debugging - How is ProcDump implemented? Is it essentially a debugger? -
i interested in internals of procdump (a sysinternals utility): debugger? how manage dump process on exceptions, first chance exceptions , managed (clr) exceptions?
i can see has imports such debugactiveprocess kernel32.dll. strings contain names of clr libraries assume dynamically loads them make use of clr debugging api (although don't see mscordbi.dll in strings - should i?).
i try give elementary answer own question, after taking @ procdump ida pro.
at least unmanaged side, procdump seems make use of win32 debugging api: uses debugactiveprocess , debug loop of waitfordebugevent & continuedebugevent. then, depending on startup parameters, can e.g. inspect exception , dump contents readprocessmemory io device.
Comments
Post a Comment