调用 DebugBreakProcess() 后 - 事件的 dwThreadId 代表什么？
假设某个进程调试另一个进程（通过调用 DebugActiveProcess()）。
然后其他一些进程/线程在该调试进程中生成断点异常（通过调用 DebugBreakProcess()）。 然后，调试器接收此 EXCEPTION_DEBUG_EVENT->EXCEPTION_BREAKPOINT 事件，并且在 DEBUG_EVENT 结构中，字段 dwThreadId 将保存一些 ID。
我的根本问题是 - 这个 dwThreadId 代表什么？ （MSDN 说它是“发生调试事件的线程的标识符”）。
我的担忧如下：
“调试事件发生的位置”是什么意思？难道不是进程的所有线程都以某种方式发出信号，因此进程被完全阻塞吗？
此外，根据我读到的内容，该机制的工作原理如下：
DebugBreakProcess() API 的工作原理是在目标进程中创建一个线程来调用断点指令，这会导致正常的 SEH 机制接管。
这意味着这个 dwThreadId 实际上可能是这个新创建的线程的 ID，而不是任何原始进程线程的 ID。我是否正确？
如果调试的进程是多线程的（实际上几乎可以肯定是）怎么办？ 这是调用 DebugBreakProcess() API 时“处理器中”的线程 ID 吗？
更新：所有此块均已得到答复。请参阅第一个答案。
- 那么双核系统并且同一进程的两个线程当前并行运行的情况又如何呢？哪一个会获胜并将在该 ID 中注明？或者可能会导致两个不同的 EXCEPTION_BREAKPOINT 异常？
非常感谢您提供的任何帮助。
Let's say some process debugs another process (by calling DebugActiveProcess()).
Then some other process/thread generates break-points exceptions at that debugged process (by calling DebugBreakProcess()).
The debugger then receives this EXCEPTION_DEBUG_EVENT->EXCEPTION_BREAKPOINT event and in the DEBUG_EVENT structure the field dwThreadId will hold some ID.
My root question is - What does this dwThreadId represents?
(MSDN says it is "The identifier of the thread in which the debugging event occurred").
My concerns are of the following:
What does it mean "in which the debugging event occurred"? Isn't it that all the threads of the process are somehow signaled this way and therefor the process is entirely blocked?
Moreover, from stuff I read, this mechanism works something like this:
The DebugBreakProcess() API works by creating a thread in the target process that invokes a breakpoint instruction, which causes the normal SEH mechanism to take over.
Which means there's a possibility that this dwThreadId is actually the ID of this newly created thread and not an ID of any of the original process' threads. Am i correct?
What if the debugged process is multi-threaded (actually it is almost certain it is)?
Is this the ID of the thread that was "in the processor" at the moment of calling the DebugBreakProcess() API?
UPDATE: all this block was answered. See the first answer.
- What about the case of a dual-core system and two threads of the same process are currently running in parallel? Which one will win and will be stated in this ID? Or maybe it will cause two different EXCEPTION_BREAKPOINT exceptions?
Thank you very much for any help that is provided.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您几乎回答了自己的问题，这将是调用 DebugBreak() 的线程，而该线程又是由 DebugBreakProcess() 创建的新线程。
You pretty much answered your own question, it would be the thread that called
DebugBreak()which in turn is the new thread created byDebugBreakProcess().