Question

I have a debugging program which I’ve written to attach to a process and create a crash dump file. That part works fine.

The problem I have is that when the debugger program terminates, so does the program that it was debugging.

I did some Googling and found the DebugActiveProcessStop() API call. This didn’t show up in my older MSDN documentation as it was only introduced in Windows XP so I’ve tried loading it dynamicall from Kernel32.dll at runtime.

Now my problem is that my debugger program crashes as soon as the _DebugActiveProcessStop() call is made. Can somebody please tell me what I’m doing wrong?

typedef BOOL (*DEBUGACTIVEPROCESSSTOP)(DWORD);

DEBUGACTIVEPROCESSSTOP _DebugActiveProcessStop;

HMODULE hK32 = LoadLibrary( "kernel32.dll" );

if( hK32 )
  _DebugActiveProcessStop = (DEBUGACTIVEPROCESSSTOP) GetProcAddress( hK32,"DebugActiveProcessStop" );
else
{
  printf( "Can't load Kernel32.dll\n" );
  return;
}

if( ! _DebugActiveProcessStop )
{
  printf( "Can't find DebugActiveProcessStop\n" );
  return;
}

...

void DebugLoop( void )
{
  DEBUG_EVENT de;

  while( 1 )
  {
    WaitForDebugEvent( &de, INFINITE ); 

    switch( de.dwDebugEventCode )
    {
      case CREATE_PROCESS_DEBUG_EVENT:
        hProcess = de.u.CreateProcessInfo.hProcess;
        break;

      case EXCEPTION_DEBUG_EVENT: 

        // PDS: I want a crash dump immediately!
        dwProcessId = de.dwProcessId;
        dwThreadId  = de.dwThreadId;

        WriteCrashDump( &de.u.Exception );
        return;

      case CREATE_THREAD_DEBUG_EVENT:
      case OUTPUT_DEBUG_STRING_EVENT:
      case EXIT_THREAD_DEBUG_EVENT:
      case EXIT_PROCESS_DEBUG_EVENT :
      case LOAD_DLL_DEBUG_EVENT:
      case UNLOAD_DLL_DEBUG_EVENT:
      case RIP_EVENT:
      default:
        break;
    }

    ContinueDebugEvent( de.dwProcessId, de.dwThreadId, DBG_CONTINUE );
  }
}

...
void main( void )
{
...
  BOOL bo = DebugActiveProcess( dwProcessId );

  if( bo == 0 )
    printf( "DebugActiveProcess failed, GetLastError: %u \n",GetLastError() );

  hProcess = OpenProcess( PROCESS_ALL_ACCESS, TRUE, dwProcessId );

  if( hProcess == NULL )
    printf( "OpenProcess failed, GetLastError: %u \n",GetLastError() );

  DebugLoop();

  _DebugActiveProcessStop( dwProcessId );

  CloseHandle( hProcess );
}

Answer 1

The reason its crashing is because I missed out the WINAPI keyword on my function pointer definitions.

This works:

typedef BOOL (WINAPI *DEBUGSETPROCESSKILLONEXIT)(BOOL);