procedure TForm1.StartRun;
var
StartupInfo:TStartupInfo;
DebugInfo:TDebugEvent;
iThreadCount:Integer;
begin
FillChar(StartupInfo, SizeOf(TStartupInfo), 0);
with StartupInfo do
begin
cb := SizeOf(TStartupInfo);
dwFlags := STARTF_USESHOWWINDOW;
wShowWindow := SW_NORMAL;
end;
if not CreateProcess(nil, PChar(sExe), nil, nil, False,
DEBUG_ONLY_THIS_PROCESS, nil,
nil, StartupInfo, pi) then
RaiseLastError;
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
DebugProcess:=pi.hProcess;
HideDebug(pi);
iThreadCount:=0;
while WaitForDebugEvent(DebugInfo,INFINITE) do
begin
case DebugInfo.dwDebugEventCode of
CREATE_PROCESS_DEBUG_EVENT:
lstMsg.ItemIndex:=lstMsg.Items.Add('程序开始运行...');
CREATE_THREAD_DEBUG_EVENT:
begin
iThreadCount:=iThreadCount+1;
lblDebugMsg.Caption:='线程计数：'+IntToStr(iThreadCount);
end;
EXIT_PROCESS_DEBUG_EVENT:
begin
lstMsg.ItemIndex:=lstMsg.Items.Add('程序退出...');
bCreate:=False;
Break;
end;
EXCEPTION_ACCESS_VIOLATION:
begin
lstMsg.ItemIndex:=lstMsg.Items.Add('读写地址出错:'+
Format('%d, %x',[DebugInfo.Exception.ExceptionRecord.ExceptionInformation[0],
DebugInfo.Exception.ExceptionRecord.ExceptionAddress]));
ContinueDebugEvent(DebugInfo.dwProcessId,DebugInfo.dwThreadId,DBG_EXCEPTION_NOT_HANDLED);
Break;
end;
EXCEPTION_DEBUG_EVENT:
if not OnDebug_Except(DebugInfo) then
begin
ContinueDebugEvent(DebugInfo.dwProcessId,DebugInfo.dwThreadId,DBG_EXCEPTION_NOT_HANDLED);
Break;
end;
LOAD_DLL_DEBUG_EVENT:
begin
if (not bINT13) and (Trim(lbledtSetPoint.Text)<>EmptyStr) then
// begin
// if IsUnpacked(pi) then
SetBreakPoint(pi,StrToIntDef('$'+Trim(lbledtSetPoint.Text),0));
// end;
end;
end;
ContinueDebugEvent(DebugInfo.dwProcessId,DebugInfo.dwThreadId,DBG_CONTINUE);
end;
lstMsg.ItemIndex:=lstMsg.Items.Add('程序已关闭...');
end;
设置断点的函数：
function TForm1.SetBreakPoint(pi: TProcessInformation; BreakPoint: Cardinal):
Boolean;
var
dwRead, OldProtect: Cardinal;
bRet:Boolean;
NumberBytes : Cardinal;
const
INT3:Byte=$cc;
begin
if BreakPoint=0 then Exit;
SuspendThread(pi.hThread);
VirtualProtectEx(pi.hProcess,Pointer(BreakPoint),1,PAGE_READWRITE, OldProtect);
ReadProcessMemory(pi.hProcess,Pointer(BreakPoint),Pointer(@SourceValue),sizeof(Byte),NumberBytes);
Result:=WriteProcessMemory(pi.hProcess,Pointer(BreakPoint),@INT3,sizeof(INT3),NumberBytes);
VirtualProtectEx(pi.hProcess,Pointer(BreakPoint),1,OldProtect,OldProtect);
iBreakPoint:=BreakPoint;
bINT13:=True;
ResumeThread(pi.hThread);
end;
在中断之后，查看寄存器的函数
procedure TForm1.ShowPoint;
var
Context:TContext;
NumberBytes, OldProtect:Cardinal;
sValue:array[1..256] of char;
begin
lstMsg.ItemIndex:=lstMsg.Items.Add('===========================================');
SuspendThread(pi.hThread);
FillChar(Context,SizeOf(TContext),0);
Context.ContextFlags := CONTEXT_FULL or CONTEXT_DEBUG_REGISTERS;
GetThreadContext(pi.hThread,Context);
lbledtEAX.Text:=Format('%x',[Context.Eax]);
lbledtEsi.Text:=Format('%x',[Context.Esi]);
lbledtEBP.Text:=Format('%x',[Context.Ebp]);
lbledtEIP.Text:=Format('%x',[Context.Eip]);
lbledtESP.Text:=Format('%x',[Context.Esp]);
if Context.Eip=iBreakPoint+1 then
begin
if not CleanBreakPoint(pi,iBreakPoint,SourceValue) then
raise Exception.Create('清除断点失败!');
lstMsg.ItemIndex:=lstMsg.Items.Add('程序已经在断点停止');
VirtualProtectEx(pi.hProcess,Pointer(iBreakPoint),1,PAGE_READWRITE,OldProtect);
ReadProcessMemory(pi.hProcess,Pointer(Context.Edx),Pointer(@sValue[1]),sizeof(sValue),NumberBytes);
VirtualProtectEx(pi.hProcess,Pointer(iBreakPoint),1,OldProtect,OldProtect);
lstMsg.ItemIndex:=lstMsg.Items.Add(Format('%P的内容：%s',[Pointer(iBreakPoint),Trim(sValue)]))
end;
lstMsg.ItemIndex:=lstMsg.Items.Add('===========================================');
// ResumeThread(pi.hThread);
end;
清除断点
function TForm1.CleanBreakPoint(pi: TProcessInformation; BreakPoint: Cardinal;
OldValue: Byte): Boolean;
var
NumberBytes:Cardinal;
context:TContext;
begin
if bINT13 then
begin
Result:=WriteProcessMemory(pi.hProcess,Pointer(BreakPoint),@OldValue,
sizeof(Byte),NumberBytes);
if not Result then
raise Exception.Create('清除断点失败!');
