private DebuggerAction FinalizeContinue(IDebuggeeThread thread)
{
_isContinuing = false;
var eventArgs = new DebuggeeThreadEventArgs(thread)
{
NextAction = _continueAction
};
OnResumedExecution(eventArgs);
return(eventArgs.NextAction);
}
private DebuggerAction HandleExitThreadDebugEvent(DEBUG_EVENT debugEvent)
{
var info = debugEvent.InterpretDebugInfoAs <EXIT_THREAD_DEBUG_INFO>();
var process = GetProcessById((int)debugEvent.dwProcessId);
var thread = process.GetThreadById((int)debugEvent.dwThreadId);
thread.ExitCode = (int)info.dwExitCode;
var eventArgs = new DebuggeeThreadEventArgs(thread);
OnThreadTerminated(eventArgs);
process.RemoveThread(thread);
return(eventArgs.NextAction);
}
private DebuggerAction HandleCreateThreadDebugEvent(DEBUG_EVENT debugEvent)
{
var info = debugEvent.InterpretDebugInfoAs <CREATE_THREAD_DEBUG_INFO>();
var process = GetProcessById((int)debugEvent.dwProcessId);
var thread = new DebuggeeThread(process, info.hThread, (int)debugEvent.dwThreadId, info.lpStartAddress);
process.AddThread(thread);
var eventArgs = new DebuggeeThreadEventArgs(thread);
OnThreadStarted(eventArgs);
return(eventArgs.NextAction);
}
private void HandleNextAction(DebuggerAction nextAction, DEBUG_EVENT nextEvent)
{
switch (nextAction)
{
case DebuggerAction.Continue:
_nextContinueStatus = ContinueStatus.DBG_CONTINUE;
break;
case DebuggerAction.ContinueWithException:
_nextContinueStatus = ContinueStatus.DBG_EXCEPTION_NOT_HANDLED;
break;
case DebuggerAction.Stop:
var process = GetProcessById((int)nextEvent.dwProcessId);
var thread = process.GetThreadById((int)nextEvent.dwThreadId)
?? new DebuggeeThread(process, IntPtr.Zero, (int)nextEvent.dwThreadId, IntPtr.Zero);
var eventArgs = new DebuggeeThreadEventArgs(thread);
eventArgs.NextAction = DebuggerAction.Stop;
OnPaused(eventArgs);
switch (eventArgs.NextAction)
{
case DebuggerAction.Continue:
_nextContinueStatus = ContinueStatus.DBG_CONTINUE;
break;
case DebuggerAction.ContinueWithException:
_nextContinueStatus = ContinueStatus.DBG_EXCEPTION_NOT_HANDLED;
break;
case DebuggerAction.Stop:
_continueEvent.WaitOne();
break;
default:
throw new ArgumentOutOfRangeException();
}
break;
}
}
private void SessionOnPaused(object sender, DebuggeeThreadEventArgs args)
{
_currentThread = args.Thread;
var threadContext = _currentThread.GetThreadContext();
if (!_justStepped)
{
_logger.WriteLine("Debuggee paused.");
_logger.WriteLine("Thread ID: " + args.Thread.Id);
var registerCommand = _executor.GetCommand <RegisterCommand>();
registerCommand.SetCurrentThread(_currentThread);
registerCommand.Execute(_session, new string[0], _logger);
}
uint eip = (uint)threadContext.GetRegisterByName("eip").Value;
_executor.GetCommand <DisassembleCommand>().Execute(_session, new[] { eip.ToString("X8"), "1" }, _logger);
_justStepped = false;
}
private DebuggerAction FinalizeStep(DebuggeeThread thread)
{
RestoreBreakpoints();
_isStepping = false;
if (_isRestoringFromGuard)
{
return(FinalizeRestoreFromGuard(thread));
}
if (_isContinuing)
{
return(FinalizeContinue(thread));
}
var eventArgs = new DebuggeeThreadEventArgs(thread)
{
NextAction = DebuggerAction.Stop
};
OnStepCompleted(eventArgs);
return(eventArgs.NextAction);
}
protected virtual void OnStepped(DebuggeeThreadEventArgs e)
{
Stepped?.Invoke(this, e);
}
protected virtual void OnPaused(DebuggeeThreadEventArgs e)
{
Paused?.Invoke(this, e);
}
protected virtual void OnThreadTerminated(DebuggeeThreadEventArgs e)
{
ThreadTerminated?.Invoke(this, e);
}
private void SessionOnThreadTerminated(object sender, DebuggeeThreadEventArgs args)
{
_logger.WriteLine("Thread terminated. ID: " + args.Thread.Id);
}
private void SessionOnStepped(object sender, DebuggeeThreadEventArgs args)
{
_justStepped = true;
}
protected virtual void OnResumedExecution(DebuggeeThreadEventArgs e)
{
ResumedExecution?.Invoke(this, e);
}
