ud.h

Go to the documentation of this file.

#pragma once

//                  Structures                  //

typedef struct _ACTIVE_DEBUGGING_PROCESS
{
    BOOLEAN    IsActive;
    UINT64     ProcessDebuggingToken;
    UINT32     ProcessId;
    UINT32     ThreadId;
    BOOLEAN    IsPaused;
    GUEST_REGS Registers; // thread registers
    UINT64     Context;   // $context
    UINT64     Rip;
    BOOLEAN    Is32Bit;
    BYTE       InstructionBytesOnRip[MAXIMUM_INSTR_SIZE];
 
} ACTIVE_DEBUGGING_PROCESS, *PACTIVE_DEBUGGING_PROCESS;

//                  Functions                  //
 
VOID
UdInitializeUserDebugger();
 
VOID
UdUninitializeUserDebugger();
 
VOID
UdRemoveActiveDebuggingProcess();
 
VOID
UdHandleUserDebuggerPausing(PDEBUGGEE_UD_PAUSED_PACKET PausePacket);
 
VOID
UdSetActiveDebuggingProcess(UINT64  DebuggingId,
                            UINT64  Rip,
                            UINT32  ProcessId,
                            UINT32  ThreadId,
                            BOOLEAN Is32Bit,
                            BOOLEAN IsPaused,
                            BYTE    InstructionBytesOnRip[]);
 
BOOLEAN
UdSendStepPacketToDebuggee(UINT64                           ThreadDetailToken,
                           UINT32                           TargetThreadId,
                           DEBUGGER_REMOTE_STEPPING_REQUEST StepType);
 
BOOLEAN
UdSetActiveDebuggingThreadByPidOrTid(UINT32 TargetPidOrTid, BOOLEAN IsTid);
 
BOOLEAN
UdSetActiveDebuggingThreadByPidOrTid(UINT32 TargetPidOrTid, BOOLEAN IsTid);
 
BOOLEAN
UdShowListActiveDebuggingProcessesAndThreads();
 
BOOLEAN
UdListProcessThreads(DWORD OwnerPID);
 
BOOLEAN
UdCheckThreadByProcessId(DWORD Pid, DWORD Tid);
 
BOOLEAN
UdAttachToProcess(UINT32        TargetPid,
                  const WCHAR * TargetFileAddress,
                  const WCHAR * CommandLine,
                  BOOLEAN       RunCallbackAtTheFirstInstruction);
 
BOOLEAN
UdKillProcess(UINT32 TargetPid);
 
BOOLEAN
UdDetachProcess(UINT32 TargetPid, UINT64 ProcessDetailToken);
 
BOOLEAN
UdContinueProcess(UINT64 ProcessDebuggingToken);
 
BOOLEAN
UdPauseProcess(UINT64 ProcessDebuggingToken);
 
BOOLEAN
UdSendCommand(UINT64                          ProcessDetailToken,
              UINT32                          ThreadId,
              DEBUGGER_UD_COMMAND_ACTION_TYPE ActionType,
              PVOID                           OptionalBuffer,
              UINT32                          OptionalBufferSize,
              BOOLEAN                         ApplyToAllPausedThreads,
              BOOLEAN                         WaitForEventCompletion,
              UINT64                          OptionalParam1,
              UINT64                          OptionalParam2,
              UINT64                          OptionalParam3,
              UINT64                          OptionalParam4);
 
BOOLEAN
UdSendScriptBufferToProcess(UINT64  ProcessDetailToken,
                            UINT32  TargetThreadId,
                            UINT64  BufferAddress,
                            UINT32  BufferLength,
                            UINT32  Pointer,
                            BOOLEAN IsFormat);
 
BOOLEAN
UdSendReadRegisterToUserDebugger(UINT64                              ProcessDetailToken,
                                 UINT32                              TargetThreadId,
                                 PDEBUGGEE_REGISTER_READ_DESCRIPTION RegDes,
                                 UINT32                              RegBuffSize);