Chapter 4 -- How Do Debuggers Work?

[Previous] [Next]

Chapter 4

Learning how your tools operate is a crucial part of this business. If you understand the capabilities and limitations of your tools, you can better maximize their return and thus spend less time debugging. Most of the time, debuggers help you out tremendously, but sometimes they can cause subtle problems that will baffle you. In this chapter, I'll explain what a debugger is and demonstrate how various debuggers operate in Microsoft Win32 operating systems.

In describing debuggers in general, I'll go over what special features are turned on when your process is running under a debugger. I'll also explain some ways in which you can leverage certain Win32 features to make your debugging easier. I'll present two debuggers that I wrote and whose source code is on the companion CD. The first, MinDBG, does just enough to call itself a debugger. The second, WDBG, is a real Microsoft Windows debugger sample that does nearly everything a real debugger is supposed to, including manipulating symbol tables, handling breakpoints, generating disassembly, and coordinating with a graphical user interface (GUI). In discussing WDBG, I'll also cover topics such as how breakpoints work and what all the different symbol files are and what they mean.

Before jumping into the chapter, I want to make sure to define two standard terms that I'll be using throughout this book: debugger and debuggee. Simply put, a debugger is a process that can control another process in a debugging relationship, and a debuggee is a process started under a debugger. Some operating systems refer to the debugger as the parent process and the debuggee as the child process.