windows用户态调试学习（一）

元始天尊

windows用户态调试学习
一 基础知识
msdn上的介绍：https://msdn.microsoft.com/en-us/library/ms679304(v=vs.85).aspx
》调试事件及调试结构

调试事件：
WaitForDebugEvent在接收到内核传递的调试信息后会由阻塞态转为激活态，内核会挂起所有线程，直到ContinueDebugEvent执行
CREATE_PROCESS_DEBUG_EVENT 创建进程事件 CREATE_PROCESS_DEBUG_INFO
CREATE_THREAD_DEBUG_EVENT 创建线程事件 CREATE_THREAD_DEBUG_INFO
EXCEPTION_DEBUG_EVENT 发生异常 EXCEPTION_DEBUG_INFO
EXIT_PROCESS_DEBUG_EVENT 进程退出 EXIT_PROCESS_DEBUG_INFO
EXIT_THREAD_DEBUG_EVENT 线程退出 EXIT_THREAD_DEBUG_INFO
LOAD_DLL_DEBUG_EVENT 加载DLL LOAD_DLL_DEBUG_INFO
OUTPUT_DEBUG_STRING_EVENT 输出调试字符串 OUTPUT_DEBUG_STRING_INFO
UNLOAD_DLL_DEBUG_EVENT 卸载DLL UNLOAD_DLL_DEBUG_INFO
RIP_EVENT 进程不受系统调试器控制的结束 RIP_INFO

调试结构：
CONTEXT ：ring3下不能直接读写寄存器，而间接通过设置context结构完成
DEBUG_EVENT：接受的调试事件结构
LDT_ENTRY：用于获得描述符表

》调试函数
CheckRemoteDebuggerPresent  检查debug port是否存在
ContinueDebugEvent  继续执行由调试事件打断的线程.
DebugActiveProcess  附加调试
DebugActiveProcessStop  停止附加调试
DebugBreak  在当前进程中产生断点
DebugBreakProcess  在指定进程中产生断点（远程线程注入）
DebugSetProcessKillOnExit  调试器退出时结束进程
FatalExit  退出进程并将执行权交给调试器
FlushInstructionCache  刷新指令缓存（在修改内存指令后使用）
GetThreadContext  获取线程上下文
GetThreadSelectorEntry  获取线程的选择子的描述符表
IsDebuggerPresent  用调试标志检查用户态调试器是否存在
OutputDebugString  输出调试信息给调试器
SetThreadContext  设置线程上下文
WaitForDebugEvent  等待调试事件

二 用户态调试模型及相关代码
windows用户态调试器是基于事件模式的，由内核做中介的被调试进程和调试器进程的交互，也就是说被调试者和调试器处于不同进程（见《软件调试》），流程如下：
void main()
{
        (OpenProcess);
        DebugActiveProcess;
        while(Alive)
        {
                WaitForDebugEvent;
                switch(DebugEvent.dwDebugEventCode)
                {
                        ....
       
                }
                ContinueDebugEvent;
        }
}

无疑这里最重要的函数就是DebugActiveProcess和ContinueDebugEvent，是调试器最表层的接口，而调试器源码位于ntos/dbgk文件夹下，
dbgkobj.c dbgkp.h dbgkport.c dbgkproc.c

DebugActiveProcess->NtDebugActiveProcess->DbgkpPostFakeProcessCreateMessages DbgkpSetProcessDebugObject
ContinueDebugEvent->NtDebugContinue->DbgkpWakeTarget->DbgkpFreeDebugEvent

DbgkpPostFakeProcessCreateMessages->DbgkpPostFakeThreadMessages DbgkpPostFakeModuleMessages


DbgkpSendApiMessage 调试消息函数，在某些内核api操作中会将调试事件添加到队列中
DbgkpSuspendProcess 挂起进程
DbgkpResumeProcess 恢复线程

未完待续。。。。。。。。


    默认下windows只能支持一个调试器，绑定到进程peb的debugport成员中，由于内核代码已经写死了，因此想支持多个调试器同时调试一个进程，只能另寻办法，我的构想是将调试器和内核之间的通信，中间插入一个中介调试器进行协调，同时一个调试器的行为生效则刷新到所有调试器，这样就需要中介调试器hook一些调试api，并完成和这些调试器的通信，而中介调试器直接接收内核发出的调试信息。正在深入研究调试源码并完善设计思路。

元始天尊

1. 
   
