int main(int argc,TCHAR *argv[]){    DWORD dwPID;       BOOL waitEvent = TRUE;    if (argc > 1) {        dwPID = atoi(argv[1]);    }    else {        printf("usage: MyDebugger.exe dwPID\n");        exit(0);    }
    DebugActiveProcess(dwPID);    while (waitEvent)    {        DEBUG_EVENT MyDebugInfo;        waitEvent = WaitForDebugEvent(&MyDebugInfo, INFINITE); // Waiting        switch (MyDebugInfo.dwDebugEventCode)        {            case EXIT_PROCESS_DEBUG_EVENT:                waitEvent = FALSE                break;        }        if (waitEvent) {            ContinueDebugEvent(debugEvent.dwProcessId, debugEvent.dwThreadId, DBG_CONTINUE);        }    }    return 0;}

CreateProcess(path, // 可执行模块路径    NULL, // 命令行    NULL, // 安全描述符    NULL, // 线程属性是否可继承    FALSE, // 否从调用进程处继承了句柄    DEBUG_ONLY_THIS_PROCESS, // 以“只”调试的方式启动    NULL, // 新进程的环境块    NULL, // 新进程的当前工作路径（当前目录）    &stcStartupInfo, // 指定进程的主窗口特性    &stcProcInfo)) // 接收新进程的识别信息

typedef struct _DEBUG_EVENT {    DWORD dwDebugEventCode;    DWORD dwProcessId;    DWORD dwThreadId;    union {        EXCEPTION_DEBUG_INFO Exception;        CREATE_THREAD_DEBUG_INFO CreateThread;        CREATE_PROCESS_DEBUG_INFO                CreateProcessInfo;        EXIT_THREAD_DEBUG_INFO ExitThread;        EXIT_PROCESS_DEBUG_INFO ExitProcess;        LOAD_DLL_DEBUG_INFO LoadDll;        UNLOAD_DLL_DEBUG_INFO UnloadDll;        OUTPUT_DEBUG_STRING_INFO DebugString;        RIP_INFO RipInfo;    } u;} DEBUG_EVENT, *LPDEBUG_EVENT;

看雪ID：Jev0n

https://bbs.pediy.com/user-home-870016.htm

# 往期推荐

1. 破解某抢票软件的VPN抓包

2. 祥云杯2021 Windows R0题 Rev_APC

3.Android APK的加固方法

4. InCTF 内核Pwn之 Kqueue

5. HITB CTF 2018 gundam分析

6. CVE-2010-2883漏洞分析与复现