WaitForDebugEvent（kernel32.dll）错误或什么？

Question

我是新手，需要您的帮助来解决此问题。 我正在尝试创建一个简单的调试器，以了解调试器如何工作以及如何在内存中加载exe。 我已经编写了可以正常工作的代码，但是现在出现了问题：当我尝试调用WaitForDebugEvent（一个kernel32函数）以获取其调试事件时，实际上是debug_event变量被编写了，但是此函数清除了所有我的应用程序中的变量。 所以也很清楚：

this (current form)
EventArgs (arguments of my form load function)
object sender (the object who called the function)

因此，我无法继续执行我的应用程序，因为所有变量都已删除。 我不认为这是kernel32或Visual Studio错误...

这是代码：

（结构和导入来自pInvoke.net和MSDN）

    [DllImport("kernel32.dll")]
    static extern bool DebugActiveProcess(uint dwProcessId);
    [DllImport("kernel32.dll", EntryPoint = "WaitForDebugEvent")]
    [return: MarshalAs(UnmanagedType.Bool)]
    public static extern bool WaitForDebugEvent([In] ref DEBUG_EVENT lpDebugEvent, uint dwMilliseconds);
    [DllImport("kernel32.dll")]
    static extern bool ContinueDebugEvent(uint dwProcessId, uint dwThreadId, uint dwContinueStatus);
    [DllImport("kernel32.dll")]
    [return: MarshalAs(UnmanagedType.Bool)]
    public static extern bool DebugActiveProcessStop([In] int Pid);

    public struct DEBUG_EVENT
    {
        public int dwDebugEventCode;
        public int dwProcessId;
        public int dwThreadId;
        public struct u
        {
            public EXCEPTION_DEBUG_INFO Exception;
            public CREATE_THREAD_DEBUG_INFO CreateThread;
            public CREATE_PROCESS_DEBUG_INFO CreateProcessInfo;
            public EXIT_THREAD_DEBUG_INFO ExitThread;
            public EXIT_PROCESS_DEBUG_INFO ExitProcess;
            public LOAD_DLL_DEBUG_INFO LoadDll;
            public UNLOAD_DLL_DEBUG_INFO UnloadDll;
            public OUTPUT_DEBUG_STRING_INFO DebugString;
            public RIP_INFO RipInfo;
        };
    };

    [StructLayout(LayoutKind.Sequential)]
    public struct EXCEPTION_DEBUG_INFO
    {
        public EXCEPTION_RECORD ExceptionRecord;
        public uint dwFirstChance;
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct EXCEPTION_RECORD
    {
        public uint ExceptionCode;
        public uint ExceptionFlags;
        public IntPtr ExceptionRecord;
        public IntPtr ExceptionAddress;
        public uint NumberParameters;
        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 15, ArraySubType = UnmanagedType.U4)]
        public uint[] ExceptionInformation;
    }

    public delegate uint PTHREAD_START_ROUTINE(IntPtr lpThreadParameter);

    [StructLayout(LayoutKind.Sequential)]
    public struct CREATE_THREAD_DEBUG_INFO
    {
        public IntPtr hThread;
        public IntPtr lpThreadLocalBase;
        public PTHREAD_START_ROUTINE lpStartAddress;
    }

    //public delegate uint PTHREAD_START_ROUTINE(IntPtr lpThreadParameter);

    [StructLayout(LayoutKind.Sequential)]
    public struct CREATE_PROCESS_DEBUG_INFO
    {
        public IntPtr hFile;
        public IntPtr hProcess;
        public IntPtr hThread;
        public IntPtr lpBaseOfImage;
        public uint dwDebugInfoFileOffset;
        public uint nDebugInfoSize;
        public IntPtr lpThreadLocalBase;
        public PTHREAD_START_ROUTINE lpStartAddress;
        public IntPtr lpImageName;
        public ushort fUnicode;
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct EXIT_THREAD_DEBUG_INFO
    {
        public uint dwExitCode;
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct EXIT_PROCESS_DEBUG_INFO
    {
        public uint dwExitCode;
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct LOAD_DLL_DEBUG_INFO
    {
        public IntPtr hFile;
        public IntPtr lpBaseOfDll;
        public uint dwDebugInfoFileOffset;
        public uint nDebugInfoSize;
        public IntPtr lpImageName;
        public ushort fUnicode;
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct UNLOAD_DLL_DEBUG_INFO
    {
        public IntPtr lpBaseOfDll;
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct OUTPUT_DEBUG_STRING_INFO
    {
        [MarshalAs(UnmanagedType.LPStr)]
        public string lpDebugStringData;
        public ushort fUnicode;
        public ushort nDebugStringLength;
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct RIP_INFO
    {
        public uint dwError;
        public uint dwType;
    }

和调试器的主循环：

    private void Form1_Load(object sender, EventArgs e)
    {
        DebugActiveProcess((uint)Process.GetProcessesByName("notepad")[0].Id);
        DEBUG_EVENT debug_event = new DEBUG_EVENT();
        CONTEXT context = new CONTEXT();
        context.ContextFlags = (uint)CONTEXT_FLAGS.CONTEXT_ALL;
        while (true)
        {
            unchecked
            {
                if (WaitForDebugEvent(ref debug_event, (uint)double.PositiveInfinity))
                {
                       ...