2. //DbgSsReserved[0]->PDBGSS_THREAD_DATA*
   
3. //DbgSsReserved[1]->DebugObjectHandle
   
4. BOOL WINAPI ContinueDebugEvent(DWORD dwProcessId, DWORD dwThreadId, DWORD dwContinueStatus)
   
5. {
   
6.         ClientId.UniqueProcess = (HANDLE)dwProcessId;
   
7.         ClientId.UniqueThread = (HANDLE)dwThreadId;
   
8.         ZwDebugContinue(NtCurrentTeb()->DbgSsReserved[1], ClientId, dwContinueStatus);
   
9.         //移除进程线程句柄
   
10.         ThreadData = (PDBGSS_THREAD_DATA*)NtCurrentTeb()->DbgSsReserved;
    
11.         ThisData = *ThreadData;
    
12.         while(ThisData)
    
13.         {
    
14.                 if ((ThisData->HandleMarked) && ((ThisData->ProcessId == dwProcessId) || (ThisData->ThreadId == dwThreadId)))
    
15.                 {
    
16.                         if (ThisData->ThreadHandle) CloseHandle(ThisData->ThreadHandle);
    
17.                         if (ThisData->ProcessHandle) CloseHandle(ThisData->ProcessHandle);
    
18.                         *ThreadData = ThisData->Next;
    
19.                         RtlFreeHeap(RtlGetProcessHeap(), 0, ThisData);
    
20.                 }
    
21.                 else
    
22.                 {
    
23.                         ThreadData = &ThisData->Next;
    
24.                 }
    
25.                 ThisData = *ThreadData;
    
26.         }
    
27. }
    
28. 
    
29. BOOL WINAPI DebugActiveProcess(DWORD dwProcessId)
    
30. {
    
31.         //创建调试对象
    
32.         InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, 0);
    
33.         Status = ZwCreateDebugObject(&NtCurrentTeb()->DbgSsReserved[1], DEBUG_OBJECT_ALL_ACCESS, &ObjectAttributes, DBGK_KILL_PROCESS_ON_EXIT);
    
34.         //OpenProcess获取进程句柄
    
35.         ClientId.UniqueThread = NULL;
    
36.         ClientId.UniqueProcess = UlongToHandle(dwProcessId);
    
37.         InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL);
    
38.         Status = NtOpenProcess(&Handle, PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ
    
39.                 | PROCESS_SUSPEND_RESUME | PROCESS_QUERY_INFORMATION, &ObjectAttributes, &ClientId);
    
40.         Status = NtDebugActiveProcess(Process, NtCurrentTeb()->DbgSsReserved[1]);
    
41.         //注入并设置int 3
    
42.         NtClose(Handle);
    
43. }
    
44. 
    
45. BOOL WINAPI DebugActiveProcessStop(DWORD dwProcessId)
    
46. {
    
47.         //OpenProcess获取进程句柄
    
48.         ClientId.UniqueThread = NULL;
    
49.         ClientId.UniqueProcess = UlongToHandle(dwProcessId);
    
50.         InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL);
    
51.         Status = NtOpenProcess(&Handle, PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ
    
52.                 | PROCESS_SUSPEND_RESUME | PROCESS_QUERY_INFORMATION, &ObjectAttributes, &ClientId);
    
53.         //关闭所有进程句柄
    
54.         ThreadData = (PDBGSS_THREAD_DATA*)NtCurrentTeb()->DbgSsReserved;
    
55.         ThisData = *ThreadData;
    
56.         while(ThisData)
    
57.         {
    
58.                 if (ThisData->ProcessId == dwProcessId)
    
59.                 {
    
60.                         if (ThisData->ThreadHandle) CloseHandle(ThisData->ThreadHandle);
    
61.                         if (ThisData->ProcessHandle) CloseHandle(ThisData->ProcessHandle);
    
62.                         *ThreadData = ThisData->Next;
    
63.                         RtlFreeHeap(RtlGetProcessHeap(), 0, ThisData);
    
64.                 }
    
65.                 else
    
66.                 {
    
67.                         ThreadData = &ThisData->Next;
    
68.                 }
    
69.                 ThisData = *ThreadData;
    
70.         }
    
71.         Status = NtRemoveProcessDebug(Process, NtCurrentTeb()->DbgSsReserved[1]);
    
72.         NtClose(Handle);
    
73. }
    
74. 
    
