WaitForDebugEvent

WaitForDebugEvent是一個程式函式，WIN32API函式WaitForDebugEvent來獲取調試事件

函式原型

WaiteForDebugEvent(LPDEBUG_EVENT _DEBUG_EVENT,DWORD dwMilliseconds)

第一個參數指向event結構，這個結構描述了一個調試事件，第二個參數為等待事件的毫秒數。

返回一個BOOL值

event結構

c++:

typedef struct _DEBUG_EVENT { DWORD dwDebugEventCode; DWORD dwProcessId; DWORD dwThreadId; union { EXCEPTION_DEBUG_INFO Exception; CREATE_THREAD_DEBUG_INFO CreateThread; CREATE_PROCESS_DEBUG_INFO CreateProcessInfo; EXIT_THREAD_DEBUG_INFO ExitThread; EXIT_PROCESS_DEBUG_INFO ExitProcess; LOAD_DLL_DEBUG_INFO LoadDll; UNLOAD_DLL_DEBUG_INFO UnloadDll; OUTPUT_DEBUG_STRING_INFO DebugString; RIP_INFO RipInfo; }u;} DEBUG_EVENT, *LPDEBUG_EVENT;

python:

typedef struct DEBUG_EVENT {

DWORD dwDebugEventCode;

DWORD dwProcessId;

DWORD dwThreadId;

union {

EXCEPTION_DEBUG_INFO Exception;

CREATE_THREAD_DEBUG_INFO CreateThread;

CREATE_PROCESS_DEBUG_INFO CreateProcessInfo;

EXIT_THREAD_DEBUG_INFO ExitThread;

EXIT_PROCESS_DEBUG_INFO ExitProcess;

LOAD_DLL_DEBUG_INFO LoadDll;

UNLOAD_DLL_DEBUG_INFO UnloadDll;

OUTPUT_DEBUG_STRING_INFO DebugString;

RIP_INFO RipInfo;

}u;

};

dwDebugEventCode信息

值 聯合體u的值

1u.Exception

2u.Create Thread

3u.CreateProcessInfo

4u.ExitThread

5u.ExitProcess

6u.LoadDll

7 u.UnloadDll

8 u.DebugString

9 u.RipInfo