Windows simple Debugger source code 2700 lines or so

Simple Debugger project in the beginning of the function to receive the system debug events and do the corresponding processing, the simple debugger implementation process of the main debug event is an exception event, the corresponding processing function is dispatchexception.

Access exceptions, Int3 exceptions, and single-step exceptions are the exception events that are closely related to implementing debugger functions, where three functions are used to process three functions, respectively onexceptionaccess, Onexceptionbreakpoint, Onexceptionsinglestep.

If the exception handler is set for the debugger itself, the exception handler will stop to receive user input waiting for the next processing, and the corresponding user interaction function is userinput.

In the process of user interaction, the program completes the function through some command functions that start with CMD.

Breakpoint Related:

Int3 Breakpoint Correlation:

Int3 breakpoints are divided into temporary breakpoints and permanent breakpoints, when setting a breakpoint, if a permanent breakpoint and a temporary breakpoint are repeatedly required to convert a temporary breakpoint that already exists to a permanent breakpoint, the other breakpoint repeats without having to set the breakpoint again

After the temporary breakpoint has been interrupted by the debugger, you need to restore the debugger breakpoint to the original value and remove the temporary breakpoint.

After a permanent breakpoint has been interrupted by the debugger, you need to temporarily restore the debugger breakpoint to its original value, and then step through the permanent breakpoint, setting the permanent breakpoint again in the single-step exception.

Delete Breakpoint restores the debugger breakpoint to its original value, and then deletes the breakpoint

Memory Breakpoint Related:

Memory breakpoints are divided into write breakpoints and access breakpoints by modifying the memory properties of the debugged program to be inaccessible, and then handling memory breakpoints in Access exception events.

Set a memory breakpoint, this program limit memory breakpoint length can not exceed a paging, this program will detect whether the memory breakpoint set is paged across memory, if the cross-memory paging will automatically split the breakpoint into two non-cross paging memory breakpoints.

Because the memory Access property contains memory write properties, the program prompts the user to set a breakpoint to fail if there is an overlap area with a memory breakpoint that was already present when a memory breakpoint is set.

This program uses the map to record the modified memory paging start address and the corresponding memory paging original properties.

When you set a new memory breakpoint, find out if the memory page in the map already exists in the other memory breakpoint, if it exists simply add that memory breakpoint with a memory breakpoint table, modify the memory paging property if it does not exist, and then add that memory breakpoint into the Memory breakpoint table

When an access exception is encountered by the debugger, the first query is whether to hit the memory page in the map, no hit description is the exception of the program itself does not do processing, if hit map memory paging, first temporarily restore the memory paging as the original property, and then continue to find the memory breakpoint table to see whether hit specific memory breakpoint, If you hit the specific memory breakpoint table and prompt the user without hitting the specific memory breakpoint, the debugger steps through the access exception and then resumes the memory paging property in the single-step event.

To delete a memory breakpoint:

First delete the memory breakpoint and then look for the memory breakpoint table to find out if there are other memory breakpoints on the same memory page as the delete memory breakpoint, if the memory breakpoint does not exist in the same paging breakpoint as the delete memory breakpoint, find the corresponding memory page in map, restore the memory paging property to the original value, Delete the memory paging record in the map, and if you still have a memory breakpoint on the same page as the delete memory breakpoint, do not process the map.

Hardware Breakpoint Related:

Set a hardware breakpoint, determine whether a hardware breakpoint is an exception in a single-step exception, and, if hit hardware breakpoint prompts the user, set a single step in the case of a hardware breakpoint, and restore the hardware breakpoint in a single-step exception.

The attachment does not seem to show the source code can be downloaded here:

http://download.csdn.net/detail/qihuanfengyun/8351005

Windows simple Debugger source code 2700 lines or so