \n", Context.Eip);
//2.2 将断点去除
Context.Dr7 &= 0xfffffeff;
}
//3.设置线程上下文
SetThreadContext(hDebuggeeThread, &Context);
//4. 显示寄存器信息/反汇编代码
//...略
//5. 等待用户命令
while(bRet == FALSE)
{
bRet = WaitForUserCommand();
}
return bRet;
}
BOOL ExceptionHandler(DEBUG_EVENT *pDebugEvent)
{
BOOL bRet = TRUE;
EXCEPTION_DEBUG_INFO *pExceptionInfo = NULL;
pExceptionInfo = &pDebugEvent->u.Exception;
//得到线程句柄，后面要用
FnOpenThread MyOpenThread = (FnOpenThread)GetProcAddress(LoadLibrary("kernel32.dll"), "OpenThread");
hDebuggeeThread = MyOpenThread(THREAD_ALL_ACCESS, FALSE, pDebugEvent->dwThreadId);
switch(pExceptionInfo->ExceptionRecord.ExceptionCode)
{
//INT 3异常
case EXCEPTION_BREAKPOINT:
bRet = Int3ExceptionProc(pExceptionInfo);
break;
//访问异常
case EXCEPTION_ACCESS_VIOLATION:
bRet = AccessExceptionProc(pExceptionInfo);
break;
//单步执行
case EXCEPTION_SINGLE_STEP:
bRet = SingleStepExceptionProc(pExceptionInfo);
break;
}
return bRet;
}
int main(int argc, char* argv[])
{
BOOL nIsContinue = TRUE;
DEBUG_EVENT debugEvent = {0};
BOOL bRet = TRUE;
DWORD dwContinue = DBG_CONTINUE;
//1.创建调试进程
STARTUPINFO startupInfo = {0};
PROCESS_INFORMATION pInfo = {0};
GetStartupInfo(&startupInfo);
bRet = CreateProcess(DEBUGGEE, NULL, NULL, NULL, TRUE, DEBUG_PROCESS || DEBUG_ONLY_THIS_PROCESS, NULL, NULL, &startupInfo, &pInfo);
if(!bRet)
{
printf("CreateProcess error: %d \n", GetLastError());
return 0;
}
hDebuggeeProcess = pInfo.hProcess;
//2.调试循环
while(nIsContinue)
{
bRet = WaitForDebugEvent(&debugEvent, INFINITE);
if(!bRet)
{
printf("WaitForDebugEvent error: %d \n", GetLastError());
return 0;
}
switch(debugEvent.dwDebugEventCode)
{
//1.异常
case EXCEPTION_DEBUG_EVENT:
bRet = ExceptionHandler(&debugEvent);
if(!bRet)
dwContinue = DBG_EXCEPTION_NOT_HANDLED;
break;
//2.
case CREATE_THREAD_DEBUG_EVENT:
break;
//3.创建进程
case CREATE_PROCESS_DEBUG_EVENT:
//设置INT 3断点
SetInt3BreakPoint((PCHAR)debugEvent.u.CreateProcessInfo.lpStartAddress);
break;
//4.
case EXIT_THREAD_DEBUG_EVENT:
break;
//5.
case EXIT_PROCESS_DEBUG_EVENT:
break;
//6.
case LOAD_DLL_DEBUG_EVENT:
break;
//7.
case UNLOAD_DLL_DEBUG_EVENT:
break;
//8.
case OUTPUT_DEBUG_STRING_EVENT:
break;
}
bRet = ContinueDebugEvent(debugEvent.dwProcessId, debugEvent.dwThreadId, DBG_CONTINUE);
}
return 0;
}
运行结果：
2）多次输入p并回车单步执行，若执行CALL则会触发INT 3异常
3）对照OD查看是否相符
348
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