75. BOOL WINAPI DebugSetProcessKillOnExit(BOOL KillOnExit)
    
76. {
    
77.         STATE = KillOnExit != 0;
    
78.         Handle = NtCurrentTeb()->DbgSsReserved[1];
    
79.         Status = NtSetInformationDebugObject(Handle, DebugObjectKillProcessOnExitInformation, &State, sizeof(State), NULL);
    
80. }
    
81. 
    
82. BOOL WINAPI WaitForDebugEvent(LPDEBUG_EVENT lpDebugEvent, DWORD dwMilliseconds)
    
83. {
    
84.         do
    
85.         {
    
86.                 Status = NtWaitForDebugEvent(NtCurrentTeb()->DbgSsReserved[1], TRUE, TimeOut, &WaitStateChange);
    
87.         } while ((Status == STATUS_ALERTED) || (Status == STATUS_USER_APC));
    
88. 
    
89.         lpDebugEvent->dwProcessId = (DWORD)WaitStateChange->AppClientId.UniqueProcess;
    
90.         lpDebugEvent->dwThreadId = (DWORD)WaitStateChange->AppClientId.UniqueThread;
    
91. 
    
92.         switch (WaitStateChange->NewState)
    
93.         {
    
94.         case DbgCreateThreadStateChange:
    
95.                 DebugEvent->dwDebugEventCode = CREATE_THREAD_DEBUG_EVENT;
    
96.                 DebugEvent->u.CreateThread.hThread = WaitStateChange->StateInfo.CreateThread.HandleToThread;
    
97.                 DebugEvent->u.CreateThread.lpStartAddress = WaitStateChange->StateInfo.CreateThread.NewThread.StartAddress;
    
98.                 Status = NtQueryInformationThread(WaitStateChange->StateInfo.CreateThread.HandleToThread, ThreadBasicInformation, &ThreadBasicInfo, sizeof(ThreadBasicInfo), NULL);
    
99.                 DebugEvent->u.CreateThread.lpThreadLocalBase = ThreadBasicInfo.TebBaseAddress;
    
100.                 break;
     
101. 
     
102.         case DbgCreateProcessStateChange:
     
103.                 DebugEvent->dwDebugEventCode = CREATE_PROCESS_DEBUG_EVENT;
     
104.                 DebugEvent->u.CreateProcessInfo.hProcess = WaitStateChange->StateInfo.CreateProcessInfo.HandleToProcess;
     
105.                 DebugEvent->u.CreateProcessInfo.hThread = WaitStateChange->StateInfo.CreateProcessInfo.HandleToThread;
     
106.                 DebugEvent->u.CreateProcessInfo.hFile = WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.FileHandle;
     
107.                 DebugEvent->u.CreateProcessInfo.lpBaseOfImage = WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.BaseOfImage;
     
108.                 DebugEvent->u.CreateProcessInfo.dwDebugInfoFileOffset = WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.DebugInfoFileOffset;
     
109.                 DebugEvent->u.CreateProcessInfo.nDebugInfoSize = WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.DebugInfoSize;
     
110.                 DebugEvent->u.CreateProcessInfo.lpStartAddress = WaitStateChange->StateInfo.CreateProcessInfo.NewProcess.InitialThread.StartAddress;
     
111.                 Status = NtQueryInformationThread(WaitStateChange->StateInfo.CreateProcessInfo.HandleToThread, ThreadBasicInformation,
     
112.                         &ThreadBasicInfo, sizeof(ThreadBasicInfo), NULL);
     
113.                 DebugEvent->u.CreateProcessInfo.lpThreadLocalBase = ThreadBasicInfo.TebBaseAddress;
     
114.                 DebugEvent->u.CreateProcessInfo.lpImageName = NULL;
     
115.                 DebugEvent->u.CreateProcessInfo.fUnicode = TRUE;
     
116.                 break;
     
117. 
     
118.         case DbgExitThreadStateChange:
     
119.                 DebugEvent->dwDebugEventCode = EXIT_THREAD_DEBUG_EVENT;
     
120.                 DebugEvent->u.ExitThread.dwExitCode = WaitStateChange->StateInfo.ExitThread.ExitStatus;
     
121.                 break;
     
122. 
     
123.         case DbgExitProcessStateChange:
     
124.                 DebugEvent->dwDebugEventCode = EXIT_PROCESS_DEBUG_EVENT;
     
125.                 DebugEvent->u.ExitProcess.dwExitCode = WaitStateChange->StateInfo.ExitProcess.ExitStatus;
     
126.                 break;
     
127. 
     
