Ring3调试流程

调试器调试指定进程的流程：

打开调试被调试进程;

while(true)

{

等待调试事件;

处理调试事件;

恢复调试事件;

}

///////////////////////////////////////////////////////////////////////

打开被调试进程：DebugActiveProcess

This function allows a debugger to attach to an active process and then debug it.

BOOL DebugActiveProcess( 

DWORD dwProcessId 

);

等待调试事件：WaitForDebugEvent

This function blocks the debugger thread until a debug event is generated in the target process being debugged or the specified timeout elapses.

BOOL WaitForDebugEvent(

LPDEBUG_EVENT lpDebugEvent, 

DWORD dwMilliseconds 

);

调试事件的类型与具体信息：DEBUG_EVENT

typedef struct _DEBUG_EVENT { 

  DWORD dwDebugEventCode; //这个表示调试事件的类型

  DWORD dwProcessId; 

  DWORD dwThreadId; 

  union { //根据不同的类型 使用不同的结构体

    EXCEPTION_DEBUG_INFO Exception; 

    CREATE_THREAD_DEBUG_INFO CreateThread; 

    CREATE_PROCESS_DEBUG_INFO CreateProcessInfo; 

    EXIT_THREAD_DEBUG_INFO ExitThread; 

    EXIT_PROCESS_DEBUG_INFO ExitProcess; 

    LOAD_DLL_DEBUG_INFO LoadDll; 

    UNLOAD_DLL_DEBUG_INFO UnloadDll; 

    OUTPUT_DEBUG_STRING_INFO DebugString; 

    RIP_INFO RipInfo; 

  } u; 

} DEBUG_EVENT; 

恢复调试事件：ContinueDebugEvent

This function unblocks the debuggee thread identified by the given thread identifier.

BOOL ContinueDebugEvent(
  DWORD dwProcessId,
  DWORD dwThreadId,
  DWORD dwContinueStatus
);