Injecting a DLL as a Debugger

[Previous] [Next]

A debugger can perform special actions on a debuggee process. When a debuggee loads, the system automatically notifies the debugger when the debuggee's address space is ready but before the debuggee's primary thread executes any code. At this point, the debugger can force some code into the debuggee's address space (using WriteProcessMemory, for example) and then cause the debuggee's primary thread to execute that code.

This technique requires that you manipulate the debuggee thread's CONTEXT structure, which means that you must write CPU-specific code. You have to modify your source code to work correctly on different CPU platforms. In addition, you probably have to hand-code the machine language instructions that you want the debuggee to execute. Also, the relationship between a debugger and its debuggee is solid. If the debugger terminates, Windows automatically kills the debuggee. You cannot prevent this.