CreateProcess : DEBUG_PROCESS+DEBUG_ONLY_THIS_PROCESS flags

Index > Windows > CreateProcess : DEBUG_PROCESS+DEBUG_ONLY_THIS_PROCESS flags

Author

Thread

vbVeryBeginner

Joined: 15 Aug 2004
Posts: 884
Location: \\world\asia\malaysia

vbVeryBeginner 07 Oct 2004, 14:09

hi,
why this couldn't kill this open process ?

Code:

struct EXCEPTION_RECORD
        .ExceptionCode          dd ?
        .ExceptionFlags         dd ?
        .ExceptionRecord        dd ?
        .ExceptionAddress       dd ?
        .NumberParameters       dd ?
        .ExceptionInformation   rd 15
ends

struct EXCEPTION_DEBUG_INFO
        .ExceptionRecord        EXCEPTION_RECORD
        .dwFirstChance          dd ?
ends

struct DEBUG_EVENT
        .dwDebugEventCode       dd ?
        .dwProcessId            dd ?
        .dwThreadId             dd ?
        .u                      rd 22
ends

struct EXIT_PROCESS_DEBUG_INFO
        .dwExitCode             dd ?
ends

Code:

wmCOMMAND_300:
        invoke  GetOpenFileName,ofn
                cmp  eax,TRUE
                jne  wmBYE
        invoke  GetDlgItem,[hDlg],100
        invoke  SetWindowText,eax,ofnBuffer
        invoke  GetStartupInfo,proStartInfo
        invoke  CreateProcess,ofnBuffer,NULL,NULL,NULL,FALSE,\
                NORMAL_PRIORITY_CLASS + DEBUG_PROCESS + DEBUG_ONLY_THIS_PROCESS,NULL,NULL,proStartInfo,proInfo

        _300_debug_loop:
                invoke  WaitForDebugEvent,dbgEvent,0
                        cmp  [dbgEvent.dwDebugEventCode],EXIT_PROCESS_DEBUG_EVENT
                        je   _300_debug_exit
                        cmp  [dbgEvent.dwDebugEventCode],EXCEPTION_DEBUG_EVENT
                        jne  @f
                                cmp  [dbgEvent.u + EXCEPTION_DEBUG_INFO.ExceptionRecord.ExceptionCode],EXCEPTION_BREAKPOINT
                                jne  @f
                        invoke  ContinueDebugEvent,[dbgEvent.dwProcessId],[dbgEvent.dwThreadId],DBG_CONTINUE
                                jmp  _300_debug_loop
        @@:
                invoke  ContinueDebugEvent,[dbgEvent.dwProcessId],[dbgEvent.dwThreadId],DBG_EXCEPTION_NOT_HANDLED
                        jmp  _300_debug_loop

        _300_debug_exit:

                invoke  TerminateProcess,[proInfo.hProcess],-1
                        mov  [dbgEvent.dwDebugEventCode],EXIT_PROCESS_DEBUG_EVENT
                        mov  [dbgEvent.u + EXIT_PROCESS_DEBUG_INFO.dwExitCode],-1
                invoke  TerminateThread,[proInfo.hThread],-1
                invoke  CloseHandle,[proInfo.hProcess]
                invoke  CloseHandle,[proInfo.hThread]
                        jmp  wmBYE

this is a debugger tutorial for iczelion tutorial 28, iczelion use the ExitProcess in the end to exit, but i wish to enchance it
i wish to terminate the loaded "ofnBuffer" process & thread, so that i could load it with another executable
but some how, the (debugee)process & thread still remain (i use Process Viewer to check it) although i jmp it "_300_debug_exit:" already

i really wish if anyone willing to tell me where i miss
btw, i receive a lot of death blue screen already Sad

sincerely,
sulaiman chang

07 Oct 2004, 14:09

decard

Joined: 11 Sep 2003
Posts: 1092
Location: Poland

decard 07 Oct 2004, 15:11

AFAIR JohnFound had similar problems when he was implementing a debugger in Fresh. I'm not sure, but what I can realise when I look at Fresh sources, is that there is a new thread created ("debug server"), and it waits for debug events. When debugee is terminated, "debug server" is so. Then, when you wan't to load another module, just create new "debug server" thread.
I would recommend to take a look at Fresh source.

