Figure 1 Events Received by the Debugger
Event Value
| Description
| CREATE_PROCESS_DEBUG_EVENT
| This is the first event received by the debugger, even before LOAD_DLL_
DEBUG_EVENT for statically linked DLLs.
| EXIT_PROCESS_DEBUG_EVENT
| This is the last event received by the debugger. It means the debuggee has reached the end of its life.
| EXCEPTION_DEBUG_EVENT
| An exception occurs. Its description is in u.Exception. It is received before any catch when the dw-
FirstChance flag is set. If there is no catch, a second event is received before the debuggee is terminated.
| CREATE_THREAD_DEBUG_EVENT
| A new thread is created. Its description is in u.CreateThread.
| EXIT_THREAD_DEBUG_EVENT
| The description of an exiting thread is set in the u.ExitThread member.
| LOAD_DLL_DEBUG_EVENT
| When a DLL is mapped in the debuggee address space, either statically linked or dynamically loaded, this event is received by the debugger.
| UNLOAD_DLL_DEBUG_EVENT
| Unlike the previous event, this occurs only when a DLL is dynamically unloaded. This means it cannot be used to detect when each statically loaded DLL is unloaded at the end of the process life.
| OUTPUT_DEBUG_STRING_EVENT
| Each time the debuggee calls OutputDebugString, the debugger receives this event with the string in u.DebugString.lpDebug.StringData, but in the debuggee address space.
| RIP_EVENT
| According to the documentation, this event is received when a RIP-de-bugging event (system debugging error) occurs,
but I have never seen this
in practice.
| Figure 2 DEBUG_EVENT
typedef struct _DEBUG_EVENT {
DWORD dwDebugEventCode;
DWORD dwProcessId;
DWORD dwThreadId;
union
{
EXCEPTION_DEBUG_INFO Exception;
CREATE_THREAD_DEBUG_INFO CreateThread;
CREATE_PROCESS_DEBUG_INFO CreateProcessInfo;
EXIT_THREAD_DEBUG_INFO ExitThread;
EXIT_PROCESS_DEBUG_INFO ExitProcess;
LOAD_DLL_DEBUG_INFO LoadDll;
UNLOAD_DLL_DEBUG_INFO UnloadDll;
OUTPUT_DEBUG_STRING_INFO DebugString;
RIP_INFO RipInfo;
} u;
} DEBUG_EVENT, *LPDEBUG_EVENT;
Figure 5 DLL Details
Type
| Member
| Description
| CString
| m_szName
| Module name
| DWORD
| m_LoadAddress
| hModule
| DWORD
| m_PreferedLoadAddress
| Supposed loading address (at link time)
| CString
| m_szReason
| Gets real info
| BOOL
| m_bDynamic
| TRUE if loaded through LoadLibrary
| BOOL
| m_bAfterStartup
| TRUE if loaded after the process starts
| DWORD
| m_nLoaded
| Number of times it has been loaded
| DWORD
| m_nRemoved
| Number of times it has been unloaded
| CString
| m_szFullPath
| Full path name of the DLL
| DWORD
| m_Position
| Loading position, starting from 1
| Figure 6 Debugger Thread Messages
ID
| wParam
| lParam
| Description
| UM_INITPROCESS
| 0
| 0
| The statically linked DLLs have all been loaded. The icon changes from static to dynamic after this event.
| UM_FREELIBRARY
| 0
| CModuleInfo*
| The DLL has been unloaded. The corresponding line is updated in CModuleListCtrl.
| UM_LOADLIBRARY
| 0
| CModuleInfo*
| The DLL has been loaded. The corresponding line is added or updated in CModuleListCtrl.
