debugging - How is ProcDump implemented? Is it essentially a debugger? -


i interested in internals of procdump (a sysinternals utility): debugger? how manage dump process on exceptions, first chance exceptions , managed (clr) exceptions?

i can see has imports such debugactiveprocess kernel32.dll. strings contain names of clr libraries assume dynamically loads them make use of clr debugging api (although don't see mscordbi.dll in strings - should i?).

i try give elementary answer own question, after taking @ procdump ida pro.

at least unmanaged side, procdump seems make use of win32 debugging api: uses debugactiveprocess , debug loop of waitfordebugevent & continuedebugevent. then, depending on startup parameters, can e.g. inspect exception , dump contents readprocessmemory io device.


Comments

Popular posts from this blog

javascript - How to get current YouTube IDs via iMacros? -

c# - Maintaining a program folder in program files out of date? -

emulation - Android map show my location didn't work -