07 Oct 2004, 15:11

vbVeryBeginner

Joined: 15 Aug 2004
Posts: 884
Location: \\world\asia\malaysia

vbVeryBeginner 07 Oct 2004, 15:29

em, i just found out from a VB site :p

i should terminate it using such approach :

Code:

_300_debug_exit:
        invoke  ContinueDebugEvent,[dbgEvent.dwProcessId],[dbgEvent.dwThreadId],DBG_TERMINATE_THREAD
        invoke  ContinueDebugEvent,[dbgEvent.dwProcessId],[dbgEvent.dwThreadId],DBG_TERMINATE_PROCESS
        invoke  CloseHandle,[proInfo.hProcess]
        invoke  CloseHandle,[proInfo.hThread]
                jmp  wmBYE

sincerely,
sulaiman chang

ps: i will take a look at fresh source Smile

07 Oct 2004, 15:29

vbVeryBeginner

Joined: 15 Aug 2004
Posts: 884
Location: \\world\asia\malaysia

vbVeryBeginner 07 Oct 2004, 15:38

but this produce some kinda weird scene, it would like the debugee will eat up the debugger window (when u move the debugee window around the debugger)

or mess with the debugger PAINT event?

i don't know,

i have succeed not to make the debuggee eat up those debugger window (a few minutes before)... em.. but i change my code already Sad

the mess debuggggggggeeeeeeerr!
the tutorial 19 is debugee and the messy dialog is debugger

07 Oct 2004, 15:38

vbVeryBeginner

Joined: 15 Aug 2004
Posts: 884
Location: \\world\asia\malaysia

vbVeryBeginner 07 Oct 2004, 20:17

em..., i got another guesss.

i guess the debugee halted the debugger looping message, so until the debugger jmp into _300_debug_exit and jmp wmBYE, or the WM_PAINT would be ignore by the debugger :-:

07 Oct 2004, 20:17

vbVeryBeginner

Joined: 15 Aug 2004
Posts: 884
Location: \\world\asia\malaysia

vbVeryBeginner 08 Oct 2004, 17:22

em, this is solve as i implement it using a thread Smile

the result could be view here http://board.flatassembler.net/topic.php?p=16587#16587

sincerely,
sulaiman chang

08 Oct 2004, 17:22

i-don

Joined: 18 Jul 2003
Posts: 66

i-don 16 Oct 2004, 12:03

Sulaiman,

I try to compile your tut_28.asm and found the following line failed on compile due to SS_PATHELLIPSIS not defined.

Code:

dialogitem      'STATIC','',100,27,7,206,11,SS_RIGHT + SS_SUNKEN + SS_PATHELLIPSIS + WS_VISIBLE

Whar is the value of SS_PATHELLIPSIS?

Btw, I just comment out SS_PATHELLIPSIS from the line and compile it without a problem. Nice tutorial conversion. Keep up the good works.

i-don.

16 Oct 2004, 12:03

decard

Joined: 11 Sep 2003
Posts: 1092
Location: Poland

decard 16 Oct 2004, 12:04

SS_PATHELLIPSIS = 000008000h

16 Oct 2004, 12:04

i-don

Joined: 18 Jul 2003
Posts: 66

i-don 16 Oct 2004, 12:05

Thanks Decard, cheers. Smile

16 Oct 2004, 12:05

vbVeryBeginner

Joined: 15 Aug 2004
Posts: 884
Location: \\world\asia\malaysia

vbVeryBeginner 16 Oct 2004, 13:48

Quote:

Nice tutorial conversion. Keep up the good works.

thanks you Smile

your words make me feel happy :p

16 Oct 2004, 13:48

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum