73 switch (WaitStateChange->NewState)
83 WaitStateChange->StateInfo.CreateThread.HandleToThread;
85 WaitStateChange->StateInfo.CreateThread.NewThread.StartAddress;
92 sizeof(ThreadBasicInfo),
102 DebugEvent->u.CreateThread.lpThreadLocalBase =
116 WaitStateChange->StateInfo.CreateProcessInfo.HandleToProcess;
118 WaitStateChange->StateInfo.CreateProcessInfo.HandleToThread;
120 WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.
122 DebugEvent->u.CreateProcessInfo.lpBaseOfImage =
123 WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.
125 DebugEvent->u.CreateProcessInfo.dwDebugInfoFileOffset =
126 WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.
128 DebugEvent->u.CreateProcessInfo.nDebugInfoSize =
129 WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.
131 DebugEvent->u.CreateProcessInfo.lpStartAddress =
132 WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.
133 InitialThread.StartAddress;
137 CreateProcessInfo.HandleToThread,
140 sizeof(ThreadBasicInfo),
150 DebugEvent->u.CreateProcessInfo.lpThreadLocalBase =
166 WaitStateChange->StateInfo.ExitThread.ExitStatus;
176 WaitStateChange->StateInfo.ExitProcess.ExitStatus;
186 if (WaitStateChange->StateInfo.Exception.ExceptionRecord.
194 (
PVOID)WaitStateChange->
195 StateInfo.Exception.ExceptionRecord.
196 ExceptionInformation[1];
197 DebugEvent->u.DebugString.nDebugStringLength =
198 WaitStateChange->StateInfo.Exception.ExceptionRecord.
199 ExceptionInformation[0];
202 else if (WaitStateChange->StateInfo.Exception.ExceptionRecord.
210 WaitStateChange->StateInfo.Exception.ExceptionRecord.
211 ExceptionInformation[1];
213 WaitStateChange->StateInfo.Exception.ExceptionRecord.
214 ExceptionInformation[0];
221 WaitStateChange->StateInfo.Exception.ExceptionRecord;
223 WaitStateChange->StateInfo.Exception.FirstChance;
236 WaitStateChange->StateInfo.LoadDll.FileHandle;
238 WaitStateChange->StateInfo.LoadDll.BaseOfDll;
240 WaitStateChange->StateInfo.LoadDll.DebugInfoFileOffset;
242 WaitStateChange->StateInfo.LoadDll.DebugInfoSize;
244 WaitStateChange->StateInfo.LoadDll.NamePointer;
257 WaitStateChange->StateInfo.UnloadDll.BaseAddress;
_Inout_ PIRP _In_ NTSTATUS ExceptionCode
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
NTSYSAPI NTSTATUS NTAPI ZwDebugContinue(_In_ HANDLE DebugObject, _In_ PCLIENT_ID AppClientId, _In_ NTSTATUS ContinueStatus)
NTSYSAPI NTSTATUS NTAPI ZwCreateDebugObject(_Out_ PHANDLE DebugHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ ULONG Flags)
NTSTATUS NTAPI NtRemoveProcessDebug(IN HANDLE ProcessHandle, IN HANDLE DebugHandle)
NTSTATUS NTAPI NtDebugActiveProcess(IN HANDLE ProcessHandle, IN HANDLE DebugHandle)
NTSTATUS NTAPI NtWaitForDebugEvent(IN HANDLE DebugHandle, IN BOOLEAN Alertable, IN PLARGE_INTEGER Timeout OPTIONAL, OUT PDBGUI_WAIT_STATE_CHANGE StateChange)
#define DEBUG_OBJECT_ALL_ACCESS
#define DBGK_KILL_PROCESS_ON_EXIT
@ DbgBreakpointStateChange
@ DbgCreateProcessStateChange
@ DbgCreateThreadStateChange
@ DbgExitProcessStateChange
@ DbgExceptionStateChange
@ DbgUnloadDllStateChange
@ DbgExitThreadStateChange
@ DbgSingleStepStateChange
NTSTATUS NTAPI DbgUiContinue(IN PCLIENT_ID ClientId, IN NTSTATUS ContinueStatus)
NTSTATUS NTAPI DbgUiConvertStateChangeStructure(IN PDBGUI_WAIT_STATE_CHANGE WaitStateChange, OUT PVOID Win32DebugEvent)
NTSTATUS NTAPI DbgUiDebugActiveProcess(IN HANDLE Process)
NTSTATUS NTAPI DbgUiIssueRemoteBreakin(IN HANDLE Process)
NTSTATUS NTAPI DbgUiStopDebugging(IN HANDLE Process)
NTSTATUS NTAPI DbgUiConnectToDbg(VOID)
NTSTATUS NTAPI DbgUiWaitStateChange(OUT PDBGUI_WAIT_STATE_CHANGE WaitStateChange, IN PLARGE_INTEGER TimeOut OPTIONAL)
HANDLE NTAPI DbgUiGetThreadDebugObject(VOID)
VOID NTAPI DbgUiRemoteBreakin(VOID)
VOID NTAPI DbgUiSetThreadDebugObject(HANDLE DebugObject)
#define NT_SUCCESS(StatCode)
HANDLE WINAPI DECLSPEC_HOTPATCH CreateThread(IN LPSECURITY_ATTRIBUTES lpThreadAttributes, IN DWORD dwStackSize, IN LPTHREAD_START_ROUTINE lpStartAddress, IN LPVOID lpParameter, IN DWORD dwCreationFlags, OUT LPDWORD lpThreadId)
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE FileHandle
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
NTSYSAPI void WINAPI DbgBreakPoint(void)
#define InitializeObjectAttributes(p, n, a, r, s)
NTSYSAPI VOID NTAPI RtlExitUserThread(_In_ NTSTATUS Status)
NTSYSAPI NTSTATUS NTAPI RtlCreateUserThread(_In_ PVOID ThreadContext, _Out_ HANDLE *OutThreadHandle, _Reserved_ PVOID Reserved1, _Reserved_ PVOID Reserved2, _Reserved_ PVOID Reserved3, _Reserved_ PVOID Reserved4, _Reserved_ PVOID Reserved5, _Reserved_ PVOID Reserved6, _Reserved_ PVOID Reserved7, _Reserved_ PVOID Reserved8)
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
NTSTATUS NTAPI NtQueryInformationThread(IN HANDLE ThreadHandle, IN THREADINFOCLASS ThreadInformationClass, OUT PVOID ThreadInformation, IN ULONG ThreadInformationLength, OUT PULONG ReturnLength OPTIONAL)
#define DBG_PRINTEXCEPTION_C
PULONG MinorVersion OPTIONAL
#define STATUS_UNSUCCESSFUL
#define CREATE_PROCESS_DEBUG_EVENT
#define LOAD_DLL_DEBUG_EVENT
#define EXIT_PROCESS_DEBUG_EVENT
#define OUTPUT_DEBUG_STRING_EVENT
#define EXCEPTION_DEBUG_EVENT
#define CREATE_THREAD_DEBUG_EVENT
#define UNLOAD_DLL_DEBUG_EVENT
#define EXIT_THREAD_DEBUG_EVENT
_Out_ PCLIENT_ID ClientId