Windows调试原理-part0

simple example

先写一个拥有最基本的处理调试事件能力的程序，当它发现程序有一个软件断点即0xcc指令时，使当前线程恢复执行

#include <Windows.h>
#include <iostream>

BOOL Debug(DWORD pid)
{
	if (pid == 0)
	{
		MessageBox(NULL, "please enter pid", "!!!!", MB_OK);
		return FALSE;
	}
	if (!DebugActiveProcess(pid))
	{
		MessageBox(NULL, "debug process wrong", "!!!!", MB_OK);
		return FALSE;
	}
	while (TRUE)
	{
		DEBUG_EVENT debug_event;
		WaitForDebugEvent(&debug_event, INFINITE);
		switch (debug_event.dwDebugEventCode)
		{
		case EXCEPTION_DEBUG_EVENT:
			if (debug_event.u.Exception.ExceptionRecord.ExceptionCode == EXCEPTION_BREAKPOINT)
			{
				MessageBox(NULL, "find a break point", "!!!!", MB_OK);
				HANDLE hThread = debug_event.u.CreateProcessInfo.hThread;
				CONTEXT context;
				GetThreadContext(hThread, &context);
				context.Eip++;
				SetThreadContext(hThread, &context);
			}
		default:
			break;
		}
		ContinueDebugEvent(pid, debug_event.dwThreadId, DBG_CONTINUE);
	}
	return TRUE;
}

int main()
{
	DWORD pid, tid;
	std::cout << "please enter the process id" << std::endl;
	std::cin >> pid;
	Debug(pid);
	return 0;
}

接着我们写一个目标程序，我们用内联汇编写一行int 3指令，即0xcc

#include <iostream>
#include <string>

void bug()
{
	_asm int 3;
	std::cout << "now you clear the break point" << std::endl;
}

int main()
{
	while (true)
	{
		std::cout << "you want a bug?(yes/no)" << std::endl;
		std::string answer;
		std::cin >> answer;
		if (answer == "yes")
			bug();
		else if (answer == "no")
			continue;
	}
	return 0;
}

接下来进行测试，我们先打开被测程序，输入yes后，程序断了下来，然后就卡死了

我们重新打开该程序，然后找到其pid，并用调试器附加上去

之后我们再次输入yes

可以看到在弹窗后，我们的程序正常的执行了下去。

标签：return,Windows,pid,part0,debug,include,event,调试,hThread
来源： https://blog.csdn.net/qq_35713009/article/details/90982593