73 switch (WaitStateChange->NewState)
83 WaitStateChange->StateInfo.CreateThread.HandleToThread;
85 WaitStateChange->StateInfo.CreateThread.NewThread.StartAddress;
92 sizeof(ThreadBasicInfo),
102 DebugEvent->u.CreateThread.lpThreadLocalBase =
116 WaitStateChange->StateInfo.CreateProcessInfo.HandleToProcess;
118 WaitStateChange->StateInfo.CreateProcessInfo.HandleToThread;
120 WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.
122 DebugEvent->u.CreateProcessInfo.lpBaseOfImage =
123 WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.
125 DebugEvent->u.CreateProcessInfo.dwDebugInfoFileOffset =
126 WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.
128 DebugEvent->u.CreateProcessInfo.nDebugInfoSize =
129 WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.
131 DebugEvent->u.CreateProcessInfo.lpStartAddress =
132 WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.
133 InitialThread.StartAddress;
137 CreateProcessInfo.HandleToThread,
140 sizeof(ThreadBasicInfo),
150 DebugEvent->u.CreateProcessInfo.lpThreadLocalBase =
166 WaitStateChange->StateInfo.ExitThread.ExitStatus;
176 WaitStateChange->StateInfo.ExitProcess.ExitStatus;
186 if (WaitStateChange->StateInfo.Exception.ExceptionRecord.
194 (
PVOID)WaitStateChange->
195 StateInfo.Exception.ExceptionRecord.
196 ExceptionInformation[1];
197 DebugEvent->u.DebugString.nDebugStringLength =
198 WaitStateChange->StateInfo.Exception.ExceptionRecord.
199 ExceptionInformation[0];
202 else if (WaitStateChange->StateInfo.Exception.ExceptionRecord.
210 WaitStateChange->StateInfo.Exception.ExceptionRecord.
211 ExceptionInformation[1];
213 WaitStateChange->StateInfo.Exception.ExceptionRecord.
214 ExceptionInformation[0];
221 WaitStateChange->StateInfo.Exception.ExceptionRecord;
223 WaitStateChange->StateInfo.Exception.FirstChance;
236 WaitStateChange->StateInfo.LoadDll.FileHandle;
238 WaitStateChange->StateInfo.LoadDll.BaseOfDll;
240 WaitStateChange->StateInfo.LoadDll.DebugInfoFileOffset;
242 WaitStateChange->StateInfo.LoadDll.DebugInfoSize;
244 WaitStateChange->StateInfo.LoadDll.NamePointer;
257 WaitStateChange->StateInfo.UnloadDll.BaseAddress;
HANDLE NTAPI DbgUiGetThreadDebugObject(VOID)
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
_Inout_ PIRP _In_ NTSTATUS ExceptionCode
NTSTATUS NTAPI DbgUiConnectToDbg(VOID)
VOID NTAPI DbgUiSetThreadDebugObject(HANDLE DebugObject)
VOID NTAPI DbgUiRemoteBreakin(VOID)
NTSYSAPI VOID NTAPI RtlExitUserThread(_In_ NTSTATUS Status)
NTSTATUS NTAPI DbgUiStopDebugging(IN HANDLE Process)
#define DBGK_KILL_PROCESS_ON_EXIT
NTSTATUS NTAPI NtRemoveProcessDebug(IN HANDLE ProcessHandle, IN HANDLE DebugHandle)
NTSTATUS NTAPI NtDebugActiveProcess(IN HANDLE ProcessHandle, IN HANDLE DebugHandle)
#define LOAD_DLL_DEBUG_EVENT
NTSYSAPI NTSTATUS NTAPI ZwDebugContinue(_In_ HANDLE DebugObject, _In_ PCLIENT_ID AppClientId, _In_ NTSTATUS ContinueStatus)
NTSTATUS NTAPI NtWaitForDebugEvent(IN HANDLE DebugHandle, IN BOOLEAN Alertable, IN PLARGE_INTEGER Timeout OPTIONAL, OUT PDBGUI_WAIT_STATE_CHANGE StateChange)
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
VOID NTAPI DbgBreakPoint(VOID)
HANDLE WINAPI DECLSPEC_HOTPATCH CreateThread(IN LPSECURITY_ATTRIBUTES lpThreadAttributes, IN DWORD dwStackSize, IN LPTHREAD_START_ROUTINE lpStartAddress, IN LPVOID lpParameter, IN DWORD dwCreationFlags, OUT LPDWORD lpThreadId)
#define UNLOAD_DLL_DEBUG_EVENT
NTSTATUS NTAPI DbgUiContinue(IN PCLIENT_ID ClientId, IN NTSTATUS ContinueStatus)
NTSTATUS NTAPI DbgUiDebugActiveProcess(IN HANDLE Process)
#define EXIT_PROCESS_DEBUG_EVENT
_Out_ PCLIENT_ID ClientId
#define CREATE_THREAD_DEBUG_EVENT
#define NT_SUCCESS(StatCode)
NTSTATUS NTAPI NtQueryInformationThread(IN HANDLE ThreadHandle, IN THREADINFOCLASS ThreadInformationClass, OUT PVOID ThreadInformation, IN ULONG ThreadInformationLength, OUT PULONG ReturnLength OPTIONAL)
NTSTATUS NTAPI DbgUiConvertStateChangeStructure(IN PDBGUI_WAIT_STATE_CHANGE WaitStateChange, OUT PVOID Win32DebugEvent)
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
NTSTATUS NTAPI DbgUiWaitStateChange(OUT PDBGUI_WAIT_STATE_CHANGE WaitStateChange, IN PLARGE_INTEGER TimeOut OPTIONAL)
#define STATUS_UNSUCCESSFUL
NTSTATUS NTAPI DbgUiIssueRemoteBreakin(IN HANDLE Process)
#define DBG_PRINTEXCEPTION_C
NTSYSAPI NTSTATUS NTAPI RtlCreateUserThread(_In_ PVOID ThreadContext, _Out_ HANDLE *OutThreadHandle, _Reserved_ PVOID Reserved1, _Reserved_ PVOID Reserved2, _Reserved_ PVOID Reserved3, _Reserved_ PVOID Reserved4, _Reserved_ PVOID Reserved5, _Reserved_ PVOID Reserved6, _Reserved_ PVOID Reserved7, _Reserved_ PVOID Reserved8)
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE FileHandle
FORCEINLINE struct _TEB * NtCurrentTeb(VOID)
NTSYSAPI NTSTATUS NTAPI ZwCreateDebugObject(_Out_ PHANDLE DebugHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ ULONG Flags)
#define EXCEPTION_DEBUG_EVENT
#define EXIT_THREAD_DEBUG_EVENT
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
#define OUTPUT_DEBUG_STRING_EVENT
#define DEBUG_OBJECT_ALL_ACCESS
#define InitializeObjectAttributes(p, n, a, r, s)
#define CREATE_PROCESS_DEBUG_EVENT
PULONG MinorVersion OPTIONAL