, 32- Windows (Win32) , . -, createProcess ( dwCreationFlags) DEBUG_ONLY_THIS_PROCESS. , , , . , , DEBUG_ONLY_THIS_PROCESS :reateProcess DEBUG_PROCESS.
, API Win32 , Win32 . (wild memory writes) , . ( 16- Windows Macintosh , , .)
, , API- v/aitForDebugEvent, . , :ontinueDebugEvent. , , :reateProcess , API-. , , Win32-oxnafl4HK:
void main ( void)
CreateProcess ( ..., DEBUG_ONLY_THIS_PROCESS, ...);
while ( 1 == WaitForDebugEvent ( ...))
{
if ( EXIT_PROCESS)
{
break;
}
ContinueDebugEvent ( ...);
}
}
, 32- Win- , , - . API Win32 , .
, , . ( DEBUG_EVENT), WaitForDebugEvent, .
typedef struct _DEBUG_EVENT {
DWORD dwDebugEventCode;
DWORD dwProcessId;
DWORD dwThreadld;
union {
EXCEPTION_DEBUG_INFO Exception;
CREATE_THREAD_DEBUG_INFO CreateThread;
CREATE_PROCESS_DEBUG_INFO CreateProcessInfo;
EXIT_THREAD_DEBUG_INFO ExitThread;
EXIT_PROCESS_DEBUG_INFO ExitProcess;
LOAD_DLL_DEBUG_INFO LoadDll;
UNLOAD_DLL_DEBUG_INFO UnloadDll;
OUTPUT_DEBUG_STRING_INFO DebugString;
RIP_INFO Riplnfo;
} u;
} DEBUG_EVENT
.
, . , , .
DEBUG_EVENT CREATE_PROCESS_DEBUG_INFO.
, , , .
PROCESS_VM_READ PROCESS_VM_WRITE. , , ReadProcessMemory WriteProcessMemory.
GENERIC_READ (read-sharing).
THREAD_GET_CONTEXT, THREAD_SET_CONTEXT THREAD_SUSPEND_RESUME. , () , GetThreadContext SetThreadContext, , ResumeThread SuspendThread.
, . , .
DEBUG_EVENT CREATE_THREAD_DEBUG_INFO. . THREAD_GET_CONTEXT, THKEAD_SET_ CONTEXT THREAD_SUSPEND_RESUME. , () , GetThreadContext SetThreadContext, , ResumeThread SuspendThread.
, . , , 0 , "Structured Exception Handling" ( ) Platform SDK.
DEBUG_EVENT EXCEPTION_DEBUG_INFO. , .
, . DBG_CONTROL_C, <Ctrl>+<C>. <Ctrl>+<C> . . . , .
DBG_CONTROL_C, . ( MSDN SetConsoleCtrlHandler.)
, . , DLL .
DEBUG_EVENT EXIT_PROCESS_DEBUG_INFO, .
, . , .
, , . , .
DEBUG_EVENT EXIT_THREAD_DEBUG_INFO, .
, . , .
, . EXIT_PROCESS_DEBUG_EVENT.
, DLL. , DLL LoadLibrary. , DLL. DLL 0, DLL . DLL .
DEBUG_EVENT LOAD_DLL_DEBUG_INFO. DLL, DLL, , DLL.
, , DLL.
, OutputDebugString.
DEBUG_EVENT OUTPUT_DEBUG_STRING_INFO. , .
, DLL, FreeLibrary. , DLL (. . DLL 0).
DEBUG_EVENT UNLOAD_DLL_DEBUG_INFO. DLL , DLL.
, , DLL.
, DLL , UNLOAD_DLL_DEBUG _EVENT.
Windows 98 , , , , .
, :.TaitForDebugEvent, , , , continueoebugEvent. , ReadProcessMemory WriteProcessMemory. "--", virtuaiProtect, . WriteProcessMemory, FlushinstructionCache, . FlushinstructionCache, , , , , , CPU, . FlushinstructionCache . CPU, GetThreadContext SetThreadContext.
