C/C++ 内存转储与获取DLL加载

CREATE_PROCESS_DEBUG_EVENT 创建进程的调试事件。CREATE_PROCESS_DEBUG_INFO结构体描述了该类调试事件的详细信息
OUTPUT_DEBUG_STRING_EVENT 该事件，当被调试进程调用OutputDebugString时就会引发该类调试事件，OUTPUT_DEBUG_STRING_INFO结构体描述了关于该事件的详细信息
LOAD_DLL_DEBUG_EVENT 当DLL被加载时，会调用该回调，LOAD_DLL_DEBUG_INFO结构体描述了它的详细信息，dll的路径被放在了，hfile字段，该字段默认是句柄方式存储的，需要手工转换，

实现简易调试器: 通过调试API实现建议调试器，可以加以改进，变成内存dump工具，等，也可以获取实际OEP作为查壳工具来用。

#include <stdio.h>
#include <Windows.h>
#include <Tlhelp32.h>
#include <imagehlp.h>
#pragma comment (lib, "Dbghelp")

BYTE bCC = '\xCC';

// 这是调试进程第一次被断下后执行操作
void OnException(DEBUG_EVENT *pDebug, BYTE *bCode)
{
    CONTEXT context;
    DWORD dwNum;
    BYTE bTmp;

    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pDebug->dwProcessId);
    HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, pDebug->dwThreadId);

    SuspendThread(hThread);
    // 读取出异常首地址
    ReadProcessMemory(hProcess, pDebug->u.Exception.ExceptionRecord.ExceptionAddress, &bTmp, sizeof(BYTE), &dwNum);

    context.ContextFlags = CONTEXT_FULL;
    GetThreadContext(hThread, &context);

    printf("EAX = %x  EIP = %x \n", context.Eax, context.Eip);
    // 将刚才的CC断点取消,也就是会写原始指令集
    WriteProcessMemory(hProcess, pDebug->u.Exception.ExceptionRecord.ExceptionAddress, bCode, sizeof(BYTE), &dwNum);
    context.Eip--;
    SetThreadContext(hThread, &context);

    printf("EAX = %x  EIP = %x \n", context.Eax, context.Eip);
    printf("入口点: %x \n", pDebug->u.CreateProcessInfo.lpBaseOfImage);

    ResumeThread(hThread);
    CloseHandle(hThread);
    CloseHandle(hProcess);
}

int main(int argc, char * argv[])
{
    STARTUPINFO si = { 0 };
    PROCESS_INFORMATION pi = { 0 };
    DEBUG_EVENT de = { 0 };

    // 创建调试进程
    BOOL bRet = CreateProcess("c://123.exe", 0, 0, 0, FALSE, DEBUG_PROCESS | DEBUG_ONLY_THIS_PROCESS, 0, 0, &si, &pi);

    if (bRet == FALSE)
        return bRet;
    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);

    BYTE bCode;
    DWORD dwNum;
    int dwCC_Count = 0;

    // 开始调试循环
    while (WaitForDebugEvent(&de, INFINITE))
    {
        switch (de.dwDebugEventCode)
        {
            // 当进程创建成功后自动执行的部分
            case CREATE_PROCESS_DEBUG_EVENT:
            {
                // 获取入口地址 0x0 可以增加偏移到入口后任意位置
                DWORD dwAddr = 0x0 + (DWORD)de.u.CreateProcessInfo.lpStartAddress;
                // 暂停线程
                SuspendThread(de.u.CreateProcessInfo.hThread);
                // 读取入口地址处的字节码
                ReadProcessMemory(de.u.CreateProcessInfo.hProcess, (const void *)dwAddr, &bCode, sizeof(BYTE), &dwNum);
                // 在入口地址处写入0xCC 即写入INT 3
                WriteProcessMemory(de.u.CreateProcessInfo.hProcess, (void *)dwAddr, &bCC, sizeof(BYTE), &dwNum);
                // 恢复线程
                ResumeThread(de.u.CreateProcessInfo.hThread);
                break;
            }
            // 当进程产生异常时自动执行这里
            case EXCEPTION_DEBUG_EVENT:
            {
                switch (dwCC_Count)
                {
                    // 第0次是系统断点,这里我们直接跳过
                    case 0: 
                        dwCC_Count++; break;
                    // 第一次断点,我们让他执行下面的函数
                    case 1:
                        OnException(&de, &bCode); dwCC_Count++; break;
                }
            }
        }
        ContinueDebugEvent(de.dwProcessId, de.dwThreadId, DBG_CONTINUE);
    }
    system("pause");
    return 0;
}

获取DLL加载情况：

#include <stdio.h>
#include <Windows.h>
#include <tchar.h>
#include <psapi.h>

void OnDllLoaded(const LOAD_DLL_DEBUG_INFO *pDebug)
{
    printf("基址: 0x%-8X --> ", pDebug->lpBaseOfDll);

    BOOL bSuccess = FALSE;
    TCHAR pszFilename[MAX_PATH + 1];
    HANDLE hFileMap;

    // Get the file size.
    DWORD dwFileSizeHi = 0;
    DWORD dwFileSizeLo = GetFileSize(pDebug->hFile, &dwFileSizeHi);

    printf("长度: %9d --> ", dwFileSizeLo);

    if (dwFileSizeLo == 0 && dwFileSizeHi == 0)
    {
        return;
    }
    // 创建内存映射
    hFileMap = CreateFileMapping(pDebug->hFile, 0, PAGE_READONLY, 0, 1, 0);

    if (hFileMap)
    {
        void* pMem = MapViewOfFile(hFileMap, FILE_MAP_READ, 0, 0, 1);
        if (pMem)
        {
            if (GetMappedFileName(GetCurrentProcess(), pMem, pszFilename, MAX_PATH))
            {
                printf("路径: %s \n", pszFilename);
            }
            UnmapViewOfFile(pMem);
        }
        CloseHandle(hFileMap);
    }
}

int main(int argc, char * argv[])
{
    STARTUPINFO si = { 0 };
    PROCESS_INFORMATION pi = { 0 };
    DEBUG_EVENT debug_event = { 0 };

    // 创建调试进程
    BOOL bRet = CreateProcess("C:/Program Files/Tencent/QQ/Bin/QQ.exe", 0, 0, 0, FALSE, DEBUG_PROCESS | DEBUG_ONLY_THIS_PROCESS, 0, 0, &si, &pi);
    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);

    // 开始调试循环
    while (WaitForDebugEvent(&debug_event, INFINITE))
    {
        switch (debug_event.dwDebugEventCode)
        {
            // 当DLL加载到进程时自动的执行此处代码
        case LOAD_DLL_DEBUG_EVENT:
            OnDllLoaded(&debug_event.u.LoadDll);
            break;
        }
        ContinueDebugEvent(debug_event.dwProcessId, debug_event.dwThreadId, DBG_CONTINUE);
    }
    return 0;
}