Ejemplo n.º 1
0
        private static void PrepareContextForSingleStep(DebuggeeThread thread)
        {
            var threadContext = thread.GetThreadContext();

            threadContext.GetRegisterByName("tf").Value = true;
            threadContext.Flush();
        }
Ejemplo n.º 2
0
        private void SignalStepIn(DebuggeeThread thread, DebuggerAction nextAction)
        {
            // Set trap flag to signal an EXCEPTION_SINGLE_STEP event after next instruction.

            PrepareContextForSingleStep(thread);
            _session.SignalDebuggerLoop(nextAction);
        }
Ejemplo n.º 3
0
        private void SignalStepOver(DebuggeeThread thread, DebuggerAction nextAction)
        {
            // Stepping over means step one instruction, but skip call instructions.
            // Therefore, if the current instruction is a call, we set a temporary breakpoint
            // to the next instruction and continue execution, otherwise we perform a normal step.

            var threadContext = thread.GetThreadContext();
            var eip           = (uint)threadContext.GetRegisterByName("eip").Value;

            var info = _disassemblers[thread.Process];

            info.Reader.Position = eip;
            var instruction = info.Disassembler.ReadNextInstruction();

            switch (instruction.Mnemonic)
            {
            case X86Mnemonic.Call:
            case X86Mnemonic.Call_Far:
                _stepOverBreakpoint = new Int3Breakpoint(thread.Process, (IntPtr)info.Reader.Position, true);
                _session.SignalDebuggerLoop(nextAction);
                break;

            default:
                SignalStepIn(thread, nextAction);
                break;
            }
        }
Ejemplo n.º 4
0
        public void Continue(DebuggeeThread thread, DebuggerAction nextAction)
        {
            _isContinuing   = true;
            _continueAction = nextAction;

            if (HasBreakpointsToRestore)
            {
                SignalStep(thread, StepType.StepIn, nextAction);
            }
            else
            {
                _session.SignalDebuggerLoop(FinalizeContinue(thread));
            }
        }
Ejemplo n.º 5
0
        private DebuggerAction HandleCreateThreadDebugEvent(DEBUG_EVENT debugEvent)
        {
            var info    = debugEvent.InterpretDebugInfoAs <CREATE_THREAD_DEBUG_INFO>();
            var process = GetProcessById((int)debugEvent.dwProcessId);

            var thread = new DebuggeeThread(process, info.hThread, (int)debugEvent.dwThreadId, info.lpStartAddress);

            process.AddThread(thread);

            var eventArgs = new DebuggeeThreadEventArgs(thread);

            OnThreadStarted(eventArgs);

            return(eventArgs.NextAction);
        }
Ejemplo n.º 6
0
        private DebuggerAction HandleCreateProcessDebugEvent(DEBUG_EVENT debugEvent)
        {
            var info    = debugEvent.InterpretDebugInfoAs <CREATE_PROCESS_DEBUG_INFO>();
            var process = GetOrCreateProcess(info.hProcess, (int)debugEvent.dwProcessId);

            process.BaseAddress = info.lpBaseOfImage;

            // Create process event also spawns a new thread.
            _currentThread = new DebuggeeThread(process, info.hThread, (int)debugEvent.dwThreadId, info.lpStartAddress);
            process.AddThread(_currentThread);

            var eventArgs = new DebuggeeProcessEventArgs(process);

            OnProcessStarted(eventArgs);

            return(eventArgs.NextAction);
        }
Ejemplo n.º 7
0
        public void SignalStep(DebuggeeThread thread, StepType stepType, DebuggerAction nextAction)
        {
            _isStepping = true;
            switch (stepType)
            {
            case StepType.StepIn:
                SignalStepIn(thread, nextAction);
                break;

            case StepType.StepOver:
                SignalStepOver(thread, nextAction);
                break;

            case StepType.StepOut:
                SignalStepOut(thread, nextAction);
                break;

            default:
                throw new ArgumentOutOfRangeException(nameof(stepType), stepType, null);
            }
        }
Ejemplo n.º 8
0
        private void DebuggerLoop()
        {
            while (IsActive)
            {
                // Handle next debugger event.
                var nextEvent = NativeMethods.WaitForDebugEvent(uint.MaxValue);

                _isPaused      = true;
                _currentThread = GetProcessById((int)nextEvent.dwProcessId)?.GetThreadById((int)nextEvent.dwThreadId);

                var nextAction = HandleDebugEvent(nextEvent);

                // Handle action that might have been set by subscribed event handlers.
                HandleNextAction(nextAction, nextEvent);

                // Continue execution.
                NativeMethods.ContinueDebugEvent(
                    nextEvent.dwProcessId,
                    nextEvent.dwThreadId,
                    _nextContinueStatus);

                _isPaused = false;
            }
        }
Ejemplo n.º 9
0
        private DebuggerAction FinalizeStep(DebuggeeThread thread)
        {
            RestoreBreakpoints();

            _isStepping = false;

            if (_isRestoringFromGuard)
            {
                return(FinalizeRestoreFromGuard(thread));
            }

            if (_isContinuing)
            {
                return(FinalizeContinue(thread));
            }

            var eventArgs = new DebuggeeThreadEventArgs(thread)
            {
                NextAction = DebuggerAction.Stop
            };

            OnStepCompleted(eventArgs);
            return(eventArgs.NextAction);
        }
Ejemplo n.º 10
0
 internal void RemoveThread(DebuggeeThread thread)
 {
     _threads.Remove(thread.Id);
     OnThreadTerminated(new DebuggeeThreadEventArgs(thread));
 }
Ejemplo n.º 11
0
 internal void AddThread(DebuggeeThread thread)
 {
     _threads.Add(thread.Id, thread);
     OnThreadStarted(new DebuggeeThreadEventArgs(thread));
 }
Ejemplo n.º 12
0
 private DebuggerAction FinalizeRestoreFromGuard(DebuggeeThread thread)
 {
     _isRestoringFromGuard = false;
     return(DebuggerAction.Continue);
 }