Win32, , . CREATE_PROCESS_DEBUG_VENT LOAD_DLL_DEBUG_EVENT , EXCEPTION_DEBUG_EVENT. (loader breakpoint). , CREATE_PROCESS_DEBUG_EVENT , , , . , . (real-world) (, ) , , .
1 , , Visual Basic, Visual C++ .
, , . , ( ), CPU. Intel Pentium , ContinueDebugEvent DBG_CONTINUE, .
4-2 " " MinDBG. . MinDBG , , , , DLL. , "" "".
4-2. MINDBG.CPP
/*- - - - - - - - - - - - - - - - - - - - - - - -
Win32
- - - - - - - - - - - - - - - - - - - - - - - - - */
/*//////////////////////////////////////////////////////////////
#include
//////////////////////////////////////////////////////////////*/
#include "stdafx.h"
/*///////////////////////////////////////////////////
////////////////////////////////////////////////////////*/
// Shows the minimal help.
void ShowHelp ( void);
// Display-
void DisplayCreateProcessEvent ( CREATE_PROCESS_DEBUG_INFO & stCPDI);
void DisplayCreateThreadEvent ( CREATE_THREAD_DEBUG_INFO & stCTDI);
void DisplayExitThreadEvent ( EXIT_THREAD_DEBUG_INFO & stETDI);
void DisplayExitProcessEvent ( EXIT_PROCESS_DEBUG_INFO & stEPDI);
void DisplayDllLoadEvent ( LOAD_DLL_DEBUG_INFO & stLDDI);
void DisplayDllUnLoadEvent ( UNLOAD_DLL_DEBUG_INFO & stULDDI);
void DisplayODSEvent ( HANDLE hProcess,
OUTPUT_DEBUG_STRING_INFO & stODSI );
void DisplayExceptionEvent ( EXCEPTION_DEBUG_INFO & stEDI);
/*////////////////////////////////////////////////////////////
!
/////////////////////////////////////////////////////////////*/
void main ( int argc, char * argv[ ])
// .
if ( 1 == argc)
{
ShowHelp ();
return;
}
// .
TCHAR szCmdLine[ _ ];
szCmdLine[ 0 ] = '\0';
for ( int i = 1; i < argc; i++)
{ strcat ( szCmdLine, argv[ i ]);
if ( i < argc)
{
strcat ( szCmdLine, " ");
}
}
// .
// CreateProcess,
//
// DEBUG_ONLY_THIS_PROCESS.
STARTUPINFO stStartlnfo ;
PROCESS_INFORMATION stProcessInfo ;
memset ( sstStartlnfo , NULL, sizeof ( STARTUPINFO ));
memset ( SstProcessInfo, NULL, sizeof ( PROCESS_INFORMATION));
stStartlnfo.cb = sizeof ( STARTUPINFO);
BOOL bRet = CreateProcess ( NULL ,
szCmdLine ,
NULL
NULL ,
FALSE ,
CREATE_NEW_CONSOLE |
DEBUG__ONLY_THIS_PROCESS,
NULL ,
NULL ,
&stStartlnfo ,
&stProcessInfo ) ;
// , .
if ( FALSE == bRet)
{
printf ( "Unable to start %s\n", szCmdLine);
return;
}
// , .
DEBUG_EVENT stDE
BOOL bSeenlnitialBP = FALSE ;
BOOL bContinue = TRUE ;
HANDLE hProcess = INVALID_HANDLE_VALUE;
DWORD dwContinueStatus
// while.
while ( TRUE == bContinue)
{
// , .
bContinue = WaitForDebugEvent ( &stDE, INFINITE);
// . -
// MinDBG ,
// .
