Monitor process exceptions via Debug API

Question

Any help to start using sample code find at C++/CLI Win32 debugger library for x86 to monitor process exceptions.

Some code I made is :

using System;
using DebugLibrary;

namespace DebugTeste01
{
    class Program
    {
        static void Main(string[] args)
        {
            DebugUtil.DebugActiveProcess(4932);
            DebugEvent de = new DebugEvent();
            ThreadContext tc = new ThreadContext();
            LDTEntry ldte = new LDTEntry();

            do
            {
                debug_evt = DebugUtil.WaitForDebugEvent(0xffffffff);

                de = (DebugEvent)debug_evt;
                Process proc = Process.GetProcessById(de.processId);

                object meminfo = DebugUtil.GetMemoryInfo(proc.Handle);
                //...
                object modinf = DebugUtil.GetModuleInfo(proc.Handle);
                //...

                switch (debug_evt.GetType().ToString())
                {
                    case "DebugLibrary.DebugEvent_CreateProcess":
                        {
                            DebugEvent_CreateProcess decp = (DebugEvent_CreateProcess)debug_evt;
                            //some action, logging, etc.
                        }
                        break;
                    case "DebugLibrary.DebugEvent_LoadDll":
                        {
                            DebugEvent_LoadDll dect = (DebugEvent_LoadDll)debug_evt;
                            //some action, logging, etc.
                        }
                        break;
                    case "DebugLibrary.DebugEvent_CreateThread":
                        {
                            DebugEvent_CreateThread dect = (DebugEvent_CreateThread)debug_evt;
                            //some action, logging, etc.
                        }
                        break;
                    case "DebugLibrary.DebugEvent_ExitThread":
                        {
                            DebugEvent_ExitThread dect = (DebugEvent_ExitThread)debug_evt;
                            //some action, logging, etc.
                        }
                        break;
                    case "DebugLibrary.DebugEvent_Exception":
                        {
                            DebugEvent_Exception dect = (DebugEvent_Exception)debug_evt;

                            ExceptionRecord exbp = dect.exceptionRecord;

                            switch (exbp.GetType().ToString())
                            {
                                case "Breakpoint":
                                    {
                                        //some action, logging, etc.
                                        exbp = null;
                                    }
                                    break;
                                case "AccessViolation":
                                    {
                                        //some action, logging, etc.
                                        exbp = null;
                                    }
                                    break;
                                //more case
                            }
                        }
                        break;
                    default:
                        {
                            //some action, logging, etc.
                            debug_evt = null;
                        }
                        break;
                }

                try
                {
                    DebugUtil.ContinueDebugEvent(de.processId, de.threadId, false);
                }
                catch
                {
                    break;
                }
            }
            while ( true );
        }
    }
}

[EDIT] 03/14/2012
Good article: Using the Windows Debugging API
[EDIT] 03/14/2012
Improvements in implementation.
Now it has an initial skeleton construction for a final application.

Necrolis · Accepted Answer · 2012-03-13 15:51:40Z

1

Seems to me you are after resources on debugger writing for understanding, in which case, your best place to start is MSDN, this gives the basics of what should be handled how. from there its really up to your application and environment how you handle the exceptions.

As a comment on your actual code, avoid hardcoding to a PID, rather use the process name.

answered Mar 13, 2012 at 15:51

Necrolis

26.3k3 gold badges69 silver badges103 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

lsalamon Over a year ago

The purpose of the code is to show how to use the API, but first have to understand how it works.

Collectives™ on Stack Overflow

Monitor process exceptions via Debug API

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related