| Figure 7 XXX_DEBUG_EVENT Handles
Event
| Handles to Close
| LOAD_DLL_DEBUG_EVENT
| u.LoadDll.hFile
| CREATE_PROCESS_DEBUG_EVENT
| u.CreateProcessInfo.hFile
u.CreateProcessInfo.hProcess
u.CreateProcessInfo.hThread
| Figure 9 Icons for Loading Status
Icon
| Description
| .gif) | Statically linked, and loaded at its preferred address
| .gif) | Statically linked, but not loaded at its preferred address
| .gif) | Loaded after the process is initialized at its preferred address
| .gif) | Loaded after the process is initialized, but not at its preferred address
| .gif) | Dynamically loaded at its preferred address
| .gif) | Dynamically loaded, but not at its preferred address
| Figure 12 WindowDump Information
Detail
| How to Get It
| ClassName
| GetClassName
| Title
| GetWindowText
| ID
| GetWindowLong(GWL_ID)
| Process
| GetWindowThreadProcessId and GetFullModuleName
| Handle
| During enumeration
| Styles
| GetWindowLong(GWL_STYLE)
| Dimension
| GetWindowRect
| State
| IsWindowVisible and IsWindowEnabled
| Figure 13 Remote Execution
.gif) Figure 14 Useful Console Mode Tools in Resource Kit
Program
| Description
| dh
| Lists memory, heap, stack, and kernel objects consumption and thread information
| dhcmp
| Used with DH to help find leaks
| dmdiag
| Provides information about your hard drives, mount points, partitions, and devices
| drivers
| Lists which drivers are loaded and what they consume
| memsnag
| Dumps running processes memory; handles consumption into a file
| oh
| Lists the kernel objects used by one or all processes
| pstat
| Lists running processes with their ID, user/kernel time, working set, page faults, commited memory, priority, and threads (with their state)
| pulist
| Lists running processes with their ID and owner
| sclist
| Lists services with their state and description
| showpriv
| Displays the trustees assigned to a privilege (user right)
| uptime
| Gives statistics about boot and shutdown events
| vadump
| Creates a listing containing information about the memory usage of a specified process with per-DLL usage (Virtual Address Dump)
| where
| Looks for file; /e provides the exe type
| whoami
| Lists user, group, and privilege for the current user
| Figure 16 PEB Structure using WinDbg and kdex2x86
0:000> !kdex2x86.strct PEB
Loaded kdex2x86 extension DLL
struct _PEB (sizeof=488)
+000 byte InheritedAddressSpace
+001 byte ReadImageFileExecOptions
+002 byte BeingDebugged
+003 byte SpareBool
+004 void *Mutant
+008 void *ImageBaseAddress
+00c struct _PEB_LDR_DATA *Ldr
+010 struct _RTL_USER_PROCESS_PARAMETERS *ProcessParameters
+014 void *SubSystemData
+018 void *ProcessHeap
+01c void *FastPebLock
+020 void *FastPebLockRoutine
+024 void *FastPebUnlockRoutine
+028 uint32 EnvironmentUpdateCount
+02c void *KernelCallbackTable
+030 uint32 SystemReserved[2]
+038 struct _PEB_FREE_BLOCK *FreeList
+03c uint32 TlsExpansionCounter
+040 void *TlsBitmap
+044 uint32 TlsBitmapBits[2]
+04c void *ReadOnlySharedMemoryBase
+050 void *ReadOnlySharedMemoryHeap
+054 void **ReadOnlyStaticServerData
+058 void *AnsiCodePageData
+05c void *OemCodePageData
+060 void *UnicodeCaseTableData
+064 uint32 NumberOfProcessors
+068 uint32 NtGlobalFlag
+070 union _LARGE_INTEGER CriticalSectionTimeout
+070 uint32 LowPart
+074 int32 HighPart
+070 struct __unnamed3 u
+070 uint32 LowPart
+074 int32 HighPart
+070 int64 QuadPart
+078 uint32 HeapSegmentReserve
+07c uint32 HeapSegmentCommit
+080 uint32 HeapDeCommitTotalFreeThreshold
+084 uint32 HeapDeCommitFreeBlockThreshold
+088 uint32 NumberOfHeaps
