2 months ago
- The author writes a debugger in Rust to learn the language and help others understand debugger internals.
- A debugger uses an event loop: attaches to a process, waits for debug events, and continues execution.
- On Windows, attach via DebugActiveProcess or CreateProcessW with DEBUG_ONLY_THIS_PROCESS flag.
- The event loop calls WaitForDebugEventEx to receive events and ContinueDebugEvent to resume the target.
- Debug events include CreateProcess, LoadDll, CreateThread, Exception, etc., each carrying specific data.
- The initial exception is the breakpoint from ntdll!LdrpDoDebuggerBreak triggered at process startup.
- Future posts will cover handling exceptions, breakpoints, stepping, and other advanced features.