128.         case DbgExceptionStateChange:
     
129.         case DbgBreakpointStateChange:
     
130.         case DbgSingleStepStateChange:
     
131.                 if (WaitStateChange->StateInfo.Exception.ExceptionRecord.ExceptionCode == DBG_PRINTEXCEPTION_C)
     
132.                 {
     
133.                         DebugEvent->dwDebugEventCode = OUTPUT_DEBUG_STRING_EVENT;
     
134.                         DebugEvent->u.DebugString.lpDebugStringData = (PVOID)WaitStateChange->StateInfo.Exception.ExceptionRecord.ExceptionInformation[1];
     
135.                         DebugEvent->u.DebugString.nDebugStringLength = WaitStateChange->StateInfo.Exception.ExceptionRecord.ExceptionInformation[0];
     
136.                         DebugEvent->u.DebugString.fUnicode = FALSE;
     
137.                 }
     
138.                 else if (WaitStateChange->StateInfo.Exception.ExceptionRecord.ExceptionCode == DBG_RIPEXCEPTION)
     
139.                 {
     
140.                         DebugEvent->dwDebugEventCode = RIP_EVENT;
     
141.                         DebugEvent->u.RipInfo.dwType = WaitStateChange->StateInfo.Exception.ExceptionRecord.ExceptionInformation[1];
     
142.                         DebugEvent->u.RipInfo.dwError = WaitStateChange->StateInfo.Exception.ExceptionRecord.ExceptionInformation[0];
     
143.                 }
     
144.                 else
     
145.                 {
     
146.                         DebugEvent->dwDebugEventCode = EXCEPTION_DEBUG_EVENT;
     
147.                         DebugEvent->u.Exception.ExceptionRecord = WaitStateChange->StateInfo.Exception.ExceptionRecord;
     
148.                         DebugEvent->u.Exception.dwFirstChance = WaitStateChange->StateInfo.Exception.FirstChance;
     
149.                 }
     
150.                 break;
     
151. 
     
152.         case DbgLoadDllStateChange:
     
153.                 DebugEvent->dwDebugEventCode = LOAD_DLL_DEBUG_EVENT;
     
154.                 DebugEvent->u.LoadDll.lpBaseOfDll = WaitStateChange->StateInfo.LoadDll.BaseOfDll;
     
155.                 DebugEvent->u.LoadDll.hFile = WaitStateChange->StateInfo.LoadDll.FileHandle;
     
156.                 DebugEvent->u.LoadDll.dwDebugInfoFileOffset = WaitStateChange->StateInfo.LoadDll.DebugInfoFileOffset;
     
157.                 DebugEvent->u.LoadDll.nDebugInfoSize = WaitStateChange->StateInfo.LoadDll.DebugInfoSize;
     
158.                 InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL);
     
159.                 Status = NtOpenThread(&ThreadHandle, THREAD_QUERY_INFORMATION, &ObjectAttributes, &WaitStateChange->AppClientId);
     
160.                 Status = NtQueryInformationThread(ThreadHandle, ThreadBasicInformation, &ThreadBasicInfo, sizeof(ThreadBasicInfo), NULL);
     
161.                 NtClose(ThreadHandle);
     
162.                 DebugEvent->u.LoadDll.lpImageName = ((PTEB)ThreadBasicInfo.TebBaseAddress)->NtTib.ArbitraryUserPointer;
     
163.                 DebugEvent->u.LoadDll.fUnicode = TRUE;
     
164.                 break;
     
165. 
     
166.         case DbgUnloadDllStateChange:
     
167.                 DebugEvent->dwDebugEventCode = UNLOAD_DLL_DEBUG_EVENT;
     
168.                 DebugEvent->u.UnloadDll.lpBaseOfDll = WaitStateChange->StateInfo.UnloadDll.BaseAddress;
     
169.                 break;
     
170. 
     
171.         default:
     
172.                 return STATUS_UNSUCCESSFUL;
     
173.         }
     
174. 
     
