c++ - DebugActiveProcessStop 使正在调试的应用程序崩溃

Question

我有一个附加到应用程序的调试器。

在获取所需信息后，我尝试分离调试器，但正在调试的应用程序在 DebugActiveProcessStop() 上崩溃:

int main(void)
{
    HWND window = FindWindow(NULL, L"apptodebug");

    DWORD_PTR pid = 0;
    GetWindowThreadProcessId(window, &pid);

    DWORD address = 0x004F0186; // address of the instruction after the call

    DebugActiveProcess(pid); // PID of target process

    DWORD dwThreadID = GetWindowThreadProcessId(window, &pid);

    CONTEXT ctx = {0};
    ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS | CONTEXT_INTEGER;
    ctx.Dr0 = address;
    ctx.Dr7 = 0x00000001;

    HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, dwThreadID);

    SetThreadContext(hThread, &ctx); // hThread with enough permissions

    DEBUG_EVENT dbgEvent;

    DWORD edx = 0;
    DWORD ecx = 0;
    int gg = 0;

    while (!gg)
    {
        if (WaitForDebugEvent(&dbgEvent, INFINITE) == 0)
            break;

        if (dbgEvent.dwDebugEventCode == EXCEPTION_DEBUG_EVENT &&
            dbgEvent.u.Exception.ExceptionRecord.ExceptionCode == EXCEPTION_SINGLE_STEP)
        {
            if (dbgEvent.u.Exception.ExceptionRecord.ExceptionAddress == (LPVOID)address)
            {
                GetThreadContext(hThread, &ctx);

                edx = ctx.Edx; // edx get
                ecx = ctx.Ecx; // edx get

                std::cout<<edx<<"\n";
                std::cout<<ecx<<"\n";

                //system("pause");

                gg = 1;
            }
        }

        ContinueDebugEvent(dbgEvent.dwProcessId, dbgEvent.dwThreadId, DBG_CONTINUE);
    }

    DebugActiveProcessStop(pid); // The application I was debugging crashes here.
    DebugSetProcessKillOnExit(false);

    return 0;
}

我找不到“正常”分离调试器的方法。该应用程序只是“停止工作”并关闭。

Answer 1

您正在向进程中注入(inject)一个断点。这将在命中断点时引发异常。如果在断点处于事件状态时分离调试器，此类异常将导致程序崩溃。

因此，首先禁用断点(将 DR7 设置为 0)，然后再分离。

我自己从来没有这样做过，但是类似

GetThreadContext(hThread, &ctx);
ctx.Dr7 = 0x00000000;
SetThreadContext(hThread, &ctx);
ContinueDebugEvent(dbgEvent.dwProcessId, dbgEvent.dwThreadId, DBG_CONTINUE); 
DebugActiveProcessStop(pid);

应该做。