+08c uint32 MaximumNumberOfHeaps
+090 void **ProcessHeaps
+094 void *GdiSharedHandleTable
+098 void *ProcessStarterHelper
+09c uint32 GdiDCAttributeList
+0a0 void *LoaderLock
+0a4 uint32 OSMajorVersion
+0a8 uint32 OSMinorVersion
+0ac uint16 OSBuildNumber
+0ae uint16 OSCSDVersion
+0b0 uint32 OSPlatformId
+0b4 uint32 ImageSubsystem
+0b8 uint32 ImageSubsystemMajorVersion
+0bc uint32 ImageSubsystemMinorVersion
+0c0 uint32 ImageProcessAffinityMask
+0c4 uint32 GdiHandleBuffer[34]
+14c function *PostProcessInitRoutine
+150 void *TlsExpansionBitmap
+154 uint32 TlsExpansionBitmapBits[32]
+1d4 uint32 SessionId
+1d8 void *AppCompatInfo
+1dc struct _UNICODE_STRING CSDVersion
+1dc uint16 Length
+1de uint16 MaximumLength
+1e0 uint16 *Buffer
Figure 17 Inner Structure of _RTL_USER_PROCESS
0:000> !kdex2x86.strct _RTL_USER_PROCESS_PARAMETERS
struct _RTL_USER_PROCESS_PARAMETERS (sizeof=656)
+000 uint32 MaximumLength
+004 uint32 Length
+008 uint32 Flags
+00c uint32 DebugFlags
+010 void *ConsoleHandle
+014 uint32 ConsoleFlags
+018 void *StandardInput
+01c void *StandardOutput
+020 void *StandardError
+024 struct _CURDIR CurrentDirectory
+024 struct _UNICODE_STRING DosPath
+024 uint16 Length
+026 uint16 MaximumLength
+028 uint16 *Buffer
+02c void *Handle
+030 struct _UNICODE_STRING DllPath
+030 uint16 Length
+032 uint16 MaximumLength
+034 uint16 *Buffer
+038 struct _UNICODE_STRING ImagePathName
+038 uint16 Length
+03a uint16 MaximumLength
+03c uint16 *Buffer
+040 struct _UNICODE_STRING CommandLine
+040 uint16 Length
+042 uint16 MaximumLength
+044 uint16 *Buffer
+048 void *Environment
+04c uint32 StartingX
+050 uint32 StartingY
+054 uint32 CountX
+058 uint32 CountY
+05c uint32 CountCharsX
+060 uint32 CountCharsY
+064 uint32 FillAttribute
+068 uint32 WindowFlags
+06c uint32 ShowWindowFlags
+070 struct _UNICODE_STRING WindowTitle
+070 uint16 Length
+072 uint16 MaximumLength
+074 uint16 *Buffer
+078 struct _UNICODE_STRING DesktopInfo
+078 uint16 Length
+07a uint16 MaximumLength
+07c uint16 *Buffer
+080 struct _UNICODE_STRING ShellInfo
+080 uint16 Length
+082 uint16 MaximumLength
+084 uint16 *Buffer
+088 struct _UNICODE_STRING RuntimeData
+088 uint16 Length
+08a uint16 MaximumLength
+08c uint16 *Buffer
+090 struct _RTL_DRIVE_LETTER_CURDIR CurrentDirectores[32]
uint16 Flags
uint16 Length
uint32 TimeStamp
struct _STRING DosPath
uint16 Length
uint16 MaximumLength
char *Buffer
Figure 18 Using !peb to Decipher Fields
0:000> !peb
PEB at 7FFDF000
InheritedAddressSpace: No
ReadImageFileExecOptions: No
BeingDebugged: Yes
ImageBaseAddress: 01000000
Ldr.Initialized: Yes
Ldr.InInitializationOrderModuleList: 271f78 . 272290
Ldr.InLoadOrderModuleList: 271ee0 . 272368
Ldr.InMemoryOrderModuleList: 271ee8 . 272370
01000000 C:\Program Files\Resource Pro Kit\oh.exe
77F80000 C:\WINNT\System32\ntdll.dll
78000000 C:\WINNT\system32\MSVCRT.dll
77E80000 C:\WINNT\system32\KERNEL32.dll
77DB0000 C:\WINNT\system32\ADVAPI32.dll
77D40000 C:\WINNT\system32\RPCRT4.DLL
SubSystemData: 0
ProcessHeap: 270000
ProcessParameters: 20000
WindowTitle: 'C:\Program Files\Resource Pro Kit\oh.exe'
ImageFile: 'C:\Program Files\Resource Pro Kit\oh.exe'
CommandLine: '"C:\Program Files\Resource Pro Kit\oh.exe" '
DllPath: 'C:\Program Files\Resource Pro
Kit;.;C:\WINNT\System32;C:\WINNT\system;C:\WINNT;C:\WINNT\system32;C:\WINNT;C:\
WINNT\System32\Wbem;C:\Program Files\Resource Pro
Kit\;c:\ntddk\bin;C:\Program Files\Microsoft Visual
Studio\VC98\Bin;C:\Program Files\Microsoft Platform SDK\Bin\;C:\Program
Files\Microsoft Platform SDK\Bin\WinNT'
Environment: 0x10000
|