switch ( stDE.dwDebugEventCode)
{
case CREATE_PROCESS_DEBUG_EVENT :
{
DisplayCreateProcessEvent ( stDE.u.CreateProcessInfo);
// ,
//
. hProcess = stDE.u.CreateProcessInfo.hProcess;
dwContinueStatus = DBG_CONTINUE;
}
break;
case 'EXIT_PROCESS_DEBUG_EVENT :
{
DisplayExitProcessEvent ( stDE.u.ExitProcess);
bContinue = FALSE;
dwContinueStatus = DBG_CONTINUE;
}
break;
case LOAD_DLL_DEBUG_EVENT :
{
DisplayDllLoadEvent ( stDE.u.LoadDll);
dwContinueStatus = DBG_CONTINUE;
}
break;
case UNLOAD_DLL_DEBUG_EVENT :
{
DisplayDllUnLoadEvent ( stDE.u.UnloadDll);
dwContinueStatus = DBG_CONTINUE;
}
break;
case CREATE_THREAD_DEBUG_EVENT :
{
DisplayCreateThreadEvent ( stDE.u.CreateThread);
dwContinueStatus = DBG_CONTINUE;
}
break;
case EXIT_THREAD_DEBUG_EVENT :
{
DisplayExitThreadEvent ( stDE.u.ExitThread);
dwContinueStatus = DBG_CONTINUE;
}
break;
case OUTPUT_DEBUG_STRING_EVENT :
{
DisplayODSEvent ( hProcess, stDE.u.DebugString);
dwContinueStatus = DBG_CONTINUE;
}
break;
case RIPR_VENT :
dwContinueStatus = DBG_CONTINUE;
}
break;
case EXCEPTION_DEBUG_EVENT :
{
DisplayExceptionEvent ( stDE.u.Exception);
// ,
// -,
// , .
switch ( stDE.u.Exception.ExceptionRecord.ExceptionCode)
{
case EXCEPTION_BREAKPOINT :
{
//
// , ;
// ,
//
if ( FALSE == bSeenlnitialBP)
{
bSeenlnitialBP = TRUE;
dwContinueStatus = DBG_CONTINUE;
}
else {
// , !
dwContinueStatus =
DBG_EXCEPTION_NOT_HANDLED;
}
}
break;
//
// ,
default :
{
dwContinueStatus = DBG_EXCEPTION_NOT_HANDLED;
}
break;
}
}
break;
// ,
default :
{
dwContinueStatus = DBG_CONTINUE;
}
break;
}
// .
ContinueDebugEvent ( stDE.dwProcessId,
stDE.dwThreadld ,
dwContinueStatus );
}
}
/*/////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////*/
void ShowHelp ( void)
{
printf ( "MinDBG <program to debug> "
"<program's command-line options>\n");
}
void DisplayCreateProcessEvent ( CREATE_PROCESS_DEBUG_INFO & stCPDI)
{
printf ( "Create Process Event :\n");
printf (." hFile : Ox%08X\n",
stCPDI.hFile );
printf ( " hProcess : 0x%08X\n",
stCPDI.hProcess );
printf ( " hThread : 0x%08X\n",
stCPDI.hThread);
printf (" lpBaseOfImage :0x%08X\n",
stCPDI.lpBaseOfImage);
printf("dwDebugInfoFileOffset: 0x%08X\n",
stCPDI.dwDebugInfoFileOffset);
printf("nDebugInfoSize: 0x%08X\n",
stCPDI.nDebugInfoSize);
printf ( " IpThreadLocalBase : Ox%08X\n",
stCPDI.IpThreadLocalBase );
printf ( " IpStartAddress : Ox%08X\n",stCPDI.IpStartAddress ) ;
printf ( " IpImageName : Ox%08X\n",
stCPDI.IpImageName );
printf ( " fUnicode : Ox%08X\n",
stCPDI.fUnicode );
}
void DisplayCreateThreadEvent ( CREATE_THREAD_DEBUG_INFO & stCTDI)
{
printf ( "Create Thread Event :\n");
printf ( " hThread : Ox%08X\n",
stCTDI.hThread );
printf ( " IpThreadLocalBase : Ox%08X\n",
stCTDI.IpThreadLocalBase );
printf ( " IpStartAddress : Ox%08X\n",