175.         switch (lpDebugEvent->dwDebugEventCode)
     
176.         {
     
177.         case CREATE_THREAD_DEBUG_EVENT:
     
178.                 SaveThreadHandle(lpDebugEvent->dwProcessId, lpDebugEvent->dwThreadId, lpDebugEvent->u.CreateThread.hThread);
     
179.                 break;
     
180.         case CREATE_PROCESS_DEBUG_EVENT:
     
181.                 SaveProcessHandle(lpDebugEvent->dwProcessId, lpDebugEvent->u.CreateProcessInfo.hProcess);
     
182.                 SaveThreadHandle(lpDebugEvent->dwProcessId, lpDebugEvent->dwThreadId, lpDebugEvent->u.CreateProcessInfo.hThread);
     
183.                 break;
     
184.         case EXIT_PROCESS_DEBUG_EVENT:
     
185.                 MarkProcessHandle(lpDebugEvent->dwProcessId);
     
186.         case EXIT_THREAD_DEBUG_EVENT:
     
187.                 MarkThreadHandle(lpDebugEvent->dwThreadId);
     
188.                 break;
     
189.         case EXCEPTION_DEBUG_EVENT:
     
190.         case LOAD_DLL_DEBUG_EVENT:
     
191.         case UNLOAD_DLL_DEBUG_EVENT:
     
192.         case OUTPUT_DEBUG_STRING_EVENT:
     
193.         case RIP_EVENT:
     
194.                 break;
     
195.         default:
     
196.                 return FALSE;
     
197.         }
     
198. }
     

复制代码

元始天尊

1. #define DbgSsSetThreadData(d) NtCurrentTeb()->DbgSsReserved[0] = d
   
2. #define DbgSsGetThreadData() ((PDBGSS_THREAD_DATA)NtCurrentTeb()->DbgSsReserved[0])
   
3. 
   
4. VOID WINAPI SaveThreadHandle(DWORD dwProcessId, DWORD dwThreadId, HANDLE hThread)
   
5. {
   
6.         PDBGSS_THREAD_DATA ThreadData;
   
7.         ThreadData = RtlAllocateHeap(RtlGetProcessHeap(), 0, sizeof(DBGSS_THREAD_DATA));
   
8.         ThreadData->ThreadHandle = hThread;
   
9.         ThreadData->ProcessId = dwProcessId;
   
10.         ThreadData->ThreadId = dwThreadId;
    
11.         ThreadData->ProcessHandle = NULL;
    
12.         ThreadData->HandleMarked = FALSE;
    
13.         ThreadData->Next = DbgSsGetThreadData();
    
14.         DbgSsSetThreadData(ThreadData);
    
15. }
    
16. 
    
17. VOID WINAPI SaveProcessHandle(DWORD dwProcessId, HANDLE hProcess)
    
18. {
    
19.         PDBGSS_THREAD_DATA ThreadData;
    
20.         ThreadData = RtlAllocateHeap(RtlGetProcessHeap(), 0, sizeof(DBGSS_THREAD_DATA));
    
21.         ThreadData->ProcessHandle = hProcess;
    
22.         ThreadData->ProcessId = dwProcessId;
    
23.         ThreadData->ThreadId = 0;
    
24.         ThreadData->ThreadHandle = NULL;
    
25.         ThreadData->HandleMarked = FALSE;
    
26.         ThreadData->Next = DbgSsGetThreadData();
    
27.         DbgSsSetThreadData(ThreadData);
    
28. }
    
29. 
    
30. VOID WINAPI MarkProcessHandle(DWORD dwProcessId)
    
31. {
    
32.         PDBGSS_THREAD_DATA ThreadData;
    
33.         for (ThreadData = DbgSsGetThreadData(); ThreadData; ThreadData = ThreadData->Next)
    
34.         {
    
35.                 if ((ThreadData->ProcessId == dwProcessId) && !(ThreadData->ThreadId))
    
36.                 {
    
37.                         ThreadData->HandleMarked = TRUE;
    
38.                         break;
    
39.                 }
    
40.         }
    
41. }
    
42. 
    
43. VOID WINAPI MarkThreadHandle(DWORD dwThreadId)
    
44. {
    
45.         PDBGSS_THREAD_DATA ThreadData;
    
46.         for (ThreadData = DbgSsGetThreadData(); ThreadData; ThreadData = ThreadData->Next)
    
47.         {
    
48.                 if (ThreadData->ThreadId == dwThreadId)
    
49.                 {
    
50.                         ThreadData->HandleMarked = TRUE;
    
51.                         break;
    
52.                 }
    
53.         }
    
54. }

复制代码

可见作为内核接口的api有：
ZwDebugContinue
ZwCreateDebugObject
NtDebugActiveProcess
NtRemoveProcessDebug
NtSetInformationDebugObject
NtWaitForDebugEvent