Managed windows debugger

The word managed refers to the memory management in C# .NET. The name windows debugger comes from the API use resulting in a managed windows debugger. A managed windows debugger works with all versions of windows as it is a .NET framework based windows debugger.

Managed windows debugger requires some calls into un-managed code (native code API's). A call into un-managed code means importing a function from the native windows library. A DLL that is.

To get started with this article see the code examples below. The examples includes main windows debugger loop. The free debugger for windows referred to in this article is not the same as WinDbg. Managed windows debugger can debug native x64 code.

Cheat Tool Set X https://overlayhack.com/cheat-tool-set is one of the free debugging tools for windows that has a managed windows debugger, written in C# .NET. The debugger in the free version of the software can be used to debug 64-bit x86_64 user-mode code. This x64 debugger has been designed for dynamic debugging. The debugger view updates real time according to the process.

It has an advanced debugging features such as string references, the code execution references and so forth. It categories the sections to (CODE, DATA, OTHER) and shows also memory protection constants.

The debugger also comes with disassembly signature maker plugin that allows you to generate unique signatures which are a must have features in any decent free windows debugger, whether managed or not.

The debugger has been mainly tested on Windows 10 but it also works with Windows 7 or newer.

1680:1008


HOW TO CODE A MANAGED WINDOWS DEBUGGER?

The process starts by importing the required native API calls into un-managed code.

C#

1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.


[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool DebugActiveProcess(int dwProcessId);

[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool DebugActiveProcessStop(int dwProcessId);

[DllImport("kernel32.dll")]
public static extern bool DebugSetProcessKillOnExit(bool flag);

[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr OpenThread(ThreadAccess dwDesiredAccess, bool bInheritHandle, uint dwThreadId);

[DllImport("kernel32.dll", SetLastError = true)]
public static extern uint SuspendThread(IntPtr hThread);

[DllImport("kernel32.dll", SetLastError = true)]
public static extern int ResumeThread(IntPtr hThread);

[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
public static extern bool CheckRemoteDebuggerPresent(IntPtr hProcess, ref bool isDebuggerPresent);




Post a comment

Registered users do not have to enter captcha. A line in the code tag is currently limited to maxium of 160 characters.
Posting guidelines: You may not post any personal information. When you report an issue: Always mention which version and operating system and briefly describe the issue. Any support request post that does not include this information will be removed as spam without a reply.
Title
Tags You may use the following tags: [QUOTE] [/QUOTE] [B] [/B] [URL] [/URL] [CODE] [/CODE]
Captcha Please enter the text you see (case insensitive). The listed characters must be entered clockwise starting from twelve o'clock.
Comments are moderated Y