stCTDI.IpStartAddress );
}
void DisplayExitThreadEvent ( EXIT_THREAD_DEBUG_INFO & stETDI)
{
printf ( "Exit Thread Event :\n");
printf ( " dwExitCode : Ox%08X\n",
stETDI.dwExitCode );
}
void DisplayExitPrpcessEvent ( EXIT_PROCESS_DEBUG_INFO & stEPDI)
{
printf ( "Exit Process Event :\n");
printf ( " dwExitCode ' : Ox%08X\n",
stEPDI.dwExitCode );
}
void DisplayDllLoadEvent ( LOAD_DLL_DEBUG_INFO & stLDDI)
{
printf ( "DLL Load Event :\n");
printf ( " hFile : Ox%08X\n",
stLDDI.hFile );
printf ( " IpBaseOfDll : Ox%08X\n",
stLDDI.IpBaseOfDll );
printf ( " dwDebuglnfoFileOffset : Ox%08X\n",
stLDDI.dwDebuglnfoFileOffset );
printf ( " nDebuglnfoSize : Ox%08X\n",
stLDDI.nDebuglnfoSize );
printf ( " IpImageName : Ox%08X\n",
stLDDI.IpImageName );
printf ( " fUnicode : Ox%08X\n",
stLDDI.fUnicode );
}
void DisplayDllUnLoadEvent ( UNLOAD_DLL_DEBUG_INFO & stULDDI)
{
printf ( "DLL Unload Event :\n");
printf ( " IpBaseOfDll : Ox%08X\n",
stULDDI.IpBaseOfDll );
}
void DisplayODSEvent { HANDLE hProcess,
OUTPUT_DEBUG STRING INFO & stODSI )
{
printf ( "OutputDebugString Event :\n");
printf ( " IpDebugStringData : Ox%08X\n",
stODSI.IpDebugStringData );
printf ( " fUnicode : Ox%08X\n",
stODSI.fUnicode );
printf ( " nDebugStringLength : Ox%08X\n",
stODSI.nDebugStringLength );
printf ( " String :\n"); char szBuff[ 512 ];
if ( stODSI.nDebugStringLength > 512)
{
return;
}
DWORD dwRead;
BOOL bRet;
bRet = ReadProcessMemory ( hProcess
stODSI.IpDebugStringData ,
szBuff ,
stODSI.nDebugStringLength ,
SdwRead );
printf ( "%s", szBuff);
}
void DisplayExceptionEvent ( EXCEPTION_DEBUG INFO & stEDI)
{
printf ( "Exception Event :\n");
printf ( " dwFirstChance : Ox%08X\n",
stEDI.dwFirstChance );
printf ( " ExceptionCode : Ox%08X\n",
stEDI.ExceptionRecord.ExceptionCode );
printf ( " ExceptionFlags : Ox%08X\n",
stEDI.ExceptionRecord.ExceptionFlags );
printf ( " ExceptionRecord : Ox%08X\n",
stEDI.ExceptionRecord.ExceptionRecord );
printf ( " ExceptionAddress : Ox%08X\n",
stEDI.ExceptionRecord.ExceptionAddress );
printf ( " NumberParameters : Ox%08X\n",
stEDI.ExceptionRecord.NumberParameters );
}
10.11.2021 - 12:37: - Personalias -> WHO IS WHO - - _. 10.11.2021 - 12:36: - Conscience -> . ? - _. 10.11.2021 - 12:36: , , - Upbringing, Inlightening, Education -> ... - _. 10.11.2021 - 12:35: - Ecology -> - _. 10.11.2021 - 12:34: , - War, Politics and Science -> - _. 10.11.2021 - 12:34: , - War, Politics and Science -> . - _. 10.11.2021 - 12:34: , , - Upbringing, Inlightening, Education -> , - _. 10.11.2021 - 09:18: - New Technologies -> , 5G- - _. 10.11.2021 - 09:18: - Ecology -> - _. 10.11.2021 - 09:16: - Ecology -> - _. 10.11.2021 - 09:15: , , - Upbringing, Inlightening, Education -> - _. 10.11.2021 - 09:13: , , - Upbringing, Inlightening, Education -> - _. |