debugging - How is ProcDump implemented? Is it essentially a debugger? -


i interested in internals of procdump (a sysinternals utility): debugger? how manage dump process on exceptions, first chance exceptions , managed (clr) exceptions?

i can see has imports such debugactiveprocess kernel32.dll. strings contain names of clr libraries assume dynamically loads them make use of clr debugging api (although don't see mscordbi.dll in strings - should i?).

i try give elementary answer own question, after taking @ procdump ida pro.

at least unmanaged side, procdump seems make use of win32 debugging api: uses debugactiveprocess , debug loop of waitfordebugevent & continuedebugevent. then, depending on startup parameters, can e.g. inspect exception , dump contents readprocessmemory io device.


Comments

Popular posts from this blog

javascript - Feed FileReader from server side files -

c++ - What's the differece between of link to a dynamic file and as a input object? -

Android Unit Testing / Mockito: android.location.Location not mocked -