flat assembler
Message board for the users of flat assembler.
 Home   FAQ   Search   Register 
 Profile   Log in to check your private messages   Log in 
flat assembler > Windows > Writing a debugger...[solved]

Author
Thread Post new topic Reply to topic
vivik



Joined: 29 Oct 2016
Posts: 95
Writing a debugger...[solved]
I'm trying to write a debugger with the help of Iczelion's tutorial 28.

My problem is, debuggee windows is left open even after the ExitProcess in it is called. Debugger receives EXIT_PROCESS_DEBUG_EVENT, but debuggee window is still visible and does not react to anything. It does goes away with the closing of debugger though.


Last edited by vivik on 31 Oct 2016, 06:16; edited 4 times in total
Post 29 Oct 2016, 07:54
View user's profile Send private message Reply with quote
vivik



Joined: 29 Oct 2016
Posts: 95
Thought about using DebugActiveProcessStop instead of just CloseHandle how tutorial suggests, but got "undefined reference". Looking for cause now. I'm using MinGW, if that's important.
Post 29 Oct 2016, 08:04
View user's profile Send private message Reply with quote
vivik



Joined: 29 Oct 2016
Posts: 95
I had to call ContinueDebugEvent for the last time, found help on a different forum. I wonder if it's a bug in tutorial itself, or masm's ".break" does a different thing from what I expect. Or there is just a different case of usage. Whatever.
Post 29 Oct 2016, 11:36
View user's profile Send private message Reply with quote
vivik



Joined: 29 Oct 2016
Posts: 95
Where can I find documentation about the CONTEXT structure? I found this https://msdn.microsoft.com/en-us/library/windows/desktop/ms679284(v=vs.85).aspx , but it tells pretty much nothing useful.

Iczelion tutorial says something about the context.regFlag field, but my C headers don't have this field. They have EFlags instead, is that it? Edit: yes, EFlags==regFlag, they both are fourth from the end. Installed masm to check.
Post 29 Oct 2016, 16:05
View user's profile Send private message Reply with quote
bitRAKE



Joined: 21 Jul 2003
Posts: 2628
Location: dank orb
Here are a few thread that might help:
https://board.flatassembler.net/topic.php?p=134491#134491
https://board.flatassembler.net/topic.php?p=109624#109624

I've not see documentation on CONTEXT structure - I do know it has changed with almost every new Windows version. Probably best to look at other tools using debug interfaces.
Post 30 Oct 2016, 01:58
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 14848
Location: Lost in translation

bitRAKE wrote:
I've not see documentation on CONTEXT structure - I do know it has changed with almost every new Windows version. Probably best to look at other tools using debug interfaces.

It changes with each CPU. It is different for ARM, PPC, x86, etc. And even within x86 with the newer registers being added (i.e. XMM, YMM, ZMM) is must be updated to allow for the extra registers each time the CPU is upgraded.
Post 30 Oct 2016, 02:03
View user's profile Send private message Visit poster's website Reply with quote
vivik



Joined: 29 Oct 2016
Posts: 95
I have the PROCESS_INFORMATION pi , which I receive from the CreateProcess call, and I have the DEBUG_EVENT DBEvent, which I receive from the WaitForDebugEvent call.

What's the difference between pi.hProcess and DBEvent.u.CreateProcessInfo.hProcess ? I expected them to be the same thing, but they are different.

Thanks for info btw, very interesting.
Post 30 Oct 2016, 17:42
View user's profile Send private message Reply with quote
bitRAKE



Joined: 21 Jul 2003
Posts: 2628
Location: dank orb
Not sure why Windows creates a different handle:

http://www.codeproject.com/Articles/43682/Writing-a-basic-Windows-debugger

Quote:
Please note that hProcess and hThread may not have the same handle values we have received in pi (PROCESS_INFORMATION). The process-ID and the thread-ID would, however, be the same. Each handle you get by Windows (for the same resource) is different from other handles, and has a different purpose. So, the debugger may choose to display either the handles or the IDs.

If I had to assume, I would say the handles have different permissions.
Post 30 Oct 2016, 19:44
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >

Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001-2005 phpBB Group.

Main index   Download   Documentation   Examples   Message board
Copyright © 2004-2016, Tomasz Grysztar.