Debugging a Running Process

原文链接：http://msdn.microsoft.com/en-us/library/windows/desktop/ms679301%28v=vs.85%29.aspx

本文链接：http://blog.csdn.net/wlsgzl/article/details/18714945

To debug a process that is already running, the debugger should use DebugActiveProcess with the process identifier. 要调试一个已经运行的进程，调试器应该使用附带进程ID的DebugActiveProcess函数。To retrieve a list of process identifiers, use either the EnumProcesses or Process32First function.要想获得进程ID列表，可以使用EnumProcesses或Process32First函数。

DebugActiveProcess attaches the debugger to the active process. DebugActiveProcess函数将调试器附加到活动的进程。In this case, only the active process can be debugged; its child processes cannot. 在这种情形下，只有当前活动进程是可调试的，其子进程是不可调试的。The debugger must have appropriate access to the executing process to use DebugActiveProcess. 使用DebugActiveProcess函数时，调试器必须对正在执行的程序拥有适当的访问权限。For more information about access rights, see Access Control.关于访问权限的更多信息，参见Access Control。

After the debugger has either created or attached itself to the process it intends to debug, the system notifies the debugger of all debugging events that occur in the process, and, if specified, in any child processes.当调试器创建了一个要调试的进程或者把自己附加到要调试的进程上后，系统通知调试器发生在进程中的所有调试事件，如果指定了子进程，子进程的也是可以通知的。 For more information about debugging events, see Debugging Events.关于调试事件的更多信息，参见Debugging Events。

To detach from the process being debugged, the debugger should use the DebugActiveProcessStop function.想要从被调试的进程上剥离，调试器需要调用DebugActiveProcessStop函数。