debugee是我自己写的程序,看内存地址比较方便;
出现的问题是,debugee创建之后运行正常,但是debuger(就是我做的loader)没反应,断不下来,各位帮看一下代码哪里出错了。VC的代码
STARTUPINFO *si = new STARTUPINFO();
PROCESS_INFORMATION *pi = new PROCESS_INFORMATION();
DWORD dwAdr = 0x12FEFF;
si->cb = sizeof(STARTUPINFO);
CreateProcess("H:\\VC6PRO\\debugee\\Release\\debugee.exe" , NULL , NULL , NULL ,
FALSE , CREATE_SUSPENDED | CREATE_DEFAULT_ERROR_MODE , NULL , NULL , si , pi);
DEBUG_EVENT *pDEvent = new DEBUG_EVENT();
CONTEXT *pDContext = new CONTEXT();
DWORD dwDParam;
DWORD dwNewAccess;
DWORD dwValue = 0;
ResumeThread(pi->hThread);
if (WaitForInputIdle(pi->hProcess , INFINITE) != 0)
{
MessageBox("wait error");
}
if (!DebugActiveProcess(pi->dwProcessId))
{
MessageBox("DebugActive error");
}
pDContext->ContextFlags = CONTEXT_ALL;
while (WaitForDebugEvent(pDEvent , INFINITE))
{
dwDParam = DBG_CONTINUE;
switch(pDEvent->dwDebugEventCode)
{
case CREATE_PROCESS_DEBUG_EVENT:
GetThreadContext(pDEvent->u.CreateProcessInfo.hThread , pDContext);
pDContext->Dr0 = dwAdr;
pDContext->Dr6 = 0;
pDContext->Dr7 = 0x101;
pDContext->ContextFlags = CONTEXT_ALL;
if (!SetThreadContext(pDEvent->u.CreateProcessInfo.hThread , pDContext))
{
MessageBox("SetThreadContext error");
}
break;
case EXCEPTION_DEBUG_EVENT:
{
switch (pDEvent->u.Exception.ExceptionRecord.ExceptionCode)
{
case EXCEPTION_ACCESS_VIOLATION:
dwDParam = DBG_EXCEPTION_NOT_HANDLED;
break;
case EXCEPTION_SINGLE_STEP:
GetThreadContext(pi->hThread , pDContext);
if (pDContext->Dr6 & 1)
{
MessageBox("break");
}
else
{
dwDParam = DBG_EXCEPTION_NOT_HANDLED;
}
break;
}
}
break;
case EXIT_PROCESS_DEBUG_EVENT:
ContinueDebugEvent(pDEvent->dwProcessId , pDEvent->dwThreadId , dwDParam);
break;
default:
break;
}
ContinueDebugEvent(pDEvent->dwProcessId , pDEvent->dwThreadId , dwDParam);
}
[招生]系统0day安全班,企业级设备固件漏洞挖掘,Linux平台漏洞挖掘!