Question

我很新，我需要你帮助解决这个问题。我正在尝试创建一个简单的调试器来了解调试器的工作原理以及如何在内存中加载exes。我已经编写了可以正常工作的代码，但是现在有问题：当我尝试调用WaitForDebugEvent（一个kernel32函数）来获取调试事件时，它实际上编写了debug_event变量，但是这个函数清除了所有我的应用程序中的变量。所以它也清楚了：

this (current form)
EventArgs (arguments of my form load function)
object sender (the object who called the function)

所以我无法继续执行我的应用，因为所有的变量都被删除了。我不认为这是一个kernel32或Visual Studio错误......

这是代码：

（结构和导入来自pInvoke.net和MSDN）

    [DllImport("kernel32.dll")]
    static extern bool DebugActiveProcess(uint dwProcessId);
    [DllImport("kernel32.dll", EntryPoint = "WaitForDebugEvent")]
    [return: MarshalAs(UnmanagedType.Bool)]
    public static extern bool WaitForDebugEvent([In] ref DEBUG_EVENT lpDebugEvent, uint dwMilliseconds);
    [DllImport("kernel32.dll")]
    static extern bool ContinueDebugEvent(uint dwProcessId, uint dwThreadId, uint dwContinueStatus);
    [DllImport("kernel32.dll")]
    [return: MarshalAs(UnmanagedType.Bool)]
    public static extern bool DebugActiveProcessStop([In] int Pid);

    public struct DEBUG_EVENT
    {
        public int dwDebugEventCode;
        public int dwProcessId;
        public int dwThreadId;
        public struct u
        {
            public EXCEPTION_DEBUG_INFO Exception;
            public CREATE_THREAD_DEBUG_INFO CreateThread;
            public CREATE_PROCESS_DEBUG_INFO CreateProcessInfo;
            public EXIT_THREAD_DEBUG_INFO ExitThread;
            public EXIT_PROCESS_DEBUG_INFO ExitProcess;
            public LOAD_DLL_DEBUG_INFO LoadDll;
            public UNLOAD_DLL_DEBUG_INFO UnloadDll;
            public OUTPUT_DEBUG_STRING_INFO DebugString;
            public RIP_INFO RipInfo;
        };
    };

    [StructLayout(LayoutKind.Sequential)]
    public struct EXCEPTION_DEBUG_INFO
    {
        public EXCEPTION_RECORD ExceptionRecord;
        public uint dwFirstChance;
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct EXCEPTION_RECORD
    {
        public uint ExceptionCode;
        public uint ExceptionFlags;
        public IntPtr ExceptionRecord;
        public IntPtr ExceptionAddress;
        public uint NumberParameters;
        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 15, ArraySubType = UnmanagedType.U4)]
        public uint[] ExceptionInformation;
    }

    public delegate uint PTHREAD_START_ROUTINE(IntPtr lpThreadParameter);

    [StructLayout(LayoutKind.Sequential)]
    public struct CREATE_THREAD_DEBUG_INFO
    {
        public IntPtr hThread;
        public IntPtr lpThreadLocalBase;
        public PTHREAD_START_ROUTINE lpStartAddress;
    }

    //public delegate uint PTHREAD_START_ROUTINE(IntPtr lpThreadParameter);

    [StructLayout(LayoutKind.Sequential)]
    public struct CREATE_PROCESS_DEBUG_INFO
    {
        public IntPtr hFile;
        public IntPtr hProcess;
        public IntPtr hThread;
        public IntPtr lpBaseOfImage;
        public uint dwDebugInfoFileOffset;
        public uint nDebugInfoSize;
        public IntPtr lpThreadLocalBase;
        public PTHREAD_START_ROUTINE lpStartAddress;
        public IntPtr lpImageName;
        public ushort fUnicode;
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct EXIT_THREAD_DEBUG_INFO
    {
        public uint dwExitCode;
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct EXIT_PROCESS_DEBUG_INFO
    {
        public uint dwExitCode;
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct LOAD_DLL_DEBUG_INFO
    {
        public IntPtr hFile;
        public IntPtr lpBaseOfDll;
        public uint dwDebugInfoFileOffset;
        public uint nDebugInfoSize;
        public IntPtr lpImageName;
        public ushort fUnicode;
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct UNLOAD_DLL_DEBUG_INFO
    {
        public IntPtr lpBaseOfDll;
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct OUTPUT_DEBUG_STRING_INFO
    {
        [MarshalAs(UnmanagedType.LPStr)]
        public string lpDebugStringData;
        public ushort fUnicode;
        public ushort nDebugStringLength;
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct RIP_INFO
    {
        public uint dwError;
        public uint dwType;
    }

调试器的主循环：

    private void Form1_Load(object sender, EventArgs e)
    {
        DebugActiveProcess((uint)Process.GetProcessesByName("notepad")[0].Id);
        DEBUG_EVENT debug_event = new DEBUG_EVENT();
        CONTEXT context = new CONTEXT();
        context.ContextFlags = (uint)CONTEXT_FLAGS.CONTEXT_ALL;
        while (true)
        {
            unchecked
            {
                if (WaitForDebugEvent(ref debug_event, (uint)double.PositiveInfinity))
                {
                       ...

