//--------------------------------------------------------------------------
bool win32_debmod_t::create_process(const char *path,
const char *args,
const char * /*startdir*/,
bool is_gui,
PROCESS_INFORMATION *ProcessInformation)
{
wchar_t wpath[MAXSTR];
wchar_t wargs_buffer[MAXSTR];
wchar_t *wargs = NULL;
if ( args != NULL )
{
cwstr(wargs_buffer, args, qnumber(wargs_buffer));
wargs = wargs_buffer;
}
cwstr(wpath, path, qnumber(wpath));
return CreateProcess(
wpath, // pointer to name of executable module
wargs, // pointer to command line string
NULL, // pointer to process security attributes
NULL, // pointer to thread security attributes
false, // handle inheritance flag
(is_gui ? 0 : CREATE_NEW_CONSOLE) // creation flags
|DEBUG_ONLY_THIS_PROCESS
|DEBUG_PROCESS,
NULL, // pointer to new environment block
NULL, // pointer to current directory name
NULL, // pointer to STARTUPINFO
ProcessInformation); // pointer to PROCESS_INFORMATION
}
//--------------------------------------------------------------------------
// The only reason why we load and use kernel stub is to ignore
// hardware breakpoints in foreign applications. If the user puts
// a breakpoint in a shared DLL, we don't want other applications
// to be aware of it - exceptions in these applications should be ignored.
static bool load_kdstub(void)
{
bool ok = false;
if ( g_global_server == NULL )
return false;
__try
{
static const char stubname[] = "\\Windows\\ida_kdstub.dll";
// 01234567 8
ok = g_global_server->rpc_sync_stub(stubname, &stubname[9]);
if ( !ok )
{
g_global_server->dwarning("Failed to synchronize kernel debugger stub");
}
else
{
wchar_t wname[80];
cwstr(wname, stubname, qnumber(wname));
ok = AttachDebugger(wname);
if ( !ok )
{
//Likely error codes:
//ERROR_FILE_NOT_FOUND (2) - if LoadKernelLibrary failed
// This may happen if the DLL is not found or cannot be
// loaded. The DLL will fail to load if it is for a
// wrong platform or if it is linked to any other DLL.
//ERROR_INVALID_PARAMETER (87) -if ConnectDebugger failed
// This may happen if IOCTL_DBG_INIT was not called
// by the DLL initialization routing or if some module
// in the system is marked as non-debuggable
int code = GetLastError();
g_global_server->dwarning("Failed to attach kernel debugger stub: %s", winerr(code));
}
else
{
g_global_server->dmsg("Successfully attached kernel debugger stub\n");
// win420_module_t wm;
// if ( find_module_by_name("ida_kdstub", (wince_module_t*)&wm) )
// msg("%x: kernel stub\n", int(wm.BasePtr)+0x1000);
}
}
}
__except( EXCEPTION_EXECUTE_HANDLER )
{
}
return ok;
}
