Форум программистов [Powered by Invision Power Board]

Код

  int Stop = 0;
  STARTUPINFO si = {0};
  PROCESS_INFORMATION pi;
  DEBUG_EVENT evDebug;
  DWORD dwContinueStatus = DBG_CONTINUE;

  if (CreateProcess("C:\\windows\\system32\\notepad.exe", "", 0, 0, FALSE, DEBUG_PROCESS, 0, 0, &si, &pi))
  {
    while (!Stop)
    {
      WaitForDebugEvent(&evDebug, INFINITE);
      switch (DebugEv.dwDebugEventCode)
      {
        case EXCEPTION_DEBUG_EVENT:
            switch(DebugEv.u.Exception.ExceptionRecord.ExceptionCode)
            {
                case EXCEPTION_ACCESS_VIOLATION:
                // First chance: Pass this on to the system.
                // Last chance: Display an appropriate error.
                    break;

                case EXCEPTION_BREAKPOINT:
                // First chance: Display the current
                // instruction and register values.
                    break;

                case EXCEPTION_DATATYPE_MISALIGNMENT:
                // First chance: Pass this on to the system.
                // Last chance: Display an appropriate error.
                    break;

                case EXCEPTION_SINGLE_STEP:
                // First chance: Update the display of the
                // current instruction and register values.
                    break;

                case DBG_CONTROL_C:
                // First chance: Pass this on to the system.
                // Last chance: Display an appropriate error.
                    break;

                default:
                // Handle other exceptions.
                    break;
            }
        case CREATE_THREAD_DEBUG_EVENT:
        // As needed, examine or change the thread's registers
        // with the GetThreadContext and SetThreadContext functions;
        // and suspend and resume thread execution with the
        // SuspendThread and ResumeThread functions.
            break;
        case CREATE_PROCESS_DEBUG_EVENT:
        // As needed, examine or change the registers of the
        // process's initial thread with the GetThreadContext and
        // SetThreadContext functions; read from and write to the
        // process's virtual memory with the ReadProcessMemory and
        // WriteProcessMemory functions; and suspend and resume
        // thread execution with the SuspendThread and ResumeThread
        // functions. Be sure to close the handle to the process image
        // file with CloseHandle.
            break;

        case EXIT_THREAD_DEBUG_EVENT:
        // Display the thread's exit code.
            break;

        case EXIT_PROCESS_DEBUG_EVENT:
        // Display the process's exit code.
            Stop = 1;
            break;

        case LOAD_DLL_DEBUG_EVENT:
        // Read the debugging information included in the newly
        // loaded DLL. Be sure to close the handle to the loaded DLL
        // with CloseHandle.
            break;

        case UNLOAD_DLL_DEBUG_EVENT:
        // Display a message that the DLL has been unloaded.
            break;

        case OUTPUT_DEBUG_STRING_EVENT:
        // Display the output debugging string.
            break;

      }
      // Resume executing the thread that reported the debugging event.
      ContinueDebugEvent(evDebug.dwProcessId, evDebug.dwThreadId, dwContinueStatus);
    } // !Stop
    CloseHandle( pi.hThread );
    CloseHandle( pi.hProcess );
  }