                    ContinueDebugEvent((uint)debug_event.dwProcessId, (uint)debug_event.dwThreadId, (uint)0x10002);
                }
            }
        }
    }

我能做什么？ 提前致谢...

编辑：

我已经用C ++重写了代码，看看那里是否也存在问题。 但是没有问题...所以我认为问题仅在于C＃。 这是C ++中的代码：

进口：

#include <windows.h>
#include <tlhelp32.h>
#include <msclr\marshal_cppstd.h>

码：

        private: System::Void DebuggerForm_Load(System::Object^  sender, System::EventArgs^  e) {
            std::wstring processName = msclr::interop::marshal_as<std::wstring, String^>("myExe.exe");
            DWORD id = getProcessId(processName);
            if (id == 0) std::exit(0);
            DebugActiveProcess(id); 

            DEBUG_EVENT debug_event = { 0 };
            while (true)
            {
                if (WaitForDebugEvent(&debug_event, INFINITE)) {
                    // TODO
                    ContinueDebugEvent(debug_event.dwProcessId, debug_event.dwThreadId, DBG_CONTINUE);
                }
            }
        }

        DWORD getProcessId(const std::wstring& processName)
        {
            PROCESSENTRY32 processInfo;
            processInfo.dwSize = sizeof(processInfo);

            HANDLE processesSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
            if (processesSnapshot == INVALID_HANDLE_VALUE)
                return 0;

            Process32First(processesSnapshot, &processInfo);
            if (!processName.compare(processInfo.szExeFile))
            {
                CloseHandle(processesSnapshot);
                return processInfo.th32ProcessID;
            }

            while (Process32Next(processesSnapshot, &processInfo))
            {
                if (!processName.compare(processInfo.szExeFile))
                {
                    CloseHandle(processesSnapshot);
                    return processInfo.th32ProcessID;
                }
            }

            CloseHandle(processesSnapshot);
            return 0;
        }

Answer 1

首先，您应该在目标进程上启用SE_DEBUG_NAME特权：

（ SE_DEBUG_NAME =“ SeDebugPrivilege”）

1. 将OpenProcessToken与TOKEN_ADJUST_PRIVILEGES和TOKEN_QUERY访问标志TOKEN_QUERY使用。
2. 使用LookupPrivilegeValue检索SE_DEBUG_NAME特权名称的LUID。
3. 使用AdjustTokenPrivileges启用SE_DEBUG_NAME特权。
4. CloseHandle

对于第三步，您需要一个TOKEN_PRIVILEGES结构，其中PrivilegesCount字段必须设置为1 。 另外，您还必须设置“ Privilege字段的第一项（零索引）（ Luid ：请参见第二步， Attributes ： SE_PRIVILEGE_ENABLED ）

DEBUG_EVENT结构：

结构的u字段是一个并集，表示它仅包含列出的结构之一。 尝试使用LayoutKind.Explicit并使用属性FieldOffset装饰每个字段，以在结构内定义正确的偏移量。 尝试这个：

[StructLayout(LayoutKind.Explicit)]
public struct DEBUG_EVENT
{

    [FieldOffset(0)]
    public int dwDebugEventCode;

    [FieldOffset(4)]
    public int dwProcessId;

    [FieldOffset(8)]
    public int dwThreadId;

    [FieldOffset(12)]
    [StructLayout(LayoutKind.Explicit)]
    public struct u {

        [FieldOffset(0)]
        public EXCEPTION_DEBUG_INFO Exception;
        [FieldOffset(0)]
        public CREATE_THREAD_DEBUG_INFO CreateThread;
        [FieldOffset(0)]
        public CREATE_PROCESS_DEBUG_INFO CreateProcessInfo;
        [FieldOffset(0)]
        public EXIT_THREAD_DEBUG_INFO ExitThread;
        [FieldOffset(0)]
        public EXIT_PROCESS_DEBUG_INFO ExitProcess;
        [FieldOffset(0)]
        public LOAD_DLL_DEBUG_INFO LoadDll;
        [FieldOffset(0)]
        public UNLOAD_DLL_DEBUG_INFO UnloadDll;
        [FieldOffset(0)]
        public OUTPUT_DEBUG_STRING_INFO DebugString;
        [FieldOffset(0)]
        public RIP_INFO RipInfo;
    }
};