我有一个调试器附加到一个应用程序。
在获得了所需的信息之后,我尝试分离调试器,但是正在调试的应用程序在DebugActiveProcessStop()
上崩溃
int main(void)
{
HWND window = FindWindow(NULL, L"apptodebug");
DWORD_PTR pid = 0;
GetWindowThreadProcessId(window, &pid);
DWORD address = 0x004F0186; // address of the instruction after the call
DebugActiveProcess(pid); // PID of target process
DWORD dwThreadID = GetWindowThreadProcessId(window, &pid);
CONTEXT ctx = {0};
ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS | CONTEXT_INTEGER;
ctx.Dr0 = address;
ctx.Dr7 = 0x00000001;
HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, dwThreadID);
SetThreadContext(hThread, &ctx); // hThread with enough permissions
DEBUG_EVENT dbgEvent;
DWORD edx = 0;
DWORD ecx = 0;
int gg = 0;
while (!gg)
{
if (WaitForDebugEvent(&dbgEvent, INFINITE) == 0)
break;
if (dbgEvent.dwDebugEventCode == EXCEPTION_DEBUG_EVENT &&
dbgEvent.u.Exception.ExceptionRecord.ExceptionCode == EXCEPTION_SINGLE_STEP)
{
if (dbgEvent.u.Exception.ExceptionRecord.ExceptionAddress == (LPVOID)address)
{
GetThreadContext(hThread, &ctx);
edx = ctx.Edx; // edx get
ecx = ctx.Ecx; // edx get
std::cout<<edx<<"\n";
std::cout<<ecx<<"\n";
//system("pause");
gg = 1;
}
}
ContinueDebugEvent(dbgEvent.dwProcessId, dbgEvent.dwThreadId, DBG_CONTINUE);
}
DebugActiveProcessStop(pid); // The application I was debugging crashes here.
DebugSetProcessKillOnExit(false);
return 0;
}
我找不到“正常”分离调试器的方法。应用程序只是“停止工作”并关闭。
发布于 2015-10-20 11:27:21
您正在向进程中注入一个断点。当命中断点时,这将导致异常。如果在断点处于活动状态时分离调试器,则此异常将导致程序崩溃。
因此,首先禁用断点(将DR7设置为0),然后分离。
我自己从来没做过,但有点像
GetThreadContext(hThread, &ctx);
ctx.Dr7 = 0x00000000;
SetThreadContext(hThread, &ctx);
ContinueDebugEvent(dbgEvent.dwProcessId, dbgEvent.dwThreadId, DBG_CONTINUE);
DebugActiveProcessStop(pid);
应该可以的。
https://stackoverflow.com/questions/33234763
复制相似问题