                    ContinueDebugEvent((uint)debug_event.dwProcessId, (uint)debug_event.dwThreadId, (uint)0x10002);
                }
            }
        }
    }

我该怎么办？提前谢谢......

修改

我已经用C ++重写了代码，看看那里是否存在问题。但没有问题...所以我认为这个问题只存在于C＃中。这是C ++中的代码：

进口：

#include <windows.h>
#include <tlhelp32.h>
#include <msclr\marshal_cppstd.h>

CODE：

        private: System::Void DebuggerForm_Load(System::Object^  sender, System::EventArgs^  e) {
            std::wstring processName = msclr::interop::marshal_as<std::wstring, String^>("myExe.exe");
            DWORD id = getProcessId(processName);
            if (id == 0) std::exit(0);
            DebugActiveProcess(id); 

            DEBUG_EVENT debug_event = { 0 };
            while (true)
            {
                if (WaitForDebugEvent(&debug_event, INFINITE)) {
                    // TODO
                    ContinueDebugEvent(debug_event.dwProcessId, debug_event.dwThreadId, DBG_CONTINUE);
                }
            }
        }

        DWORD getProcessId(const std::wstring& processName)
        {
            PROCESSENTRY32 processInfo;
            processInfo.dwSize = sizeof(processInfo);

            HANDLE processesSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
            if (processesSnapshot == INVALID_HANDLE_VALUE)
                return 0;

            Process32First(processesSnapshot, &processInfo);
            if (!processName.compare(processInfo.szExeFile))
            {
                CloseHandle(processesSnapshot);
                return processInfo.th32ProcessID;
            }

            while (Process32Next(processesSnapshot, &processInfo))
            {
                if (!processName.compare(processInfo.szExeFile))
                {
                    CloseHandle(processesSnapshot);
                    return processInfo.th32ProcessID;
                }
            }

            CloseHandle(processesSnapshot);
            return 0;
        }

Answer 1

首先，您应该为目标流程启用SE_DEBUG_NAME权限：

（SE_DEBUG_NAME =＆＃34; SeDebugPrivilege＆＃34;）

将OpenProcessToken与TOKEN_ADJUST_PRIVILEGES和TOKEN_QUERY访问标记一起使用。
使用LookupPrivilegeValue检索SE_DEBUG_NAME权限名称的LUID。
使用AdjustTokenPrivileges启用SE_DEBUG_NAME权限。
CloseHandle

对于第3步，您需要TOKEN_PRIVILEGES结构，其中PrivilegesCount字段必须设置为1。此外，您必须设置Privilege字段的第一个（零索引）项（Luid：请参阅第2步，Attributes：SE_PRIVILEGE_ENABLED）

DEBUG_EVENT结构：

结构的u字段是一个联合，它意味着它只包含一个列出的结构。尝试使用LayoutKind.Explicit并使用属性FieldOffset装饰每个字段以定义结构内的正确偏移量。试试这个：

[StructLayout(LayoutKind.Explicit)]
public struct DEBUG_EVENT
{

    [FieldOffset(0)]
    public int dwDebugEventCode;

    [FieldOffset(4)]
    public int dwProcessId;

    [FieldOffset(8)]
    public int dwThreadId;

    [FieldOffset(12)]
    [StructLayout(LayoutKind.Explicit)]
    public struct u {

        [FieldOffset(0)]
        public EXCEPTION_DEBUG_INFO Exception;
        [FieldOffset(0)]
        public CREATE_THREAD_DEBUG_INFO CreateThread;
        [FieldOffset(0)]
        public CREATE_PROCESS_DEBUG_INFO CreateProcessInfo;
        [FieldOffset(0)]
        public EXIT_THREAD_DEBUG_INFO ExitThread;
        [FieldOffset(0)]
        public EXIT_PROCESS_DEBUG_INFO ExitProcess;
        [FieldOffset(0)]
        public LOAD_DLL_DEBUG_INFO LoadDll;
        [FieldOffset(0)]
        public UNLOAD_DLL_DEBUG_INFO UnloadDll;
        [FieldOffset(0)]
        public OUTPUT_DEBUG_STRING_INFO DebugString;
        [FieldOffset(0)]
        public RIP_INFO RipInfo;
    }
};

WaitForDebugEvent（kernel32.dll）的bug还是什么？

1 个答案: