我正在学习使用VS2015＆windows10上的visual c ++进行内存补丁。 所以我用DEBUG_PROCESS |来“CreateProcess” DEBUG_ONLY_THIS_PROCESS。 然后我很快就得到了CREATE_PROCESS_DEBUG_EVENT，在那里我写0xcc到我想要打破的地步。 之后，debugging目标挂在那里，'WaitForDebugEvent'不能得到任何debugging事件。 我转储的目标和INT3确实存在，因为它应该是运行转储文件，并执行它应该做的。 这里是代码：
STARTUPINFO si = { sizeof(si) }; PROCESS_INFORMATION pi; HANDLE PatchProcess; BYTE ReadBuffer[MAX_PATH] = { 0 }; BYTE int3Code[1] = { 0xcc }; BYTE dwOldStyle[4] = { 0x65,0x65,0x65,0x65 }; if (!CreateProcess(FILE_NAME, NULL, NULL, NULL, FALSE, DEBUG_PROCESS | DEBUG_ONLY_THIS_PROCESS | CREATE_NEW_CONSOLE, NULL, NULL, &si, &pi)) { std::cout << "CreateProcess failed" << std::endl; return false; } GetLastError(); PatchProcess = pi.hProcess; DEBUG_EVENT dbEvent; CONTEXT Regs; DWORD dwState, Oldpp; Regs.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS; BOOL WhileDoFlag = true; while (WhileDoFlag) { WaitForDebugEvent(&dbEvent, INFINITE); std::cout << "Waiting" << std::endl; std::cout << "Debug event code:" << dbEvent.dwDebugEventCode << std::endl; dwState = DBG_EXCEPTION_HANDLED; switch (dbEvent.dwDebugEventCode) { case CREATE_PROCESS_DEBUG_EVENT: ReadProcessMemory(pi.hProcess, (LPVOID)(BP), &ReadBuffer, 2, NULL); GetLastError(); std::cout << "Code at" << BP << ":" << ReadBuffer[0] << std::endl; system("pause"); VirtualProtectEx(pi.hProcess, (LPVOID)BP, 4, PAGE_EXECUTE_READWRITE, &Oldpp); GetLastError(); WriteProcessMemory(pi.hProcess, (LPVOID)(BP), &int3Code, 2, NULL); GetLastError(); dwState = DBG_CONTINUE; break; case EXIT_PROCESS_DEBUG_EVENT: WhileDoFlag = false; break; case EXCEPTION_DEBUG_EVENT: switch (dbEvent.u.Exception.ExceptionRecord.ExceptionCode) { case EXCEPTION_BREAKPOINT: { GetThreadContext(pi.hThread, &Regs); if (Regs.Eip == BP + 1) { Regs.Eip--; WriteProcessMemory(pi.hProcess, (LPVOID)BP, &dwOldStyle, 4, 0); GetLastError(); ReadProcessMemory(pi.hProcess, (LPVOID)(Regs.Ebp), &ReadBuffer, 1, 0); GetLastError(); MessageBox(0, (char*)ReadBuffer, "patch test", MB_OK); SetThreadContext(pi.hThread, &Regs); } dwState = DBG_CONTINUE; break; } } break; } ContinueDebugEvent(pi.dwProcessId, pi.dwThreadId, dwState); } 在Windows上（XP后）它是一种安全的保护？
PS：IDA可以使用默认的本地win32debugging器从转储文件中获取正确位置的断点。 PS2：使用ollydbg来debugging转储文件，目标在执行时崩溃
mov dword ptr ss:[esp+0x4],eax
eax是一个ModuleEntryPoint ESP + 0x4也是一个ModuleEntryPoint它是一个坏的断点，我补充说，造成了这个问题？