Injecting a DLL as a Debugger
A debugger can perform special actions on a debuggee process. When a debuggee loads, the system automatically notifies the debugger when the debuggee’s address space is ready but before the debuggee’s primary thread executes any code. At this point, the debugger can force some code into the debuggee’s address space (using WriteProcessMemory, for example) and then cause the debuggee’s primary thread to execute that code.
This technique requires that you manipulate the debuggee thread’s CONTEXT structure, which means that you must write CPU-specific code. You have to modify your source code to work correctly on different CPU platforms. In addition, you probably have to hand-code the machine language instructions that ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access