debugging - How is ProcDump implemented? Is it essentially a debugger? -


i interested in internals of procdump (a sysinternals utility): debugger? how manage dump process on exceptions, first chance exceptions , managed (clr) exceptions?

i can see has imports such debugactiveprocess kernel32.dll. strings contain names of clr libraries assume dynamically loads them make use of clr debugging api (although don't see mscordbi.dll in strings - should i?).

i try give elementary answer own question, after taking @ procdump ida pro.

at least unmanaged side, procdump seems make use of win32 debugging api: uses debugactiveprocess , debug loop of waitfordebugevent & continuedebugevent. then, depending on startup parameters, can e.g. inspect exception , dump contents readprocessmemory io device.


Comments

Popular posts from this blog

Load Balancing in Bluemix using custom domain and DNS SRV records -

oracle - pls-00402 alias required in select list of cursor to avoid duplicate column names -

python - Consider setting $PYTHONHOME to <prefix>[:<exec_prefix>] error -